Domain name detection method and device and electronic equipment
By obtaining DNS domain names in network traffic and querying their type, combining the judgment of domain name level and parsing address, the problem of inaccurate distinction between DNS domain name types in the existing technology is solved, and the accurate identification of whitelisted domain names and malicious domain names is achieved, which improves the accuracy and efficiency of network security.
Patent Information
- Application Number
- CN202411876387.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-19
- Publication Date
- 2025-03-18
AI Technical Summary
It is difficult to accurately distinguish whether the DNS domain name in network traffic is a whitelisted domain name or a malicious domain name, especially an unknown malicious domain name type.
By getting the DNS domain name in network traffic and querying its type in the preset database. If the domain name exists in the database, its type is output; if it does not exist, its type is determined based on the level of the domain name and the resolution address, including determining whether the first-level domain name is suspicious, whether the resolution address is a local loopback address, and whether the number of subdomains exceeds the set range.
It realizes more accurate identification of DNS domain name types, can identify unknown malicious domain name types, and improves the accuracy and efficiency of network security.
Smart Images
Figure CN119652636A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security technology, and in particular to a domain name detection method and device, and electronic equipment. Background Art
[0002] In actual network attack and defense, it is often necessary to determine whether various vulnerabilities really exist. In related technologies, network security vendors will use DNS domain names of known malicious domain types to match in traffic. The successfully matched domain names belong to the DNS domain names of malicious domain types, and the remaining domain names belong to the DNS domain names of whitelist domain types. However, network traffic contains not only DNS domain names of known malicious domain types, but also domain names in the domain name system built by attackers. Through the above method, only DNS domain names of known malicious domain types can be found, so the DNS domain name finally determined to be a malicious domain type or a whitelist domain type is not accurate enough.
[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention
[0004] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical components or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.
[0005] The embodiments of the present application provide a domain name detection method and device, and an electronic device to more accurately distinguish whether a DNS domain name belongs to a whitelist domain name or a malicious domain name.
[0006] An embodiment of the present application provides a domain name detection method, including: obtaining a DNS domain name in network traffic, and querying the DNS domain name in a preset first database; if the DNS domain name exists in the first database, outputting a domain name type corresponding to the DNS domain name recorded in the first database, the domain name type including a whitelist domain name or a malicious domain name; if the DNS domain name does not exist in the first database, determining whether the DNS domain name is suspicious according to the domain name level of the DNS domain name; if the DNS domain name is suspicious, determining the domain name type corresponding to the DNS domain name according to the resolution address of the DNS domain name; if the DNS domain name is not suspicious, outputting the domain name type corresponding to the DNS domain name as a whitelist domain name.
[0007] In the above implementation, it is possible to distinguish some DNS domain names as whitelist domain names or malicious domain names through domain name levels. For some suspicious domain names that cannot be determined to be whitelist domain names or malicious domain names, the domain name type of the DNS domain name is further distinguished as a whitelist domain name or a malicious domain name according to the resolution address of the DNS domain name. In this way, other unknown malicious domain name types of DNS domain names can be discovered, so that it is possible to more accurately distinguish whether the DNS domain name belongs to a whitelist domain name or a malicious domain name.
[0008] Furthermore, whether the DNS domain name is suspicious is determined according to the domain name level of the DNS domain name, including: if the DNS domain name is a first-level domain name, determining that the DNS domain name is not suspicious; if the DNS domain name is a second-level domain name or above, determining that the DNS domain name is suspicious.
[0009] In the above implementation, considering that malicious domain names are generated based on the first-level domain name, whether the DNS domain name is suspicious can be determined by the domain level of the DNS domain name, thereby excluding some non-suspicious DNS domain names to reduce the number of DNS domain names that need to be judged later.
[0010] Furthermore, the domain name type corresponding to the DNS domain name is determined according to the resolution address of the DNS domain name, including: when the resolution address is a local loopback address, determining that the domain name type corresponding to the DNS domain name is a malicious domain name; when the resolution address is an intranet address or an extranet address, obtaining the number of subdomain names corresponding to the first-level domain name of the DNS domain name in the first database; when the number of subdomain names is greater than the first set number of domain names, determining that the domain name type corresponding to the DNS domain name is a malicious domain name; when the number of subdomain names is less than or equal to the first set number of domain names, obtaining the second-level and above domain names corresponding to the DNS domain name as the domain names to be judged.
[0011] In the above implementation, considering that the local loopback address is mainly used for inter-process communication of the local computer, a legitimate website will not use the local loopback address as the main service provider address; the DNS domain name with malicious domain name type can be accurately distinguished through the resolution address of the DNS domain name. At the same time, considering that under normal circumstances, the number of businesses of a company is limited, so the number of its subdomains is also limited, and the DNS domain name with malicious domain name type can be accurately distinguished according to the number of subdomains.
[0012] Furthermore, after obtaining the second-level and above domain names corresponding to the DNS domain name as the domain names to be judged, it includes: using preset judgment rules to determine whether each of the domain names to be judged is normal, and accumulating the number of normal domain names; if the number of domain names is not equal to the preset number, determining that the domain name type corresponding to the DNS domain name is a malicious domain name; if the number of domain names is equal to the preset number, determining that the domain name type corresponding to the DNS domain name is a whitelist domain name; the preset number is the number of domain name levels corresponding to the DNS domain name minus one.
[0013] In the above implementation, it is considered that a malicious domain name may add the data to be transmitted in the character string at the highest level position, or use bypass means to add the data to be transmitted in the character string at a non-highest level position, and other positions are filled with normal characters or random characters. Therefore, by judging whether each domain name to be judged is normal, it is convenient to accurately distinguish whether the DNS domain name belongs to a whitelist domain name or a malicious domain name.
[0014] Further, the preset judgment rule is used to judge whether the domain name to be judged is normal, including: searching the domain name to be judged from a preset second database, and determining that the domain name to be judged is normal when the domain name to be judged is not found; determining that the domain name to be judged is abnormal when the domain name to be judged is found; the second database stores a preset system command execution result character string; and / or, dividing the domain name to be judged into a plurality of character strings to be tested by periods, searching the character strings to be tested from a preset third database, and determining that the domain name to be judged is normal when each character string to be tested is found; determining that the domain name to be judged is abnormal when the character string to be tested is not found; the third database stores the character strings that constitute the included domain names.
[0015] In the above implementation, by pre-recording the system command execution result character string in the second database, and / or pre-storing the character strings constituting the included domain names in the third database, by directly comparing the character strings to confirm whether there are abnormal character strings in the domain name to be judged, it is possible to easily and quickly determine whether the domain name to be judged is normal.
[0016] Further, a preset judgment rule is used to judge whether the domain name to be judged is normal, including: calculating the entropy value of the character string constituting the domain name to be judged, if the entropy value of the character string is greater than the set entropy value range, determining that the domain name to be judged is abnormal; if the entropy value of the character string is less than or equal to the set entropy value range, determining that the domain name to be judged is normal; and / or determining the word frequency corresponding to each character of the character string constituting the domain name to be judged; calculating the word frequency difference between each word frequency and the preset word frequency; if each word frequency difference is less than or equal to the preset difference, determining that the domain name to be judged is normal; if there is a word frequency difference greater than the preset difference, determining that the domain name to be judged is abnormal.
[0017] In the above implementation, the entropy value of the character string and / or the word frequency corresponding to each character can reflect the similarity between the character string constituting the domain name to be determined and the normal character string, so as to accurately determine whether the domain name to be determined is abnormal.
[0018] Furthermore, a preset judgment rule is used to judge whether the domain name to be judged is normal, including: determining whether the encoding method of the domain name to be judged is a preset encoding method; if the encoding method is the preset encoding method, determining that the domain name to be judged is normal; if the encoding method is not the preset encoding method, determining that the domain name to be judged is abnormal.
[0019] In the above implementation, considering that the attacker may encode the data before transmitting, by judging whether the encoding method of the domain name to be judged is the preset encoding method, the abnormal data transmitted after being encoded by the attacker can be determined, and whether the domain name to be judged is abnormal can be accurately judged.
[0020] Furthermore, the domain name detection method also includes: obtaining the first-level domain name corresponding to all DNS domain names in the first database every preset time period; counting the number of second-level and above domain names generated by each of the first-level domain names; if the number of the second-level and above domain names is greater than the second set number of domain names, changing the domain name type of the first-level domain name to a malicious domain name.
[0021] In the above implementation, by regularly searching for the number of second-level and above domain names generated by first-level domain names, potential malicious domain names can be effectively identified and processed, network security can be guaranteed, and a subsequent automated response mechanism can be supported.
[0022] An embodiment of the present application provides an electronic device, including a processor and a memory, wherein the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the above-mentioned domain name detection method.
[0023] The above general description and the following description are exemplary and explanatory only and are not intended to limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0024] One or more embodiments are exemplarily described by corresponding drawings, and these exemplary descriptions and drawings do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings are considered similar elements, and the drawings do not constitute a scale limitation, and wherein:
[0025] Figure 1 is a schematic diagram of a domain name detection method provided in an embodiment of the present application;
[0026] Figure 2 is a schematic diagram of another domain name detection method provided in an embodiment of the present application;
[0027] Figure 3 is a schematic diagram of a domain name detection device provided in an embodiment of the present application;
[0028] Figure 4 It is a schematic diagram of an electronic device provided in an embodiment of the present application.
[0029] Reference numerals:
[0030] 1: search module; 2: first domain name type determination module; 3: suspicious domain name determination module; 4: second domain name type determination module; 5: processor; 6: bus; 7: memory; 8: communication interface. DETAILED DESCRIPTION
[0031] In order to be able to understand the features and technical contents of the embodiments of the present application in more detail, the implementation of the embodiments of the present application is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present application. In the following technical description, for the convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.
[0032] The terms "first", "second", etc. in the specification and claims of the embodiments of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the embodiments of the present application described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.
[0033] Unless otherwise stated, the term "plurality" means two or more.
[0034] The term "correspondence" may refer to an association relationship or a binding relationship. The correspondence between A and B means that there is an association relationship or a binding relationship between A and B.
[0035] Embodiment 1
[0036] The present application provides a domain name detection method. Figure 1 As shown, Figure 1 The following is a flow chart of a domain name detection method provided in an embodiment of the present application, wherein the method comprises:
[0037] Step S101, obtaining a DNS domain name in network traffic, and querying the DNS domain name in a preset first database.
[0038] Exemplarily, DNS protocol traffic in network traffic may be extracted to obtain the DNS domain name.
[0039] Optionally, the acquired DNS domain name may be stored in a preset storage repository to facilitate subsequent determination of the domain name type of the DNS domain name.
[0040] Optionally, the response IP (Internet Protocol), points, levels, number of requests, etc. corresponding to the DNS domain name may also be stored in the preset repository. The points are the number of points (.) in the domain name, and the levels are the number of points (.) in the middle of the character string that constitutes the DNS domain name. The number of requests is the number of times the same DNS domain name is obtained in the network traffic, which can be obtained by accumulation.
[0041] Optionally, after determining the domain name type of the DNS domain name, the domain name type of the DNS domain name may also be stored.
[0042] For example, Table 1 is an example table of DNS domain name, response IP, points, level, number of requests, and domain name type in the preset repository. As shown in Table 1, the DNS domain name is "wdl1.file.cache.docer.com", its response IP is 117.25.159.181, the points are 4, the level is 4, the number of requests is 10, and the domain name type is a whitelist domain name.
[0043] Optionally, a preset storage repository storing historical DNS domain names can be used as the preset first database, that is, a preset storage repository storing no DNS domain names for which domain name types need to be determined can be used as the preset first database.
[0044]
[0045]
[0046] Table 1
[0047] Step S102, determine whether the DNS domain name exists in the first database; if the DNS domain name exists in the first database, execute step S103; if the DNS domain name does not exist in the first database, execute step S104.
[0048] Step S103: output the domain name type corresponding to the DNS domain name recorded in the first database.
[0049] In some embodiments, determining whether a DNS domain name exists in the first database may be: determining whether a first-level domain name corresponding to the DNS domain name exists in the first database; if the first-level domain name corresponding to the DNS domain name does not exist in the first database, determining that the DNS domain name does not exist in the first database; otherwise, determining that the DNS domain name exists in the first database.
[0050] Correspondingly, if the first-level domain name corresponding to the DNS domain name exists in the first database, the domain name type of the first-level domain name corresponding to the DNS domain name recorded in the first database is output; if the first-level domain name corresponding to the DNS domain name does not exist in the first database, the DNS domain name does not exist in the first database.
[0051] In other embodiments, determining whether a DNS domain name exists in the first database may be: determining whether a DNS domain name or a first-level domain name corresponding to the DNS domain name exists in the first database; if the DNS domain name and the first-level domain name corresponding to the DNS domain name do not exist in the first database, determining that the DNS domain name does not exist in the first database; otherwise, determining that the DNS domain name exists in the first database.
[0052] Correspondingly, if the first-level domain name corresponding to the DNS domain name exists in the first database, and the DNS domain name does not exist, the domain name type of the first-level domain name corresponding to the DNS domain name recorded in the first database is output; if the DNS domain name and the first-level domain name corresponding to the DNS domain name do not exist in the first database, the DNS domain name does not exist in the first database; otherwise, the domain name type corresponding to the DNS domain name recorded in the first database is output.
[0053] Step S104, determining whether the DNS domain name is suspicious according to the domain name level of the DNS domain name; if the DNS domain name is not suspicious, executing step S105; if the DNS domain name is suspicious, executing step S106.
[0054] In some embodiments, whether a DNS domain name is suspicious is determined based on the domain name level of the DNS domain name, including: if the DNS domain name is a first-level domain name, then the DNS domain name is determined to be not suspicious; if the DNS domain name is a second-level domain name or above, then the DNS domain name is determined to be suspicious.
[0055] For example, it is assumed that the DNS domain name is “aaaa.bbbb.cccc.com”, wherein the first-level domain name is cccc.com, the second-level domain name is bbbb.cccc.com, and the third-level domain name is aaaa.bbbb.cccc.com.
[0056] In this way, attackers usually apply for a random second-level domain name in a first-level domain name system, and then generate a third-level domain name for request based on the content returned by the attack. For example: Taking the dnslog.cn website as an example, apply for a random second-level domain name c4ikcd.dnslog.cn on the website, send malicious payload at the risk point of the attacked business, including requesting a random or third-level domain name with intranet information such as `whoami`.c4ikcd.dnslog.cn, and then check whether there is request data on the dnslog receiving platform. If there is such as root.c4ikcd.dnslog.cn, it means that the attacked business has a vulnerability point, so root.c4ikcd.dnslog.cn is a malicious domain name. Another example: apply for 58s9d8.xxx.cn, the attacker needs to transmit the intranet information, so there must be a request for {yyyy}.58s9d8.xxx.cn.
[0057] Step S105: The domain name type corresponding to the output DNS domain name is a whitelist domain name.
[0058] For example, assuming that the first-level DNS domain name "bing.com", the second-level DNS domain name "3knzdf.dnslog.cn", the third-level DNS domain name "root.3knzdf.dnslog.cn", the fourth-level DNS domain name "33716d1e1c.ipv6.1433.eu.org", and the fifth-level DNS domain name "root.33716d1e1c.ipv6.1433.eu.org" are obtained, and none of them are found in the first database, then the first-level DNS domain name "bing.com" is determined to be a whitelist domain name. The second-level DNS domain name "3knzdf.dnslog.cn", the third-level DNS domain name "root.3knzdf.dnslog.cn", the fourth-level DNS domain name "33716d1e1c.ipv6.1433.eu.org", and the fifth-level DNS domain name "root.33716d1e1c.ipv6.1433.eu.org" are all suspicious.
[0059] Step S106: determining the domain name type corresponding to the DNS domain name according to the resolution address of the DNS domain name.
[0060] In some embodiments, step S106 may include: when the resolved address is a local loopback address, determining that the domain name type corresponding to the DNS domain name is a malicious domain name; when the resolved address is an intranet address or an extranet address, obtaining the number of subdomain names corresponding to the first-level domain name of the DNS domain name in the first database; when the number of subdomain names is greater than the first set number of domain names, determining that the domain name type corresponding to the DNS domain name is a malicious domain name; when the number of subdomain names is less than or equal to the first set number of domain names, obtaining the second-level and above domain names corresponding to the DNS domain name as the domain names to be judged.
[0061] The number of first set domain names can be appropriately adjusted by engineers according to the company's business and office environment traffic conditions. The number of first set domain names is, for example, 1000.
[0062] The number of subdomains is the number of subdomains corresponding to the first-level domain of the DNS domain name after deduplication.
[0063] Exemplarily, a DNS domain name obtained from network traffic, such as "docs.qq.com", obtains all subdomains allocated to the first-level domain name "qq.com" of the DNS domain name "docs.qq.com" in the first database in the first database, and the statistical number after deduplication of all subdomains is the number of subdomains corresponding to the first-level domain name "qq.com". In this way, combined with Table 2, Table 2 is a statistical analysis table of DNS request data of a certain company over a period of time. Considering that the number of subdomains under a main domain name of most companies is limited, and each allocation of a malicious domain name will generate a new subdomain name, resulting in a large number of subdomains generated based on the main domain name. Therefore, some DNS domain names that may be malicious domain names can be screened out by the number of subdomain names.
[0064]
[0065]
[0066]
[0067] Table 2
[0068] In some embodiments, after obtaining the second-level and above domain names corresponding to the DNS domain name as the domain names to be judged, it includes: using preset judgment rules to determine whether each domain name to be judged is normal, and accumulating the number of normal domain names; if the number of domain names is not equal to the preset number, then determining that the domain name type corresponding to the DNS domain name is a malicious domain name; if the number of domain names is equal to the preset number, then determining that the domain name type corresponding to the DNS domain name is a whitelist domain name.
[0069] The preset number is the domain name level number corresponding to the DNS domain name minus one.
[0070] In the above embodiment, the preset judgment rule can be used to judge whether the domain name to be judged is normal in the following manner:
[0071] Method 1: Searching for the domain name to be determined from a preset second database, and determining that the domain name to be determined is normal if the domain name to be determined is not found; and determining that the domain name to be determined is abnormal if the domain name to be determined is found. The second database stores a preset system command execution result character string.
[0072] Exemplarily, the system command execution result string, for example: root@ti360:~#whoami;root. Engineers can store common system command execution result strings into the second database based on experience.
[0073] As another example, the system command and the system command execution result string corresponding to the system command can be stored in the second database. Table 3 is an example table of the relationship between the system command and the system command execution result string. As shown in Table 3, when the command is whoami, the system command execution result string is root.
[0074] System Commands System command execution result string whoami root uname Linux hostname mylinux
[0075] Table 3
[0076] Method 2: Split the domain name to be judged into several character strings to be tested by periods, search for the character strings to be tested from a preset third database, and determine that the domain name to be judged is normal when each character string to be tested is found; if there are character strings to be tested that are not found, determine that the domain name to be judged is abnormal; the third database stores the character strings that make up the included domain names.
[0077] For example, the domain names of existing websites can be counted, separated by periods, and the characters separated by periods are stored in the third database. For example, for www.baidu.com, www, baidu and com can be stored in the third database.
[0078] Method 3: Calculate the entropy value of the string that makes up the domain name to be judged. If the entropy value of the string is greater than the set entropy value range, the domain name to be judged is determined to be abnormal; if the entropy value of the string is less than or equal to the set entropy value range, the domain name to be judged is determined to be normal. In this way, by judging the entropy value of the string, it is possible to determine whether the string is randomly generated, which is conducive to screening malicious domain names.
[0079] In the above method 3: the entropy value of the string can be obtained by counting the number of times each character in the string appears in the string to obtain the frequency of each character; for each character: calculate the frequency of the character divided by the total number of letters in the string to obtain the probability distribution of the character; calculate Get the entropy value of the string. Where H is the entropy value of the string, p(x i ) is the character x i The probability distribution of n is the total number of characters that make up the string after duplication. b is the base of the logarithm, and the value of b can be 2, so that the unit of entropy value is bit.
[0080] Exemplarily, the entropy value of the string of the domain name to be determined can be calculated by the following code:
[0081] def calculate_entropy(s):
[0082] frequency={char:s.count(char) / len(s)for char in set(s)};This code is used to calculate the probability distribution of character occurrences;
[0083] entropy = -sum([freq*math.log(freq,2)for freq in frequency.values()iffreq>0]); return entropy. This code is used to calculate and return the entropy value of a string.
[0084] Exemplarily, the entropy range can be set with reference to the public entropy value, or the entropy value of the character string appearing in all business URLs in the machine learning sample network traffic can be used to determine the entropy range. Among them, the public entropy value is 4.03 for English letters and 9.65 for Chinese characters. In this way, usually if the URL (Uniform Resource Locator) only contains simple ASCII (American Standard Code for Information Interchange) characters, such as English letters and numbers, its entropy value will be relatively low. If the URL contains special characters, multilingual characters, or a long random string, the entropy value will be relatively high. If the entropy value of a corresponding character class is compared with the two categories of English letter entropy and Chinese character entropy, the entropy value is high, which means that the character clutter is high.
[0085] Method 4: Determine the word frequency corresponding to each character of the character string constituting the domain name to be judged; calculate the word frequency difference between each word frequency and the preset word frequency; if the word frequency difference is less than or equal to the preset difference, determine that the domain name to be judged is normal; if there is a word frequency difference greater than the preset difference, determine that the domain name to be judged is abnormal.
[0086] In the above method 4: the word frequency corresponding to each character can be obtained by the following method: count the number of times each character in the string appears in the string to obtain the frequency of each character; for each character: calculate the frequency of the character and divide it by the total number of letters in the string to obtain the word frequency of the character.
[0087] For example, the word frequency corresponding to each character can be calculated by the following code:
[0088] def get_word_freq(word):
[0089] letter_frequency=Counter(word); This code is used to use Counter to calculate the frequency of characters.
[0090] total_letters = sum(letter_frequency.values()); This code is used to calculate the total number of letters;
[0091] for letter,frequency in letter_frequency.items():
[0092] percentage=(frequency / total_letters)*100;
[0093] printf("The letter '{letter}' appears {frequency} times, with a percentage of {percentage:.2f}%"); This code is used to print the frequency and percentage of each letter.
[0094] For example, the following is a rough distribution of word frequencies of characters based on statistics of English text samples, E is about 12%, A is about 8%, R is about 7.5%, I is about 7%, O is about 7%, T is about 7%, N is about 6.5%, S is about 6%, L is about 4%, C is about 3%, U is about 3%, D is about 3%, P is about 2.5%, M is about 2.5%, W is about 2%, F is about 2%, G is about 2%, H is about 1.5%, Y is about 1.5%, B is about 1.5%, V is about 1%, K is about 0.75%, J is about 0.15%, X is about 0.15%, Q is about 0.1%, and Z is about 0.1%. The rough distribution of the above word frequencies can be used as the preset word frequencies. It is also possible to obtain the word frequency distribution as the preset word frequency by machine learning of all business URL characters in the sample network traffic. In this way, according to statistics, the letters in English words will have a word frequency distribution. By judging the word frequency of the characters, it is possible to judge whether the string is randomly generated, which is conducive to screening malicious domain names.
[0095] Method 5: Determine whether the encoding method of the domain name to be judged is the preset encoding method; if the encoding method is the preset encoding method, the domain name to be judged is normal; if the encoding method is not the preset encoding method, the domain name to be judged is abnormal. In this way, considering that the attacker needs to carry more data, there may be special characters in the data or in order to hide the real data, a string that can be used for transmission in the URL is obtained through some common encoding or symmetric encryption algorithms. Therefore, by determining whether the encoding method of the domain name to be judged is the preset encoding method, it is helpful to screen malicious domain names.
[0096] Exemplary, preset encoding methods, such as: Base64 decryption, binary to string, hexadecimal to string, Caesar cipher decryption, etc.
[0097] In one of the above-mentioned methods 5, a preset encoding method can be used to decode the domain name to be judged; if the decoding is successful, it is considered that the encoding method of the domain name to be judged is the preset encoding method; otherwise, it is considered that the encoding method of the domain name to be judged is not the preset encoding method.
[0098] Exemplarily, successful decoding may be returning an ASCII character string in the normal range.
[0099] For example, if the domain name to be determined is encoded by Base64, it can be decoded by Base64; otherwise, using Base64 decoding will result in an error or the decoded data is garbled. As shown in Table 4, normal encoding, for example: the character after Base64 encoding is "cm9vdA", and the character after Base64 decoding is "root". The manifestation of garbled characters, for example: its hexadecimal is not in the [20, 7E] interval, and the Chinese hexadecimal is not in the [4E00, 9FFF], [3400, 4DBF], [20000, 2A6DF], [2A700, 2B73F], [2B740, 2B81F], [2B820, 2CEAF], [2CEB0, 2EBEF] intervals, etc. Error reporting, for example: decoding "login" displays "Malformed UTF-8data".
[0100] Base64 Encoded Characters Base64 decoded characters 9vD root Ni44LjAtNDAtZ2VuZXJpYw 6.8.0-40-generic TxDV Linux
[0101] Table 4
[0102] In another method of the fifth method, the domain name to be determined may be input into a preset encoding method anomaly detection model to obtain whether the encoding method of the domain name to be determined is a preset encoding method.
[0103] Optionally, the encoding method anomaly detection model can be obtained by the following method: obtaining sample system command results, inputting the sample system command results with whether the encoding method is a preset encoding method label into a preset training model for training, and obtaining the encoding method anomaly detection model.
[0104] Among them, the preset training model, for example: a neural network model.
[0105] Optionally, in the absence of conflicts, one or more combinations of the above methods can be selected to determine whether each domain name to be determined is normal. For example, method 1, method 2, method 3, method 4, and method 5 can be used in sequence to determine whether the domain name to be determined is normal. If the results of determining the domain name to be determined by using method 1, method 2, method 3, method 4, and method 5 are all normal, then the domain name to be determined is considered normal.
[0106] In other embodiments, after obtaining the second-level and higher-level domain names corresponding to the DNS domain name as the domain name to be judged, it includes: obtaining the character strings that constitute the second-level and higher-level domain names, and using the deduplicated character strings as the character strings to be judged; using preset judgment rules to determine whether each character string to be judged is normal, and accumulating the number of normal character strings; if the number of characters is not equal to the preset number, determining that the domain name type corresponding to the DNS domain name is a malicious domain name; if the number of character strings is equal to the preset number, determining that the domain name type corresponding to the DNS domain name is a whitelist domain name.
[0107] In the above embodiment, the preset number is the total number of character strings to be determined, that is, each character string to be determined is normal, and the DNS domain name corresponding to the domain name to be determined is a whitelist domain name.
[0108] For example, assuming that the DNS domain name is "root.33716d1e1c.ipv6.1433.eu.org", "root", "33716d1e1c", "ipv6", and "1433" need to be judged respectively as the character strings to be judged. At this time, the preset number is 4. If any of the character strings to be judged is abnormal, the DNS domain name is a malicious domain name.
[0109] In the above embodiment, the method of judging whether each character string to be judged is normal is similar to the above method of judging whether the domain name to be judged is normal. Among them, the domain name to be judged in the above method 1, method 3, method 4 and method 5 can be replaced with the character string to be judged for judgment. For method 2, the step of segmentation by dot is reduced, and the character string to be judged is directly searched from the preset third database.
[0110] In other embodiments, step S106 may include: when the resolved address is a local loopback address, determining that the domain name type corresponding to the DNS domain name is a malicious domain name. When the resolved address is an intranet address or an extranet address, if the DNS domain name is a second-level or higher domain name, then obtaining the number of subdomains corresponding to the first-level domain name of the DNS domain name in the first database; when the number of subdomains is greater than the first set number of domain names, determining that the domain name type corresponding to the DNS domain name is a malicious domain name; when the number of subdomains is less than or equal to the first set number of domain names, obtaining the second-level and above domain names corresponding to the DNS domain name as the domain name to be determined. When the resolved address is an intranet address or an extranet address, if the DNS domain name is a second-level domain name, directly use the DNS domain name as the domain name to be determined.
[0111] In some embodiments, the domain name detection method further includes: obtaining the first-level domain names corresponding to all DNS domain names in the first database at a preset time interval; counting the number of second-level and above domain names generated by each first-level domain name; if the number of second-level and above domain names is greater than the second set number of domain names, then changing the domain name type of the first-level domain name to a malicious domain name. In this way, all DNS domain names in the first database are automatically judged at regular intervals, and the first database can be updated in a timely manner to ensure the accuracy of the first database.
[0112] See also Figure 2 As shown, another domain name detection method is provided in an embodiment of the present application, including:
[0113] Step S201, obtaining a DNS domain name in network traffic, and querying the DNS domain name in a preset first database.
[0114] Step S202, if the DNS domain name does not exist in the first database, determine whether the DNS domain name is suspicious according to the domain name level of the DNS domain name; if the DNS domain name is suspicious, execute step S203; if the DNS domain name is not suspicious, execute step S209.
[0115] Step S203, determining whether the resolution address of the suspicious DNS domain name is a local loopback address; if so, executing step S204; otherwise, executing step S205.
[0116] Step S204: determine that the domain name type corresponding to the DNS domain name is a malicious domain name.
[0117] Step S205: Obtain the number of subdomain names corresponding to the first-level domain name of the DNS domain name in the first database.
[0118] Step S206, determining whether the number of subdomains is greater than the first set number of domain names; if so, executing step S204; otherwise, executing step S207.
[0119] Step S207, obtaining the second-level and higher-level domain names corresponding to the DNS domain name as domain names to be judged, using preset judgment rules to determine whether each domain name to be judged is normal, and accumulating the number of normal domain names.
[0120] Step S208, determine whether the number of domain names is equal to the preset number; if so, execute step S209; otherwise, execute step S204.
[0121] Step S209: The domain name type corresponding to the output DNS domain name is a whitelist domain name.
[0122] For example, Table 5 shows partial DNS resolution statistics of a device in half a day. As shown in Table 5, the number of visits to the DNS domain name "nl-3.concert-geb.com" is 1186 times, and its domain name type is a whitelist domain name.
[0123]
[0124]
[0125] Table 5
[0126] For example, as shown in Table 6, Table 6 is a DNS domain name record example table. As shown in Table 6, the DNS domain name "root.c4ikcd.dnslog.cn" was created on July 17, 2024, and its IP address is 39.97.22.161.
[0127] DNS domain name record IP address Creation time root.c4ikcd.dnslog.cn 39.97.22.161 2024-07-17 c4ikcd.dnslog.cn 39.97.22.165 2024-07-17 c4ikcd.dnslog.cn 39.97.22.166 2024-07-17 c4ikcd.dnslog.cn 39.97.22.166 2024-07-17 c4ikcd.dnslog.cn 39.97.22.161 2024-07-17
[0128] Table 6
[0129] Embodiment 2
[0130] Based on the same inventive concept, the embodiment of the present application provides a domain name detection device, such as Figure 3As shown, the domain name detection device includes: a search module 1, a first domain name type determination module 2, a suspicious domain name determination module 3 and a second domain name type determination module 4. Among them, the search module 1 is used to obtain the DNS domain name in the network traffic and query the DNS domain name in the preset first database; the first domain name type determination module 2 is used to output the domain name type corresponding to the DNS domain name recorded in the first database if the DNS domain name exists in the first database, and the domain name type includes a whitelist domain name or a malicious domain name; the suspicious domain name determination module 3 is used to determine whether the DNS domain name is suspicious according to the domain name level of the DNS domain name if the DNS domain name does not exist in the first database; the second domain name type determination module 4 is used to determine the domain name type corresponding to the DNS domain name according to the resolution address of the DNS domain name if the DNS domain name is suspicious; if the DNS domain name is not suspicious, the domain name type corresponding to the DNS domain name is output as a whitelist domain name.
[0131] In some embodiments, the suspicious domain name determination module 3 is used to determine whether the DNS domain name is suspicious according to the domain name level of the DNS domain name in the following manner: if the DNS domain name is a first-level domain name, the DNS domain name is determined to be not suspicious; if the DNS domain name is a second-level or above domain name, the DNS domain name is determined to be suspicious.
[0132] In some embodiments, the second domain name type determination module 4 is used to determine the domain name type corresponding to the DNS domain name according to the resolution address of the DNS domain name in the following manner: when the resolution address is a local loopback address, determine that the domain name type corresponding to the DNS domain name is a malicious domain name; when the resolution address is an intranet address or an extranet address, obtain the number of subdomain names corresponding to the first-level domain name of the DNS domain name in the first database; when the number of subdomain names is greater than the first set number of domain names, determine that the domain name type corresponding to the DNS domain name is a malicious domain name; when the number of subdomain names is less than or equal to the first set number of domain names, obtain the second-level and above domain names corresponding to the DNS domain name as the domain names to be judged.
[0133] In some embodiments, the domain name detection device also includes: a third domain name type determination module, which is used to obtain the second-level and above domain names corresponding to the DNS domain name as the domain name to be judged, and then use the preset judgment rules to determine whether each domain name to be judged is normal, and accumulate the number of normal domain names; if the number of domain names is not equal to the preset number, the domain name type corresponding to the DNS domain name is determined to be a malicious domain name; if the number of domain names is equal to the preset number, the domain name type corresponding to the DNS domain name is determined to be a whitelist domain name; the preset number is the number of domain name levels corresponding to the DNS domain name minus one.
[0134] In some embodiments, the third domain name type determination module is used to determine whether the domain name to be judged is normal using a preset judgment rule in the following manner: searching the domain name to be judged from a preset second database, and determining that the domain name to be judged is normal when the domain name to be judged is not found; determining that the domain name to be judged is abnormal when the domain name to be judged is found; the second database stores a preset system command execution result string; and / or, dividing the domain name to be judged into several character strings to be tested with periods, searching for the character strings to be tested from a preset third database, and determining that the domain name to be judged is normal when each character string to be tested is found; determining that the domain name to be judged is abnormal when there is a character string to be tested that is not found; the third database stores the character strings that constitute the included domain names.
[0135] In some embodiments, the third domain name type determination module is used to determine whether the domain name to be judged is normal using a preset judgment rule in the following manner: calculating the entropy value of the character string constituting the domain name to be judged, if the entropy value of the character string is greater than the set entropy value range, determining that the domain name to be judged is abnormal; if the entropy value of the character string is less than or equal to the set entropy value range, determining that the domain name to be judged is normal; and / or, determining the word frequency corresponding to each character of the character string constituting the domain name to be judged; calculating the word frequency difference between each word frequency and the preset word frequency; if each word frequency difference is less than or equal to the preset difference, determining that the domain name to be judged is normal; if there is a word frequency difference greater than the preset difference, determining that the domain name to be judged is abnormal.
[0136] In some embodiments, the third domain name type determination module is used to determine whether the domain name to be judged is normal using a preset judgment rule in the following manner: determine whether the encoding method of the domain name to be judged is a preset encoding method; if the encoding method is the preset encoding method, determine that the domain name to be judged is normal; if the encoding method is not the preset encoding method, determine that the domain name to be judged is abnormal.
[0137] In some embodiments, the domain name detection device also includes: a correction module, which is used to obtain the first-level domain name corresponding to all DNS domain names in the first database every preset time period; count the number of second-level and above domain names generated by each first-level domain name; if the number of second-level and above domain names is greater than the second set number of domain names, the domain name type of the first-level domain name is changed to a malicious domain name.
[0138] It can be understood that the various embodiments described in the first embodiment are also applicable to the second embodiment if there is no conflict. Based on the consideration of brevity of description, they will not be repeated here.
[0139] Embodiment 3
[0140] Combination Figure 4As shown, an embodiment of the present application provides an electronic device, including a processor 5 and a memory 7. Optionally, the device may also include a communication interface 8 and a bus 6. The processor 5, the communication interface 8, and the memory 7 may communicate with each other through the bus 6. The communication interface 8 may be used for information transmission. The processor 5 may call the logic instructions in the memory 7 to execute the domain name detection method of the above embodiment.
[0141] In addition, the logic instructions in the above-mentioned memory 7 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.
[0142] The memory 7 is a computer-readable storage medium that can be used to store software programs and computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present application. The processor 5 executes the functional application and data processing by running the program instructions / modules stored in the memory 7, that is, implementing the domain name detection method in the above embodiment.
[0143] The memory 7 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 7 may include a high-speed random access memory and may also include a non-volatile memory.
[0144] The electronic device may be a computer or a server, etc.
[0145] Exemplarily, the domain name detection method can be applied to security protection software, and the security protection software can be integrated into the electronic device. The security protection software, for example, network firewall, terminal security software, etc.
[0146] An embodiment of the present application provides a storage medium storing computer executable instructions, wherein the computer executable instructions are configured to execute the above domain name detection method.
[0147] An embodiment of the present application provides a computer program product, which includes a computer program stored on a storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the above-mentioned domain name detection method.
[0148] The computer-readable storage medium mentioned above may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.
[0149] The technical solution of the embodiment of the present application can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in the embodiment of the present application. The aforementioned storage medium can be a non-transient storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., which can store program codes, or a transient storage medium.
[0150] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.
[0151] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. At the same time, the above embodiments can be combined with each other to form new embodiments without conflict.
Claims
1. A domain name detection method, characterized in that: include: Obtaining a DNS domain name in network traffic, and querying the DNS domain name in a preset first database; If the DNS domain name exists in the first database, output the domain name type corresponding to the DNS domain name recorded in the first database, where the domain name type includes a whitelist domain name or a malicious domain name; If the DNS domain name does not exist in the first database, determining whether the DNS domain name is suspicious according to the domain name level of the DNS domain name; If the DNS domain name is suspicious, determining the domain name type corresponding to the DNS domain name according to the resolution address of the DNS domain name; If the DNS domain name is not suspicious, the domain name type corresponding to the DNS domain name is output as a whitelist domain name.
2. The method according to claim 1, characterized in that Determining whether the DNS domain name is suspicious according to the domain name level of the DNS domain name includes: If the DNS domain name is a first-level domain name, it is determined that the DNS domain name is not suspicious; If the DNS domain name is a second-level domain name or above, it is determined that the DNS domain name is suspicious.
3. The method according to claim 1, characterized in that Determining the domain name type corresponding to the DNS domain name according to the resolution address of the DNS domain name includes: In a case where the resolved address is a local loopback address, determining that the domain name type corresponding to the DNS domain name is a malicious domain name; When the resolved address is an intranet address or an extranet address, obtaining the number of subdomain names corresponding to the first-level domain name of the DNS domain name in the first database; When the number of the subdomain names is greater than the first set number of domain names, determining that the domain name type corresponding to the DNS domain name is a malicious domain name; When the number of the subdomain names is less than or equal to the first set number of domain names, the second-level and higher-level domain names corresponding to the DNS domain name are obtained as domain names to be determined.
4. The method according to claim 3, characterized in that: After obtaining the second-level and higher-level domain names corresponding to the DNS domain name as the domain name to be determined, it includes: Using the preset judgment rules, determine whether each domain name to be judged is normal, and accumulate the number of normal domain names; If the number of domain names is not equal to the preset number, the domain name type corresponding to the DNS domain name is determined to be a malicious domain name; if the number of domain names is equal to the preset number, the domain name type corresponding to the DNS domain name is determined to be a whitelist domain name; the preset number is the domain name level number corresponding to the DNS domain name minus one.
5. The method according to claim 4, characterized in that Using the preset judgment rules to judge whether the domain name to be judged is normal includes: searching the domain name to be determined from a preset second database, and determining that the domain name to be determined is normal if the domain name to be determined is not found; and determining that the domain name to be determined is abnormal if the domain name to be determined is found; the second database stores a preset system command execution result character string; and / or, The domain name to be determined is divided into a number of character strings to be determined by periods, and the character strings to be determined are searched from a preset third database. When each of the character strings to be determined is found, the domain name to be determined is normal; when there are character strings to be determined that are not found, the domain name to be determined is abnormal; the third database stores the character strings that constitute the included domain names.
6. The method according to claim 4, characterized in that Using the preset judgment rules to judge whether the domain name to be judged is normal includes: Calculate the entropy value of the character string constituting the domain name to be determined, and if the entropy value of the character string is greater than a set entropy value range, determine that the domain name to be determined is abnormal; if the entropy value of the character string is less than or equal to the set entropy value range, determine that the domain name to be determined is normal; and / or, Determine the word frequency corresponding to each character of the character string constituting the domain name to be judged; calculate the word frequency difference between each word frequency and a preset word frequency; if each word frequency difference is less than or equal to the preset difference, determine that the domain name to be judged is normal; if there is a word frequency difference greater than the preset difference, determine that the domain name to be judged is abnormal.
7. The method according to claim 4, characterized in that Using the preset judgment rules to judge whether the domain name to be judged is normal includes: Determine whether the encoding method of the domain name to be determined is a preset encoding method; if the encoding method is the preset encoding method, determine that the domain name to be determined is normal; if the encoding method is not the preset encoding method, determine that the domain name to be determined is abnormal.
8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: Obtaining the first-level domain names corresponding to all DNS domain names in the first database at every preset time period; Counting the number of second-level and above domain names generated by each of the first-level domain names; If the number of the second-level and above domain names is greater than the second set number of domain names, the domain name type of the first-level domain name is changed to a malicious domain name.
9. A domain name detection device, characterized in that: include: A search module, used to obtain a DNS domain name in network traffic and query the DNS domain name in a preset first database; A first domain name type determination module, configured to output a domain name type corresponding to the DNS domain name recorded in the first database if the DNS domain name exists in the first database, the domain name type including a whitelist domain name or a malicious domain name; a suspicious domain name determination module, configured to determine whether the DNS domain name is suspicious according to the domain name level of the DNS domain name if the DNS domain name does not exist in the first database; The second domain name type determination module is used to determine the domain name type corresponding to the DNS domain name according to the resolution address of the DNS domain name if the DNS domain name is suspicious; if the DNS domain name is not suspicious, output the domain name type corresponding to the DNS domain name as a whitelist domain name.
10. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the domain name detection method according to any one of claims 1 to 8.