Domain name risk assessment method and device, electronic equipment and storage medium

Abstract

The invention provides a domain name risk assessment method and device, electronic equipment and a storage medium, and relates to but is not limited to the technical field of data processing.The method comprises the steps that according to a target domain name, an analysis dependency path tree corresponding to the target domain name is determined; performing depth-first search on the resolution dependency path tree to determine each resolution dependency path of the target domain name; obtaining an attribute risk index for analyzing a node risk attribute of each node on the dependency path tree; according to the analysis dependency paths and the attribute risk indexes, calculating to obtain path risk indexes of the analysis dependency paths; and determining a target risk index of the target domain name according to each path risk index corresponding to the target domain name. According to the embodiment of the invention, the domain name risk is diagnosed from a management perspective, the existing analysis side risk is supplemented and improved, and further analysis of various dependency risks in the analysis process can be realized based on the dependency analysis dependency path tree, so that the domain name risk assessment precision and assessment efficiency can be improved.

Description

Technical Field

[0001] The embodiments of the present application relate to, but are not limited to, the field of data processing technology, and in particular to a domain name risk assessment method, device, electronic device, and storage medium. Background Art

[0002] The current Domain Name System (DNS) risk analysis mainly focuses on the risk analysis of DNS resolution results, especially the analysis of various security attack risks faced by the DNS resolution side, including hijacking, cache poisoning, etc., and lacks the assessment of the risks of domain names on the management side. The risks on the DNS management side are often transmitted to the user side, affecting the normal resolution of domain names. On the other hand, since domain name resolution is top-down, there is a dependency on the resolution of upstream domain name resources at all levels, and the existing related risk analysis is more complex in expressing the resolution dependency relationship, making it difficult to achieve risk assessment of the domain name resolution process. That is, the current domain name risk analysis focuses more on the assessment and analysis of existing risks, and lacks analysis of potential risks, especially the potential impact of management-side risks on domain name resolution risks, and lacks risk analysis of domain name resolution dependencies, resulting in low accuracy and low efficiency of domain name risk assessment. Therefore, there is an urgent need for a domain name risk assessment method that can improve the accuracy and efficiency of domain name risk assessment. Summary of the invention

[0003] The embodiments of the present application provide a domain name risk assessment method, device, electronic device and storage medium, aiming to improve the accuracy and efficiency of domain name risk assessment.

[0004] In a first aspect, an embodiment of the present application provides a domain name risk assessment method, the domain name risk assessment method comprising: Obtain the target domain name to be risk assessed; According to the target domain name, determining a resolution dependency path tree corresponding to the target domain name; Performing a depth-first search on the resolution dependency path tree to determine each resolution dependency path of the target domain name; Obtaining an attribute risk indicator of a node risk attribute of each node on the resolution dependency path tree; Calculate the path risk index of each parsing dependency path according to the parsing dependency path and each of the attribute risk indicators; A target risk index of the target domain name is determined according to each path risk index corresponding to the target domain name.

[0005] In a second aspect, an embodiment of the present application provides a domain name risk assessment device, the domain name risk assessment device comprising: A first acquisition module is used to acquire a target domain name to be risk assessed; A determination module, configured to determine, according to the target domain name, a resolution dependency path tree corresponding to the target domain name; A search module, used for performing a depth-first search on the resolution dependency path tree to determine each resolution dependency path of the target domain name; A second acquisition module is used to obtain an attribute risk index of a node risk attribute of each node on the resolution dependency path tree; A path risk index determination module, used to calculate the path risk index of each parsing dependency path according to the parsing dependency path and each attribute risk index; The target risk indicator module is used to determine the target risk indicator of the target domain name according to each path risk indicator corresponding to the target domain name.

[0006] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the domain name risk assessment method as described in the first aspect is implemented.

[0007] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, comprising computer-executable instructions stored therein, wherein the computer-executable instructions are used by a processor to execute the domain name risk assessment method as described in the first aspect.

[0008] The above-mentioned embodiments of the present application have at least the following beneficial effects: by calculating the path risk index for each resolution dependency path of each target domain name and determining the target risk index based on each path risk index, it is possible to diagnose domain name risks from a management perspective, supplement and improve the existing resolution-side risks, and improve the accuracy of risk assessment. And based on the dependency resolution dependency path tree, further analysis of various dependency risks in the resolution process is achieved, and the resolution efficiency is higher. Therefore, compared with related technologies, the embodiments of the present application can improve the accuracy and efficiency of domain name risk assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 A schematic diagram of a device module corresponding to the domain name risk assessment method of an embodiment of the present application; Figure 2 A flowchart of a domain name risk assessment method according to an embodiment of the present application; Figure 3 A flowchart of an embodiment of a domain name risk assessment method according to an embodiment of the present application; Figure 4 A schematic diagram of parsing dependency relationships in one embodiment of a domain name risk assessment method according to an embodiment of the present application; Figure 5A schematic diagram of building a parsing dependency path in one embodiment of a domain name risk assessment method according to an embodiment of the present application; Figure 6 A schematic diagram of parsing a dependency path tree in one embodiment of a domain name risk assessment method according to an embodiment of the present application; Figure 7 A schematic diagram of the hardware structure corresponding to the domain name risk assessment method of the application embodiment. DETAILED DESCRIPTION

[0010] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0011] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those generally understood by those skilled in the art belonging to the technical field of the present application. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application. The terms "first", "second", "third", "fourth", etc. (if present) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order.

[0012] In addition, the described features, structures or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known methods, devices, implementations or operations are not shown or described in detail to avoid blurring the various aspects of the present disclosure.

[0013] In the past research on DNS security risks, the main risk issues of DNS focused on the user side, including attacks on DNS and using DNS to attack other network entities. The threats or challenges faced by DNS are mainly shown in Table 1 below. As can be seen from Table 1, the threats or challenges faced by DNS are mainly threats and challenges to the user side of DNS. On the management side of DNS, current research focuses on the risks of centralized root management. However, centralized management of root services will bring the following risks of abuse of power: 1) "Blinding risk": The root server does not provide resolution services or provides abnormal resolution data for recursive resolvers and users in a specific network area, resulting in the targeted users being in a "blind" state. 2) "Disappearing risk": The publishing center of the root zone deletes or tampers with the data submitted by a specific top-level domain registry (TLD Registry), resulting in the domain name under the top-level domain being unable to be resolved and accessed, which is equivalent to the disappearance of the top-level domain in the domain name space. The risks on the DNS management side are often transmitted to the user side, affecting the normal resolution of the domain name. And because domain name resolution is top-down, there is a resolution dependency on upstream domain name resources at all levels. Although the existing relevant risk analysis can perform risk assessment on resolution dependency relationships, the expression of resolution dependency relationships is relatively complex, making it difficult to ensure the accuracy and efficiency of domain name risk assessments, and there is also a lack of risk analysis of the domain name resolution process. Based on this, this application takes the management side of the domain name system as the main analysis object, analyzes the risk factors of DNS management and the impact on the DNS usage side, and proposes a domain name management risk assessment model based on a resolution dependency search tree. It diagnoses domain name risks from a management perspective, on the one hand, supplements and improves the existing resolution side risks, and on the other hand, provides a simple and efficient analysis method for domain name resolution process analysis based on the proposed resolution dependency search tree. Based on the dependency search tree, further analysis of various dependency risks in the resolution process can be achieved. Among them, Table 1 is shown below:

[0014] Table 1 Reference Figure 1 As shown, according to an embodiment of the present application, a domain name risk assessment device is provided, the device comprising: The first acquisition module 100 is used to acquire a target domain name to be risk assessed; A determination module 200, configured to determine a resolution dependency path tree corresponding to a target domain name according to the target domain name; A search module 300 is used to perform a depth-first search on the resolution dependency path tree to determine each resolution dependency path of the target domain name; The second acquisition module 400 is used to obtain the attribute risk index of the node risk attribute of each node on the parsing dependency path tree; A path risk index determination module 500 is used to calculate the path risk index of each parsing dependent path according to the parsing dependent path and each attribute risk index; The target risk indicator module 600 is used to determine the target risk indicator of the target domain name according to each path risk indicator corresponding to the target domain name.

[0015] The device may be a device deployed independently of the domain name system, or may be a device deployed in the domain name system for real-time risk assessment. In some embodiments, when the domain name risk assessment device determines that the target risk index exceeds the threshold, a prompt message is output, or the domain name is processed based on the security policy. In this regard, the processing operation of the target risk index exceeding the threshold is not described in detail in the embodiments of the present application.

[0016] It is understandable that the above modules can be combined or re-divided according to needs, and this embodiment of the present application does not limit this.

[0017] Reference Figure 2 As shown, it can be understood that according to a domain name risk assessment method provided in an embodiment of the present application, the domain name risk assessment method includes: Step S100, obtaining a target domain name to be risk assessed; Step S200: Determine a resolution dependency path tree corresponding to the target domain name according to the target domain name; Step S300: performing a depth-first search on the resolution dependency path tree to determine each resolution dependency path of the target domain name; Step S400, obtaining the attribute risk index of the node risk attribute of each node on the parsing dependency path tree; Step S500: Calculate the path risk index of each parsing dependency path according to the parsing dependency path and each attribute risk index; Step S600: Determine a target risk index of the target domain name according to each path risk index corresponding to the target domain name.

[0018] Therefore, by calculating the path risk index for each resolution dependency path of each target domain name and determining the target risk index based on each path risk index, it is possible to diagnose domain name risks from a management perspective, supplement and improve the existing resolution side risks, and improve the accuracy of risk assessment. And based on the dependency resolution dependency path tree, further analysis of various dependency risks in the resolution process is achieved, and the resolution efficiency is higher. Therefore, compared with related technologies, the embodiments of the present application can improve the accuracy and efficiency of domain name risk assessment.

[0019] It is understandable that the domain name risk assessment method of the embodiment of the present application can be used for offline risk assessment of domain names, and can also be used for online risk assessment of domain names. The embodiment of the present application does not limit this, and technicians in this field can selectively set it according to actual conditions.

[0020] It is understandable that each target domain name has a unique corresponding resolution dependency path tree. The embodiment of the present application does not limit how the resolution dependency path tree is determined. For example, the resolution dependency tree can be constructed in real time according to the various regions involved in the resolution process of the target domain name in the domain name system, and the relationship between the region and the authoritative server. It can also be user input. In this regard, the embodiment of the present application does not limit it, and those skilled in the art can selectively set it according to actual conditions.

[0021] The resolution dependency path tree represents the resolution process of the corresponding target domain name. Each resolution dependency path tree has at least one resolution dependency path; each node on the resolution dependency path tree corresponds to an authoritative server, which can be an intra-domain server or an extra-domain server. The node risk attribute is the attribute of the corresponding node that will generate resolution risk. For example, the resolution risk may be caused by the server operator, and the node risk attribute includes the server operator attribute. For example, the resolution risk may also be caused by the network operator, that is, the node risk attribute includes the network operator attribute. For this, technicians in this field can selectively set it according to actual conditions. Among them. The attribute risk indicator represents the probability that the corresponding node risk attribute will generate resolution risk. It can be set manually or dynamically determined based on the historical resolution data of the node in the domain name system. Technicians in this field can selectively set it according to actual needs.

[0022] In the case of multiple resolution paths, it is only necessary to ensure that some paths are available to ensure that the target domain name can be resolved normally. Therefore, it is necessary to integrate the risk indicators of each path corresponding to the target domain name to determine the target risk indicator of the target domain name. The embodiment of the present application does not limit how to integrate, such as averaging, averaging or weighting the m with the lowest risk probability, or selecting one from multiple paths as the target risk indicator of the target domain name.

[0023] It is understandable that in some embodiments, the risk factors affecting the risk of each node on the parsing dependency path tree will also be subscribed, such as the risk factors including the type of node risk attribute (such as the increase / decrease of the type indicates that the risk factor has changed), the attribute risk index of the node risk attribute (such as the increase / decrease of the attribute risk index indicates that the risk factor has changed) and the relationship between nodes (such as the increase / decrease of nodes or the change of node dependencies, etc., all indicate that the risk factor has changed). A change flag is set to indicate whether the risk factor has changed and the target risk index calculated in real time is saved each time; when the target domain name search is triggered and the change flag indicates that there is a change in the risk factor, the target risk index is determined in real time based on steps S200 to S600. When the target domain name search is triggered and the change flag indicates that the risk factor has not changed, the historical target risk index is directly read as the target risk index at the current moment. In other embodiments, when the risk factor changes, the real-time update of the target risk index is initiated in the idle time period, so that when the target domain name triggers the search, the updated target risk index is directly obtained, so that the target risk index can be determined more timely.

[0024] It is understandable that the embodiment of the present application does not limit the number of node risk attributes in step S400, and those skilled in the art can selectively set them according to actual needs.

[0025] It can be understood that according to the parsing dependency path and each attribute risk index, the path risk index of each parsing dependency path is calculated, including: Determine the node risk index of each node of each resolution dependency path according to the attribute risk index of the node risk attribute of each node; Determine the safety index of each node based on the node risk index; Perform a product operation based on the safety index of each node of the same analytical dependency path to determine the path safety index of each analytical dependency path; According to the security index of each path, the path risk index of each resolution dependent path is determined.

[0026] At least one node risk attribute can be set. When one node risk attribute is set, the node risk index is the attribute risk index. When multiple node risk attributes are set, multiple attribute risk indicators can be weighted to obtain the node risk index, or multiple attribute risk indicators can be summed to obtain the node risk index. The embodiment of the present application does not limit how to determine the node risk index.

[0027] The safety risk index represents the safety probability of the corresponding node. Assuming that the node risk index is p(node i ), then the safety index is 1-p(node i ).

[0028] By first calculating the safety index of the node, and then calculating the path safety index of the parsed dependent path based on the safety index of each node, the accuracy of the path risk index can be further ensured based on the path safety index.

[0029] The product calculation of the safety index can be a product operation or a direct product operation, such as p(path i ) = 1- ∏ 1<=j<=n (1- p(node j )); where j represents the node index, node j Represents the jth node on the resolution dependency path.

[0030] It is understandable that the node risk attributes include institutional attributes, server operation attributes and network operator attributes. According to the attribute risk index of the node risk attribute of each node, the node risk index of each node of each resolution dependency path is determined, including: Obtain risk factors for institution attributes, server operation attributes, and network operator attributes; A weighted calculation is performed based on each risk coefficient and each attribute risk index of the same node to determine the node risk index of each node of each analytical dependency path.

[0031] It is understandable that the embodiments of the present application do not limit how to set the risk coefficient. Those skilled in the art can set it based on experience or determine it based on the parsed data on the node. It is understandable that the risk coefficients of the organization attributes, server operation attributes, and network operator attributes on the same node can be set according to the importance of each attribute. For example, by using the hierarchical analysis method, the importance is determined as w m >w s >w n .w m is the risk factor of the institution’s attributes, w s is the risk factor of the server operation attribute, w n is the risk factor of the network operator attributes.

[0032] For example, assume that the risk probabilities of the organization attributes, server operation attributes, and network operator attributes are represented as p m 、p s and p n In some embodiments, when the country of the institution included in the management institution attribute is inconsistent with the country of the registrant of the domain name resource, the risk probability of the institution attribute of the node can be set to 1, otherwise it is 0. At this time, the risk index of the node is calculated as shown in the following formula (1). Assume a path path i The nodes are (node1,node2,…,noden ), the path risk index of the path is calculated as shown in formula (2). In some embodiments, the path risk indexes of all resolution-dependent paths can be sorted from high to low by probability, and the path risk index of the 80%th path is taken to represent the overall management risk probability of the target domain name (that is, the target risk index). Among them, the 80% ratio mainly considers that as long as 20% of the paths in the resolution path are guaranteed to be available, the domain name resolution can be ensured to be available. Therefore, the risk probability of the 80%th path ensures that 20% of the path risk probabilities are less than or equal to the risk probability. In actual applications, 80% can be gradually adjusted in actual analysis operations to find a path position that reasonably reflects the overall risk probability of the domain name. The embodiment of the present application does not limit how to gradually adjust, and technicians in this field can selectively set it according to needs.

[0033] p(node i ) = w m p m + w s p s + w n p n Formula (1); p(path i ) = 1- ∏ 1<=j<=n (1- p(node j ))Formula (2); It is understandable that the risk factors for obtaining the attributes of the organization, server operation and network operator include: When the node risk index of the node to be calculated at the current moment is not found in the preset cache area, the risk coefficients of the institution attributes, server operation attributes and network operator attributes are obtained; wherein the cache area is used to cache the node risk index of the nodes that have been calculated on each resolution dependency path; After performing weighted calculation according to each risk coefficient and each attribute risk index of the same node to determine the node risk index of each node of each resolution dependency path, the method further includes: The node risk indicator of the node is associated with the node and saved in a cache area.

[0034] By associating the node risk indicator with the node and saving it in the cache, the node risk indicator calculation of the same node can be reduced when multiple resolution dependency paths share the node.

[0035] In some embodiments, after the target risk indicator is output, the risk indicators of each node involved in the target risk indicator calculation process in the cache can be cleared to ensure that what is cached in the cache area are the node risk indicators of each node under the parsing dependency path tree at the current moment.

[0036] It is understandable that the target risk index of the target domain name is determined according to the various path risk indicators corresponding to the target domain name, including: Sort the path risk indicators of the target domain name from high to low to obtain a path risk sequence; Get the path safety threshold ratio; Determine the target location based on the path security threshold ratio and the total number of paths that the target domain name relies on for resolution; The path risk indicator corresponding to the target location is selected from the path risk sequence as the target risk indicator.

[0037] The path safety threshold ratio can be selectively set according to actual needs. A path safety threshold ratio can be set. In actual operation, the path safety threshold is dynamically adjusted according to the accuracy of the target risk indicator evaluation.

[0038] It is understood that the parsing dependency path tree is determined by the following steps: Split the target domain name into regional hierarchies to obtain the regions of the target domain name and their regional dependencies; Determine the resolution dependency paths of the target domain name based on each region and each preset authoritative server; Build a resolution dependency path tree for all resolution dependency paths of the target domain name.

[0039] The region dependency indicates the hierarchical relationship between regions. The relationship between each region and the authoritative server is pre-configured, so the region authority dependency can be obtained based on each region and each authoritative server.

[0040] It is understandable that in some embodiments, the repetition of each resolution dependency path can be calculated, and the resolution dependency paths with a repetition greater than a preset threshold can be removed to reduce the number of resolution dependency paths involved in the construction and improve the efficiency of subsequent real-time target risk indicator calculations. Accordingly, the original regions, regional dependencies, and regional authority dependencies will be saved to update the resolution dependency path tree in real time when changes are detected in the original regions, regional dependencies, and regional authority dependencies.

[0041] It is understandable that according to the regional dependency and regional authority dependency of the target domain name, a resolution dependency path tree is constructed, including: According to the regional dependencies, each region of the target domain name is traversed layer by layer; According to the regional authority dependency, determine the target authoritative server for each traversed region, where the target authoritative server is the authoritative server that does not participate in the construction of the resolution dependency path; When all areas of the target domain name have been traversed, the target authoritative servers obtained through the traversal are connected in sequence according to the preset hierarchical order to construct a resolution dependency path for the target domain name; When there is an authoritative server that does not participate in building the resolution dependency path in the regional dependency, jump to the step of traversing each zone of the target domain name layer by layer according to the regional dependency; When all authoritative servers in the regional dependency relationship participate in constructing the resolution dependency path, the resolution dependency path tree is obtained according to each constructed resolution dependency path.

[0042] For example, refer to Figures 3 to 6 The method for evaluating a domain name in the embodiment of the present application is described with reference to Figure 3 As shown, the details are as follows: Step 1: Determine the management role type: The hierarchical domain name system is managed by different organizations from top to bottom. The hierarchy of the target domain name areas in the domain name system is as follows: The top level of the domain name system is the root domain. The management of the root domain includes two parts: one is the naming center management of the root domain, also known as the root zone management, and the other is the publishing center and resolution center management, also known as the root server management.

[0043] The next level below the root domain is the top-level domain (TLD). ICANN divides top-level domains into different categories based on the purpose, owner, and geographic location of the site. There are five official types of top-level domains: generic top-level domains (gTLDs), sponsored top-level domains (sTLDs), country code top-level domains (ccTLDs), infrastructure top-level domains (ARPAs), and test top-level domains (tTLDs). Among them, generic top-level domains are the most popular and familiar type of domain extensions. Common generic top-level domains include ".org", ".com", and ".net". Sponsored top-level domains are special domain name suffixes that are supported by sponsors of specific groups that the domain name will serve. Common sponsored top-level domains include ".edu", ".gov", etc. Country code top-level domains (ccTLDs) use a two-letter string for identification. Common country code top-level domains include ".cn", ".us", ".ru", etc. Infrastructure top-level domains contain only one top-level domain: the address and routing parameter area (".arpa"), which is only used for technical infrastructure purposes, such as DNS reverse queries. Test top-level domains are reserved for documentation and local testing and cannot be published to the root zone. They include four top-level domains: ".example", ".invalid", ".localhost" and ".test". The management agency of the top-level domain is also called the registry, which is responsible for managing the top-level domain name database, maintaining the database of all registered domain names under the top-level domain, and ensuring the uniqueness and accuracy of the domain name. The registry also cooperates with domain name registrars to provide domain name registration services to the public through registrars, and is responsible for processing domain name registration, renewal and transfer requests. In addition, the registry is responsible for or hosts professional DNS operators to operate and manage the authoritative servers of top-level domain names. Such organizations that operate and manage DNS authoritative servers are also called authoritative server operators.

[0044] The next layer of the top-level domain is the second-level domain name (SLD). The second-level domain name is generally registered by the user on his own, and the second-level domain name is registered with the top-level domain registry through the domain name registrar. Therefore, the registration information of the second-level domain name is generally managed and maintained on the platform of the domain name registrar, including registration application, domain name renewal, domain name transfer, and domain name cancellation. The domain name registrar initiates a management operation request for the registered domain name to the registry based on the standard registered domain name protocol such as EPP, so that the change of the second-level domain name takes effect in the domain name database maintained by the registry and is published to the authoritative server of the top-level domain.

[0045] The authoritative server of the second-level domain name is generally operated and managed by the registered user himself or entrusted to a DNS hosting service provider for operation and management. As defined above, the DNS hosting service operator is also called the DNS authoritative server operator, which has two responsibilities. One is to maintain the authoritative records of the subdomains of the second-level domain name and provide authoritative record resolution services.

[0046] The next level of domain name below the second-level domain name is the third-level domain name. The third-level domain name is generally a domain name customized by the second-level domain name registration user organization, including ordinary domain names, i.e. fully qualified domain names (FQDN) and subdomain names. The authoritative servers of the third-level domain names are also managed by themselves and managed by trustees. For some specific second-level domain names such as "com.cn", they are registered by the "cn" registry CNNIC and provide open registration for third-level domain names, so registered domain names are not limited to second-level domain names.

[0047] In summary, the types of management roles in the domain name system are, from top to bottom according to the domain name level, the root zone management agency, the root service management agency, the top-level domain registry, the domain name registrar, the authoritative server operator, and the network operator where the server is located.

[0048] Among them, the network operators where the root servers and authoritative servers of domain names at all levels are deployed have the ability to impose network restrictions on servers deployed on their networks, thereby affecting the root servers and authoritative servers from providing external resolution services.

[0049] Step 2: Analyze the dependency path tree construction. The specific steps are as follows: The domain name resolution dependency can be broken down into two types of relationships: domain name region dependency and region-authoritative dependency. Domain names can be constructed into a multi-level regional parent-child dependency relationship based on the region they belong to. The region is provided with domain name resolution within the region by the authoritative server. Therefore, a resolution dependency relationship is established between the region and the authoritative server.

[0050] 1) Determine regional dependencies: According to the management role type in step one, the DNS domain name hierarchy system includes the root zone, top-level domains, and domain names at all levels under the top-level domains from top to bottom. By splitting the domain name into regional levels, the parent-child zone dependency relationship of the target domain name can be constructed. Although from the domain name level, the root zone is not the parent domain of the top-level domain, it also has a regional resolution dependency relationship. Therefore, for the sake of unified expression in this application, the relationship between the root zone and the top-level domain is also recorded as a parent-child zone relationship. Among them, the parent-child zone is a one-to-many relationship, that is, a parent zone contains multiple child zones, and the child zone belongs to only one parent zone. For example, if Figure 4 As shown in the figure, the target domain name "www.example.com" is split into regional hierarchies, from bottom to top, namely "www.example.com", "example.com.", "com." and ".", where the parent domain of "www.example.com" is "example.com.", the parent domain of "example.com." is "com", and the parent domain of "com" is ".".

[0051] 2) Regional authority dependency: The authoritative dependency relationship between a region and an authoritative server is divided into intra-domain authoritative dependency and extra-domain authoritative dependency according to the authoritative server domain name type. Intra-domain authoritative dependency means that the authoritative server domain name is within the region, while extra-domain authoritative dependency means that the authoritative server domain name is outside the region. Regional authoritative dependency is a many-to-many relationship, that is, a region can rely on multiple authoritative servers, and authoritative servers can provide resolution for multiple regions. Assuming that for the region "example.com", it has two authoritative servers, and the server domain names are "ns1.example.com" and "ns2.dns.net", then "ns1.example.com" is an intra-domain authoritative dependency, and "ns2.dns.net" is an extra-domain authoritative dependency.

[0052] Through the regional dependency and regional authority dependency, a complete domain name resolution dependency graph can be constructed, such as Figure 4 As shown. Figure 4 The zone "example.com" has an out-of-domain authoritative server "ns2.dns.net"; its parent zone "com" has an in-domain authoritative server "ns1.com"; the parent zone root of "com" corresponds to the in-domain authoritative server "a.dns.root". At this time, the resolution dependency path from top to bottom can be obtained as "a.dns.root"->"ns1.com"->"a.dns.root"->"ns1.net"->"dnsx.net".

[0053] Assume that the target domain name is d, and use DNRG(d) to represent the resolution dependency graph of d. Figure 4 It can be seen that the resolution dependency graph contains two types of entities and three types of relationships. The two types of entities are domain names / regions and authoritative servers, and the three types of relationships are regional parent-child relationships, intra-domain authoritative dependencies, and extra-domain authoritative dependencies. i Indicates that the set of zone entities contained in domain name d is represented as Zones(d), i and z j The parent-child relationship of the parent-child zone of the zone is expressed as ZoneRel(z i ,z j ), ZRLIST(d) represents the set of regional parent-child relationships contained in the resolution dependency relationship of the target domain name d. i Represents an authoritative server with a single address, S i Represents a group of authoritative servers with a common domain name, SLIST(d) represents the set of authoritative servers for managing the resolution dependency of the target domain name d, which does not include the authoritative servers for domain name resolution of out-of-domain authoritative servers. Such authoritative servers are recorded in the out-of-domain authoritative dependency. i,S j ) represents the area z i and the authoritative server S i The intra-domain authority dependency relationship, OAuRel(z i ,S j ) represents the area z i and the authoritative server S i ARLIST(d) and OARLIST(d) represent the domain and extra-domain authoritative dependency sets contained in the domain name d resolution dependency. Then we can use the region set as the traversal object and build the resolution path of the authoritative server from top to bottom, and get the following: Figure 5 The dependency path diagram shown.

[0054] It is understandable that when a zone name corresponds to multiple authoritative servers (which may include an authoritative server within the domain and an authoritative server outside the domain; or multiple authoritative servers within the domain, etc.), multiple resolution dependency paths can be constructed based on the domain name resolution dependency relationship of the same target domain name. These paths constitute a domain name resolution path set, so that when analyzing the domain name management risk, the management risk can be evaluated for each resolution path in the domain name resolution path set, and the risks of all paths can be combined to obtain the overall management risk assessment result of the domain name.

[0055] The domain name resolution dependency path set is represented by constructing a domain name resolution dependency path tree, and all resolution paths are obtained through a depth-first search of the tree. When the network system architecture remains unchanged, the subsequent risk assessment involving the same target domain name can be directly based on the previous domain name resolution dependency path tree, which makes the risk assessment more efficient. Figure 6 As shown, the dotted circle represents the vertex of the tree (or subtree), which is represented by a virtual node. Although the virtual node is represented as an independent node in the tree, it does not need to participate in the risk assessment of the resolution path and can be filtered during the assessment. Each non-virtual node contains three management information attributes. The first is the institutional attribute of the authoritative server resolution area. For the scenario where the non-virtual node is the root server, it is the root zone management agency, for the top-level domain, it is the registry, and for the secondary domain name, it is the registrar. The second attribute is the service operation attribute, and the third attribute is the network operator attribute. The leaf node of the tree is the end point of the domain name resolution path, so through the depth-first search algorithm, the nodes traversed each time a leaf node is reached constitute a resolution path. In Figure 6In the resolution path tree shown, the depth-first search traversal can obtain the first resolution path as (a.dns.root / 198.41.0.4, ns1.com / 192.5.6.30,a.dns.root / 198.41.0.4, ns1.net / 192.26.92.30, dns.net / 192.55.83.30).

[0056] Step 3: Perform risk assessment on the target domain name based on the resolution dependency path tree. The specific steps are as follows: (1) Based on the depth-first search of the domain name resolution dependency path tree, the domain name resolution dependency path set can be obtained. To calculate the domain name resolution management risk, the management risk of each domain name resolution path can be calculated first, using p(path i ) indicates the path path i The risk of a path is determined by the risk of the nodes on the path, so we need to first calculate the risk probability of the nodes on the path, using p(node i ) represents node i Since multiple paths share some nodes, the risk of each node in the parsed path tree can be calculated and cached, which can reduce the repeated calculation of nodes when calculating path risks. The management risk of a node is calculated based on the three management attributes of the node. First, weights are assigned to the risks of the three management attributes, w m 、w s 、w n The risk weights of the node organization, authoritative server operator and network operator are calculated by the hierarchical analysis method according to the importance of the three management attributes. w >w s >w n The risk probabilities of institution attributes, server operation attributes, and network operator attributes are represented as p m 、p s and p n When the country of the institution contained in the above-mentioned institution attribute is inconsistent with the country of the registrant of the domain name resource, the risk probability of the management attribute of the node is 1, otherwise it is 0. The risk probability of the node is calculated as shown in formula (1). Assume a path path iThe nodes are (node1, node2, …, noden), and the risk probability of the path is calculated as shown in formula (2). The risk probability of all paths is calculated and sorted from high to low by probability. The risk probability of the 80% path is taken to represent the overall management risk probability of the domain name. The 80% ratio mainly considers that as long as 20% of the paths in the resolution path are available, the domain name resolution can be ensured to be available. Therefore, the risk probability of the 80% path ensures that the risk probability of 20% of the paths is less than or equal to the risk probability. Of course, this is just a predefined threshold, which can be gradually adjusted in actual analysis and operation to find a path position that reasonably reflects the overall risk probability of the domain name.

[0057] Therefore, the analysis method for the risk on the domain name management side based on the domain name resolution dependency search tree of the embodiment of the present application can expand the dimension of the existing domain name risk analysis focusing on the risk on the resolution side, making the domain name risk analysis dimension more complete, and providing a new focus area for dealing with domain name risks. For example, in addition to the various attack risks faced by domain names during resolution, the risks caused by the dependence of domain names on other resources during registration and operation are also considered, especially the impact of foreign resources such as foreign registrars and foreign top-level domain registries on domain names. On the other hand, the analysis method based on the domain name dependency search tree proposed in the present application not only provides a simple and efficient dependency analysis method for the risk analysis of domain names, but also provides a simple and efficient domain name dependency expression and use for the analysis of the resolution process of other dimensions of domain names.

[0058] Reference Figure 7 As shown, an embodiment of the present application further provides an electronic device, including: One or more processors 701; The memory 702 stores one or more programs. When the one or more programs are executed by the one or more processors 701, the one or more processors 701 implement the method provided in any embodiment of the present application.

[0059] The memory 702, as a non-transient network system, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory 702 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory 702 may optionally include a memory 702 remotely arranged relative to the processor 701, and these remote memories 702 may be connected to the processor 701 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0060] The memory 702 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 702 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 702, and the processor 701 calls and executes the methods of the embodiments of this application.

[0061] The processor 701 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solution provided in the embodiment of the present application.

[0062] In some embodiments, the electronic device further comprises: Input / output interface, used to realize information input and output; Communication interface, used to realize communication interaction between this device and other devices. Communication can be realized through wired methods (such as USB, network cable, etc.) or wireless methods (such as mobile network, WIFI, Bluetooth, etc.); A bus that transmits information between various components of the device (e.g., processor 701, memory 702, input / output interfaces, and communication interfaces); The processor 701 , the memory 702 , the input / output interface and the communication interface can be connected to each other in communication within the device via a bus.

[0063] An embodiment of the present application further provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute a method provided in any embodiment of the present application.

[0064] An embodiment of the present application also provides a computer program product, including a computer program or computer instructions, which are stored in a computer-readable storage medium. A processor of an electronic device reads the computer program or computer instructions from the computer-readable storage medium, and the processor executes the computer program or computer instructions, so that the electronic device performs a method provided in any embodiment of the present application.

[0065] The system architecture and application scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of the system architecture and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are equally applicable to similar technical problems.

[0066] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0067] In hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or transient medium). As is well known to those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0068] The terms "component", "module", "system", etc. used in this specification are used to represent computer-related entities, hardware, firmware, a combination of hardware and software, software, or software in execution. For example, a component can be, but is not limited to, a process running on a processor, a processor, an object, an executable file, an execution thread, a program, or a computer. By way of illustration, both applications running on a computing device and a computing device can be components. One or more components may reside in a process or an execution thread, and a component may be located on a computer or distributed between two or more computers. In addition, these components may be executed from various computer-readable media having various data structures stored thereon. Components may communicate, for example, through a local or remote process based on a signal having one or more data packets (e.g., data from two components interacting with another component between a local system, a distributed system, or a network, such as the Internet interacting with other systems through signals). The above describes some embodiments of the present application with reference to the accompanying drawings, but does not limit the scope of the present invention. Any modification, equivalent substitution and improvement made by those skilled in the art without departing from the scope and essence of the present invention shall be within the scope of the present application.

Claims

1. A domain name risk assessment method, characterized in that: The domain name risk assessment method includes: Obtain the target domain name to be risk assessed; According to the target domain name, determining a resolution dependency path tree corresponding to the target domain name; Performing a depth-first search on the resolution dependency path tree to determine each resolution dependency path of the target domain name; Obtaining an attribute risk indicator of a node risk attribute of each node on the resolution dependency path tree; Calculate the path risk index of each parsing dependency path according to the parsing dependency path and each of the attribute risk indicators; A target risk index of the target domain name is determined according to each path risk index corresponding to the target domain name.

2. The domain name risk assessment method according to claim 1, characterized in that: The step of calculating the path risk index of each parsing dependency path according to the parsing dependency path and each of the attribute risk indexes includes: Determining a node risk index of each node of each of the resolution dependency paths according to the attribute risk index of the node risk attribute of each of the nodes; Determining the safety index of each of the nodes according to the node risk index; Performing a product operation based on the safety index of each node of the same resolution-dependent path to determine the path safety index of each resolution-dependent path; According to each of the path security indicators, a path risk indicator of each of the resolution-dependent paths is determined.

3. The domain name risk assessment method according to claim 2, characterized in that: The node risk attributes include organization attributes, server operation attributes, and network operator attributes. The node risk index of each node in each resolution dependency path is determined based on the attribute risk index of the node risk attribute of each node, including: Obtaining risk coefficients of the institution attributes, the server operation attributes, and the network operator attributes; A weighted calculation is performed based on each of the risk coefficients and each of the attribute risk indicators of the same node to respectively determine the node risk indicator of each node of each of the analytical dependency paths.

4. The domain name risk assessment method according to claim 3, characterized in that: The step of obtaining the risk coefficients of the organization attributes, the server operation attributes, and the network operator attributes includes: When the node risk index of the node to be calculated at the current moment is not found in the preset cache area, the risk coefficients of the institution attributes, the server operation attributes and the network operator attributes are obtained; wherein the cache area is used to cache the node risk index of the nodes that have completed the calculation on each of the resolution dependency paths; After performing weighted calculation according to each of the risk coefficients and each of the attribute risk indicators of the same node to respectively determine the node risk indicator of each node of each of the resolution dependency paths, the method further includes: A node risk indicator of the node is associated with the node and stored in the cache area.

5. The domain name risk assessment method according to claim 1, characterized in that: Determining a target risk index of the target domain name according to each path risk index corresponding to the target domain name includes: Sort the path risk indicators of the target domain name from high to low to obtain a path risk sequence; Get the path safety threshold ratio, Determining a target location according to the path security threshold ratio and the total number of paths of the target domain name resolution dependency; A path risk indicator corresponding to the target position is selected from the path risk sequence as a target risk indicator.

6. The domain name risk assessment method according to claim 1, characterized in that: The parsing dependency path tree is determined by the following steps: Performing regional hierarchical decomposition on the target domain name to obtain regions and regional dependencies of the target domain name; According to each of the regions and each of the preset authoritative servers, a regional authority dependency relationship is obtained; A resolution dependency path tree is constructed according to the regional dependency and regional authority dependency of the target domain name.

7. The domain name risk assessment method according to claim 6, characterized in that: The step of constructing a resolution dependency path tree according to the regional dependency relationship and the regional authority dependency relationship of the target domain name includes: According to the area dependency, traverse each area of ​​the target domain name level by level; Determine the target authoritative server for each traversed area according to the regional authoritative dependency relationship, wherein the target authoritative server is an authoritative server that does not participate in the construction of the resolution dependency path; When the traversal of each area of ​​the target domain name is completed, each target authoritative server obtained through the traversal is connected in sequence according to a preset hierarchical order to construct a resolution dependency path of the target domain name; When there is an authoritative server that does not participate in building the resolution dependency path in the regional dependency relationship, jump to the step of traversing each zone of the target domain name layer by layer according to the regional dependency relationship; When all authoritative servers in the regional dependency relationship participate in constructing the resolution dependency path, the resolution dependency path tree is obtained according to each constructed resolution dependency path.

8. A domain name risk assessment device, characterized in that: A first acquisition module is used to acquire a target domain name for risk assessment; A determination module, configured to determine, according to the target domain name, a resolution dependency path tree corresponding to the target domain name; A search module, used for performing a depth-first search on the resolution dependency path tree to determine each resolution dependency path of the target domain name; A second acquisition module is used to obtain an attribute risk index of a node risk attribute of each node on the resolution dependency path tree; A path risk index determination module, used to calculate the path risk index of each parsing dependency path according to the parsing dependency path and each attribute risk index; The target risk indicator module is used to determine the target risk indicator of the target domain name according to each path risk indicator corresponding to the target domain name.

9. An electronic device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the domain name risk assessment method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The method comprises storing computer executable instructions, wherein the computer executable instructions are used to be executed by a processor to implement the domain name risk assessment method according to any one of claims 1 to 7.

Images