External connection information carrying evidence obtaining method and system based on embedded DNS code

Abstract

The embodiment of the invention provides an external connection information carrying evidence obtaining method and system based on an embedded DNS code, and the method comprises the steps: collecting the whole network flow through a data mirroring mode, and capturing an external access request of a detected terminal for an access page; dynamically generating a detection code according to the IP address of the detected terminal, wherein the detection code comprises evidence obtaining information; embedding the detection code into the access page so as to trigger a DNS analysis request under the condition that the access page is accessed by the detected terminal; and based on the DNS analysis request, extracting, generating and storing illegal external connection information.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for collecting evidence based on external information embedded in DNS code. Background Art

[0002] Terminals in the internal LAN that are not connected to the Internet are connected to the Internet through wireless network cards, mobile hotspots, 4G / 5G networks, etc., or are connected to the Internet through privately built illegal Internet exits in office networks that provide public Internet exits. This illegal external connection poses a huge threat to the host security and data security of the internal network, and is likely to lead to multiple security issues such as the spread of Trojans / mining viruses, data theft, and silent monitoring.

[0003] In order to prevent illegal external connections, in the prior art, a monitoring method based on the TCP protocol is usually used. However, due to the characteristics of the TCP protocol, it is necessary to complete a three-way handshake (i.e., SYN, SYN-ACK, ACK) or wait for the handshake return result to time out in order to determine whether the terminal has generated an illegal external connection. This process is relatively slow, especially in a large-scale network environment, so there are freezes and delays in the detection process. In addition, this delay will cause a bad experience for network users, especially in high-concurrency access, which may affect the response speed of the overall network. Not only that, since the TCP connection establishment process is relatively long, the network connection of the detected terminal may be interrupted or suspended during detection, affecting other normal operations. Summary of the invention

[0004] The present invention provides a method, system, electronic device and storage medium for collecting evidence based on external connection information embedded in DNS code, aiming to solve at least the following technical problems: (1) low efficiency in monitoring illegal external connections; (2) degradation of the response speed of the overall network; and (3) limitation of other normal network operations.

[0005] Specifically, the embodiment of the present invention provides the following technical solutions: In a first aspect, an embodiment of the present invention provides a method for collecting evidence based on external information embedded in a DNS code, comprising: Collect the entire network traffic through data mirroring and capture the external access requests of the inspected terminal for access pages; Dynamically generate a detection code according to the IP address of the detected terminal, wherein the detection code includes evidence collection information; Embedding the detection code into the access page to trigger a DNS resolution request when the access page is accessed by the detected terminal; Based on the DNS resolution request, illegal external connection information is extracted, generated and stored.

[0006] Furthermore, the method further comprises: The field of the forensic information is carried in the detection code in the form of a domain name.

[0007] Furthermore, the method further comprises: The domain name includes at least the domain name of the illegal external connection evidence collection server, the authorized user ID of the intranet illegal external connection detection system, the product serial number of the intranet illegal external connection detection system, and the IP address of the inspected terminal.

[0008] Furthermore, the method further comprises: The step of embedding the detection code into the access page to trigger a DNS resolution request when the access page is accessed by the detected terminal includes: Checking whether there is a resolution result corresponding to the domain name in the local DNS cache; Check whether there is a resolution result corresponding to the domain name in the local Hosts file; Submit query requests to the local DNS server step by step to obtain the resolution result corresponding to the domain name.

[0009] Furthermore, the method further comprises: The checking whether there is a resolution result corresponding to the domain name in the local DNS cache, checking whether there is a resolution result corresponding to the domain name in the local Hosts file, and submitting query requests to the local DNS server step by step to obtain the resolution result corresponding to the domain name, includes: If the local DNS cache contains a resolution result corresponding to the domain name, the IP address corresponding to the domain name is returned. If there is no resolution result corresponding to the domain name in the local DNS cache, check whether there is a resolution result corresponding to the domain name in the local Hosts file, If the local Hosts file contains a resolution result corresponding to the domain name, the IP address corresponding to the domain name is returned. If there is no resolution result corresponding to the domain name in the local Hosts file, check whether there is a resolution result corresponding to the domain name in the local DNS server, or When there is a resolution result corresponding to the domain name in the local DNS server, the IP address corresponding to the domain name is returned.

[0010] Furthermore, the method further comprises: The step of submitting query requests to the local DNS server step by step to obtain a resolution result corresponding to the domain name includes: If there is no resolution result corresponding to the domain name in the local DNS server, Submit a query request to the root domain name server through iterative query or recursive query to obtain the address of the top-level domain name server. Submit a query request to the top-level domain name server through iterative query or recursive query to obtain the address of the second-level domain name server. Submitting a query request to a secondary domain name server through iterative query or recursive query to obtain the address of the illegal external connection forensics server corresponding to a part of the domain name, Based on the address of the illegal external connection evidence collection server, the DNS resolution request is sent to the illegal external connection evidence collection server.

[0011] Furthermore, the method further comprises: Extracting, generating and storing illegal external connection information based on the DNS resolution request includes: When the illegal external connection evidence collection server receives the DNS resolution request, it does not respond to the DNS resolution request, and extracts, generates and stores the illegal external connection information from the DNS resolution request.

[0012] In a second aspect, an embodiment of the present invention further provides an external information carrying evidence collection system based on embedded DNS code, comprising: The capture request module is used to collect the whole network traffic through data mirroring and capture the external access request of the inspected terminal for the access page; A detection code generation module, used to dynamically generate a detection code according to the IP address of the detected terminal, wherein the detection code includes evidence collection information; A DNS resolution request triggering module, used for embedding the detection code into the access page to trigger a DNS resolution request when the access page is accessed by the detected terminal; The illegal external connection information processing module is used to extract, generate and store illegal external connection information based on the DNS resolution request.

[0013] Furthermore, in a third aspect, an embodiment of the present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned external information carrying forensics method based on embedded DNS code when executing the program.

[0014] Furthermore, in a fourth aspect, an embodiment of the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the above-mentioned external information carrying forensics method based on embedded DNS code are implemented.

[0015] It can be seen from the above technical solutions that the embodiment of the present invention provides a method for collecting evidence based on external information carried by embedded DNS code and a system for collecting evidence based on external information carried by embedded DNS code, which aims to detect illegal external connections by using the UDP protocol, and at least solve the following problems: (1) the low efficiency of monitoring illegal external connections; (2) the degradation of the response speed of the overall network; (3) the limitation of other normal network operations. The embodiment of the present invention provides a method for collecting evidence based on embedded DNS code and a system for collecting evidence based on embedded DNS code, which at least achieves: (1) significantly improving the detection efficiency of illegal external connections; (2) significantly enhancing the concealment of network defense behavior for monitoring illegal external connections; (3) significantly reducing the waste of resources caused by monitoring illegal external connections; (4) significantly improving the user network experience during the monitoring of illegal external connections. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 A flowchart of a method for collecting evidence based on external information embedded in DNS code provided by an embodiment of the present invention; Figure 2 A schematic diagram of the structure of an external information evidence collection system based on embedded DNS code provided by an embodiment of the present invention; and Figure 3 A schematic diagram of an electronic device provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] The various terms or phrases used in the present invention have the general meanings known to those of ordinary skill in the art. Even so, the present invention still hopes to provide a more detailed description and explanation of these terms or phrases. If the terms and phrases involved in this article are inconsistent with the commonly known meanings, the meanings expressed in the present invention shall prevail; and if not defined in this application, they have the meanings commonly understood by those of ordinary skill in the art.

[0020] The existing technology has many problems including but not limited to the following: (1) low efficiency in monitoring illegal external connections; (2) deterioration of the overall network response speed; and (3) restriction of other normal network operations.

[0021] In view of this, in a first aspect, an embodiment of the present invention proposes a method for carrying and collecting evidence based on external information embedded in DNS code.

[0022] Combine the following Figure 1 The invention describes the external information carrying evidence collection method based on embedded DNS code.

[0023] Figure 1 A flowchart of a method for collecting evidence based on external information embedded in DNS code provided by an embodiment of the present invention.

[0024] In this embodiment, it should be noted that the external information evidence collection method based on embedded DNS code can at least include the following steps: S100: Collect the entire network traffic through data mirroring to capture the external access request of the inspected terminal for access pages; S200: dynamically generate a detection code according to the IP address of the terminal under inspection, the detection code including evidence collection information; S300: embedding the detection code into the access page to trigger a DNS resolution request when the access page is accessed by the detected terminal; S400: Extract, generate and store illegal external connection information based on the DNS resolution request.

[0025] In this embodiment, it should be noted that, for S200, the external information carrying evidence collection method based on embedded DNS code may also include: the field of the evidence collection information is carried in the detection code in the form of a domain name.

[0026] In this embodiment, it should be noted that, for S200, the external connection information carrying evidence collection method based on embedded DNS code can also include: the domain name includes at least the domain name of the illegal external connection evidence collection server, the authorized user ID of the intranet illegal external connection detection system, the product serial number of the intranet illegal external connection detection system, and the IP address of the inspected terminal.

[0027] Specifically, in this embodiment, the example extended domain name structure can be {IP address of the detected terminal}.{system product serial number}.{system authorized user ID}.{illegal external connection forensics server domain name}, for example 192.168.1.1.NAD202308220001.20.huafoun.info. Based on the construction of the above domain name structure, this embodiment of the present invention can achieve faster illegal external connection forensics based on DNS with less data acquisition and shorter detection code generation time, thereby optimizing the overall detection time and improving user experience.

[0028] Specifically, in a further embodiment, the domain name structure of the forensic information in the detection code can be expanded or adjusted according to actual needs. In addition to the domain name of the illegal external connection forensics server, the authorized user ID of the intranet illegal external connection detection system, the product serial number of the intranet illegal external connection detection system, and the IP address of the inspected terminal, the field of the forensic information can also add other fields, such as network environment related fields, time and operation identification fields, terminal device information fields, security event related fields, system and business related fields, so as to improve the forensic effect and conduct accurate subsequent analysis and management.

[0029] More specifically, the network environment-related fields can distinguish different network environments to facilitate rapid problem location, and the network environment-related fields may include but are not limited to: intranet subnet information, identifying the intranet subnet where the detected terminal is located, such as subnet123; network device ID, identifying the network device to which the detected terminal is connected, such as a unique identifier of a switch or router; network area code: identifying the area or branch network covered by the detection system, such as region001.

[0030] More specifically, the time and operation identification fields can facilitate tracking the specific time and operation background of the event, and the time and operation identification fields may include but are not limited to: timestamp, recording the time when the detection code was generated, such as 20241129T101500; operator ID, if the detection process involves manual operation by the administrator, the operator ID can be added for subsequent accountability, etc.

[0031] More specifically, the terminal device information field can improve positioning accuracy, and the terminal device information field may include but is not limited to: device MAC address, identifying the unique physical address of the detected terminal, such as 00:1A:2B:3C:4D:5E; device type, identifying the type of terminal, such as PC, server, mobile device, etc.), such as deviceType_PC; device operating system version, marking the operating system and its version used by the terminal, such as Windows10_Pro.

[0032] More specifically, the security event related fields can provide more detailed information support for specific illegal external connection events, and may include but are not limited to: event number, identifying the specific illegal external connection event, such as event12345; illegal external connection behavior type, used to describe the type of external connection behavior, such as private_hotspot or 4G_network.

[0033] More specifically, the system and business related fields may be fields related to business logic or system configuration, and may provide administrators with more background information, including but not limited to: a system version number, identifying the current version of the illegal outbound contact detection system, such as sysVersion1.2.3; a business department code, identifying the business department to which the illegal outbound contact terminal belongs, such as Dept_Sales.

[0034] In a further embodiment, the example expanded domain name structure can be {terminal IP}.{MAC address}.{device type}.{operating system}.{subnet information}.{event number}.{violation type}.{authorized user ID}.{product serial number}.{forensic server domain name}, for example, 192.168.1.1.00-1A-2B-3C-4D-5E.PC.Windows10.subnet123.event12345.private_hotspot.userID20.NAD 20230822.huafoun.info.

[0035] In addition, it should be noted that according to the embodiments of the present invention, when expanding the domain name structure, the number of fields and the length limit of the domain name will be further considered, and privacy and security will also be taken into consideration. For example, some fields (such as user ID or MAC address) may involve privacy issues and are encrypted or desensitized when publicly transmitted. Moreover, according to the embodiments of the present invention, when expanding the domain name structure, system compatibility will be further considered to ensure that the newly added fields can be correctly processed by DNS resolution and server records to avoid exceeding the resolution capacity.

[0036] In this embodiment, it should be noted that, for S300, the external information carrying forensics method based on embedded DNS code can also include: embedding the detection code into the access page to trigger a DNS resolution request when the access page is accessed by the inspected terminal, including: checking whether there is a resolution result corresponding to the domain name in the local DNS cache; checking whether there is a resolution result corresponding to the domain name in the local Hosts file; submitting query requests to the local DNS server step by step to obtain the resolution result corresponding to the domain name.

[0037] In this embodiment, it should be noted that, for S300, the external information carrying evidence collection method based on embedded DNS code may also include: checking whether there is a resolution result corresponding to the domain name in the local DNS cache, checking whether there is a resolution result corresponding to the domain name in the local Hosts file, and submitting query requests to the local DNS server step by step to obtain the resolution result corresponding to the domain name, including: if there is a resolution result corresponding to the domain name in the local DNS cache, returning the IP address corresponding to the domain name, if there is no resolution result corresponding to the domain name in the local DNS cache, checking whether there is a resolution result corresponding to the domain name in the local Hosts file, if there is a resolution result corresponding to the domain name in the local Hosts file, returning the IP address corresponding to the domain name, if there is no resolution result corresponding to the domain name in the local Hosts file, checking whether there is a resolution result corresponding to the domain name in the local DNS server, or if there is a resolution result corresponding to the domain name in the local DNS server, returning the IP address corresponding to the domain name.

[0038] In this embodiment, it should be noted that, for S300, the external information carrying evidence collection method based on embedded DNS code may also include: submitting query requests to the local DNS server step by step to obtain the resolution result corresponding to the domain name, including: when there is no resolution result corresponding to the domain name in the local DNS server, submitting a query request to the root domain name server through iterative query or recursive query to obtain the address of the top-level domain name server, submitting a query request to the top-level domain name server through iterative query or recursive query to obtain the address of the second-level domain name server, submitting a query request to the second-level domain name server through iterative query or recursive query to obtain the address of the illegal external information collection server corresponding to a part of the domain name, and sending a DNS resolution request to the illegal external information collection server based on the address of the illegal external information collection server.

[0039] Specifically, in an embodiment of the present application, for querying a root domain name server, a local DNS server or a client sends a query request to the root domain name server, and the root domain name server returns the address of a top-level domain name server associated with a target top-level domain name (eg, .info).

[0040] Specifically, in the embodiment of the present application, for querying the top-level domain name server, after receiving the response from the root domain name server, the local DNS server or client continues to send a query request to the top-level domain name server. The top-level domain name server returns the authoritative DNS server address related to the second-level domain name (such as huafoun.info).

[0041] Specifically, in an embodiment of the present application, with respect to querying a secondary domain name server, a local DNS server or a client sends a query request to the secondary domain name server, and the secondary domain name server returns the address of an illegal external connection forensics server associated with a specific monitored domain name (e.g., 192.168.1.1.userID20.NAD20230822.huafoun.info).

[0042] Specifically, in an embodiment of the present application, in order to query the illegal external connection forensics server, the local DNS server or client sends a resolution request to the illegal external connection forensics server address, hoping to obtain the IP address corresponding to the complete domain name, and then the resolution request reaches the illegal external connection forensics server, triggering the next step of logic.

[0043] Specifically, in the embodiments of the present application, with respect to a part of a domain name and the domain name itself, it is explained as follows: a part of a domain name can be understood as a specific monitoring domain name, which is a partial expression of the complete domain name, and is used as a basis for guiding the next step of parsing during the parsing process. The difference between the specific monitoring domain name and the complete domain name is mainly reflected in the structural level and the context of use.

[0044] More specifically, part of a domain name, namely a specific monitoring domain name, is an intermediate level in the domain name resolution chain, usually referring to the target domain name that has reached a certain stage of resolution (such as the domain name managed by the secondary domain name server), such as huafoun.info or 20.huafoun.info. Its resolution range is the address returned by the upper-level DNS server and pointing to the lower-level DNS server. Its usage scenario is that the top-level domain name server returns the authoritative server address related to the specific monitoring domain name.

[0045] Specifically, in the embodiments of the present application, for the full domain name, the full domain name is the full domain name used for final target resolution, contains all hierarchical information, and can uniquely identify network resources. In the detection code proposed in the embodiments of the present application, the full domain name carries all forensic information fields and directly corresponds to the resolution target of the illegal external connection forensic server. In terms of the full amount of layering, it is composed of all hierarchical domain name fields, such as 192.168.1.1.NAD20230822.20.huafoun.info. The full domain name is the end point of the recursive or iterative resolution chain, which is handled by the illegal external connection forensic server. Its usage scenario is used when the detected terminal initiates a resolution request to the local DNS server, and the forensic server extracts the terminal's illegal external connection behavior information based on the full domain name.

[0046] Specifically, with respect to S300 , when the detected terminal accesses the target page, it attempts to load all resources embedded in the page, including, for example, the embedded detection code (such as a field including forensic information, a picture link or other external resources).

[0047] Specifically, with respect to S300, the detection code may be embedded in the form of a page element (eg, tags, script files, CSS files, etc.), so that the terminal actively sends a resource loading request to the specified monitoring domain name.

[0048] Specifically, for S300, since the embedded detection code uses a dynamically generated domain name, the terminal can resolve the domain name into an IP address through DNS resolution. From another perspective, the request initiated by the detected terminal is actually a DNS resolution request (UDP protocol) for the domain name embedded in the monitoring code, rather than a request to directly access the target page.

[0049] In an embodiment of the present application, the terminal actively accesses the target page to trigger the execution of the monitoring code, making the monitoring behavior more covert and difficult to circumvent.

[0050] Of course, in this embodiment of the present application, the process of initiating a DNS request for the terminal can also be described as follows: after obtaining the page, the detected terminal requests page elements from the specified address according to the page content. First, the domain name needs to be converted into an IP address, that is, a request is initiated to the DNS server to resolve the domain name into an IP.

[0051] The specific query process is as follows: first query the browser DNS cache, if the resolution fails, proceed to the next step; query the local Hosts file, if the resolution fails, proceed to the next step; initiate a request to the local DNS server, if the resolution fails, proceed to the next step; the local DNS client (iterative query) or the local DNS server (recursive query) requests the root domain name server for resolution, and the root domain name server returns the top-level domain name server address; the local DNS client (iterative query) or the local DNS server (recursive query) requests the top-level domain name server for resolution, and the top-level domain name server returns the domain name server address of the "huafoun.info" secondary domain name provider; the local DNS client (iterative query) or the local DNS server (recursive query) requests the domain name server of the secondary domain name provider for resolution, and returns the NAME SERVER domain name server address corresponding to this domain name, that is, the address of the illegal external forensic server; the local DNS client (iterative query) or the local DNS server (recursive query) requests the illegal external forensic server address to resolve the full domain name. The illegal external forensic server does not respond to the DNS resolution request received. After the request times out, the page skips loading this resource.

[0052] In this embodiment, it should be noted that, for S400, the external connection information carrying evidence collection method based on embedded DNS code may also include: based on the DNS resolution request, extracting, generating and storing illegal external connection information, including: when the illegal external connection evidence collection server receives the DNS resolution request, not responding to the DNS resolution request, and extracting, generating and storing illegal external connection information from the DNS resolution request.

[0053] Specifically, in an embodiment of the present application, the illegal external connection forensics server intentionally does not return any resolution results after receiving a DNS request according to the design logic. The purpose of this is to avoid returning the actual IP address and prevent the detected terminal from obtaining any valid target resource data by not responding. It can also record forensic information, that is, extract key information (such as terminal IP address, user ID, etc.) from the received DNS request.

[0054] Specifically, in an embodiment of the present application, not responding to a DNS resolution request may include, but is not limited to, intentionally setting the response to time out, etc., so that the DNS request resolution of the terminal fails, resulting in resource loading interruption, but the sending of forensic information has been completed.

[0055] Specifically, in an embodiment of the present application, extracting, generating and storing illegal external connection information from a DNS resolution request may include but is not limited to the forensic server at the final node of the DNS resolution chain, receiving a DNS resolution request from the detected terminal. Since the domain name carried in the request contains forensic information (such as terminal IP address, user ID, product serial number, etc.), etc., at least one of the following information can be extracted: the IP address of the detected terminal, the authorized user ID of the intranet detection system, the system product serial number, and the timestamp of the DNS request.

[0056] Specifically, in an embodiment of the present application, the extracted forensic information needs to be stored in a background database for subsequent analysis, and the forensic server stores the parsed key information in the database and associates it with log records for query and tracing.

[0057] Furthermore, in an embodiment of the present application, the DNS request received by the server indicates that the terminal has attempted to access the external network in an unauthorized manner (i.e., an illegal external connection behavior), and therefore at least one illegal external connection event record can be generated and stored, including at least one of the following: key information of the illegal terminal (such as IP address, user ID), the time when the illegal behavior occurred, and the unique number of the event.

[0058] Furthermore, in an embodiment of the present application, illegal external connection events can also be pushed to a management interface (such as a WEB management platform or a security operation and maintenance system) for administrators to view and process, such as isolating terminals, investigating the causes of the behavior, etc.

[0059] After receiving the request, the illegal external connection evidence collection server will record and analyze the information carried in the domain name, and store the authorized user ID of the intranet illegal external connection detection system, the product serial number of the intranet illegal external connection detection system, and the IP address of the detected terminal on the server, and prompt the occurrence of new illegal external connection events on the WEB management page.

[0060] Of course, in this embodiment of the present application, the process of receiving and recording by the evidence collection platform can also be described as follows. After receiving the request, the illegal external connection evidence collection server records and analyzes the information carried in the domain name, and stores the authorized user ID of the intranet illegal external connection detection system, the product serial number of the intranet illegal external connection detection system, and the IP address of the detected terminal on the server, and prompts the occurrence of new illegal external connection events on the WEB management page.

[0061] Based on this, it can be seen that in the embodiment of the present application, the DNS request resolution stage ensures that the terminal triggers an external access signal and sends the key information of the illegal external connection behavior to the evidence collection server, and the evidence recording and event generation stage extracts, records and analyzes these signals through the server to achieve efficient evidence collection and real-time alarm of illegal external connection behavior. The two stages are closely related and jointly complete the monitoring and disposal chain of illegal external connections. And because the UDP protocol is connectionless, the sending and receiving of data packets does not need to wait for a response, which can avoid jamming during the detection process, improve the response speed of the detection and the overall efficiency of the system. In the embodiment of the present application, detection is performed by means of DNS requests, and DNS itself is based on the UDP protocol, which makes the detection requests triggered by DNS faster and more seamless, thereby improving the user experience.

[0062] It can be seen from the above technical scheme that the embodiment of the present invention provides an external information carrying evidence collection method based on embedded DNS code, which aims to detect illegal external connections by using the UDP protocol, and at least solves (1) the low efficiency of monitoring illegal external connections; (2) the degradation of the response speed of the overall network; (3) other normal network operations are limited. The external information carrying evidence collection method based on embedded DNS code and the external information carrying evidence collection system based on embedded DNS code provided by the embodiment of the present invention at least achieve: (1) significantly improve the detection efficiency of illegal external connections; (2) significantly enhance the concealment of network defense behavior for monitoring illegal external connections; (3) significantly reduce the waste of resources caused by monitoring illegal external connections; (4) significantly improve the user network experience during the monitoring of illegal external connections.

[0063] Based on the same inventive concept, on the other hand, an embodiment of the present invention proposes an external information carrying evidence collection system based on embedded DNS code.

[0064] Combine the following Figure 2The external information carrying forensics system based on embedded DNS code provided by the present invention is described. The external information carrying forensics system based on embedded DNS code described below and the external information carrying forensics method based on embedded DNS code described above can be referenced to each other.

[0065] Figure 2 A schematic diagram of the structure of an external information carrying evidence collection system based on embedded DNS code provided in one embodiment of the present invention.

[0066] In this embodiment, it should be noted that the external information carrying forensics system 100 based on embedded DNS code includes: a capture request module 110, which is used to collect the entire network traffic through data mirroring, and capture the external access request of the inspected terminal for the access page; a detection code generation module 120, which is used to dynamically generate a detection code according to the IP address of the inspected terminal, and the detection code includes forensic information; a DNS resolution request trigger module 130, which is used to embed the detection code into the access page to trigger the DNS resolution request when the access page is accessed by the inspected terminal; an illegal external information processing module 140, which is used to extract, generate and store illegal external information based on the DNS resolution request.

[0067] It can be seen from the above technical scheme that the embodiment of the present invention provides an external information carrying evidence collection system based on embedded DNS code, which aims to detect illegal external connections by using the UDP protocol, and at least solves (1) the low efficiency of monitoring illegal external connections; (2) the degradation of the response speed of the overall network; (3) other normal network operations are limited. The external information carrying evidence collection method based on embedded DNS code and the external information carrying evidence collection system based on embedded DNS code provided by the embodiment of the present invention can at least achieve: (1) significantly improve the detection efficiency of illegal external connections; (2) significantly enhance the concealment of network defense behavior for monitoring illegal external connections; (3) significantly reduce the waste of resources caused by monitoring illegal external connections; (4) significantly improve the user network experience during the monitoring of illegal external connections.

[0068] Since the external information carrying evidence collection system based on embedded DNS code provided by the embodiment of the present invention can be used to execute the external information carrying evidence collection method based on embedded DNS code described in the above embodiment, the specific content of its working principle can be found in the introduction of the above method embodiment.

[0069] In this embodiment, it should be noted that the various modules in the external information carrying evidence collection system based on embedded DNS code in the embodiment of the present invention can be integrated into one or deployed separately. The above modules can be combined into one module or further split into multiple sub-units.

[0070] On the other hand, based on the same inventive concept, another embodiment of the present invention provides an electronic device.

[0071] Figure 3 A schematic diagram of an electronic device provided according to an embodiment of the present invention.

[0072] In this embodiment, it should be noted that the electronic device may include: a processor 310, a communication interface 320, a memory 330 and a communication bus 340, wherein the processor 310, the communication interface 320 and the memory 330 communicate with each other through the communication bus 340. The processor 310 may call the logic instructions in the memory 330 to execute the external information carrying evidence collection method based on the embedded DNS code, and the external information carrying evidence collection method based on the embedded DNS code includes: S100: collecting the whole network traffic through data mirroring, capturing the external access request of the inspected terminal for the access page; S200: dynamically generating a detection code according to the IP address of the inspected terminal, and the detection code includes evidence collection information; S300: embedding the detection code into the access page to trigger the DNS resolution request when the access page is accessed by the inspected terminal; S400: extracting, generating and storing illegal external information based on the DNS resolution request.

[0073] In addition, the logic instructions in the above-mentioned memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0074] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute an external information carrying forensics method based on embedded DNS code, and the external information carrying forensics method based on embedded DNS code includes: S100: collecting the entire network traffic through data mirroring, capturing the external access request of the inspected terminal for the access page; S200: dynamically generating a detection code according to the IP address of the inspected terminal, the detection code including forensic information; S300: embedding the detection code into the access page to trigger a DNS resolution request when the access page is accessed by the inspected terminal; S400: extracting, generating and storing illegal external information based on the DNS resolution request.

[0075] The system embodiment described above is merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

[0076] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0077] In addition, in the present invention, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0078] In addition, in the present invention, the description with reference to the terms "embodiment", "present embodiment", "another embodiment", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for collecting evidence based on external information embedded in DNS code, characterized in that: include: Collect the entire network traffic through data mirroring and capture the external access requests of the inspected terminal for access pages; Dynamically generate a detection code according to the IP address of the detected terminal, wherein the detection code includes evidence collection information; Embedding the detection code into the access page to trigger a DNS resolution request when the access page is accessed by the detected terminal; Based on the DNS resolution request, illegal external connection information is extracted, generated and stored.

2. The external information carrying evidence collection method based on embedded DNS code according to claim 1 is characterized in that: The field of the forensic information is carried in the detection code in the form of a domain name.

3. The external information carrying evidence collection method based on embedded DNS code according to claim 2 is characterized in that: The domain name includes at least the domain name of the illegal external connection evidence collection server, the authorized user ID of the intranet illegal external connection detection system, the product serial number of the intranet illegal external connection detection system, and the IP address of the inspected terminal.

4. The external information carrying evidence collection method based on embedded DNS code according to claim 2 is characterized in that: The step of embedding the detection code into the access page to trigger a DNS resolution request when the access page is accessed by the detected terminal includes: Checking whether there is a resolution result corresponding to the domain name in the local DNS cache; Check whether there is a resolution result corresponding to the domain name in the local Hosts file; Submit query requests to the local DNS server step by step to obtain the resolution result corresponding to the domain name.

5. The external information carrying evidence collection method based on embedded DNS code according to claim 4 is characterized in that: The checking whether there is a resolution result corresponding to the domain name in the local DNS cache, checking whether there is a resolution result corresponding to the domain name in the local Hosts file, and submitting query requests to the local DNS server step by step to obtain the resolution result corresponding to the domain name, includes: If the local DNS cache contains a resolution result corresponding to the domain name, the IP address corresponding to the domain name is returned. If there is no resolution result corresponding to the domain name in the local DNS cache, check whether there is a resolution result corresponding to the domain name in the local Hosts file, If the local Hosts file contains a resolution result corresponding to the domain name, the IP address corresponding to the domain name is returned. If there is no resolution result corresponding to the domain name in the local Hosts file, check whether there is a resolution result corresponding to the domain name in the local DNS server, or When there is a resolution result corresponding to the domain name in the local DNS server, the IP address corresponding to the domain name is returned.

6. The external information carrying evidence collection method based on embedded DNS code according to claim 5 is characterized in that: The step of submitting query requests to the local DNS server step by step to obtain a resolution result corresponding to the domain name includes: If there is no resolution result corresponding to the domain name in the local DNS server, Submit a query request to the root domain name server through iterative query or recursive query to obtain the address of the top-level domain name server. Submit a query request to the top-level domain name server through iterative query or recursive query to obtain the address of the second-level domain name server. Submitting a query request to a secondary domain name server through iterative query or recursive query to obtain the address of the illegal external connection forensics server corresponding to a part of the domain name, Based on the address of the illegal external connection evidence collection server, the DNS resolution request is sent to the illegal external connection evidence collection server.

7. The external information carrying evidence collection method based on embedded DNS code according to claim 6 is characterized in that: Extracting, generating and storing illegal external connection information based on the DNS resolution request includes: When the illegal external connection evidence collection server receives the DNS resolution request, it does not respond to the DNS resolution request, and extracts, generates and stores the illegal external connection information from the DNS resolution request.

8. An external information carrying evidence collection system based on embedded DNS code, characterized in that: include: The capture request module is used to collect the whole network traffic through data mirroring and capture the external access request of the inspected terminal for the access page; A detection code generation module, used to dynamically generate a detection code according to the IP address of the detected terminal, wherein the detection code includes evidence collection information; A DNS resolution request triggering module, used for embedding the detection code into the access page to trigger a DNS resolution request when the access page is accessed by the detected terminal; The illegal external connection information processing module is used to extract, generate and store illegal external connection information based on the DNS resolution request.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the external information carrying evidence collection method based on embedded DNS code as described in any one of claims 1 to 7 are implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of carrying and collecting evidence based on external information embedded in DNS code as described in any one of claims 1 to 7 are implemented.

Images