Message processing method and device, network equipment, medium and program product

Abstract

The invention discloses a message processing method and device, network equipment, a medium and a program product. The method comprises the following steps: receiving a DNS request message from a user terminal; domain name information of the DNS request message is determined, and target domain name features contained in the domain name information and contained in the domain name feature list are determined; and executing an access control operation corresponding to the target domain name feature on the DNS request message, generating an alarm record, and sending the alarm record to an access control device. When the DNS request message of the user terminal is monitored, the target domain name feature contained in the domain name information in the DNS request message and contained in the domain name feature list are determined, and an alarm is sent to the access control device in time, so that an administrator can quickly trace the source of a user, and meanwhile, the access control operation corresponding to the target domain name feature is executed on the DNS request message, and the user experience is improved. Therefore, domain name management and control are carried out in the DNS request stage, DNS request flow even response message flow cannot continue to be transmitted downwards in network networking, and timeliness of domain name management and control is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a message processing method, device, network equipment, medium and program product. Background Art

[0002] When a firewall (FW) performs domain name access control, it generally adopts a strategy based on the IP (Internet Protocol) address, that is, by using DNS snooping (domain name detection) to listen to the response message of the DNS request, extracting the IP result corresponding to the domain name in the message, reporting the IP result to the domain name address object group, and then providing the domain name address object group for security policies to intercept the use of the IP result. This process is equivalent to intercepting the domain name using the IP address corresponding to the domain name in the subsequent stage of the DNS request, resulting in untimely domain name interception. Summary of the invention

[0003] The purpose of the present application is to propose a message processing method, device, network equipment, medium and program product to address the deficiencies of the above-mentioned prior art, and this purpose is achieved through the following technical solutions.

[0004] The first aspect of the present application provides a message processing method, the method comprising:

[0005] Receiving a DNS request message from a user terminal;

[0006] Determine the domain name information of the DNS request message, and determine the target domain name feature contained in the domain name information and in the domain name feature list;

[0007] An access control operation corresponding to the target domain name feature is performed on the DNS request message, and an alarm record is generated and sent to the access control device.

[0008] A second aspect of the present application provides a message processing device, the device comprising:

[0009] A receiving module, used to receive a DNS request message from a user terminal;

[0010] A determination module, used to determine the domain name information of the DNS request message, and determine the target domain name feature contained in the domain name information and in the domain name feature list;

[0011] The processing module is used to perform the access control operation corresponding to the target domain name feature on the DNS request message, generate an alarm record and send it to the access control device.

[0012] A third aspect of the present application proposes a network device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in the first aspect above.

[0013] A fourth aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the program is executed by a processor to implement the method described in the first aspect above.

[0014] An embodiment of the fifth aspect of the present application provides a computer program product, including a computer program, wherein the computer program is executed by a processor to implement the method described in the first aspect above.

[0015] Based on the message processing method described in the first aspect above, the present application has at least the following beneficial effects or advantages:

[0016] When the DNS request message of the user terminal is monitored, the target domain name features contained in the domain name information in the DNS request message and in the domain name feature list are determined, and an alarm is promptly sent to the access control device to facilitate the administrator to quickly trace the user. At the same time, the access control operation corresponding to the target domain name features is performed on the DNS request message, thereby realizing domain name control in the DNS request stage, so that the DNS request traffic and even the response message traffic will not continue to be transmitted downward in the network networking, thereby improving the timeliness of domain name control.

[0017] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 The present invention is a flow chart of an embodiment of a message processing method according to an exemplary embodiment;

[0020] Figure 2 A schematic diagram of a snort rule import interface according to an exemplary embodiment is shown;

[0021] Figure 3 This is a schematic diagram of a domain name feature viewing interface according to an exemplary embodiment;

[0022] Figure 4A schematic diagram of an alarm record email according to an exemplary embodiment is shown;

[0023] Figure 5 It is a structural schematic diagram of a message processing device according to an exemplary embodiment;

[0024] Figure 6 The figure is a schematic diagram of the hardware structure of a network device according to an exemplary embodiment;

[0025] Figure 7 The figure is a schematic diagram of the structure of a storage medium according to an exemplary embodiment. DETAILED DESCRIPTION

[0026] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of systems and methods consistent with some aspects of the present application as detailed in the appended claims.

[0027] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0028] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0029] In addition, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0030] Currently, the domain name security function provided by DNS snooping is based on the IP address strategy. Its management process is cumbersome, and the management process does not intercept in the DNS request stage, but intercepts the IP address corresponding to the domain name in the subsequent stage, and the domain name interception is not timely.

[0031] To solve the above technical problems, the present application proposes a message processing method. When a DNS request message from a user terminal is received, an alarm is promptly sent to an access control device by determining the target domain name features contained in the domain name information in the DNS request message and in the domain name feature list, so that the administrator can quickly trace the user. At the same time, the access control operation corresponding to the target domain name features is performed on the DNS request message, thereby realizing domain name control in the DNS request stage. In this way, the DNS request traffic and even the response message traffic will not continue to be transmitted downward in the network networking, thereby improving the timeliness of domain name control.

[0032] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The several specific embodiments listed can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0033] Figure 1 This is a flow chart of an embodiment of a message processing method according to an exemplary embodiment. The message processing method can be applied to a network device. The network device can be understood as an intermediate device that a DNS request message needs to pass through before being transmitted to a DNS server for domain name resolution. That is, the network device is an intermediate device located between a client and a server. Taking a firewall as an example, a firewall is usually a core network device that controls the ingress and egress of a large amount of network traffic. Therefore, it is beneficial to implement domain name access control on a large amount of network traffic on a firewall.

[0034] like Figure 1 As shown, the following steps 101 to 103 are included:

[0035] Step 101: receiving a DNS request message from a user terminal;

[0036] Step 102: Determine the domain name information of the DNS request message, and determine the target domain name feature contained in the domain name information and in the domain name feature list;

[0037] Step 103: Perform access control operations corresponding to the target domain name characteristics on the DNS request message, generate an alarm record and send it to the access control device.

[0038] The user terminal can be understood as the initiator of the DNS request message. The user terminal can be a browser, an APP (Application), or a web application such as an H5 (Hyper Text Markup Language 5) application, or a light application (also known as a mini-program, a lightweight application) or a cloud application, etc.

[0039] The DNS request message can be understood as a domain name access message. The DNS request message uses the DNS protocol. Through the DNS request message, the user terminal can request the DNS server to resolve the domain name and return the corresponding IP address. Therefore, the destination address in the DNS request message is usually the address of the DNS server. In this embodiment, since domain name access control is performed on the intermediate network device, the domain name access control of the DNS request message occurs before the DNS server resolves the domain name.

[0040] The domain name information can be understood as the website address that the user terminal wants to access. It can be regarded as a string-form address used to identify and locate computers, services, or resources on the Internet. The domain name information usually consists of multiple labels, separated by "." between the labels. For example, www.example.com.

[0041] The domain name feature list can be understood as a list of domain names for which alarms need to be generated预先设置的需要产生告警的域名清单,其包含有不同的域名特征,每个域名特征可以看作是完整域名中包含的关键字段,因此每个域名特征可以认为是一个模糊域名。

[0042] Exemplarily, assume that the user wants to perform access control on "www.example.com". Then the "example" field can be used as a domain name feature.

[0043] It should be explained that since the domain name features in the domain name feature list are fuzzy domain names and the domain name information in the DNS request message is a complete domain name, in the domain name feature list, it is possible that the domain name information contains one or more domain name features, or there is no domain name feature contained in the domain name information.

[0044] Exemplarily, assume that the domain name features included in the domain name feature list are "abcd", "bog", etc. If the domain name information is: www.abcdbog.com, then the extracted target domain name features are 2: "abcd" and "bog". If the domain name information is: www.abcd吧.com, then the extracted target domain name feature is 1: "abcd".

[0045] It should be noted that there seems to be an incorrect expression in the original text of . I have translated it as best as possible according to the context, but it may need to be adjusted according to the correct content.It should be noted here that by using domain name features to control domain name access, the problem of domain name control omissions can be avoided.

[0046] The specific method for determining the target domain name feature contained in the domain name information and in the domain name feature list is: extracting the target domain name feature contained in the domain name information, and determining whether the target domain name feature is in the domain name feature list, or using each domain name feature in the domain name feature list to match the domain name information, and using the matched domain name feature as the target domain name feature.

[0047] Access control operations can be understood as instructions for processing DNS request messages set by domain name characteristics.

[0048] The access control device can be understood as the controller of network traffic. All alarm records generated on the network device will be sent to the access control device. The data representation of the access control device can be an email address, SMS address, etc.

[0049] The alarm record can be understood as an alarm message generated when a user accesses a domain name with a domain name feature in the domain name feature list. The alarm record may include relevant information of the DNS request message and relevant information of the target domain name feature.

[0050] It should be noted that if the target domain name feature does not exist after executing step 102, the DNS request message is processed according to the existing process.

[0051] At this point, the above Figure 1 The message processing flow shown in the figure, when the DNS request message of the user terminal is monitored, by determining the target domain name features contained in the domain name information in the DNS request message and in the domain name feature list, an alarm is promptly sent to the access control device, so that the administrator can quickly trace the user, and at the same time, the access control operation corresponding to the target domain name feature is performed on the DNS request message, thereby realizing domain name control in the DNS request stage, so that the DNS request traffic and even the response message traffic will not continue to be transmitted downward in the network networking, thereby improving the timeliness of domain name control.

[0052] In an optional embodiment of the present application, the above step 103 performs an access control operation corresponding to the target domain name feature on the DNS request message, which may include:

[0053] When the number of target domain name features is one, the DNS request message is processed according to the access control operation corresponding to this one target domain name feature. When the number of target domain name features is multiple, the DNS request message is processed based on the priority of each access control operation corresponding to the target domain name feature.

[0054] In the domain name feature list, you can set corresponding access control operations for each domain name feature according to actual needs.

[0055] Optionally, access control operations may include blacklisting, interception, redirection, and release, etc. Blacklisting means adding the user terminal information of the user terminal that initiates the DNS request message to a blacklist, and any subsequent network traffic from the user terminal information will be intercepted; interception means rejecting the DNS request message; redirection means redirecting the DNS request message to a specified website; and release means allowing the DNS request message to continue to be transmitted downward.

[0056] Different access control operations represent different processing levels for DNS request messages, and the priority of access control operations can be assigned according to the message processing level they represent. It can be seen that the message processing levels represented by the access control operations of adding to the blacklist, intercepting, redirecting, and releasing gradually decrease, so the priorities assigned to these access control operations can also be reduced in turn.

[0057] In this embodiment, when the number of target domain name features is one, the DNS request message can be directly processed using the access control operation corresponding to the target domain name feature. When there are multiple target domain name features, since the access control operations corresponding to different target domain name features may also be different, it is necessary to process the DNS request message in combination with the priority of each access control operation corresponding to the target domain name feature, so that the domain name control meets user expectations and achieves a better domain name control effect.

[0058] In an optional embodiment of the present application, the process of processing the DNS request message according to the priority of each access control operation corresponding to the target domain name feature may include:

[0059] The DNS request message is processed according to the highest priority access control operation among the access control operations corresponding to the target domain name characteristics.

[0060] In this embodiment, by using the highest priority access control operation to process the DNS request message, the DNS request message is processed with the highest processing level, thereby achieving effective control of the domain name.

[0061] It should be noted that in addition to the above-mentioned use of the highest priority access control operation corresponding to the target domain name characteristics to process the DNS request message, the lowest priority access control operation can be used according to actual needs, or the access control operation corresponding to any target domain name characteristic can be used to process the DNS request message.

[0062] Further, based on the above embodiment, the message processing method may also include the following process of configuring the domain name feature list:

[0063] The snort rules are obtained by converting a custom domain name file using a preset script, thereby generating a domain name feature list according to the snort rules.

[0064] In this configuration process, snort rules are the basis of IPS (Intrusion Prevention System) for detecting and preventing network attacks. They can be seen as a set of instructions for triggering alarms or taking actions based on specific network traffic characteristics. Therefore, by converting the domain names in the custom domain name file into snort rules and importing them into network devices, network devices can automatically load and identify snort rules to obtain a domain name feature list, which can simplify the configuration process of domain name features.

[0065] In a specific implementation, the domain name features are put into a file (such as a txt format file), each domain name feature occupies one line, and then a preset script is run in the folder to generate a snort rule file in the folder, such as Figure 2 The snort rule import interface shown in the figure can import snort rules into the device by selecting the path where the snort rule file is located and then clicking "Import Signatures".

[0066] After executing the snort rule import, you can view the imported domain name characteristics, such as Figure 3 In the domain name feature viewing interface shown, the access control operation corresponding to each domain name feature is the default access control operation in the snort rule. By selecting one of the domain name features, you can modify the access control operation for the selected domain name feature in the option box of setting the action, and set whether the selected domain name feature is effective in the option box of the status.

[0067] It should be noted that the domain name feature configuration process given above is only an exemplary implementation method and does not constitute a limitation on the protection scope of this application.

[0068] In an optional embodiment of the present application, the above step 103 generates an alarm record and sends it to the access control device, which may include:

[0069] The user terminal information is extracted from the DNS request message, an alarm record containing the user terminal information and the target domain name characteristics is generated, and the alarm record is sent to the access control device.

[0070] The user terminal information represents the user who uses the service and is used to uniquely identify a user. In addition to the user terminal information and domain name characteristics, the generated alarm record may also include relevant information about the DNS request message and relevant information about the domain name characteristics.

[0071] Exemplarily, the alarm record may be sent in the form of an email or a text message, and this application does not make any specific limitation on this.

[0072] like Figure 4 In the alarm record email shown, users can see the source IP address and source port, destination IP address and destination port, message protocol, and domain name of the DNS request message.

[0073] Above Figure 4 The content of the alarm record shown is only an example display, and this application does not limit it. Other relevant information can be added according to actual needs.

[0074] In this embodiment, by carrying user terminal information and domain name features in the alarm record, it is helpful for the access control device to quickly understand the users who access the risky domain name and the hit domain name.

[0075] In an optional embodiment of the present application, as described above, the alarm record includes user terminal information and accessed domain name features, and the message processing method may further include:

[0076] At preset time intervals, the number of times the same user terminal accesses the domain name containing the same domain name characteristics in the sent alarm records is counted. If the number of accesses exceeds the preset number, a serious alarm record containing the user terminal information of the same user terminal, the same domain name characteristics and the number of accesses is generated, and the serious alarm record is sent to the access control device.

[0077] In this embodiment, statistical analysis is performed on the sent alarm records to screen out users who have visited the same risky domain name multiple times, and the access control device is notified, which helps the access control device automatically discover users who frequently visit dangerous domain names and facilitates control.

[0078] Corresponding to the above-mentioned embodiment of the message processing method, the present application also provides an embodiment of the message processing device.

[0079] Figure 5 FIG. 1 is a schematic diagram of the structure of a message processing device according to an exemplary embodiment. The device is used to execute the message processing method provided in any of the above embodiments, such as Figure 5 As shown, the message processing device includes:

[0080] The receiving module 510 is used to receive a DNS request message from a user terminal;

[0081] A determination module 520, configured to determine the domain name information of the DNS request message, and determine a target domain name feature included in the domain name information and in the domain name feature list;

[0082] The processing module 530 is used to perform the access control operation corresponding to the target domain name feature on the DNS request message, generate an alarm record and send it to the access control device.

[0083] In an optional implementation, the processing module 530 is specifically used to process the DNS request message according to the access control operation corresponding to the target domain name feature when the number of the target domain name features is 1; and to process the DNS request message based on the priority of each access control operation corresponding to the target domain name feature when the number of the target domain name features is multiple.

[0084] In an optional implementation, the processing module 530 is specifically used to process the DNS request message according to the access control operation with the highest priority among the access control operations corresponding to the target domain name characteristics, during the process of processing the DNS request message based on the priorities of the various access control operations corresponding to the target domain name characteristics.

[0085] In an optional implementation, the access control operation includes at least one of the following: adding to a blacklist, intercepting, redirecting, and releasing.

[0086] In an optional implementation, the processing module 530 is specifically used to extract user terminal information from the DNS request message; generate an alarm record including the user terminal information and the target domain name characteristics; and send the alarm record to the access control device.

[0087] In an optional implementation, the device further includes ( Figure 5 Not shown):

[0088] The configuration module is used to obtain snort rules before the determination module 520, wherein the snort rules are obtained by performing conversion operations on a custom domain name file by a preset script; and generate a domain name feature list according to the snort rules.

[0089] In an optional implementation, the alarm record includes user terminal information and accessed domain name features, and the device further includes ( Figure 5 Not shown):

[0090] The statistical analysis module is used to count the number of visits of the same user terminal to the domain name containing the same domain name characteristics in the sent alarm records at preset time intervals; when the number of visits exceeds the preset number, generate a serious alarm record containing the user terminal information of the same user terminal, the same domain name characteristics and the number of visits; and send the serious alarm record to the access control device.

[0091] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0092] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0093] The embodiment of the present application also provides a network device corresponding to the message processing method provided in the above embodiment to execute the above message processing method.

[0094] Figure 6 The hardware structure diagram of a network device according to an exemplary embodiment is shown, and the network device includes: a communication interface 601, a processor 602, a memory 603 and a bus 604; wherein the communication interface 601, the processor 602 and the memory 603 complete mutual communication through the bus 604. The processor 602 can execute the message processing method described above by reading and executing the machine executable instructions corresponding to the control logic of the message processing method in the memory 603. The specific content of the method is referred to the above embodiment, and will not be repeated here.

[0095] The memory 603 mentioned in this application can be any electronic, magnetic, optical or other physical storage system, and can contain storage information, such as executable instructions, data, etc. Specifically, the memory 603 can be RAM (Random Access Memory), flash memory, storage drive (such as hard disk drive), any type of storage disk (such as optical disk, DVD, etc.), or similar storage medium, or a combination thereof. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 601 (which can be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. can be used.

[0096] The bus 604 may be an ISA bus, a PCI bus or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory 603 is used to store programs, and the processor 602 executes the programs after receiving execution instructions.

[0097] Processor 602 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in processor 602 or an instruction in software form. The above-mentioned processor 602 can be a general-purpose processor, including a network processor (Network Processor, referred to as NP), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a readily available programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The disclosed methods, steps and logic block diagrams in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware decoding processor to execute, or the hardware and software modules in the decoding processor are combined to execute.

[0098] The network device provided in the embodiment of the present application and the message processing method provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented therein.

[0099] The present application also provides a computer-readable storage medium corresponding to the message processing method provided in the above embodiment. Figure 7 As shown, the computer-readable storage medium shown is a CD 30 on which a computer program (ie, a program product) is stored. When the computer program is run by a processor, the message processing method provided by any of the aforementioned implementations will be executed.

[0100] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0101] The computer-readable storage medium provided in the above-mentioned embodiments of the present application and the message processing method provided in the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0102] An embodiment of the present application also provides a computer program product corresponding to the message processing method provided in the aforementioned embodiment. The computer program product includes a computer program, and the computer program is executed by a processor to implement the message processing method provided in the aforementioned embodiment.

[0103] The computer program product provided by the above-mentioned embodiments of the present application and the message processing method provided by the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0104] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0105] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0106] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A message processing method, characterized in that: The method comprises: Receiving a DNS request message from a user terminal; Determine the domain name information of the DNS request message, and determine the target domain name feature contained in the domain name information and in the domain name feature list; An access control operation corresponding to the target domain name feature is performed on the DNS request message, and an alarm record is generated and sent to the access control device.

2. The method according to claim 1, characterized in that The performing the access control operation corresponding to the target domain name feature on the DNS request message includes: When the number of the target domain name characteristics is 1, processing the DNS request message according to the access control operation corresponding to the target domain name characteristics; In the case where there are multiple target domain name features, the DNS request message is processed based on the priorities of the access control operations corresponding to the target domain name features.

3. The method according to claim 2, characterized in that The processing of the DNS request message based on the priority of each access control operation corresponding to the target domain name feature includes: The DNS request message is processed according to the access control operation with the highest priority among the access control operations corresponding to the target domain name characteristics.

4. The method according to claim 3, characterized in that: The access control operation includes at least one of the following: adding to a blacklist, intercepting, redirecting, and releasing.

5. The method according to claim 1, characterized in that The generating of the alarm record and sending it to the access control device includes: Extracting user terminal information from the DNS request message; Generate an alarm record including the user terminal information and the target domain name characteristics; Send the alarm record to the access control device.

6. The method according to any one of claims 1 to 5, characterized in that: Before determining the target domain name feature contained in the domain name information and in the domain name feature list, the method further includes: Obtaining snort rules, wherein the snort rules are obtained by performing a conversion operation on a custom domain name file by a preset script; The domain name feature list is generated according to the snort rules.

7. The method according to any one of claims 1 to 5, characterized in that: The alarm record includes user terminal information and domain name features accessed, and the method further includes: At preset intervals, count the number of times the same user terminal accesses a domain name containing the same domain name feature in the sent alarm records; When the number of accesses exceeds a preset number, a serious alarm record including user terminal information of the same user terminal, the same domain name feature and the number of accesses is generated; Send the serious alarm record to the access control device.

8. A message processing device, characterized in that: The device comprises: A receiving module, used to receive a DNS request message from a user terminal; A determination module, used to determine the domain name information of the DNS request message, and determine the target domain name feature contained in the domain name information and in the domain name feature list; The processing module is used to perform the access control operation corresponding to the target domain name feature on the DNS request message, generate an alarm record and send it to the access control device.

9. A network device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: The processor executes the program to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that The computer program is executed by a processor to implement the method according to any one of claims 1 to 7.

Images