Domain name abnormal behavior simulation method and device, computer equipment and storage medium

Abstract

The embodiment of the invention provides a domain name abnormal behavior simulation method and device, computer equipment and a storage medium. The method comprises the following steps: in response to a domain name abnormal behavior simulation request, determining a target domain name needing to be analyzed and simulated; determining a plurality of real service nodes associated with the target domain name when domain name resolution is executed in the Internet environment; respectively deploying simulation nodes corresponding to each real service node and each routing node through a container cluster manager, and constructing a simulation node topological structure; obtaining node state data, and generating a corresponding initial simulation environment; adjusting the corresponding object data in the initial simulation environment, and converting the object data into a target simulation environment corresponding to the target environment type; and obtaining any one target sub-domain name contained in the target domain name, and inputting the target sub-domain name into the target simulation environment for simulation to obtain a domain name abnormal behavior simulation result. Therefore, the system stability can be kept, and potential problems existing when the domain name system deals with the risk can be found and solved in time.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a method, device, computer equipment and storage medium for simulating abnormal behavior of a domain name. Background Art

[0002] The Domain Name System (DNS) is a core service of the Internet. Its function is to convert domain names that are easy for users to remember (such as www.example.com) into Internet Protocol addresses (such as 192.0.2.1) used by computers for network communication, so as to ensure that users can smoothly access relevant websites. However, as the Internet has become an important platform for information exchange, DNS not only assumes the function of domain name resolution, but also easily becomes a target of network security attacks, making the domain name system face risks such as service suspension, network disconnection and suspension, domain name disappearance and tampering, and domain name hijacking and tampering, resulting in users being unable to access websites or services through domain names.

[0003] In order to ensure the security and stability of the system, it is necessary to ensure that the domain name system has good risk response capabilities when facing risks such as service suspension, network outage, domain name disappearance and tampering, and domain name hijacking and tampering. Therefore, it is particularly important to evaluate the protection capabilities of the domain name system in different scenarios in order to subsequently repair the weak links in the system, thereby improving the overall security of the system and reducing the risk of business interruption caused by DNS attacks.

[0004] In related technologies, when evaluating the protection capabilities of the domain name system in different scenarios, the evaluation is generally conducted based on the system's response after the system is attacked or interrupted. For example, after a domain name hijacking or tampering occurs, the system's response during this period can be obtained and evaluated. However, this evaluation method has a certain lag, which is not conducive to maintaining the stability of the system and cannot promptly discover and solve potential problems in the domain name system when responding to risks. Summary of the invention

[0005] The main purpose of the embodiments of the present application is to propose a domain name abnormal behavior simulation method, device, computer equipment and storage medium, which can timely discover and solve potential problems existing in the domain name system when dealing with risks while maintaining system stability.

[0006] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a method for simulating abnormal behavior of a domain name, the method comprising:

[0007] Responding to a domain name abnormal behavior simulation request, and determining a target domain name that needs to be parsed and simulated from the domain name abnormal behavior simulation request;

[0008] Determine multiple real service nodes associated with the target domain name when performing domain name resolution in an Internet environment, wherein the multiple real service nodes communicate with each other through respective routing nodes;

[0009] Through the container cluster manager, each real service node and each routing node corresponding to the simulation node are deployed respectively to build a simulation node topology structure according to the multiple simulation nodes;

[0010] Obtaining node status data of each real service node and each routing node in the Internet environment, and injecting each set of node status data into the simulation node corresponding to the simulation node topology structure, to generate a corresponding initial simulation environment; wherein the target domain name corresponds to different Internet Protocol addresses in the Internet environment and the initial simulation environment respectively;

[0011] Determine the target environment type to be simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjust the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type;

[0012] Obtain any target subdomain contained in the target domain name, and input the target subdomain into the target simulation environment for simulation to obtain a simulation result of abnormal behavior of the domain name.

[0013] Accordingly, a second aspect of an embodiment of the present application proposes a domain name abnormal behavior simulation device, the device comprising:

[0014] A response module, used to respond to the domain name abnormal behavior simulation request, and determine the target domain name that needs to be parsed and simulated from the domain name abnormal behavior simulation request;

[0015] A determination module, used to determine a plurality of real service nodes associated with the target domain name when performing domain name resolution in an Internet environment, wherein the plurality of real service nodes communicate with each other through respective routing nodes;

[0016] A deployment module, used to deploy each real service node and each simulation node corresponding to the routing node through a container cluster manager, so as to construct a simulation node topology structure according to the multiple simulation nodes;

[0017] A generation module, used for obtaining node status data of each real service node and each routing node in the Internet environment, and injecting each set of node status data into the simulation node corresponding to the simulation node topology structure, to generate a corresponding initial simulation environment; wherein the target domain name corresponds to different Internet protocol addresses in the Internet environment and the initial simulation environment respectively;

[0018] A conversion module, used to determine the target environment type simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjust the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type;

[0019] The simulation module is used to obtain any target subdomain name contained in the target domain name, and input the target subdomain name into the target simulation environment for simulation to obtain a simulation result of abnormal behavior of the domain name.

[0020] In some implementations, the types of the simulation nodes include at least a root domain name simulation node, a recursive simulation node, a top-level domain simulation node, and an authoritative name simulation node, and the simulation module is further used to:

[0021] Inputting the target subdomain name into the target simulation environment, and determining a corresponding recursive simulation node from the target simulation environment according to the target subdomain name;

[0022] Determine the root domain name simulation node corresponding to the target subdomain name through the recursive simulation node;

[0023] Acquire the top-level domain of the target subdomain name, and transmit the first address of the top-level domain simulation node to the recursive simulation node based on the top-level domain through the root domain name simulation node;

[0024] Accessing the top-level domain simulation node based on the first address through the recursive simulation node to obtain the authoritative name simulation node address of the target subdomain name;

[0025] Through the recursive simulation node, the authoritative name simulation node is accessed based on the authoritative name simulation node address, so that the authoritative name simulation node returns the domain name abnormal behavior simulation result corresponding to the target subdomain name by querying the subdomain name resolution record of the target subdomain name.

[0026] In some implementations, the domain name abnormal behavior simulation device further includes an adjustment module, which is used to:

[0027] Inputting the target subdomain into the Internet environment to obtain a first Internet Protocol address corresponding to the target subdomain;

[0028] Compare the domain name abnormal behavior simulation result with the first Internet Protocol address to obtain a comparison result;

[0029] When the comparison result indicates that the first Internet Protocol address and the domain name abnormal behavior simulation result are inconsistent, the attack and defense strategy parameters of the domain name system are adjusted.

[0030] In some implementations, the target environment type is service outage, the object data is an access control list, and the conversion module is further used to:

[0031] In the initial simulation environment, determining a domain name resolution configuration module of the target domain name in a corresponding authoritative name simulation node;

[0032] An access control list is set in the domain name resolution configuration module, and the Internet Protocol address segment where the recursive simulation node corresponding to the target domain name is located is added to the access control list to restrict the recursive simulation node from accessing the domain name resolution record stored in the authoritative name simulation node;

[0033] A target simulation environment corresponding to the target environment type is updated.

[0034] In some implementations, the target environment type is network disconnection and service suspension, and the object data includes a restricted access list; the conversion module is further used to:

[0035] In the initial simulation environment, determining a target routing node of the target domain name in an authoritative name simulation node;

[0036] Establishing a restricted access list in the routing configuration of the target routing node, and adding the Internet Protocol address segment where the recursive simulation node corresponding to the target domain name is located to the restricted access list to limit the traffic data sent by the recursive simulation node to the authoritative name simulation node;

[0037] A target simulation environment corresponding to the target environment type is updated.

[0038] In some implementations, the target environment type is domain name disappearance and tampering, the object data includes a target zone file, and the conversion module is further used to:

[0039] In the initial simulation environment, determining an authoritative name simulation node corresponding to the target domain name;

[0040] In the authoritative name simulation node, a target zone file is determined; wherein the target zone file is at least used to store a mapping relationship between the target domain name and the corresponding second Internet Protocol address;

[0041] In the target zone file, deleting the resource record corresponding to the target domain name;

[0042] A target simulation environment corresponding to the target environment type is updated.

[0043] In some implementations, the target environment type is domain name hijacking and tampering, the object data includes a target zone file, and the conversion module is further used to:

[0044] In the initial simulation environment, determining an authoritative name simulation node corresponding to the target domain name;

[0045] In the authoritative name simulation node, a target zone file is determined; wherein the target zone file is at least used to store a mapping relationship between the target domain name and the corresponding second Internet Protocol address;

[0046] In the target area file, modifying the second Internet Protocol address to a third Internet Protocol address; wherein the third Internet Protocol address points to an abnormal network page;

[0047] A target simulation environment corresponding to the target environment type is updated.

[0048] In some implementations, the deployment module is further configured to:

[0049] Deploy each real service node and each routing node's corresponding simulation node in at least one virtual server node through a container cluster manager;

[0050] Based on the border gateway protocol, network data is deployed for each simulation node corresponding to each routing node, and a simulation node topology structure is constructed according to the deployed multiple simulation nodes.

[0051] In some implementations, the domain name abnormal behavior simulation device further includes a modification module, which is used to:

[0052] When there is a first authoritative name simulation node associated with any first domain name when performing domain name resolution in the Internet environment, which is the same as the authoritative name server node associated with the target domain name, modifying the Internet Protocol address corresponding to the first domain name to a fourth Internet Protocol address in the target simulation environment;

[0053] Perform a domain name abnormal behavior simulation on the first domain name to obtain a first domain name abnormal behavior simulation result corresponding to the first domain name.

[0054] Correspondingly, the third aspect of the embodiments of the present application proposes a computer device, which includes a memory and a processor, the memory stores a computer program, and the processor implements the domain name abnormal behavior simulation method described in any one of the embodiments of the first aspect of the present application when executing the computer program.

[0055] Correspondingly, the fourth aspect of the embodiments of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the domain name abnormal behavior simulation method of any one of the embodiments of the first aspect of the present application.

[0056] The embodiment of the present application responds to a domain name abnormal behavior simulation request and determines a target domain name that needs to be simulated for resolution from the domain name abnormal behavior simulation request; determines multiple real service nodes associated with the target domain name when performing domain name resolution in an Internet environment, and the multiple real service nodes communicate with each other through their respective routing nodes; through a container cluster manager, deploys simulation nodes corresponding to each real service node and each routing node respectively, so as to build a simulation node topology structure according to the multiple simulation nodes; obtains node status data of each real service node and each routing node in the Internet environment, and injects each group of node status data into the simulation node corresponding to the simulation node topology structure to generate a corresponding initial simulation environment; wherein the target domain name corresponds to different Internet Protocol addresses in the Internet environment and the initial simulation environment respectively; determines the target environment type to be simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjusts the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type; obtains any target subdomain contained in the target domain name, and inputs the target subdomain into the target simulation environment for simulation to obtain a domain name abnormal behavior simulation result. In this way, it is possible to build an initial simulation environment that is highly similar to the Internet environment in advance, allowing the object data corresponding to different target environment types in the initial simulation environment to be adjusted under controlled conditions to simulate various risk behaviors that the domain name system may encounter, and test the response of the domain name system when facing various potential risks, thereby greatly shortening the time cycle from problem discovery to problem resolution, so as to timely discover the weak links in the system and take measures to repair them before the actual attack occurs, effectively improving the security and stability of the system, and ensuring that even in the face of complex network security threats, it can maintain a good response capability. In summary, this application will not affect the actual Internet environment during the simulation process, and can timely discover and solve potential problems in the domain name system when responding to risks while maintaining system stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 It is a schematic diagram of the architecture of the domain name abnormal behavior simulation system provided in an embodiment of the present application;

[0058] Figure 2 is a flow chart of a method for simulating abnormal behavior of a domain name provided in an embodiment of the present application;

[0059] Figure 3 This is a simulation example diagram of a service outage provided in an embodiment of the present application;

[0060] Figure 4 This is a simulation example diagram of network disconnection and service suspension provided in an embodiment of the present application;

[0061] Figure 5This is a simulation example diagram of the disappearance and tampering of a domain name provided in an embodiment of the present application;

[0062] Figure 6 This is a simulation example diagram of domain name hijacking and tampering provided by an embodiment of the present application;

[0063] Figure 7 It is a diagram of the overall processing process of the domain name abnormal behavior simulation method provided in the embodiment of the present application;

[0064] Figure 8 It is a functional module diagram of the domain name abnormal behavior simulation device provided in an embodiment of the present application;

[0065] Fig. 9 It is a schematic diagram of the hardware structure of the computer device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0067] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0068] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0069] The Domain Name System (DNS) is a core service of the Internet. Its function is to convert domain names that are easy for users to remember (such as www.example.com) into Internet Protocol addresses (such as 192.0.2.1) used by computers for network communication, so as to ensure that users can smoothly access relevant websites. However, as the Internet has become an important platform for information exchange, DNS not only assumes the function of domain name resolution, but also easily becomes a target of network security attacks, making the domain name system face risks such as service suspension, network disconnection and suspension, domain name disappearance and tampering, and domain name hijacking and tampering, resulting in users being unable to access websites or services through domain names.

[0070] In order to ensure the security and stability of the system, it is necessary to ensure that the domain name system has good risk response capabilities when facing risks such as service suspension, network outage, domain name disappearance and tampering, and domain name hijacking and tampering. Therefore, it is particularly important to evaluate the protection capabilities of the domain name system in different scenarios in order to subsequently repair the weak links in the system, thereby improving the overall security of the system and reducing the risk of business interruption caused by DNS attacks.

[0071] In related technologies, when evaluating the protection capabilities of the domain name system in different scenarios, the evaluation is generally conducted based on the system's response after the system is attacked or interrupted. For example, after a domain name hijacking or tampering occurs, the system's response during this period can be obtained and evaluated. However, this evaluation method has a certain lag, which is not conducive to maintaining the stability of the system and cannot promptly discover and solve potential problems in the domain name system when responding to risks.

[0072] Based on this, the embodiments of the present application provide a method, apparatus, computer device and storage medium for simulating abnormal behavior of a domain name, which can timely discover and solve potential problems existing in the domain name system when dealing with risks while maintaining system stability.

[0073] The domain name abnormal behavior simulation method, device, computer equipment and storage medium provided in the embodiments of the present application are specifically described through the following embodiments. First, the domain name abnormal behavior simulation system in the embodiments of the present application is described.

[0074] Please refer to Figure 1 In some implementations, an embodiment of the present application provides a domain name abnormal behavior simulation system, including a network simulation module, a system simulation module, a simulation console, a simulation state perception module, and a simulation visualization module.

[0075] Exemplarily, the network simulation module uses an open source tool that supports the Border Gateway Protocol (BGP) to deploy a virtual routing network environment, builds interconnected routing nodes through BGP, and uses a container cluster manager (Kubernetes, K8S) and containerization technology to implement containerized deployment of nodes. The network simulation module supports the collection of BGP data from the Internet environment, dynamically generates virtual network routing configurations, and implements network simulation (simulation is simulation).

[0076] Furthermore, the system simulation module mainly implements the simulation of the domain name system, and uses the domain name system service software to realize the simulation of multiple real service nodes associated with the execution of domain name resolution. The system simulation module can analyze the target domain name to be simulated according to the domain name abnormal behavior simulation request, obtain the data of all upstream resolved real service nodes required for the target domain name from the actual Internet environment and cache it, so as to provide the domain name abnormal behavior simulation results consistent with the Internet in the simulation environment. At the same time, according to the real service node where the specified risk occurs, the principle of minimization of simulation is adopted, and only the object data related to the target environment type is modified, and other resolution parts still use the service of the target domain name in the Internet environment. Therefore, in addition to analyzing and obtaining the data of the real service node in the Internet environment, the system simulation module also determines the range of the simulated domain name node according to the location analysis of the risk occurrence domain, and determines the boundary between the target simulation environment and the Internet environment to minimize simulation resources.

[0077] Furthermore, the simulation console is responsible for receiving and routing domain name abnormal behavior simulation requests, controlling the execution of the network simulation module and the system simulation module, issuing instructions to the simulation status perception module to perform detection tasks, and the simulation perception module feeds back the domain name abnormal behavior simulation results to the simulation console, and based on the domain name abnormal behavior simulation results, sends visualization result instructions to the simulation visualization module.

[0078] Among them, the simulation status perception module can monitor the network and system simulation status of the target simulation environment, collect the network and system status data of the simulation environment, so as to feedback the simulation results of abnormal behavior of domain names to the simulation console, and provide visualization basic environment data for the simulation visualization module.

[0079] The simulation visualization module can query the simulation state perception module for environmental data during the simulation process according to the instructions of the simulation console, and visualize the data.

[0080] In some embodiments, the domain name abnormal behavior simulation system can be installed on a computer device, which can be a local server, a cloud server, a private cloud environment, a virtual machine, a container cluster, a high-performance computing cluster, etc. The specific installation environment can be selected based on the system's performance requirements, security requirements, cost-effectiveness, and convenience of maintenance and support.

[0081] The domain name abnormal behavior simulation method in the embodiment of the present application can be explained by the following embodiment.

[0082] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first. Moreover, the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or separate consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or separate consent, the necessary user-related data for enabling the normal operation of the embodiment of the present application will be obtained.

[0083] In the embodiment of the present application, the domain name abnormal behavior simulation device will be described from the perspective of the domain name abnormal behavior simulation device, which can be specifically integrated into a computer device. Figure 2 , Figure 2 This is a flowchart of the steps of the domain name abnormal behavior simulation method provided in the embodiment of the present application. The embodiment of the present application takes the domain name abnormal behavior simulation device as an example of being specifically integrated on a terminal or a server. When the processor on the terminal or the server executes the program instructions corresponding to the domain name abnormal behavior simulation method, the specific process is as follows:

[0084] Step 101, responding to a domain name abnormal behavior simulation request, and determining a target domain name that needs to be resolved and simulated from the domain name abnormal behavior simulation request.

[0085] In some implementations, in order to study and test the behavior of the domain name system when facing various security risks, the target domain name to be simulated can be determined based on the domain name abnormal behavior simulation request, so that an accurate simulation scenario can be subsequently built for the target domain name through the simulation platform.

[0086] Among them, the domain name abnormal behavior simulation request can be a simulation request submitted by the terminal when it is necessary to test the performance of the system when the target domain name is affected by abnormal behavior in the network. The domain name abnormal behavior simulation request can include the target domain name, target environment type and other related parameters.

[0087] The target domain name may be a specific domain name where the simulated risk is expected to be applied. For example, if the user wants to test the reaction of example.com when encountering the risk of service suspension or hijacking, then example.com is the target domain name.

[0088] Exemplarily, a domain name abnormal behavior simulation request may be manually initiated by a security analyst, or may be automatically generated by an automated system according to predefined rules or detected abnormal activities.

[0089] In some implementations, domain names with higher risk scores, belonging to key business services or associated with known threats can be preferentially selected, and a domain name abnormal behavior simulation request can be generated. The system can respond to the domain name abnormal behavior simulation request and parse the domain name abnormal behavior simulation request to obtain the target domain name and the target environment type to be simulated. In this way, it is possible to effectively focus on high-risk areas, reduce the possibility of service interruption due to network attacks, and improve the effectiveness and pertinence of security protection. Alternatively, the target domain name can also be selected according to actual conditions, and the embodiments of the present application do not impose specific restrictions on this.

[0090] By identifying the target domain name, you can effectively simulate abnormal domain name behavior, thereby better understanding and responding to potential security threats.

[0091] Step 102, determining multiple real service nodes associated with the target domain name when performing domain name resolution in the Internet environment, and the multiple real service nodes communicate with each other through their respective routing nodes.

[0092] In some embodiments, in order to prepare for subsequent risk simulation and ensure that the simulation environment can faithfully reproduce the actual resolution process, multiple real service nodes associated with the target domain name when performing domain name resolution in the Internet environment can be determined to support users to specify risks at any position in the resolution chain for simulation, thereby enhancing the authenticity of the simulation and enabling researchers to evaluate the security and stability of domain name resolution under conditions close to reality.

[0093] The Internet environment can be a real network, which is a large-scale distributed system connected by countless networks, allowing computer devices in different geographical locations to communicate with each other. In the Internet environment, domain name resolution can convert domain names into machine-readable Internet Protocol (IP) addresses.

[0094] The real service node may be a server node that actually exists in the Internet environment and resolves the target domain name into an Internet Protocol address.

[0095] Among them, the routing node can be a device or system used to forward data packets of the associated real service node in the Internet, which can determine the best path to send information according to the routing table.

[0096] Exemplarily, the real service node includes, but is not limited to, a root server, a top-level domain server, an authoritative name server, a recursive server, etc. used in the target domain name resolution process in an Internet environment.

[0097] Furthermore, the domain names that are relied upon in the resolution process of all target domain names can be queried and resolved to obtain complete domain name resolution dependency data, and then determine the multiple real service nodes associated when performing domain name resolution. For example, in an Internet environment, when a user enters the target domain name www.example.com in the browser of the terminal and tries to access it, the recursive server of the user's Internet service provider begins to process the access request. The recursive server can query the root server. The root server will instruct the recursive server to query the top-level domain server of ".com". The top-level domain server will instruct the recursive server to query the authoritative name server of example.com. After the recursive server queries the authoritative name server of example.com, it can obtain the specific Internet Protocol address information of www.example.com. From the above domain name resolution dependency data, it can be determined that the multiple real service nodes associated when performing domain name resolution include the corresponding recursive server, root server, top-level domain server, and authoritative name server.

[0098] Exemplarily, the routing node may be a router, a switch or other network device with routing function. In the process of domain name resolution, the routing node can ensure that the domain name resolution query initiated by the terminal can correctly reach the corresponding real service node, and the response can be smoothly returned to the terminal. Routing nodes can communicate with each other through the border gateway protocol and dynamically update routing information to ensure the efficiency and reliability of communication.

[0099] By determining the multiple real service nodes associated with the target domain name when performing domain name resolution in the Internet environment, as well as the routing nodes associated with each real service node, we can prepare for subsequent risk simulation and enhance the authenticity of the simulation.

[0100] Step 103: Deploy each real service node and each simulation node corresponding to each routing node through the container cluster manager, so as to construct a simulation node topology structure according to the multiple simulation nodes.

[0101] In some embodiments, in order to create a target simulation environment that is resource-saving, efficient, flexible, and close to reality, that is, a risk simulation environment, simulation nodes can be deployed by using a container cluster manager, and a simulation node topology structure can be constructed to ensure the accuracy, scalability, and resource utilization of the simulation.

[0102] Among them, the container cluster manager (Kubernetes, K8S) can be a platform for automating the deployment, management and expansion of containerized applications.

[0103] The simulation node may be a virtual node created for simulation, and the simulation node may be used to simulate a real service node or routing node that performs a specific function in a real Internet environment.

[0104] The simulation node topology structure may be the connection mode and interaction mode between all simulation nodes.

[0105] Exemplarily, a container cluster manager can be used to create corresponding container (Docker) images for each real service node and routing node, and a Kubernetes Deployment file can be written for each node to define the image, resource restrictions, environment variables, etc. of the required container. A Kubernetes Service file can be written for each node to define the service type, port mapping, etc., and the Kubernetes Deployment file and Kubernetes Service file can be applied to the K8S cluster respectively.

[0106] Furthermore, the border gateway protocol can be configured in a container that supports the border gateway protocol, neighbor nodes, routing policies, etc. can be set, and routing data can be collected from the Internet environment for the simulation nodes corresponding to each routing node to dynamically generate the routing configuration of the simulation environment. After all real service nodes and simulation nodes corresponding to all routing nodes are generated, tests can be performed to verify the connectivity, correctness, and effectiveness between the simulation nodes.

[0107] By constructing a simulation node topology, all key links involved in a specific domain name resolution process can be accurately simulated, including possible risk locations, providing a basis for the subsequent construction of an initial simulation environment.

[0108] In some implementations, in order to ensure that the simulation environment is close to reality and has good scalability and flexibility, virtual server nodes can be deployed by using a container cluster manager, and a simulation node topology structure can be constructed based on a border gateway protocol to save system resources while improving the authenticity of the simulation environment. For example, step 103 may include:

[0109] (103.1) deploying, in at least one virtual server node, a simulation node corresponding to each real service node and each routing node, respectively, through a container cluster manager;

[0110] (103.2) Based on the border gateway protocol, network data is deployed for each simulation node corresponding to each routing node, and a simulation node topology structure is constructed based on the deployed multiple simulation nodes.

[0111] Among them, the virtual server node can be a virtual machine running on a physical server or cluster through virtualization software. The virtual server node can simulate the behavior of a real server and can be quickly deployed, configured and expanded as needed.

[0112] Among them, the Border Gateway Protocol can be a standard protocol for exchanging routing information between autonomous systems in the Internet. The Border Gateway Protocol can be used to determine the best path for data packets corresponding to each real service node to be transmitted between networks, ensuring reliable communication between different networks.

[0113] For example, a K8S cluster can be installed on at least one virtual server node, and a Dockerfile can be written for each real service node using BIND9, and an image can be built; a Dockerfile can be written for each routing node using GoBGP, and an image can be built. The Go in GoBGP is the Go language, and BGP is the Border Gateway Protocol.

[0114] Furthermore, you can write Deployment and Service YAML configuration files for each real service node and routing node, define the container image, resource restrictions, service ports, etc., and apply the YAML configuration files to the K8S cluster to deploy the simulation nodes.

[0115] Furthermore, GoBGP can be configured in the Docker container of each routing node, BGP neighbor relationships and routing policies can be set, and network data can be collected from the Internet environment. The routing configuration of the initial simulation environment can be dynamically generated based on the collected network data. Then, a simulation node topology structure can be constructed based on multiple simulation nodes corresponding to real service nodes and routing nodes.

[0116] By constructing the simulation node topology, the virtual network routing configuration can be dynamically generated, so that the simulation environment can reflect the service data of the Internet environment in real time. At the same time, only simulating the nodes related to the domain name resolution can effectively reduce the resources required for simulation.

[0117] Step 104, obtain the node status data of each real service node and each routing node in the Internet environment, and inject each set of node status data into the simulation node corresponding to the simulation node topology structure to generate the corresponding initial simulation environment; wherein the target domain name corresponds to different Internet Protocol addresses in the Internet environment and the initial simulation environment respectively.

[0118] In some embodiments, in order to ensure that the simulation node matches the behavior and configuration of the real node in the initial state, the node status data of the real service node and the routing node in the current Internet environment can be obtained, and the node status data can be injected into the corresponding simulation node to generate an initial simulation environment similar to the real environment, so as to establish the foundation of a reliable simulation environment and improve the security and stability of the network.

[0119] Among them, the node status data can be a collection of information describing the current operating status of each real service node (such as a recursive resolver, an authoritative name server, etc.) and a routing node in the Internet environment.

[0120] The initial simulation environment can be a virtualized environment in a starting state constructed on a simulation platform based on the collected state data of each node in the real Internet environment. The initial simulation environment is designed to mimic the behavior pattern of the real Internet as much as possible, while allowing operators to control and observe the domain name resolution process under specific conditions.

[0121] In some implementations, different Internet Protocol addresses can be assigned to the target domain name in the initial simulation environment to avoid address conflicts with the real network environment. This also allows the initial simulation environment to run independently of the real Internet environment, avoiding potential impacts on the Internet environment.

[0122] Exemplarily, the node status data of each real service node and each routing node can be obtained from the Internet environment through network detection, API call, database query, etc. For example, for real service nodes, the node status data may include server configuration information, zone files, performance indicators, health status, resolution records, etc.; for routing nodes, the node status data may include routing tables, BGP session information, routing policies, etc.

[0123] Furthermore, when injecting the node status data into the corresponding simulation node, for the simulation node corresponding to the server node, it can include configuring the regional file of the simulation node, etc.; for the simulation node corresponding to the routing node, it can include configuring the routing table and BGP policy of the simulation node, etc., thereby generating the corresponding initial simulation environment.

[0124] By generating an initial simulation environment, a highly simulated initial simulation environment can be constructed, which can accurately simulate the behavior patterns of the real Internet. In this way, while avoiding address conflicts with the real network, it can ensure that the initial simulation environment can run independently, thereby improving the controllability and observability of the domain name resolution process, and providing a safe and flexible experimental platform for studying and testing the risk management of the domain name system.

[0125] Step 105, determining the target environment type to be simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjusting the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type.

[0126] In some embodiments, in order to accurately simulate a specific type of abnormal behavior of a domain name, a target simulation environment close to the real scene can be created by determining the target environment type and adjusting the corresponding object data in the initial simulation environment, so as to provide a solid foundation for risk assessment, protection strategy testing, etc. without affecting actual Internet services.

[0127] Among them, the target environment type can be a simulation scenario category determined according to a domain name abnormal behavior simulation request submitted by a user, which reflects the specific risks or abnormal situations that the user wants to simulate, such as service suspension, network disconnection, disappearance, hijacking, etc.

[0128] The object data may be an object of simulation adjustment, and is used to determine a target environment type of a target simulation environment.

[0129] The target simulation environment can be the final simulation state after specific adjustments are made based on the initial simulation environment and according to the simulation request for abnormal domain behavior. The target simulation environment can reproduce the risk scenario specified by the user (i.e., the target environment type) so that researchers can observe and analyze abnormal behavior in the domain name resolution process under controlled conditions.

[0130] Exemplarily, when the target environment type is service shutdown, the object data can be the access control list of the BIND configuration file in the domain name resolution configuration module. In the access control list, access to the Internet Protocol address corresponding to the target domain name during the resolution process is restricted, thereby simulating the service shutdown scenario. Similarly, when the target environment type is network disconnection and service shutdown, domain name disappearance and tampering, domain name hijacking and tampering, etc., the corresponding object data can also be modified to convert the initial simulation environment without risk into the target simulation environment corresponding to the target environment type.

[0131] By modifying the object data and converting the initial simulation environment into a target simulation environment corresponding to the target environment type, we can conduct in-depth research on various risks in the domain name resolution process in a safe and controllable environment and develop effective countermeasures without worrying about any impact on actual Internet services. This not only improves the accuracy of the simulation, but also enhances security and controllability, which helps to more comprehensively understand the risks of domain name resolution and formulate reasonable defense strategies.

[0132] In some implementations, in order to determine the impact of service outage on the system and evaluate the response of the domain name resolution system to the service outage, the service outage can be simulated in the initial simulation environment to accurately simulate and study the risk of outage in the domain name resolution process without affecting the actual Internet environment. For example, when the target environment type is service outage and the object data is an access control list, the "adjusting the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type" in step 105 may include:

[0133] (105.a1) In the initial simulation environment, determine the domain name resolution configuration module of the target domain name in the corresponding authoritative name simulation node;

[0134] (105.a2) setting an access control list in the domain name resolution configuration module, and adding the Internet Protocol address segment where the recursive simulation node corresponding to the target domain name is located to the access control list to restrict the recursive simulation node from accessing the domain name resolution record stored in the authoritative name simulation node;

[0135] (105.a3) Update the target simulation environment corresponding to the target environment type.

[0136] Among them, service suspension may be a situation where the domain name resolution service temporarily or permanently stops providing services to the outside world, that is, simulating a situation where one or more domain name resolution services are temporarily unavailable when resolving the target domain name.

[0137] Among them, the access control list (ACL) can be a network security mechanism for controlling access rights to specific resources. By configuring the access control list, access restrictions on specific Internet protocol address segments can be implemented, thereby simulating the effect of service suspension.

[0138] The domain name resolution configuration module may be a software component responsible for managing domain name resolution rules and configurations. In an authoritative name server, the domain name resolution configuration module may be a domain name system software, such as Berkeley Internet Name Domain (BIND) and the like.

[0139] The authoritative name simulation node may be a virtual node that simulates an authoritative name server in a simulation environment. The authoritative name server is a server responsible for storing and providing specific domain name resolution records.

[0140] Please refer to Figure 3For example, when the target environment type received by the system is a service outage, since the authoritative name simulation node is responsible for storing and providing resolution records of the target domain name (such as www.example.com), the authoritative name simulation node corresponding to the target domain name can be determined in the initial simulation environment.

[0141] Furthermore, in the initial simulation environment, the domain name resolution configuration module (such as BIND configuration) of the authoritative name simulation node can be modified, the permission configuration of the access control list can be added, the access rights of the Internet Protocol address segment where the simulation recursive node corresponding to the target domain name is located can be restricted, and the target simulation environment corresponding to the target environment type can be updated. In this way, when the recursive simulation node corresponding to the target domain name attempts to obtain the corresponding Internet Protocol address from the authoritative name simulation node, the authoritative name simulation node will return a resolution service failure status, such as a SERVFAIL status.

[0142] Through the above method, the access to the domain name resolution record by the IP end where the recursive simulation node of the target domain name is located can be accurately restricted, so that the system can accurately simulate the actual situation that one or more domain name resolution services are unavailable, which is conducive to accurately testing the system's ability to respond to service outages without affecting the Internet environment.

[0143] In some implementations, in order to determine the impact of network outages on the system and evaluate the response of the domain name resolution system to network outages, network outages can be simulated in an initial simulation environment to accurately simulate and study the risks of network outages during domain name resolution without affecting the actual Internet environment. For example, when the target environment type is network outages and the object data includes a restricted access list, the step 105 of "adjusting the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type" can also include:

[0144] (105.b1) In the initial simulation environment, determine the target routing node of the target domain name in the authoritative name simulation node;

[0145] (105.b2) Establishing a restricted access list in the routing configuration of the target routing node, and adding the Internet Protocol address segment where the recursive simulation node corresponding to the target domain name is located to the restricted access list to limit the traffic data sent by the recursive simulation node to the authoritative name simulation node;

[0146] (105.b3) Update the target simulation environment corresponding to the target environment type.

[0147] Among them, network outage and service suspension may be a situation where the network connection is interrupted, resulting in the inability to access the domain name resolution service normally. Network outage and service suspension may be caused by network failure, routing error or other reasons.

[0148] The restricted access list may be a routing configuration for discarding data traffic of the second Internet Protocol address corresponding to the target domain name or the Internet Protocol address segment of the recursive simulation node corresponding to the target domain name without any processing or forwarding.

[0149] The target routing node may be a routing simulation node responsible for processing traffic of a specific target network segment in a simulation environment, and is used to forward data packets.

[0150] The target network segment may be the Internet Protocol address range corresponding to the target domain name, or the target network segment may be the Internet Protocol address segment where the recursive simulation node corresponding to the target domain name is located, which is an object with restricted access in the simulated target environment type.

[0151] Please refer to Figure 4 For example, when the target environment type received by the system is network disconnection and service suspension, since the authoritative name simulation node is responsible for storing and providing resolution records of the target domain name (such as www.example.com), the authoritative name simulation node corresponding to the target domain name can be determined in the initial simulation environment.

[0152] Furthermore, in the initial simulation environment, a restricted access list can be established in the routing configuration of the routing simulation node associated with the authoritative name simulation node, and the Internet Protocol address segment where the recursive simulation node corresponding to the target domain name is located is added to the access restriction list. In this way, all traffic sent to the authoritative name simulation node through the Internet Protocol address segment will be discarded, simulating the effect of a network disconnection, and the initial simulation environment will be updated to obtain a target simulation environment corresponding to the target environment type.

[0153] Furthermore, when the recursive simulation node corresponding to the target domain name attempts to obtain the corresponding Internet Protocol address from the authoritative name simulation node, since the second Internet Protocol address corresponding to the target domain name is added to the restricted access list, the authoritative name simulation node will return a resolution service failure status, such as a SERVFAIL status.

[0154] By simulating the risk of network outages and service suspension in a simulated environment, we can accurately reproduce the situation where the domain name resolution service cannot be accessed normally due to network connection interruption. This is conducive to accurately testing the system's ability to respond to network outages and service suspension without affecting the Internet environment.

[0155] In some implementations, in order to determine the impact of domain name disappearance and tampering on the system and evaluate the response of the domain name resolution system when faced with domain name disappearance and tampering, the domain name disappearance and tampering can be simulated in the initial simulation environment, so as to accurately simulate and study the risk of domain name disappearance and tampering in the domain name resolution process without affecting the actual Internet environment. For example, when the target environment type is domain name disappearance and tampering, and the object data includes the target zone file, the "adjusting the corresponding object data in the initial simulation environment to convert the initial simulation environment into the target simulation environment corresponding to the target environment type" in step 105 can also include:

[0156] (105.c1) In the initial simulation environment, determine the authoritative name simulation node corresponding to the target domain name;

[0157] (105.c2) In the authoritative name simulation node, determining a target zone file; wherein the target zone file is used to store at least a mapping relationship between the target domain name and the corresponding second Internet Protocol address;

[0158] (105.c3) In the target zone file, delete the resource record corresponding to the target domain name;

[0159] (105.c4) Update the target simulation environment corresponding to the target environment type.

[0160] The disappearance and tampering of a domain name may be a situation in which a resource record of a target domain name on an authoritative name server is deleted or tampered with, thereby making the domain name unable to be resolved normally.

[0161] The target zone file may be a file storing a specific domain name and its corresponding resource records. In the domain name system, each domain name has a corresponding zone file for storing all resource records of the domain name. Exemplarily, the target zone file is used to store at least a mapping relationship between the target domain name and the corresponding second Internet Protocol address.

[0162] The resource record may be a data structure in the domain name system, which is used to describe the mapping relationship between the domain name and the related network information. For example, the resource record may include an A record (IPv4 address), an AAAA record (IPv6 address), an MX record (mail exchange server), etc.

[0163] Please refer to Figure 5 For example, when the target environment type received by the system is that the domain name disappears and is tampered with, since the authoritative name simulation node is responsible for storing and providing the resolution record of the target domain name (www.example.com), the authoritative name simulation node corresponding to the target domain name can be determined in the initial simulation environment.

[0164] Furthermore, a target zone file may be determined in the authoritative name simulation node, the target zone file including a mapping relationship between the target domain name (www.example.com) and its corresponding second Internet Protocol address (93.184.216.34).

[0165] Further, the resource record corresponding to the target domain name can be determined from the target zone file, and the resource record can be deleted so that the target domain name no longer points to any Internet protocol address. Afterwards, the simulation environment can be updated to obtain the target simulation environment corresponding to the target environment type.

[0166] Therefore, when a user tries to resolve www.example.com, since the resource record corresponding to the target domain name has been deleted, the authoritative name simulation node will return a status that the resolved domain name record does not exist, that is, it returns the NXDOMAIN status.

[0167] Through the above methods, the risk scenario of domain name disappearance and tampering can be accurately simulated without affecting the real Internet environment, so as to test the performance of the system when key information is lost or tampered with, thereby improving the system's security and ability to respond to emergencies.

[0168] In some implementations, in order to determine the impact of domain name hijacking and tampering on the system and evaluate the response of the domain name resolution system to domain name hijacking and tampering, the domain name hijacking and tampering can be simulated in the initial simulation environment, so as to accurately simulate and study the risk of domain name hijacking and tampering in the domain name resolution process without affecting the actual Internet environment. For example, when the target environment type is domain name hijacking and tampering, and the object data includes the target zone file, the "adjusting the corresponding object data in the initial simulation environment to convert the initial simulation environment into the target simulation environment corresponding to the target environment type" in step 105 can also include:

[0169] (105.d1) In the initial simulation environment, determine the authoritative name simulation node corresponding to the target domain name;

[0170] (105.d2) In the authoritative name simulation node, determining a target zone file; wherein the target zone file is used to store at least a mapping relationship between the target domain name and the corresponding second Internet Protocol address;

[0171] (105.d3) In the target area file, the second Internet Protocol address is modified to a third Internet Protocol address; wherein the third Internet Protocol address points to an abnormal network page;

[0172] (105.d4) Update the target simulation environment corresponding to the target environment type.

[0173] Domain name hijacking and tampering can be a process in which a malicious actor tampers with the domain name resolution results and directs legitimate users to fake or malicious websites.

[0174] Among them, the third Internet Protocol address can be a new Internet Protocol address used to replace the real Internet Protocol address corresponding to the original target domain name. The third Internet Protocol address can point to an abnormal web page or malicious site to simulate the effect of domain name hijacking and tampering.

[0175] Please refer to Figure 6 For example, when the target environment type received by the system is domain name hijacking and tampering, since the authoritative name simulation node is responsible for storing and providing the resolution record of the target domain name (www.example.com), the authoritative name simulation node corresponding to the target domain name can be determined in the initial simulation environment.

[0176] Furthermore, a target zone file may be determined in the authoritative name simulation node, the target zone file including a mapping relationship between the target domain name (www.example.com) and its corresponding second Internet Protocol address (93.184.216.34).

[0177] Further, the resource record corresponding to the target domain name can be determined from the target zone file, and the second Internet Protocol address (93.184.216.34) can be modified to a third Internet Protocol address (such as 192.168.1.1), and the third Internet Protocol address points to the abnormal network page. After that, the simulation environment can be updated to obtain the target simulation environment corresponding to the target environment type.

[0178] Therefore, when a user tries to resolve www.example.com, since the resource record corresponding to the target domain name has been tampered with, the authoritative name simulation node will return a hijacking error prompt page, indicating that the target domain name has been hijacked.

[0179] Through the above methods, the risk scenarios of domain name hijacking and tampering can be accurately simulated without affecting the real Internet environment, so as to test the performance of the system when it is tampered with, thereby improving the system's security and ability to respond to emergencies.

[0180] Step 106, obtaining any target subdomain contained in the target domain name, and inputting the target subdomain into the target simulation environment for simulation, to obtain a simulation result of abnormal behavior of the domain name.

[0181] In some implementations, in order to further simulate and test specific risk scenarios, after building a general simulation environment based on the target domain name, a target subdomain of the target domain name may be input for further testing to perform a more detailed simulation.

[0182] The target subdomain may refer to any one or more subdomains under the target domain. For example, if the target domain is example.com, its subdomains may be www.example.com, mail.example.com, etc. Each target subdomain may correspond to a different Internet protocol address and service, so simulating the abnormal behavior of the target subdomain helps to more comprehensively understand the security status of the entire domain name system.

[0183] The domain name abnormal behavior simulation result may be the result data obtained after performing abnormal behavior simulation on the target domain name (including its target subdomain name) in the simulation environment. The domain name abnormal behavior simulation result includes but is not limited to the domain name system response status, such as resolution service failure, domain name does not exist, etc.

[0184] In some implementations, building a target simulation environment based on a target domain name can reduce the number of subdomains that need to be configured and managed, and there is no need to create a separate simulation instance for each target subdomain, thereby simplifying the simulation settings, saving simulation resources, and improving simulation efficiency. Therefore, after building a target simulation environment corresponding to the target environment type based on the target domain name, any target subdomain contained in the target domain name can be input into the target simulation environment to obtain a simulation result of abnormal domain behavior.

[0185] The embodiment of the present application responds to a domain name abnormal behavior simulation request and determines a target domain name that needs to be simulated for resolution from the domain name abnormal behavior simulation request; determines multiple real service nodes associated with the target domain name when performing domain name resolution in an Internet environment, and the multiple real service nodes communicate with each other through their respective routing nodes; through a container cluster manager, deploys simulation nodes corresponding to each real service node and each routing node respectively, so as to build a simulation node topology structure according to the multiple simulation nodes; obtains node status data of each real service node and each routing node in the Internet environment, and injects each group of node status data into the simulation node corresponding to the simulation node topology structure to generate a corresponding initial simulation environment; wherein the target domain name corresponds to different Internet Protocol addresses in the Internet environment and the initial simulation environment respectively; determines the target environment type to be simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjusts the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type; obtains any target subdomain contained in the target domain name, and inputs the target subdomain into the target simulation environment for simulation to obtain a domain name abnormal behavior simulation result. In this way, it is possible to build an initial simulation environment that is highly similar to the Internet environment in advance, allowing the object data corresponding to different target environment types in the initial simulation environment to be adjusted under controlled conditions to simulate various risk behaviors that the domain name system may encounter, and test the response of the domain name system when facing various potential risks, thereby greatly shortening the time cycle from problem discovery to problem resolution, so as to timely discover the weak links in the system and take measures to repair them before the actual attack occurs, effectively improving the security and stability of the system, and ensuring that even in the face of complex network security threats, it can maintain a good response capability. In summary, this application will not affect the actual Internet environment during the simulation process, and can timely discover and solve potential problems in the domain name system when responding to risks while maintaining system stability.

[0186] In some implementations, in order to simulate the entire process of domain name resolution in the target simulation environment, a query can be performed through the corresponding simulation node, and finally a simulation result of abnormal behavior of the domain name can be obtained, so as to safely test and evaluate various defense strategies and countermeasures to ensure that potential security risks can be effectively addressed. Exemplarily, the types of simulation nodes include at least a root domain name simulation node, a recursive simulation node, a top-level domain simulation node, and an authoritative name simulation node. The step 106 of "inputting the target subdomain name into the target simulation environment for simulation to obtain a simulation result of abnormal behavior of the domain name" can include:

[0187] (106.1) inputting the target subdomain into the target simulation environment, and determining the corresponding recursive simulation node from the target simulation environment according to the target subdomain;

[0188] (106.2) Determine the root domain name simulation node corresponding to the target subdomain name by recursively simulating the node;

[0189] (106.3) Obtain the top-level domain of the target subdomain, and transmit the first address of the top-level domain simulation node to the recursive simulation node based on the top-level domain through the root domain simulation node;

[0190] (106.4) Accessing the top-level domain simulation node based on the first address through the recursive simulation node to obtain the authoritative name simulation node address of the target subdomain name;

[0191] (106.5) Through the recursive simulation node, the authoritative name simulation node is accessed based on the authoritative name simulation node address, so that the authoritative name simulation node returns the domain name abnormal behavior simulation result corresponding to the target subdomain name by querying the subdomain name resolution record of the target subdomain name.

[0192] Among them, the root domain name simulation node can be a virtual node used to simulate the root domain name server function in the target simulation environment. The root domain name server is the highest-level server in the domain name system and is responsible for responding to query requests for top-level domain names (such as ".com", ".org", etc.).

[0193] The recursive simulation node may be a virtual node that simulates the recursive domain name system resolver function in the target simulation environment, and is used to execute a complete domain name system query process in the target simulation environment and return the final result to the module that initiated the query.

[0194] Among them, the top-level domain simulation node can be a virtual node that simulates the function of a specific top-level domain name server in the target simulation environment. Each top-level domain simulation node is responsible for storing and providing authoritative information related to a specific top-level domain name, such as ".com", ".net", etc. The top-level domain simulation node can receive queries from recursive simulation nodes and direct the query requests to specific authoritative name simulation nodes.

[0195] The authoritative name simulation node can be a virtual node that simulates the functions of the authoritative server in the target simulation environment, and is at least responsible for storing and providing the resolution records of the target domain name and its target subdomain name. When receiving a query request for a domain name within its management scope, the authoritative name simulation node will directly return the corresponding Internet Protocol address.

[0196] The first address may be an Internet Protocol address or other network identifier of a top-level domain simulation node, which is used for a recursive simulation node to access the top-level domain simulation node.

[0197] The authoritative name simulation node address may be an Internet Protocol address or other network identifier of the authoritative name simulation node, which is used for the recursive simulation node to access the authoritative name simulation node.

[0198] The subdomain name resolution record may be a resource record stored in an authoritative name simulation node, and is used to describe a mapping relationship between a target subdomain name and a corresponding Internet protocol address.

[0199] For example, if the target subdomain is www.example.com, if you need to test the response of the target simulation environment when the target subdomain is hijacked or tampered, you can enter the target subdomain in the simulation console. Further, after receiving the simulation request, the target simulation environment can determine the corresponding recursive simulation node, if the Internet Protocol address of the recursive simulation node is 192.168.1.5.

[0200] Furthermore, after the recursive simulation node starts the resolution process, it can query the root domain name simulation node through the preset Internet Protocol address of the root domain name simulation node (eg, 192.168.1.10) to obtain the information of the top-level domain name server.

[0201] Further, after receiving the query, the root domain name simulation node identifies that the top-level domain of the target subdomain is ".com", and returns the first address of the top-level domain simulation node responsible for ".com", for example, the first address is 192.168.1.20.

[0202] Further, the recursive simulation node can use the first address 192.168.1.20 of the top-level domain simulation node to send a query to inquire about the authoritative information about example.com. The top-level domain simulation node 192.168.1.20 returns the authoritative name simulation node address of example.com to the recursive simulation node. Assume that the IP address of the authoritative name simulation node is 192.168.1.30. The recursive simulation node uses the address 192.168.1.30 of the authoritative name simulation node to send a final query to request the specific resolution record of www.example.com.

[0203] It should be noted that, since the target subdomain has been hijacked and tampered with, after the authoritative name simulation node queries the tampered subdomain resolution record, what is ultimately returned to the recursive simulation node is the tampered Internet Protocol address, rather than the original correct Internet Protocol address. After receiving the tampered Internet Protocol address, the domain name system will respond accordingly. At this point, the response of the domain name system can be observed, and the simulation result of the abnormal behavior of the domain name corresponding to the target subdomain can be returned.

[0204] Through the above methods, without affecting the real Internet environment, in a safe and controllable target simulation environment, the risks that the target subdomain may encounter in the actual Internet environment can be predicted and analyzed, which helps to identify potential security vulnerabilities, develop and verify defense strategies, and improve the robustness and security of the domain name system, thereby better protecting domain names from hijacking and other network attacks in the real world.

[0205] In some implementations, in order to more effectively respond to potential security threats, the simulation results can be compared with the analysis results in the real environment to identify whether the system has achieved active and effective defense in the corresponding risks, and the attack and defense strategy parameters of the domain name system can be adjusted accordingly, so that the domain name system can better respond to different risks. For example, after "inputting the target subdomain name into the target simulation environment for simulation to obtain the simulation result of abnormal behavior of the domain name" in step 106, it can also include:

[0206] (A.1) inputting the target subdomain into the Internet environment to obtain a first Internet Protocol address corresponding to the target subdomain;

[0207] (A.2) comparing the domain name abnormal behavior simulation result with the first Internet Protocol address to obtain a comparison result;

[0208] (A.3) When the comparison result indicates that the first Internet Protocol address and the domain name abnormal behavior simulation result are inconsistent, the attack and defense strategy parameters of the domain name system are adjusted.

[0209] The first Internet Protocol address may be an Internet Protocol address corresponding to the target subdomain in an actual Internet environment (where there is no risk), and the first Internet Protocol address is a real resolution result of the target subdomain.

[0210] The comparison result may be a conclusion obtained by comparing the simulation result of abnormal behavior of the domain name obtained in the target simulation environment with the first Internet Protocol address obtained in the actual Internet environment.

[0211] Among them, the attack and defense strategy parameters can be a series of settings and rules used to define and adjust network security protection measures. The attack and defense strategy parameters can include but are not limited to firewall rules, access control lists, intrusion detection system / intrusion prevention system configurations, etc. By adjusting the attack and defense strategy parameters, the protection capabilities of the domain name system can be enhanced in a targeted manner.

[0212] For example, if in an Internet environment where there is no risk, the target subdomain name (such as www.example.com) is entered into the DNS resolution system to obtain its corresponding first Internet Protocol address (assuming it is 93.184.216.34). In the target simulation environment, after simulating abnormal behaviors such as domain name hijacking and tampering, the Internet Protocol address included in the domain name abnormal behavior simulation result corresponding to the target subdomain name is 192.168.1.100. Then, the domain name abnormal behavior simulation result and the first Internet Protocol address are compared, and the comparison result can be obtained to indicate that the Internet Protocol addresses in the simulation environment and the real environment do not match, which indicates that the abnormal behavior simulated in the target simulation environment has successfully hijacked the domain name.

[0213] Furthermore, the attack and defense measurement parameters of the domain name system can be adjusted based on the above comparison results, such as updating firewall rules to block access to malicious Internet Protocol addresses found in the simulation, or adjusting the configuration of the intrusion detection system / intrusion prevention system to identify and defend against similar hijacking behaviors. The specific adjustments can be made based on actual conditions.

[0214] Through the above methods, potential security risks can be discovered in advance and network security protection strategies can be optimized to ensure that the domain name system can promptly identify and take effective protection measures when facing real domain name hijacking attacks, thereby improving the security and stability of the domain name system.

[0215] In some implementations, since in the same target simulation environment, the resolution of two top-level domains depends on the same authoritative name server (i.e., the authoritative name server is shared to store the resolution records of the domain name), modifying the resolution of one domain may affect the other domain. Therefore, in order to ensure that the simulation environment can correctly reproduce the association between the two, when simulating one of the domain names, it is necessary to simultaneously process the nodes of the other domain name to improve the consistency and accuracy of the domain name simulation. For example, the domain name abnormal behavior simulation method may also include:

[0216] (B.1) when there is a first authoritative name simulation node associated with any first domain name when performing domain name resolution in the Internet environment, which is the same as the authoritative name server node associated with the target domain name, modifying the Internet Protocol address corresponding to the first domain name to a fourth Internet Protocol address in the target simulation environment;

[0217] (B.2) Performing a domain name abnormal behavior simulation on the first domain name to obtain a first domain name abnormal behavior simulation result corresponding to the first domain name.

[0218] The first domain name may be any domain name that shares the same authoritative name server node with the target domain name when performing domain name resolution in an Internet environment. For example, if example.com is the target domain name and example.net also uses the same authoritative name server node, then example.net may be considered the first domain name.

[0219] The first authoritative name simulation node may be a server node instance that provides authoritative name resolution services for the first domain name and the target domain name.

[0220] Among them, the fourth Internet Protocol address can be a new Internet Protocol address used to replace the real Internet Protocol address corresponding to the original first domain name, and is used to simulate abnormal behaviors or risk situations that the first domain name may face in the target simulation environment, such as hijacking, tampering, etc.

[0221] Among them, the abnormal behavior simulation result of the first domain name can be the result data obtained after abnormal behavior simulation of the first domain name, which includes but is not limited to the domain name system response status, resolution record changes, traffic path, response time, etc.

[0222] For example, assuming that the target domain name is example.com, if it is necessary to simulate the risk of the target domain name under a certain attack in the target simulation environment to learn about the target simulation environment's ability to respond to the risk. If the top-level domain ".com" in the target domain name relies on the authoritative name service node with the Internet Protocol address of 192.0.2.1 in the Internet environment, and ".net" also relies on the authoritative name service node with the Internet Protocol address of 192.0.2.1, then it indicates that the authoritative name service node stores the specific resolution records of the domain names example.com and example.net.

[0223] It is understandable that when, during the simulation process, it is necessary to modify the root zone record of the top-level domain ".com" of the target domain name so that ".com" points to the top-level domain simulation node address in the simulation environment (for example, 192.168.1.10), the resolution of ".net" in the simulation environment will also be affected. Therefore, in order to accurately simulate this collateral impact, the entries in ".com" and ".net" in the root zone file need to be modified at the same time in the simulation so that ".com" and ".net" point to the top-level domain simulation node address in the simulation environment.

[0224] Furthermore, for the ".com" top-level domain, a domain name disappearance and tampering (or other risks) can be simulated. Since ".net" and ".com" share the same authoritative name simulation node, it is also necessary to simulate the same target simulation environment for ".net" to evaluate the impact of risk simulation of a single top-level domain on the entire domain name resolution system when sharing an authoritative server. The specific simulation process can be referred to above and will not be repeated here.

[0225] Through the above methods, the security and stability of the domain name system can be comprehensively evaluated and tested, which helps to comprehensively identify potential security vulnerabilities and maintain the consistency and accuracy of the simulation.

[0226] Please refer to Figure 1 and Figure 7 In some embodiments, in combination Figure 1 and Figure 7 , the overall process of this application is introduced.

[0227] Exemplarily, a user may send a domain name abnormal behavior simulation request through an application on a terminal. After receiving the domain name abnormal behavior simulation request, the simulation console may assign the task to a corresponding simulation module according to the request content.

[0228] Furthermore, the simulation console can send BGP instructions to the network simulation module to simulate the behavior of the border gateway protocol. The network simulation module executes the BGP instructions, deploys multiple routing simulation nodes, and feeds back the execution status to the simulation status perception module. At the same time, the simulation console also sends system instructions to the system simulation module to simulate the real service nodes of the entire domain name system. The system simulation module executes the system instructions, deploys multiple real service nodes associated with the target domain name when performing domain name resolution in the Internet environment, obtains the corresponding root domain name simulation node, recursive simulation node, top-level domain simulation node and authoritative name simulation node, etc., and feeds back the execution status to the simulation console.

[0229] Furthermore, the node status data of each simulation node can be collected and injected into the corresponding simulation node to generate an initial simulation environment. After that, the target simulation environment can be obtained by adjusting the object data corresponding to the target simulation environment. Furthermore, the target subdomain name can be input into the target simulation environment. During the simulation process, the simulation data of each simulation node and the simulation results of the abnormal behavior of the domain name of the target simulation environment can be collected by the simulation state perception module. The simulation state perception module can pass the collected simulation data to the simulation visualization module, and the simulation visualization module generates visualization results based on these simulation data so that the user can intuitively understand the current state of the simulation environment. The simulation console can feed back the simulation results of the abnormal behavior of the domain name to the user side, so that the user can understand the execution of the simulation operation requested by him.

[0230] The embodiment of the present application responds to a domain name abnormal behavior simulation request and determines a target domain name that needs to be simulated for resolution from the domain name abnormal behavior simulation request; determines multiple real service nodes associated with the target domain name when performing domain name resolution in an Internet environment, and the multiple real service nodes communicate with each other through their respective routing nodes; through a container cluster manager, deploys simulation nodes corresponding to each real service node and each routing node respectively, so as to build a simulation node topology structure according to the multiple simulation nodes; obtains node status data of each real service node and each routing node in the Internet environment, and injects each group of node status data into the simulation node corresponding to the simulation node topology structure to generate a corresponding initial simulation environment; wherein the target domain name corresponds to different Internet Protocol addresses in the Internet environment and the initial simulation environment respectively; determines the target environment type to be simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjusts the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type; obtains any target subdomain contained in the target domain name, and inputs the target subdomain into the target simulation environment for simulation to obtain a domain name abnormal behavior simulation result. In this way, it is possible to build an initial simulation environment that is highly similar to the Internet environment in advance, allowing the object data corresponding to different target environment types in the initial simulation environment to be adjusted under controlled conditions to simulate various risk behaviors that the domain name system may encounter, and test the response of the domain name system when facing various potential risks, thereby greatly shortening the time cycle from problem discovery to problem resolution, so as to timely discover the weak links in the system and take measures to repair them before the actual attack occurs, effectively improving the security and stability of the system, and ensuring that even in the face of complex network security threats, it can maintain a good response capability. In summary, this application will not affect the actual Internet environment during the simulation process, and can timely discover and solve potential problems in the domain name system when responding to risks while maintaining system stability.

[0231] See also Figure 8 The embodiment of the present application further provides a domain name abnormal behavior simulation device, which can implement the above-mentioned domain name abnormal behavior simulation method, and the domain name abnormal behavior simulation device includes:

[0232] A response module 81 is used to respond to the domain name abnormal behavior simulation request and determine a target domain name that needs to be resolved and simulated from the domain name abnormal behavior simulation request;

[0233] A determination module 82, used to determine multiple real service nodes associated with the target domain name when performing domain name resolution in the Internet environment, and the multiple real service nodes communicate with each other through their respective routing nodes;

[0234] A deployment module 83, used to deploy each real service node and each simulation node corresponding to each routing node through a container cluster manager, so as to construct a simulation node topology structure according to the multiple simulation nodes;

[0235] A generating module 84 is used to obtain node status data of each real service node and each routing node in the Internet environment, and inject each set of node status data into the simulation node corresponding to the simulation node topology structure to generate a corresponding initial simulation environment; wherein the target domain name corresponds to different Internet protocol addresses in the Internet environment and the initial simulation environment respectively;

[0236] The conversion module 85 is used to determine the target environment type to be simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjust the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type;

[0237] The simulation module 86 is used to obtain any target subdomain contained in the target domain name, and input the target subdomain into the target simulation environment for simulation to obtain a simulation result of abnormal behavior of the domain name.

[0238] The specific implementation of the domain name abnormal behavior simulation device is basically the same as the specific implementation of the domain name abnormal behavior simulation method described above, and will not be repeated here. On the premise of meeting the requirements of the embodiment of this application, the domain name abnormal behavior simulation device can also be provided with other functional modules to implement the domain name abnormal behavior simulation method in the above embodiment.

[0239] The embodiment of the present application also provides a computer device, the computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned domain name abnormal behavior simulation method when executing the computer program. The computer device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0240] See also Fig. 9 , Fig. 9 The hardware structure of a computer device according to another embodiment is shown, and the computer device includes:

[0241] The processor 91 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0242] The memory 92 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 92 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 92, and the processor 91 calls and executes the domain name abnormal behavior simulation method of the embodiment of this application;

[0243] Input / output interface 93, used to implement information input and output;

[0244] Communication interface 94, used to realize communication interaction between the device and other devices, which can be realized by wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0245] A bus 95 that transmits information between the various components of the device (e.g., the processor 91, the memory 92, the input / output interface 93, and the communication interface 94);

[0246] The processor 91 , the memory 92 , the input / output interface 93 and the communication interface 94 are connected to each other in communication within the device via a bus 95 .

[0247] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned domain name abnormal behavior simulation method is implemented.

[0248] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0249] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0250] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0251] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0252] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0253] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0254] It should be understood that in the present application, "at least one (item)" and "several" refer to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and subsequent associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0255] In the several embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0256] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0257] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0258] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0259] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A method for simulating abnormal behavior of a domain name, characterized in that: The method comprises: Responding to a domain name abnormal behavior simulation request, and determining a target domain name that needs to be parsed and simulated from the domain name abnormal behavior simulation request; Determine multiple real service nodes associated with the target domain name when performing domain name resolution in an Internet environment, wherein the multiple real service nodes communicate with each other through respective routing nodes; Through the container cluster manager, each real service node and each routing node corresponding to the simulation node are deployed respectively to build a simulation node topology structure according to the multiple simulation nodes; Obtaining node status data of each real service node and each routing node in the Internet environment, and injecting each set of node status data into the simulation node corresponding to the simulation node topology structure, to generate a corresponding initial simulation environment; wherein the target domain name corresponds to different Internet Protocol addresses in the Internet environment and the initial simulation environment respectively; Determine the target environment type to be simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjust the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type; Obtain any target subdomain contained in the target domain name, and input the target subdomain into the target simulation environment for simulation to obtain a simulation result of abnormal behavior of the domain name.

2. The method for simulating abnormal behavior of a domain name according to claim 1, characterized in that: The types of the simulation nodes include at least a root domain name simulation node, a recursive simulation node, a top-level domain simulation node, and an authoritative name simulation node. The target subdomain name is input into the target simulation environment for simulation to obtain a simulation result of abnormal behavior of the domain name, including: Inputting the target subdomain name into the target simulation environment, and determining a corresponding recursive simulation node from the target simulation environment according to the target subdomain name; Determine the root domain name simulation node corresponding to the target subdomain name through the recursive simulation node; Acquire the top-level domain of the target subdomain name, and transmit the first address of the top-level domain simulation node to the recursive simulation node based on the top-level domain through the root domain name simulation node; Accessing the top-level domain simulation node based on the first address through the recursive simulation node to obtain the authoritative name simulation node address of the target subdomain name; Through the recursive simulation node, the authoritative name simulation node is accessed based on the authoritative name simulation node address, so that the authoritative name simulation node returns the domain name abnormal behavior simulation result corresponding to the target subdomain name by querying the subdomain name resolution record of the target subdomain name.

3. The method for simulating abnormal behavior of a domain name according to claim 1, characterized in that: After inputting the target subdomain name into the target simulation environment for simulation and obtaining the simulation result of abnormal behavior of the domain name, the method further includes: Inputting the target subdomain into the Internet environment to obtain a first Internet Protocol address corresponding to the target subdomain; Compare the domain name abnormal behavior simulation result with the first Internet Protocol address to obtain a comparison result; When the comparison result indicates that the first Internet Protocol address and the domain name abnormal behavior simulation result are inconsistent, the attack and defense strategy parameters of the domain name system are adjusted.

4. The method for simulating abnormal behavior of a domain name according to claim 1, characterized in that: The target environment type is service outage, the object data is an access control list, and the adjusting the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type includes: In the initial simulation environment, determining a domain name resolution configuration module of the target domain name in a corresponding authoritative name simulation node; An access control list is set in the domain name resolution configuration module, and the Internet Protocol address segment where the recursive simulation node corresponding to the target domain name is located is added to the access control list to restrict the recursive simulation node from accessing the domain name resolution record stored in the authoritative name simulation node; A target simulation environment corresponding to the target environment type is updated.

5. The method for simulating abnormal behavior of a domain name according to claim 1, characterized in that: The target environment type is disconnection and service suspension, and the object data includes a restricted access list; and the adjusting of the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type also includes: In the initial simulation environment, determining a target routing node of the target domain name in an authoritative name simulation node; Establishing a restricted access list in the routing configuration of the target routing node, and adding the Internet Protocol address segment where the recursive simulation node corresponding to the target domain name is located to the restricted access list to limit the traffic data sent by the recursive simulation node to the authoritative name simulation node; A target simulation environment corresponding to the target environment type is updated.

6. The method for simulating abnormal behavior of a domain name according to claim 1, characterized in that: The target environment type is domain name disappearance and tampering, the object data includes a target zone file, and the corresponding object data is adjusted in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type, and further includes: In the initial simulation environment, determining an authoritative name simulation node corresponding to the target domain name; In the authoritative name simulation node, a target zone file is determined; wherein the target zone file is at least used to store a mapping relationship between the target domain name and the corresponding second Internet Protocol address; In the target zone file, deleting the resource record corresponding to the target domain name; A target simulation environment corresponding to the target environment type is updated.

7. The method for simulating abnormal behavior of a domain name according to claim 1, characterized in that: The target environment type is domain name hijacking and tampering, the object data includes a target zone file, and the corresponding object data is adjusted in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type, and further includes: In the initial simulation environment, determining an authoritative name simulation node corresponding to the target domain name; In the authoritative name simulation node, a target zone file is determined; wherein the target zone file is at least used to store a mapping relationship between the target domain name and the corresponding second Internet Protocol address; In the target area file, modifying the second Internet Protocol address to a third Internet Protocol address; wherein the third Internet Protocol address points to an abnormal network page; A target simulation environment corresponding to the target environment type is updated.

8. The method for simulating abnormal behavior of a domain name according to claim 1, characterized in that: The container cluster manager is used to deploy each real service node and each simulation node corresponding to each routing node, respectively, so as to construct a simulation node topology structure according to the multiple simulation nodes, including: Deploy each real service node and each routing node's corresponding simulation node in at least one virtual server node through a container cluster manager; Based on the border gateway protocol, network data is deployed for each simulation node corresponding to each routing node, and a simulation node topology structure is constructed according to the deployed multiple simulation nodes.

9. The method for simulating abnormal behavior of a domain name according to claim 1, characterized in that: The method further comprises: When there is a first authoritative name simulation node associated with any first domain name when performing domain name resolution in the Internet environment, which is the same as the authoritative name server node associated with the target domain name, modifying the Internet Protocol address corresponding to the first domain name to a fourth Internet Protocol address in the target simulation environment; Performing a domain name abnormal behavior simulation on the first domain name to obtain a first domain name abnormal behavior simulation result corresponding to the first domain name.

10. A domain name abnormal behavior simulation device, characterized in that: The device comprises: A response module, used to respond to the domain name abnormal behavior simulation request, and determine the target domain name that needs to be resolved and simulated from the domain name abnormal behavior simulation request; A determination module, used to determine a plurality of real service nodes associated with the target domain name when performing domain name resolution in an Internet environment, wherein the plurality of real service nodes communicate with each other through respective routing nodes; A deployment module, used to deploy each real service node and each simulation node corresponding to the routing node through a container cluster manager, so as to construct a simulation node topology structure according to the multiple simulation nodes; A generation module, used for obtaining node status data of each real service node and each routing node in the Internet environment, and injecting each set of node status data into the simulation node corresponding to the simulation node topology structure, to generate a corresponding initial simulation environment; wherein the target domain name corresponds to different Internet protocol addresses in the Internet environment and the initial simulation environment respectively; A conversion module, used to determine the target environment type simulated in the initial simulation environment according to the domain name abnormal behavior simulation request, and adjust the corresponding object data in the initial simulation environment to convert the initial simulation environment into a target simulation environment corresponding to the target environment type; The simulation module is used to obtain any target subdomain name contained in the target domain name, and input the target subdomain name into the target simulation environment for simulation to obtain a simulation result of abnormal behavior of the domain name.

11. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the domain name abnormal behavior simulation method according to any one of claims 1 to 9 when executing the computer program.

12. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the domain name abnormal behavior simulation method according to any one of claims 1 to 9 is implemented.

Images