Domain name compliance detection method and device, electronic equipment and medium
By configuring the preset domain name whitelist and the IP address of the intranet DNS server, obtaining and storing the resolved IP address, the problem that the Internet behavior management device cannot judge the compliance of terminal access, and realizes that the intranet DNS traffic does not pass through the device traffic compliance control.
Patent Information
- Application Number
- CN202411485975.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-23
- Publication Date
- 2025-01-17
AI Technical Summary
In an intranet environment, the Internet behavior management device cannot make a compliance judgment on terminal access, because the traffic requested by the intranet DNS server from the external network does not pass the Internet behavior management device.
Configure the preset domain name whitelist and the IP address of the intranet DNS server, obtain the resolved IP address through the intranet DNS server and store it in the IP whitelist table, and compare the IP address accessed by the end user with the IP whitelist table. Determine its compliance and release or block traffic based on the comparison results.
By reducing the overhead of Internet behavior management devices, the traffic is released or blocked based on the domain name when DNS traffic does not pass through the device, ensuring compliance judgment of terminal access.
Smart Images
Figure CN119324826A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a method, device, electronic device and medium for domain name compliance detection. Background Art
[0002] With the development and widespread application of the Internet, many group companies, universities, operators, etc. have deployed their own DNS servers in the intranet environment.
[0003] When the existing technology releases traffic based on domain names, the DNS request traffic needs to be resolved by the Internet behavior management device. However, when there is a DNS server in the company's intranet, the user's computer points to the intranet DNS server when surfing the Internet, that is, the IP address corresponding to the domain name to be accessed is obtained from the intranet DNS server, rather than the IP address corresponding to the domain name from the public DNS server. In addition, the traffic requested by the intranet DNS server to the external network does not pass through the Internet behavior management device, which makes it impossible for the Internet behavior management device in the intranet to make compliance judgments on terminal access. Summary of the invention
[0004] In view of this, it is necessary to provide a method, device, electronic device and medium for domain name compliance detection to solve the problem that Internet behavior management equipment in an intranet cannot make compliance judgments on terminal access.
[0005] In order to solve the above problems, the present invention provides a method for domain name compliance detection, which is applied to an Internet behavior management device, comprising: Configure the preset domain name whitelist and intranet DNS server IP address; Send a data acquisition request to the intranet DNS server based on the IP address of the intranet DNS server, obtain the IP address resolved by the intranet DNS server, and store the resolved IP address in the IP whitelist table, where the resolved IP address is the IP address corresponding to the preset domain name whitelist; The IP address accessed by the terminal user is compared with the IP whitelist table to determine the compliance of the domain name corresponding to the IP address accessed by the terminal user.
[0006] In a possible implementation, the above-mentioned Internet behavior management device includes: a network security device and / or a firewall with a whitelist function.
[0007] In a possible implementation, obtaining, based on the IP address of the intranet DNS server, the IP address corresponding to the preset domain name whitelist resolved by the intranet DNS server includes: A data acquisition request is sent to the intranet DNS server based on the IP address of the intranet DNS server at a preset time interval to obtain the IP address corresponding to the preset domain name whitelist resolved by the intranet DNS server.
[0008] In a possible implementation, comparing the IP address accessed by the terminal user with the IP whitelist table to determine compliance of the domain name corresponding to the IP address accessed by the terminal user includes: When the IP address accessed by the terminal user successfully matches the IP whitelist table, it is determined that the domain name corresponding to the IP address accessed by the terminal user is compliant.
[0009] In a possible implementation, after determining that the domain name corresponding to the IP address accessed by the terminal user is compliant, the following step is further included: The corresponding target website is accessed based on the IP address accessed by the terminal user.
[0010] In a possible implementation manner, after determining that the domain name corresponding to the IP address accessed by the terminal user is not compliant, the method further includes: The access to the corresponding target website is interrupted based on the IP address accessed by the terminal user.
[0011] In a possible implementation manner, after determining that the domain name corresponding to the IP address accessed by the terminal user is not compliant, the method further includes: The IP addresses accessed by the non-compliant terminal users are marked.
[0012] On the other hand, the present invention also provides a device for domain name compliance detection, comprising: Configuration module, used to configure the preset domain name whitelist and the intranet DNS server IP address; An IP address storage module is used to send a data acquisition request to the intranet DNS server based on the IP address of the intranet DNS server, obtain the IP address resolved by the intranet DNS server, and store the resolved IP address in the IP whitelist table, where the resolved IP address is the IP address corresponding to the preset domain name whitelist; The compliance judgment module is used to compare the IP address accessed by the terminal user with the IP whitelist table to determine the compliance of the domain name corresponding to the IP address accessed by the terminal user.
[0013] On the other hand, the present invention also provides an electronic device, including a memory and a processor, wherein: The memory is used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to implement the steps in the method for domain name compliance detection described in any one of the above implementations.
[0014] On the other hand, the present invention also provides a computer-readable storage medium for storing a computer-readable program or instruction, which, when executed by a processor, can implement the steps in a method for domain name compliance detection described in any of the above implementations.
[0015] The beneficial effects of the present invention are as follows: a method for domain name compliance detection provided by the present invention first configures a preset domain name whitelist and an intranet DNS server IP address, sends a data acquisition request to the intranet DNS server based on the intranet DNS server IP address, obtains the IP address resolved by the intranet DNS server, and stores the resolved IP address in the IP whitelist table, wherein the resolved IP address is the IP address corresponding to the preset domain name whitelist, and the work of resolving the domain name is handed over to the intranet DNS server, thereby reducing the overhead of the Internet behavior management device. The IP address is stored in the IP whitelist table, and the IP address accessed by the terminal user is compared with the IP whitelist table to determine the compliance of the IP address accessed by the terminal user. The present invention configures a domain name whitelist in the Internet behavior management device, obtains the IP address resolved by the DNS server and stores it in the IP whitelist table, and compares the IP address of the terminal with the IP whitelist table, thereby realizing that when the DNS traffic does not pass through the Internet behavior management device, the traffic is released or blocked based on the domain name. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] Figure 1 A flowchart of an embodiment of a method for domain name compliance detection provided by the present invention; Figure 2 A schematic diagram of a flow chart of an embodiment of a domain name compliance detection device provided by the present invention; Figure 3 A schematic structural diagram of an embodiment of an electronic device provided by the present invention. DETAILED DESCRIPTION
[0017] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not used to limit the scope of the present invention.
[0018] Before presenting the embodiments, the following terms are explained.
[0019] Online behavior management: refers to helping Internet users control and manage their use of the Internet. It includes web page access filtering, online privacy protection, network application control, bandwidth flow management, information sending and receiving auditing, user behavior analysis, etc.
[0020] DNS (Domain Name Server): It is a server that converts domain names and their corresponding IP addresses. DNS stores a table of domain names and their corresponding IP addresses to resolve the domain names of messages.
[0021] Whitelist: users (or IP addresses, IP packets, emails, etc.) in the whitelist will be given priority and will not be blocked or rejected as spam, which greatly improves security and speed.
[0022] The present invention provides a method, device, electronic device and medium for domain name compliance detection, which are described below respectively.
[0023] Figure 1 A flowchart of an embodiment of a method for domain name compliance detection provided by the present invention is shown as follows: Figure 1 As shown, the domain name compliance detection method is applied to the Internet behavior management device, including: S101, configure the preset domain name whitelist and the intranet DNS server IP address; S102, sending a data acquisition request to the intranet DNS server based on the IP address of the intranet DNS server, obtaining the IP address resolved by the intranet DNS server, and storing the resolved IP address in the IP whitelist table, where the resolved IP address is the IP address corresponding to the preset domain name whitelist; S103: Compare the IP address accessed by the terminal user with the IP whitelist table to determine compliance of the domain name corresponding to the IP address accessed by the terminal user.
[0024] Compared with the prior art, this embodiment provides a method for domain name compliance detection, firstly configuring a preset domain name whitelist and an intranet DNS server IP address, sending a data acquisition request to the intranet DNS server based on the intranet DNS server IP address, obtaining the IP address resolved by the intranet DNS server, and storing the resolved IP address in the IP whitelist table, wherein the resolved IP address is the IP address corresponding to the preset domain name whitelist, and the work of resolving the domain name is handed over to the intranet DNS server, thereby reducing the overhead of the Internet behavior management device. The IP address is stored in the IP whitelist table, and the IP address accessed by the terminal user is compared with the IP whitelist table to determine the compliance of the IP address accessed by the terminal user. The present invention configures a domain name whitelist in the Internet behavior management device, obtains the IP address resolved by the DNS server and stores it in the IP whitelist table, and compares the IP address of the terminal with the IP whitelist table, thereby realizing that when the DNS traffic does not pass through the Internet behavior management device, the traffic is released or blocked based on the domain name.
[0025] It should be noted that the application scenario of this embodiment is a scenario where the intranet needs to detect the access of terminal users.
[0026] It should be noted that the DNS configuration of the terminal user's computer points to the intranet DNS server. At this time, the traffic from the terminal to the intranet DNS server to obtain domain name resolution does not pass through the Internet behavior management device. When the intranet DNS server requests domain name resolution traffic from the external network DNS server, the traffic does not pass through the Internet behavior management device.
[0027] In some embodiments of the present invention, the online behavior management device includes: a network security device and / or a firewall with a whitelist function. Network security devices are for example: Huawei's ASG, H3C's ACG, etc., and a firewall with a whitelist function can also be used as an online behavior management device.
[0028] In a specific embodiment of the present invention, an intranet DNS server parses a preset domain name whitelist, thereby reducing the participation of an Internet behavior management device and the overhead of the Internet behavior management device.
[0029] In some embodiments of the present invention, sending a data acquisition request to an intranet DNS server based on the IP address of the intranet DNS server to acquire the IP address resolved by the intranet DNS server includes: A data acquisition request is sent to the intranet DNS server based on the IP address of the intranet DNS server at a preset time interval to obtain the IP address corresponding to the preset domain name whitelist resolved by the intranet DNS server.
[0030] In a specific implementation of the present invention, the intranet DNS server obtains the domain name whitelist configured on the Internet behavior management device, and then resolves the IP address corresponding to the domain name whitelist.
[0031] The Internet behavior management device will actively and continuously request the IP address corresponding to the domain name configured in the whitelist from the intranet DNS server every 5 seconds, and store the IP address in the built-in IP whitelist table.
[0032] In some embodiments of the present invention, in step S103, comparing the IP address accessed by the terminal user with the IP whitelist table to determine the compliance of the domain name corresponding to the IP address accessed by the terminal user includes: When the IP address accessed by the terminal user successfully matches the IP whitelist table, it is determined that the domain name corresponding to the IP address accessed by the terminal user is compliant.
[0033] In some embodiments of the present invention, after determining that the domain name corresponding to the IP address accessed by the terminal user is compliant, the process further includes: The corresponding target website is accessed based on the IP address accessed by the terminal user.
[0034] In some embodiments of the present invention, after determining that the domain name corresponding to the IP address accessed by the terminal user is not compliant, the method further includes: The access to the corresponding target website is interrupted based on the IP address accessed by the terminal user.
[0035] In some embodiments of the present invention, after determining that the domain name corresponding to the IP address accessed by the terminal user is not compliant, the method further includes: The IP addresses accessed by the non-compliant terminal users are marked.
[0036] In a specific embodiment of the present invention, after the Internet behavior management device obtains the IP address corresponding to the domain name, it can compare the destination IP address of the terminal user accessing the web page, and if the destination IP address of the URL is in the domain name whitelist, the access will be allowed. For example, when a user accesses a URL based on the domain name, the Internet behavior management device will match the user's destination IP address after being resolved by the intranet DNS server with its own built-in IP whitelist. If the destination IP address of the request is in the IP whitelist, the request will be allowed; if it is not in the IP whitelist, the request will be blocked.
[0037] The present invention links the Internet behavior management device with the intranet DNS server. When the terminal DNS traffic does not pass through the Internet behavior management device, the corresponding business traffic can be released in the form of a domain name whitelist.
[0038] In order to better implement a domain name compliance detection method in an embodiment of the present invention, based on a domain name compliance detection method, correspondingly, Figure 2 As shown, an embodiment of the present invention further provides a device for domain name compliance detection, and a device 300 for domain name compliance detection includes: Configuration module 201, used to configure a preset domain name whitelist and an intranet DNS server IP address; The IP address storage module 202 is used to send a data acquisition request to the intranet DNS server based on the IP address of the intranet DNS server, obtain the IP address resolved by the intranet DNS server, and store the resolved IP address in the IP whitelist table, where the resolved IP address is the IP address corresponding to the preset domain name whitelist; The compliance judgment module 203 is used to compare the IP address accessed by the terminal user with the IP whitelist table to determine the compliance of the IP address accessed by the terminal user.
[0039] The domain name compliance detection device 200 provided in the above embodiment can implement the technical solution described in the above domain name compliance detection method embodiment. The specific implementation principles of the above modules or units can refer to the corresponding contents in the above domain name compliance detection method embodiment, which will not be repeated here.
[0040] like Figure 3 As shown, the present invention also provides an electronic device 300. The electronic device 300 includes a processor 301, a memory 302 and a display 303. Figure 3 Only some components of the electronic device 300 are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.
[0041] In some embodiments, the processor 301 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run program codes stored in the memory 302 or process data, such as a domain name compliance detection method in the present invention.
[0042] In some embodiments, the processor 301 may be a single server or a server group. The server group may be centralized or distributed. In some embodiments, the processor 301 may be local or remote. In some embodiments, the processor 301 may be implemented in a cloud platform. In some embodiments, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an internal cloud, a multi-cloud, etc., or any combination thereof.
[0043] In some embodiments, the memory 302 may be an internal storage unit of the electronic device 300, such as a hard disk or memory of the electronic device 300. In other embodiments, the memory 302 may also be an external storage device of the electronic device 300, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc., equipped on the electronic device 300.
[0044] Furthermore, the memory 302 may include both an internal storage unit of the electronic device 300 and an external storage device. The memory 302 is used to store application software installed in the electronic device 300 and various data.
[0045] In some embodiments, the display 303 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 303 is used to display information on the electronic device 300 and to display a visual user interface. The components 301-303 of the electronic device 300 communicate with each other via a system bus.
[0046] In one embodiment, when the processor 301 executes a domain name compliance detection program in the memory 302, the following steps may be implemented: Configure the preset domain name whitelist and intranet DNS server IP address; Send a data acquisition request to the intranet DNS server based on the intranet DNS server IP address, obtain the IP address resolved by the intranet DNS server, and store the resolved IP address in the IP whitelist table, where the resolved IP address is the IP address corresponding to the preset domain name whitelist; The IP address accessed by the terminal user is compared with the IP whitelist table to determine the compliance of the domain name corresponding to the IP address accessed by the terminal user.
[0047] It should be understood that: when the processor 301 executes a domain name compliance detection program in the memory 302, in addition to the above functions, other functions can also be implemented. For details, please refer to the description of the corresponding method embodiment above.
[0048] Furthermore, the embodiment of the present invention does not specifically limit the type of the electronic device 300 mentioned, and the electronic device 300 may be a portable electronic device such as a mobile phone, a tablet computer, a personal digital assistant (PDA), a wearable device, a laptop computer, etc. Exemplary embodiments of portable electronic devices include but are not limited to portable electronic devices equipped with IOS, Android, Microsoft or other operating systems. The above-mentioned portable electronic devices may also be other portable electronic devices, such as a laptop computer with a touch-sensitive surface (e.g., a touch panel). It should also be understood that in some other embodiments of the present invention, the electronic device 300 may not be a portable electronic device, but a desktop computer with a touch-sensitive surface (e.g., a touch panel).
[0049] Those skilled in the art will appreciate that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.
[0050] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.
Claims
1. A method for domain name compliance detection, applied to an Internet behavior management device, characterized in that: include: Configure the preset domain name whitelist and intranet DNS server IP address; Send a data acquisition request to the intranet DNS server based on the intranet DNS server IP address, obtain the IP address resolved by the intranet DNS server, and store the resolved IP address in the IP whitelist table, where the resolved IP address is the IP address corresponding to the preset domain name whitelist; The IP address accessed by the terminal user is compared with the IP whitelist table to determine the compliance of the domain name corresponding to the IP address accessed by the terminal user.
2. The method for domain name compliance detection according to claim 1, characterized in that: The online behavior management device includes: a network security device and / or a firewall with a whitelist function.
3. The method for domain name compliance detection according to claim 1, characterized in that: The step of sending a data acquisition request to the intranet DNS server based on the IP address of the intranet DNS server to obtain the IP address resolved by the intranet DNS server includes: A data acquisition request is sent to the intranet DNS server based on the IP address of the intranet DNS server at a preset time interval to obtain the IP address corresponding to the preset domain name whitelist resolved by the intranet DNS server.
4. The method for domain name compliance detection according to claim 1, characterized in that: The step of comparing the IP address accessed by the terminal user with the IP whitelist table to determine compliance of the domain name corresponding to the IP address accessed by the terminal user includes: When the IP address accessed by the terminal user successfully matches the IP whitelist table, it is determined that the domain name corresponding to the IP address accessed by the terminal user is compliant.
5. The method for domain name compliance detection according to claim 4, characterized in that: After confirming that the domain name corresponding to the IP address accessed by the end user is compliant, it also includes: The corresponding target website is accessed based on the IP address accessed by the terminal user.
6. The method for domain name compliance detection according to claim 5, characterized in that: After determining that the domain name corresponding to the IP address accessed by the end user is non-compliant, it also includes: The access to the corresponding target website is interrupted based on the IP address accessed by the terminal user.
7. The method for domain name compliance detection according to claim 4, characterized in that: After determining that the domain name corresponding to the IP address accessed by the end user is non-compliant, it also includes: The IP addresses accessed by the non-compliant terminal users are marked.
8. A device for domain name compliance detection, characterized in that: include: Configuration module, used to configure the preset domain name whitelist and the intranet DNS server IP address; An IP address storage module is used to send a data acquisition request to the intranet DNS server based on the IP address of the intranet DNS server, obtain the IP address resolved by the intranet DNS server, and store the resolved IP address in the IP whitelist table, where the resolved IP address is the IP address corresponding to the preset domain name whitelist; The compliance judgment module is used to compare the IP address accessed by the terminal user with the IP whitelist table to determine the compliance of the domain name corresponding to the IP address accessed by the terminal user.
9. An electronic device, characterized in that: comprising a memory and a processor, wherein: The memory is used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to implement the steps in the method for domain name compliance detection as described in any one of claims 1 to 7 above.
10. A computer-readable storage medium, characterized in that: Used to store computer-readable programs or instructions, which, when executed by a processor, can implement the steps in the method for domain name compliance detection as described in any one of claims 1 to 7 above.