A network security protection method, electronic equipment, storage medium and program product

Abstract

The application provides a network security protection method, an electronic device, a storage medium and a program product, relates to the field of computer network security, and comprises the following steps: determining whether a received request message is a DNS message; if the received request message is a non-DNS message, determining whether the domain name of the non-DNS message hits a security domain name database; if the received request message is a DNS message, determining whether the domain name of the DNS message hits a domain name blacklist; and determining whether to release the request message according to whether the security domain name database or the domain name blacklist is hit. By identifying the DNS message and the non-DNS message and taking corresponding security measures, diversified network threats based on domain names can be comprehensively prevented.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computer network security, in particular to a network security protection method, an electronic device, a storage medium and a program product. BACKGROUND

[0002] With the development of the Internet, network security threats have become more complex and diverse. Domain names, as basic elements of the digital world, are often used as attack media. Users have difficulty distinguishing whether the domain name accessed is safe, so a special protection system is needed to identify and defend against domain name-based network threats.

[0003] The prior art mainly protects network security by processing DNS (Domain Name System) messages in the field of network security, but does not consider other types of messages. The processing capacity for non-DNS messages is limited, which is difficult to adapt to diversified network threats, resulting in the inability to comprehensively defend against domain name-based network threats. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a network security protection method, an electronic device, a storage medium and a program product, which identifies DNS messages and non-DNS messages and takes appropriate security measures to comprehensively defend against diversified network threats based on domain names.

[0005] To achieve the above purpose, the technical solutions adopted by the embodiments of the present application are as follows:

[0006] In a first aspect, the embodiments of the present application provide a network security protection method, comprising: determining whether a received request message is a DNS message; if the received request message is a non-DNS message, determining whether the domain name of the non-DNS message hits a security domain name database; if the received request message is a DNS message, determining whether the domain name of the DNS message hits a domain name blacklist; and determining whether to release the request message according to whether it hits the security domain name database or the domain name blacklist.

[0007] In an embodiment, before determining whether the received request message is a DNS message, the method further comprises: receiving a request message sent by a user terminal; determining whether the security protection measure of the user terminal is turned on according to the protection policy corresponding to different users; if it is turned on, determining whether the received request message is a DNS message; if it is turned off, directly releasing the request message.

[0008] In an embodiment, before receiving the request message sent by the user terminal, the method further comprises: generating a security protection policy for different users in response to configuration information input by an administrator on a user management page.

[0009] In an embodiment, the determining whether the received request message is a DNS message comprises: extracting and parsing a field of the request message, and determining whether the received message is a DNS message according to a parsing result of the field, and extracting a domain name of the request message.

[0010] In an embodiment, the determining whether to release the request message according to whether the security domain name database or the domain name blacklist is hit comprises: releasing the non-DNS message if the security domain name database is hit; and discarding the non-DNS message if the security domain name database is not hit.

[0011] In an embodiment, the determining whether to release the request message according to whether the security domain name database or the domain name blacklist is hit comprises: discarding the DNS message if the domain name blacklist is hit.

[0012] In an embodiment, the determining whether to release the request message according to whether the security domain name database or the domain name blacklist is hit comprises: matching the domain name of the DNS message with a preset threat domain name rule library if the domain name blacklist is not hit; and determining whether to release the request message according to a matching result.

[0013] In an embodiment, the determining whether to release the request message according to the matching result comprises: determining that the domain name of the DNS message is a security domain name if the domain name of the DNS message fails to match the preset threat domain name rule library, adding the domain name of the DNS message to the security domain name database, and releasing the DNS message; and determining that the domain name of the DNS message is a threat domain name if the domain name of the DNS message succeeds in matching the preset threat domain name rule library, adding the domain name of the DNS message to the domain name blacklist, and discarding the DNS message.

[0014] In an embodiment, after the determining whether to release the request message according to whether the security domain name database or the domain name blacklist is hit, the method further comprises: notifying a sender of the request message that a threat domain name is accessed if the request message is not released.

[0015] In an embodiment, the method further comprises: counting a number of times that each user accesses a threat domain name; and marking a corresponding risk level of each user according to the number of times that each user accesses the threat domain name.

[0016] According to a second aspect of the present application, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to perform the network security protection method described in the above embodiments.

[0017] According to a third aspect of the present application, a computer readable storage medium is provided, which stores a computer program executable by a processor to implement the network security protection method described in the above embodiments.

[0018] According to a fourth aspect of the present application, a computer program product is provided, which comprises computer programs / instructions executable by a processor to implement the network security protection method described in the above embodiments.

[0019] According to a fifth aspect of the present application, a network security protection device is further provided, which comprises: a packet type judgment module, configured to judge whether a received request packet is a DNS packet; a security domain name database judgment module, configured to, if the received request packet is a non-DNS packet, judge whether a domain name of the non-DNS packet hits a security domain name database; a domain name blacklist judgment module, configured to, if the received request packet is a DNS packet, judge whether the domain name of the DNS packet hits a domain name blacklist; and a packet release judgment module, configured to determine whether to release the request packet according to whether the security domain name database or the domain name blacklist is hit.

[0020] The network security protection method, electronic device, storage medium and program product provided by the above embodiments distinguish between DNS packets and non-DNS packets, and take corresponding security measures, thereby enhancing the protection capability against various network threats. For DNS packets, the domain name resolution process is optimized through matching with the domain name blacklist, and the security protection efficiency is improved. For non-DNS packets, the protection capability against other various network threats is enhanced through matching with the security domain name database, thereby providing more comprehensive network security protection. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0022] Figure 1 The application scenario diagram of the network security protection system provided by the embodiments of the present application;

[0023] Figure 2 The flowchart of the network security protection method provided by the embodiments of the present application;

[0024] Figure 3 The flowchart of receiving packets and judging protection strategies provided by the embodiments of the present application;

[0025] Figure 4 A flowchart of generating security protection policies for different users is provided for the embodiments of the present application.

[0026] Figure 5 A detailed flowchart of a network security protection method is provided for the embodiments of the present application.

[0027] Figure 6 A structural diagram of a network security protection device is provided for the embodiments of the present application. DETAILED DESCRIPTION

[0028] The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

[0029] Figure 1 An application scenario diagram of a network security protection system is provided for the embodiments of the present application, as shown in Figure 1 The user terminal device 110 is configured to send a request message to the network security protection system 120. The network security protection system 120 is configured to detect and process the request message by using the method provided in the embodiments of the present application, and determine whether to send the request message to the Internet 130, thereby improving network security. Figure 1 The two user terminal devices 110 are taken as examples in the embodiments of the present application, and the number of user terminal devices 110 is not limited in practice. The user terminal device 110 can be a mobile phone, a tablet computer, a computer, or the like.

[0030] Figure 2 A flowchart of a network security protection method is provided for the embodiments of the present application, as shown in Figure 2 The network security protection method includes the following steps S500-S610.

[0031] Step S500, determining whether the received request message is a DNS message.

[0032] Specifically, the system (i.e., the network security protection system 120 described above, hereinafter referred to as the system) analyzes the characteristics of the received request message, such as the port number and the protocol type, to identify whether the received request message complies with the DNS protocol. This helps the system to distinguish between DNS messages and non-DNS messages, so that different processing rules can be applied to them. This ensures that the system can accurately classify DNS traffic and non-DNS traffic, providing an accurate starting point for subsequent security checks.

[0033] Step S510, if the received request message is a non-DNS message, determining whether the domain name of the non-DNS message hits the security domain name database.

[0034] Specifically, for non-DNS packets, the system will extract the domain name information therein and query the secure domain name database to determine whether the domain name is considered secure. The secure domain name database is a matching domain name reference table, which refers to a pre-set database containing a list of verified and considered secure domain names, which are considered to contain no malicious content or threats. This step aims to identify and allow requests accessing known secure domain names to pass. By quickly verifying the security of domain names in non-DNS packets, the system can efficiently release safe traffic and reduce interference to legitimate users.

[0035] Step S600, if the received request packet is a DNS packet, determine whether the domain name of the DNS packet hits the domain name blacklist.

[0036] Specifically, if the received request packet is a DNS packet, the extracted domain name is compared with the built-in domain name blacklist. The domain name blacklist is a database containing known malicious or suspicious domain names, which are associated with network attacks, phishing websites or other security threats. This step effectively blocks DNS queries to known malicious or suspicious domain names, thereby preventing the network from being threatened by security threats associated with these domain names. By directly matching with the domain name blacklist, the threat domain name rule matching is not required every time, thereby improving the efficiency of threat domain name identification.

[0037] Step S610, determine whether to release the request packet according to whether it hits the secure domain name database or the domain name blacklist.

[0038] Specifically, the system will determine whether to release the request packet according to the results of the previous two steps. This decision step ensures that only network traffic that meets the security standards can pass through, thereby improving the overall security of the network and reducing the consumption of network resources by malicious traffic.

[0039] The technical solutions provided by the above embodiments of the application can provide security protection for DNS request packets and non-DNS request packets, have strong multiplexing and are convenient for extension. By matching with the domain name blacklist and the secure domain name database, the efficiency of security protection is improved and the device performance is improved.

[0040] In an embodiment, Figure 3 The flowchart for receiving packets and determining protection strategies provided by the embodiments of the application is shown in Figure 3 Before step S500 of determining whether the received request packet is a DNS packet, the following steps S300-S420 are further included:

[0041] Step S300, receiving a request packet sent by a user end.

[0042] Specifically, the system receives network request messages from user terminals. These messages can contain requests for access to Internet resources, such as web browsing, file downloading, etc.

[0043] Step S400, according to the protection policy corresponding to different users, judge whether the security protection measures of the user terminal is opened.

[0044] Specifically, the matched ACL (Access Control List) policy is queried to check whether the protection switch of the ACL is opened, i.e., whether the security protection measures of the user terminal is opened, to determine whether the user sending the request has enabled the network complete protection measures. This step is completed by matching the IP address or other identifiers of the user with the records in the user management list. Among them, the ACL policy is a technology for managing and controlling the access rights of users or systems to network resources in computer networks.

[0045] Step S410, if it is opened, then step S500 is executed to judge whether the received request message is a DNS message.

[0046] Specifically, if the protection switch is opened, the user's access to the network is detected and processed by the system, and the system will execute Figure 2 further security checks according to the steps shown in the corresponding embodiments.

[0047] Step S420, if it is closed, directly pass the request message.

[0048] Specifically, if the protection switch is closed, the system will directly pass the request message of the user without security check on the content of the message, and the user's access to the network is unrestricted.

[0049] Users can choose whether to enable security protection according to their own needs, providing more flexible and personalized security solutions. For requests that do not require security checks, the system can quickly pass them, improving the user's network access experience. Among them, the protection switch is opened by default and can be manually closed.

[0050] In an embodiment, Figure 4 The flowchart for generating security protection policies for different users provided by the embodiments of the present application is shown in Figure 4 Before receiving the request message sent by the user terminal in step S300, it further includes:

[0051] Step S200, in response to the configuration information input by the administrator on the user management page, generate security protection policies for different users.

[0052] Specifically, the administrator can input and update the user's configuration information through the user management page, including the username, IP address, email, and protection switch status. The system will dynamically generate and adjust personalized security protection strategies for different users based on these inputs to ensure that network resource access meets the specific security needs and protection levels of each user, thereby achieving fine-grained network security management.

[0053] For example, the administrator first adds a user to the user list through the user management page. The configuration added to the user list includes the user's name (mandatory), IP (mandatory), email (mandatory), and selection of whether to enable security protection function (mandatory). Subsequently, the system displays a user list containing the username, IP, email, protection switch, and risk level, which enhances the visual management of user information and enables the administrator to quickly understand and monitor the status and security settings of users.

[0054] The risk level is initially set to "healthy" by default and will be dynamically adjusted to "low", "medium", or "high" based on the number of times the user accesses threat domain names, which enables security protection to respond more accurately to the user's security situation and adjust protection measures in a timely manner. The administrator can also add, modify, delete, and clear the user list, which simplifies the administrator's management operations and enables flexible management of user security configurations. Furthermore, only the email and protection switch can be modified, which reduces the risk of misoperation while maintaining the security and integrity of user information.

[0055] After the user completes the configuration, the system will automatically deploy access ACL policies based on the user's personalized settings to ensure that network security protection is implemented in accordance with user needs.

[0056] Specifically, for users who have enabled security protection function, the system will automatically issue ACL policies containing security protection measures. These policies will monitor and filter the network traffic of these users to prevent potential domain name threats. For example, if user Zhang San has enabled the security protection switch in his personal settings, the system will issue an ACL containing security protection rules for him. These rules will prevent access to known malicious domain names and take appropriate protective measures when threats are detected.

[0057] Conversely, for users who choose to turn off the security protection function, the system will issue an ACL policy that does not contain security protection measures. This means that the network traffic of these users will not be subject to additional security checks, allowing them to freely access the Internet without restrictions from the domain name threat protection system. For example, if user Li Si chooses to turn off the security protection switch, the system will issue a normal ACL for him without security checks on the domain names he accesses.

[0058] In some embodiments, step S500 determines whether the received request message is a DNS message, specifically including: extracting and parsing the fields of the request message, determining whether the received message is a DNS message according to the parsing result of the fields, and extracting the domain name of the request message.

[0059] Specifically, for each request message, the AI protocol parsing and recognition module extracts key fields such as port number (DNS usually uses port 53), protocol type (UDP or TCP), and other characteristics of the message header. And parse the extracted fields, especially the port number, to determine whether the message meets the characteristics of the DNS protocol.

[0060] If the message meets the standards of the DNS protocol, such as containing the correct query or response format, appropriate port number (usually port 53), the AI module will identify it as a DNS message. If the message does not meet the standards of the DNS protocol, it will be judged as a non-DNS message.

[0061] At the same time, the domain name of the user request message is extracted, this step is not only suitable for DNS messages, but also for non-DNS messages such as HTTP and HTTPS requests. For example, for DNS messages, since DNS messages have a standardized structure, including header, question section, answer section, authority section and additional section, and the question section contains the domain name of the query, the domain name of the query is directly extracted from the question section. For non-DNS messages such as HTTP requests, the system will parse the URL (Uniform Resource Locator, Uniform Resource Locator) to extract the domain name.

[0062] The design of the AI protocol parsing and recognition module has high flexibility and universality. This module is not limited to a specific type of AI protocol parsing technology, but adopts an open architecture that can adapt to and learn different protocol characteristics, adapt to the parsing needs of multiple protocols and data formats, including but not limited to port number, protocol type, IP address, and other key information of network messages.

[0063] Enabling the AI protocol parsing and recognition module not only improves the efficiency and accuracy of DNS message recognition and enhances network security protection, but also can be easily extended to other functions, achieving reuse. This flexibility allows the system to easily integrate new protocol recognition or network traffic analysis tasks in the future without starting from scratch to develop new modules, thereby saving development time and cost and speeding up the deployment of new functions, providing a solid foundation for future technical upgrades and function extensions.

[0064] For example, user Zhang San enters a website http: / / example.com in his browser and attempts to access. After obtaining the request message, the target port is obtained by extracting and analyzing the fields of the request message, and the protocol type conforms to the characteristics of DNS query, so it is judged that the request message is a DNS message. At the same time, the domain name example.com is parsed from the DNS query message.

[0065] Figure 5 is a detailed flowchart of a network security protection method provided by the embodiment of the application. As shown in Figure 5 the network security protection method comprises the following steps S100-S900:

[0066] Step S100, the configuration information input by the administrator on the user management page includes username, IP address, mailbox and protection switch state.

[0067] Step S200, in response to the configuration information input by the administrator on the user management page, a security protection policy for different users is generated.

[0068] Step S300, receiving the request message sent by the user end.

[0069] Step S400, according to the protection policy corresponding to different users, it is judged whether the security protection measure of the user end is started. If it is started, step S500 is executed to judge whether the received request message is a DNS message. If it is closed, step S420 is executed to directly release the request message.

[0070] Step S500, judging whether the received request message is a DNS message.

[0071] Step S510, if the received request message is a non-DNS message, it is judged whether the domain name of the non-DNS message hits the security domain name database. If it does not hit, step S511 is executed, and if it hits, step S512 is executed.

[0072] Step S511, if it does not hit the security domain name database, the non-DNS message is discarded.

[0073] Step S512, if it hits the security domain name database, the non-DNS message is released.

[0074] Specifically, if the received message is a non-DNS message, it is checked whether the domain name carried in the non-DNS message is recorded in the security domain name database.

[0075] If the domain name in the non-DNS packet matches the entries in the secure domain name database, it indicates that the domain name is trustworthy, and the system will perform a release operation to allow the non-DNS packet to continue its network transmission process. Such design ensures that legitimate and secure network communication will not be blocked unnecessarily, thus maintaining the efficiency of the network and the normal online experience of users.

[0076] On the contrary, if the domain name in the non-DNS packet is not in the secure domain name database, i.e. no record is hit, the system will take preventive measures to automatically discard the non-DNS packet, preventing potential malware, phishing attacks or other network threats from entering the network.

[0077] Through this mechanism, network security risks can be effectively reduced without affecting normal network communication, improving the overall security of the network. At the same time, this also reflects the flexibility and intelligence of the system in handling non-DNS packets, which can dynamically adjust protection measures according to the latest security information.

[0078] Step S600, if the received request packet is a DNS packet, determine whether the domain name of the DNS packet hits the domain name blacklist. If it hits, execute step S611, if it does not hit, execute step S700.

[0079] Step S611, if it hits the domain name blacklist, discard the DNS packet.

[0080] Specifically, if the domain name of the DNS packet hits the blacklist, the packet is discarded directly to prevent domain name resolution requests that may cause security risks, protecting the network from known threats.

[0081] Step S700, if it does not hit the domain name blacklist, match the domain name of the DNS packet with the preset threat domain name rule library; if the matching fails, execute step S800, if the matching succeeds, execute step S710.

[0082] When the domain name does not exist in the blacklist, the prior art does not further identify and process the domain name, so it cannot identify and prevent those domain names that have not been marked as known threats but still may have risks. This leads to an important security vulnerability, making the network system vulnerable to new or not yet widely recognized network threats, resulting in an inability to comprehensively defend against domain name-based network threats.

[0083] In some embodiments of the present application, specifically, if the domain name of the DNS message does not hit the domain name blacklist, the request will not be released immediately, but further step S700 will be performed to match the domain name with the preset threat domain name rule library. This threat domain name rule library contains a series of security rules and patterns for identifying potential threat domain names that may not have been widely recognized as malicious but exhibit certain suspicious characteristics. Through this deep analysis, more potential threats can be identified and prevented, and the domain name blacklist and rule library can be dynamically adjusted according to the constantly updated threat intelligence, enabling timely response to emerging threats. Then, according to the matching result with the threat domain name rule library, it is determined whether to release the request message.

[0084] Step S800, if the domain name of the DNS message fails to match the preset threat domain name rule library, it is determined that the domain name of the DNS message is a safe domain name, the domain name of the DNS message is added to the safe domain name database, and the DNS message is released, and step S900 is performed.

[0085] Step S900, the IP and domain name in the DNS response packet in the previous step are added to the safe domain name database and the message is forwarded.

[0086] Specifically, after receiving the corresponding DNS response packet, the IP address and domain name information contained in the response packet are added to the safe domain name database. The safe domain name database records the correspondence between domain names and server IPs, which helps the system to more efficiently handle similar DNS requests in the future.

[0087] And forward the DNS response packet, ensure that the requester's query operation is completed, at the same time, through updating the safe domain name database, enhance the system's management ability to network traffic. This coherent process not only guarantees the smoothness of legal domain name resolution, but also strengthens the system's dynamic defense mechanism against network threats.

[0088] Step S710, if the domain name of the DNS message matches the preset threat domain name rule library, it is determined that the domain name of the DNS message is a threat domain name, and the domain name of the DNS message is added to the domain name blacklist;

[0089] Step S711, notify the sender of the request message that a threat domain name has been accessed.

[0090] Step S712, discard the DNS message.

[0091] Specifically, the domain name of the DNS message is matched with the preset threat domain name rule library. If the domain name of the DNS message fails to match the threat domain name rule library, it is determined that the domain name of the DNS message is a safe domain name, and the DNS message is released to allow the normal domain name resolution process to continue.

[0092] If the domain name of the DNS message matches a threat domain name rule library successfully, it indicates that the domain name is a threat domain name. The domain name is added to the domain name blacklist to ensure that all future requests pointing to the domain name will be automatically blocked. When other users attempt to access the threat domain name listed in the blacklist, there is no need to repeatedly perform domain name security comparison, but according to the record in the domain name blacklist, the access request to the domain name is quickly blocked. This optimization not only improves the response speed, but also reduces the system burden, ensuring the efficiency and effectiveness of network security protection. And the DNS message is discarded, preventing any further communication attempt. If the request message is not released, the sender of the request message is notified that the threat domain name is accessed.

[0093] Specifically, if a request message is determined not to be released due to security reasons, multiple notification methods will be used to inform the user of the request message that the domain name he / she attempts to access has been identified by the system as a threat domain name. In addition to sending email notifications, the user can also be warned through various means such as SMS, in-app push notifications, instant messaging messages, or system log prompts. This instant feedback mechanism enables users to be aware of potential network security risks they may encounter in a timely manner, thereby improving their security awareness and prompting them to take action to avoid potential security threats, further enhancing the security of the entire network environment.

[0094] In some embodiments, the network security protection method in the above embodiments can further include: counting the number of times each user accesses a threat domain name; and marking a corresponding risk level for each user according to the number of times each user accesses a threat domain name.

[0095] Specifically, in addition to basic domain name filtering and access control, the number of times each user accesses a domain name identified as a threat can also be counted to ensure real-time tracking and analysis of user behavior. By counting the number of times each user accesses a threat domain name, the network security risk of each user can be quantitatively evaluated. According to the frequency of user access to threat domain names, the system assigns a corresponding risk level to each user. The risk level can be pre-set, such as "low", "medium", and "high", corresponding to different levels of security risk. This grading system helps the system and network administrators quickly identify which users may face higher security risks, so that appropriate preventive measures can be taken.

[0096] Further, the network security protection method of any of the above embodiments can further include: implementing differentiated security policies according to the risk level of the user. For example, for users with a higher risk level, the monitoring of their network access is strengthened, their access to certain high-risk websites is limited, or the user is required to perform additional identity verification before accessing certain websites. Such measures aim to reduce the network security incidents that may be caused by high-risk users.

[0097] Through the comprehensive user behavior statistics and risk assessment mechanism, the network security protection is improved in pertinence and effectiveness, the user's understanding of network security is enhanced, and the security and stability of the entire network environment are promoted.

[0098] In a specific embodiment, the process of implementing network security protection is as follows:

[0099] The administrator adds a user list with security protection enabled. Taking Zhang San as an example, the administrator inputs the following information: name is Zhang San, IP address is 192.168.10.10, email is zhangsan@XXXX.com.cn, and selects the security protection switch.

[0100] After the user information configuration is completed, the system automatically generates and applies an ACL policy. The source address of this ACL is the IP address of the user (192.168.10.10), and the security protection function is enabled. At the same time, the AI application recognition module of the system also starts running, preparing to parse and identify network traffic.

[0101] Zhang San tries to access a threat domain name in the browser, for example: http: / / s-tech.hu.

[0102] After receiving the network request message sent by Zhang San, it is first matched to the corresponding ACL, and it is confirmed that the protection switch is in the on state. Then, the AI module parses the message and identifies that it is a DNS query message, and extracts the target domain name (s-tech.hu).

[0103] The extracted domain name is matched with the existing domain name blacklist. Since this is the first access, the domain name has not been listed in the blacklist, so the matching fails.

[0104] Then, the domain name is compared with the threat domain name rule library, and it is found that the domain name does exist in the threat domain name rule library, that is, it hits the threat domain name.

[0105] The domain name is added to the domain name blacklist, and the message is discarded immediately, preventing Zhang San from accessing the threat domain name. At the same time, the system will automatically send an email to Zhang San, informing him that he has accessed a threat domain name.

[0106] The administrator views the user list through the user management page and finds that the risk level of Zhang San has changed from the default "healthy" to "low". The administrator can clearly see that Zhang San has accessed a threat domain name and its corresponding risk level change, which facilitates subsequent management and tracking.

[0107] In another specific embodiment, the process of implementing network security protection is as follows:

[0108] The administrator adds a list of users with security protection enabled. Taking Li Si as an example, the administrator inputs the following information: name Li Si, IP address 192.168.20.20, email lisi@XXXX.com.cn, and selects the security protection switch.

[0109] After the user information is configured, the system automatically generates and applies an ACL policy. The source address of the ACL is the IP address of the user (192.168.20.20), and the security protection function is enabled. At the same time, the AI application recognition module of the system also starts running, preparing to parse and identify network traffic.

[0110] Li Si tries to access an HTTP resource in the browser, for example: http: / / example.com.

[0111] After receiving the network request message sent by Li Si, the corresponding ACL is matched first, and it is confirmed that the protection switch is in the on state. Then, the AI module parses the message and identifies that it is a non-DNS query message.

[0112] The domain name (example.com) in the extracted URL is matched with the security domain name database.

[0113] It is found that the domain name hits the security domain name database, so it is considered that the domain name is a security domain name, and the message request is allowed to pass, and the user can normally access.

[0114] The administrator views the user list through the user management page and finds that the risk level of Li Si is still "healthy" because this access is to a security domain name.

[0115] Based on any of the network security protection methods provided in the above embodiments, based on the same inventive concept, the embodiments of the present application provide a network security protection device 1000 to implement the above network security protection method. Figure 6 The structure diagram of the network security protection device provided in the embodiments of the present application is shown in Figure 6 As shown in the figure, the network security protection device 1000 of the embodiments of the present application at least includes: a message type judgment module 1001, a security domain name database judgment module 1002, a domain name blacklist judgment module 1003, and a message passing judgment module 1004, wherein:

[0116] The message type judgment module 1001 is configured to judge whether the received request message is a DNS message.

[0117] The security domain name database judgment module 1002 is configured to, if the received request message is a non-DNS message, judge whether the domain name of the non-DNS message hits the security domain name database.

[0118] The domain name blacklist judgment module 1003 is configured to, if the received request message is a DNS message, judge whether the domain name of the DNS message hits a domain name blacklist.

[0119] The message release judgment module 1004 is configured to determine whether to release the request message according to whether the security domain name database or the domain name blacklist is hit.

[0120] The specific execution process of each module can be referred to the corresponding steps in the method part, which will not be described here.

[0121] The embodiment of the application further provides an electronic device, which can include a processor and a memory for storing processor-executable instructions, and the processor is configured to implement the steps of the network security protection method of any of the above embodiments.

[0122] The embodiment of the application further provides a computer-readable storage medium, which stores a computer program, and the computer program can be executed by a processor to complete the steps of the network security protection method of any of the above embodiments.

[0123] The embodiment of the application further provides a computer program product, which includes a computer program / instruction, and the computer program / instruction is executed by a processor to implement the steps of the network security protection method of any of the above embodiments.

[0124] In summary, the technical solution provided by the embodiment of the application has the following advantages:

[0125] The administrator only needs to configure a user management list, and the system can automatically issue a security policy, thereby simplifying the management work, reducing human errors, and accelerating the response speed.

[0126] The user accessing the threat domain name is clearly identified, and timely and effective intervention is performed. Through the notification mechanism of accessing the threat domain name, the user has a clear perception of accessing the threat domain name, enhances the user's network security awareness, and enables the user to real-time understand the security of the network activity.

[0127] The AI application identification module is adopted, has powerful network traffic identification capability, and provides flexibility for future function expansion.

[0128] By adding the threat domain name to the blacklist, subsequent access requests can be quickly blocked, repeated checking is avoided, and the performance and system response speed are significantly improved.

[0129] Through deep analysis of each domain name, not only is the blacklist matched, but also the preset threat domain name rule library is combined to identify potential threats, and the blacklist and the rule library are dynamically adjusted to ensure timely response to emerging threats.

[0130] In the embodiments provided by the present application, it should be understood that the disclosed device and method can be implemented in other manners. The embodiments described above are merely exemplary.

[0131] It should be noted that, if the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on such an understanding, the technical solutions of the present application essentially or partially can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods in the embodiments of the present application. The foregoing storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and the like.

[0132] The above merely describes the embodiments of the present application, but does not serve as a limitation on the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A network security protection method characterized by, The method comprises the following steps: determining whether the received request message is a DNS message; if the received request message is a non-DNS message, determining whether the domain name of the non-DNS message hits a security domain name database; if the received request message is a DNS message, determining whether the domain name of the DNS message hits a domain name blacklist; determining whether to release the request message according to whether the security domain name database or the domain name blacklist is hit.

2. The method of claim 1, wherein, Before the step of determining whether the received request message is a DNS message, the method further comprises the following steps: receiving a request message sent by a user terminal; determining whether the security protection measure of the user terminal is turned on according to the protection strategy corresponding to different users; if the security protection measure is turned on, performing the step of determining whether the received request message is a DNS message; if the security protection measure is turned off, directly releasing the request message.

3. The method of claim 2, wherein, Before the step of receiving a request message sent by a user terminal, the method further comprises the following step: generating a security protection strategy for different users in response to configuration information input by an administrator on a user management page.

4. The method of claim 1, wherein, The step of determining whether the received request message is a DNS message comprises the following steps: extracting and analyzing the fields of the request message, and determining whether the received message is a DNS message according to the analysis result of the fields, and extracting the domain name of the request message.

5. The method of claim 1, wherein, The step of determining whether to release the request message according to whether the security domain name database or the domain name blacklist is hit comprises the following steps: if the security domain name database is hit, releasing the non-DNS message; if the security domain name database is not hit, discarding the non-DNS message.

6. The method of claim 1, wherein, The step of determining whether to release the request message according to whether the security domain name database or the domain name blacklist is hit comprises the following step: if the domain name blacklist is hit, discarding the DNS message.

7. The method of claim 1, wherein, The step of determining whether to release the request message according to whether the security domain name database or the domain name blacklist is hit comprises the following steps: if the domain name blacklist is not hit, matching the domain name of the DNS message with a preset threat domain name rule library; determining whether to release the request message according to the matching result.

8. The method of claim 7, wherein, The step of determining whether to release the request message according to the matching result comprises the following steps: if the domain name of the DNS message fails to match the preset threat domain name rule library, determining that the domain name of the DNS message is a security domain name, adding the domain name of the DNS message to the security domain name database, and releasing the DNS message; if the domain name of the DNS message matches the preset threat domain name rule library, determining that the domain name of the DNS message is a threat domain name, adding the domain name of the DNS message to the domain name blacklist, and discarding the DNS message.

9. The method of claim 1, wherein, After the step of determining whether to release the request message according to whether the security domain name database or the domain name blacklist is hit, the method further comprises the following step: if the request message is not released, notifying the sender of the request message that a threat domain name is accessed.

10. The method of claim 1, wherein, The method further comprises the following steps: counting the number of times that each user accesses a threat domain name; labeling the risk level of each user according to the number of times that each user accesses a threat domain name.

11. An electronic device, comprising: The electronic device comprises: a processor; a memory for storing processor-executable instructions; The processor is configured to perform the network security protection method of any one of claims 1-10.

12. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which can be executed by the processor to complete the network security protection method of any one of claims 1-10.

13. A computer program product, characterised in that, The computer program / instructions are executed by the processor to implement the network security protection method of any one of claims 1-10.

Images