Domain name alarm source analysis method and device and storage medium

Abstract

The invention discloses a domain name alarm source analysis method and device and a storage medium, and relates to the field of communication data analysis. The method comprises the following steps: acquiring a corresponding equipment log according to domain name alarm information; determining network access information in the device log; and accessing a corresponding network according to the network access information, and when a domain name alarm appears in the process of accessing the network, determining that an alarm source is the network. According to the method and the device, the source of the current DNS alarm information is determined according to the DNS alarm in the access process, so that the analysis precision is remarkably improved, the analysis process can be automatically realized, manual analysis is not needed, and the working efficiency is relatively high.

Description

Technical Field

[0001] The present invention relates to the field of communication data analysis, and in particular to a method, device and storage medium for analyzing a domain name (Domain Name System, DNS) alarm source. Background Art

[0002] In the field of terminal security, domain name alarms due to browser DNS resolution anomalies are of great significance for detecting malicious browsers and security incidents that exploit browser vulnerabilities. For example, in terminal security protection, if you need to confirm whether the browser alarm is caused by the user installing a malicious counterfeit browser or the browser being exploited by a vulnerability, or whether it is an intelligence alarm triggered by the browser's normal access to certain resources on the website, you first need to verify and confirm the source of the DNS alarm to ensure the accuracy of the alarm analysis and the timeliness of the response.

[0003] The traditional method of analyzing the source of DNS alarms is to check whether there is any dangerous intelligence related to the domain name in the DNS alarm information, whether there are more intelligence details, and especially whether it is marked what may have triggered the access to this malicious domain name; if not, the source of the DNS alarm cannot be determined, and professional engineers need to intervene to conduct manual analysis. Summary of the invention

[0004] In view of the defects existing in the prior art, the technical problem solved by the present invention is: how to improve the accuracy of analyzing the source of domain name alarms.

[0005] To achieve the above objectives, in the first aspect, an embodiment of the present application provides a method for analyzing the source of a domain name alarm, the method comprising the following steps: obtaining a corresponding device log based on the domain name alarm information; determining the network access information in the device log; accessing the corresponding network based on the network access information, and when a domain name alarm occurs during the access to the network, determining that the source of the alarm is the network.

[0006] In combination with the first aspect, in one implementation, the process of accessing the corresponding network according to the network access information includes: accessing the corresponding network according to the network access information closest to the domain name alarm time until a domain name alarm occurs.

[0007] In combination with the first aspect, in one embodiment, the information includes at least one of DNS and URL; when the network access information includes both DNS and URL, the process of accessing the corresponding network according to the network access information also includes: first accessing the network corresponding to the URL, and if all URLs are accessed and no domain name alarm occurs, then accessing the network corresponding to the DNS.

[0008] In combination with the first aspect, in one implementation, a criterion for determining whether domain name warning information appears during access to the network is that domain name warning information exists in a domain name resolution request determined by packet capture data of accessing the network.

[0009] In combination with the first aspect, in one embodiment, the process of accessing the corresponding network based on the network access information includes: accessing the corresponding network based on the network access information through a local agent; the judgment criteria for the occurrence of domain name warning information during the access to the network are specifically: the presence of domain name warning information in the domain name resolution request, or the presence of domain name warning information in the response message of the local agent.

[0010] In combination with the first aspect, in one implementation, the process of obtaining corresponding device logs according to domain name alarm information includes: obtaining device logs corresponding to the domain name alarm information within a specified time period before and after the alarm time.

[0011] In combination with the first aspect, in one implementation, the terminal ID or the terminal IP is used, and the domain name alarm information is obtained in the domain name alarm message; when the domain name alarm message contains both the terminal ID and the terminal IP, the terminal ID is used as the domain name alarm information.

[0012] In combination with the first aspect, in one implementation, the domain name alarm information is generated according to a set alarm condition.

[0013] In a second aspect, an embodiment of the present application provides a domain name alarm source analysis device, the domain name alarm source analysis device comprising a processor, a memory, and a domain name alarm source analysis program stored in the memory and executable by the processor, wherein when the domain name alarm source analysis program is executed by the processor, the steps of the domain name alarm source analysis method provided in the first aspect are implemented.

[0014] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, on which a domain name alarm source analysis program is stored. When the domain name alarm source analysis program is executed, the steps of the domain name alarm source analysis method provided in the first aspect are implemented.

[0015] Compared with the prior art, the advantages of the present invention are:

[0016] After determining the corresponding website access information based on the DNS alarm information, the application accesses the corresponding website according to the website access information. If a DNS alarm occurs during the access process, it can be determined that the source of the current DNS alarm information is the above-mentioned visited website.

[0017] Therefore, compared with the prior art of inferring the source of the alarm based solely on the dangerous intelligence of the DNS alarm information, the present application determines the source of the current DNS alarm information based on the DNS alarm that occurs during the access process. This not only significantly improves the analysis accuracy, but also the analysis process can be automatically implemented without manual analysis, and the work efficiency is also high. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0019] Figure 1 Schematic diagram of the process of analyzing the domain name alarm source in an embodiment of the present invention;

[0020] Figure 2 This is a schematic diagram of the hardware structure of a domain name alarm source analysis device involved in the embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0022] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0023] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0024] First, the research and development process of this application is introduced.

[0025] The applicant analyzed the prior art and found that when there is no dangerous intelligence related to the domain name in the DNS alarm information, the user will definitely not be able to determine the source of the DNS alarm; at the same time, when there is dangerous intelligence related to the domain name in the DNS alarm information, the accuracy of determining that the source of the alarm is the corresponding domain name based solely on the existence of dangerous intelligence is also low. This is because: the existence of dangerous intelligence related to the domain name does not mean that the current DNS alarm is definitely related to the domain name; it may also be a DNS alarm caused by other domain names.

[0026] On this basis, in the first aspect, an embodiment of the present application provides a method for analyzing the source of a domain name alarm, the steps of the method comprising: obtaining a corresponding device log based on DNS alarm information; determining website access information in the device log; accessing a corresponding website based on the website access information, and when a DNS alarm occurs during the process of accessing the website, determining that the source of the alarm is the website.

[0027] From this, it can be seen that after the application determines the corresponding website access information based on the DNS alarm information, the corresponding website is accessed according to the website access information. If a DNS alarm occurs during the access process, it can be determined that the source of the current DNS alarm information is the above-mentioned visited website.

[0028] Therefore, compared with the prior art of inferring the source of the alarm based solely on the dangerous intelligence of the DNS alarm information, the present application determines the source of the current DNS alarm information based on the DNS alarm that occurs during the access process. This not only significantly improves the analysis accuracy, but also the analysis process can be automatically implemented without manual analysis, and the work efficiency is also high.

[0029] The above method is described below through several embodiments.

[0030] In one embodiment, the DNS alarm information in the above method is generated according to the set alarm conditions. The alarm conditions can be default or actively added by the user. For example, when the alarm process comes from the process list of the browser (chrome, ie, firefox, Edge, etc.), the user automatically sets the process name (proc_name).

[0031] In one embodiment, the process of obtaining the corresponding device log according to the DNS alarm information in the above method includes: obtaining the device log corresponding to the DNS alarm information within a specified time period (30 to 300 seconds) before and after the alarm time; the reason for obtaining the device log within a certain time range before and after the alarm time here is to avoid partial loss of the log as much as possible, or errors in the order of log recording time; the specified time period is generally 30 to 300 seconds, and the actual situation can be adjusted according to different needs.

[0032] In one embodiment, the DNS alarm information in the above method is a terminal ID or a terminal IP, and the DNS alarm information is obtained in the original DNS alarm message; when the terminal ID and the terminal IP exist in the DNS alarm message at the same time, the terminal ID is used as the DNS alarm information; the reason is that: the terminal IP may not be unique, and the terminal ID is basically unique. The preferred terminal ID can accurately determine the device log corresponding to the DND alarm.

[0033] In one embodiment, the process of accessing the corresponding website according to the website access information in the above method includes: obtaining all the website access information in the device log, accessing the corresponding website according to the website access information closest to the DNS alarm time, and if the DNS alarm does not appear during the access process, accessing the corresponding website according to the next website access information closest to the DNS alarm time, until the DNS alarm appears. The reason for this implementation is that the source of the DNS alarm is most likely to be the website access information closest to the alarm time, and setting the matching access order in this way can effectively improve the efficiency of subsequent alarm source identification.

[0034] Furthermore, the website access information in the above method includes at least one of DNS and URL (Uniform Resource Locator); when the website access information includes both DNS and URL, the process of accessing the corresponding website according to the website access information also includes: giving priority to accessing the website corresponding to the URL, and if all URLs are accessed and no DNS alarm occurs, then accessing the website corresponding to the DNS.

[0035] It should be noted that: this application determines the source of the alarm after a DNS alarm occurs during the access process, and no longer considers other website access information. This is because under normal circumstances, the source of the alarm can be determined after a DNS alarm occurs in the above manner; in actual use, the user can also set it to continue detecting all website access information after a DNS alarm occurs.

[0036] At the same time, when this application is implemented, DNS alarms will appear after corresponding accesses are made based on all website access information. At this time, professional engineers are required to intervene and conduct manual analysis.

[0037] In one embodiment, the criterion for determining whether DNS warning information appears during access to the website in the above method is that DNS warning information exists in the DNS resolution request determined by packet capture data of accessing the website.

[0038] At the same time, in one embodiment, the process of accessing the corresponding website according to the website access information in the above method includes: accessing the corresponding website according to the website access information through a local proxy; on this basis, the judgment criteria for the occurrence of DNS warning information during the above-mentioned access to the website are specifically: there is DNS warning information in the DNS resolution request, or there is DNS warning information in the response message of the local proxy.

[0039] The reason for adding a local proxy instead of judging only based on DNS resolution is that in the scripts of some malicious websites, it is set that certain conditions will be met before the triggering, for example, it will be triggered only when the website is visited from a specified region, and will not be triggered when visited from other regions; therefore, it is difficult to ensure triggering based on DNS resolution alone, and adding a local proxy to cooperate can respond to different situations, thereby achieving a comprehensive analysis of the alarm source and further improving the analysis accuracy.

[0040] The implementation process of the above method is described below in terms of time sequence through a specific embodiment.

[0041] See also Figure 1 As shown, the process of this embodiment includes:

[0042] S1: Set the alarm conditions. For setting methods, refer to the corresponding part above.

[0043] S2: After the DNS alarm is triggered based on the alarm condition and a DNS alarm message is generated, the DNS alarm information (terminal ID) is determined from the DNS alarm message; the device log corresponding to the current terminal ID within one minute before and after the alarm time is obtained; the device is such as the terminal DNS or network DLP (Data Leakage Prevention, a security protection system based on network protocol analysis and control technology).

[0044] S3: Get all website access information (DNS and URL) in the device log. The website access information can come from terminal security collection, DNS server log or network NTA log, etc.

[0045] S4: The detection rule is to detect the URL first and then the DNS. The corresponding websites are accessed through the local proxy in sequence according to the website access information closest to the alarm time, until a DNS alarm appears during the access process.

[0046] S5: The source of the DNS alarm is determined to be the website visited when the DNS alarm occurs in S4.

[0047] Specifically, this embodiment uses a headless browser (through Selenium+Chromium) to access the website to simulate normal user access. When accessing, the headless browser is configured to the local HTTPS proxy service. The proxy server is configured with certificate trust and can proxy and parse HTTPS traffic. Execute the pre-access configuration to capture the system, and end the capture after the next access (the capture can be performed using the scapy library wrpcap, which can be better configured with the headless browser startup, of course, it can also be done through other methods such as tcpdump).

[0048] Assuming that the DNS alarm information is domain name a, during the access process, when the response message of the HTTPS request contains domain name a, or the DNS resolution request of the captured packet data contains the resolution of domain name a, it is determined that a DNS alarm occurs.

[0049] To summarize, this application automatically extracts website access information based on DNS alarms, combines sorting adjustments to optimize detection speed, uses a headless browser to traverse the domain names or URLs in the context one by one, and then detects HTTP proxy traffic or DNS resolution records to automatically analyze whether the DNS alarm triggered by the browser is triggered by website access and which specific website access trigger it is from. During the process, security engineers do not need to manually analyze or collect survey data through traditional inquiry methods, which greatly improves the efficiency and accuracy of security operations.

[0050] In a second aspect, an embodiment of the present application provides a device for analyzing the source of a domain name alarm. The device for analyzing the source of a domain name alarm may be a personal computer (PC), a laptop computer, a server, or other device with data processing capabilities.

[0051] Reference Figure 2 , Figure 2 The hardware structure diagram of the domain name alarm source analysis device involved in the embodiment of the present application is shown in FIG. In the embodiment of the present application, the domain name alarm source analysis device may include a processor, a memory, a communication interface, and a communication bus.

[0052] The communication bus may be of any type and is used to interconnect the processor, the memory, and the communication interface.

[0053] The communication interface includes input / output (I / O) interfaces, physical interfaces, and logical interfaces, which are used to interconnect the devices inside the domain name alarm source analysis device, and interfaces used to interconnect the domain name alarm source analysis device with other devices (such as other computing devices or user devices). The physical interface can be an Ethernet interface, a fiber optic interface, an ATM interface, etc.; the user device can be a display, a keyboard, etc.

[0054] The memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0055] The processor may be a general-purpose processor, and the general-purpose processor may call the domain name alarm source analysis program stored in the memory, and execute the domain name alarm source analysis method provided in the embodiment of the present application. For example, the general-purpose processor may be a central processing unit (CPU). The method executed when the domain name alarm source analysis program is called may refer to the various embodiments of the domain name alarm source analysis method of the present application, and will not be repeated here.

[0056] Those skilled in the art will understand that Figure 2 The hardware structure shown in the figure does not constitute a limitation on the present application, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0057] In a third aspect, an embodiment of the present application also provides a computer-readable storage medium.

[0058] The computer-readable storage medium of the present application stores a domain name alarm source analysis program, wherein when the domain name alarm source analysis program is executed by a processor, the steps of the domain name alarm source analysis method as described above are implemented.

[0059] Among them, the method implemented when the domain name alarm source analysis program is executed can refer to the various embodiments of the domain name alarm source analysis method of the present application, and will not be repeated here.

[0060] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.

[0061] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.

[0062] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit "first", "second" and "third" to different types.

[0063] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.

[0064] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; the “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0065] In some processes described in the embodiments of the present application, multiple operations or steps that appear in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present application or in parallel, and the sequence number of the operation is only used to distinguish the different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.

[0066] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.

[0067] The above are only specific implementations of the embodiments of the present invention, but the protection scope of the embodiments of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the embodiments of the present invention, and these modifications or replacements should be included in the protection scope of the embodiments of the present invention. Therefore, the protection scope of the embodiments of the present invention shall be based on the protection scope of the claims.

Claims

1. A method for analyzing the source of domain name alarms, characterized in that: The method comprises the following steps: obtaining a corresponding device log according to domain name alarm information; determining network access information in the device log; accessing a corresponding network according to the network access information, and when a domain name alarm occurs during accessing the network, determining that the alarm source is the network.

2. The method for analyzing domain name alarm sources according to claim 1, characterized in that: The process of accessing the corresponding network according to the network access information includes: accessing the corresponding network according to the network access information closest to the domain name alarm time, until the domain name alarm occurs.

3. The method for analyzing domain name alarm sources according to claim 2, characterized in that: The method comprises at least one of a DNS and a URL; When the network access information includes both DNS and URL, the process of accessing the corresponding network according to the network access information also includes: first accessing the network corresponding to the URL, and if all URLs are accessed and no domain name alarm occurs, then accessing the network corresponding to the DNS.

4. The method for analyzing domain name alarm sources according to claim 1, characterized in that: The criterion for determining whether the domain name warning information appears during the access to the network is that the domain name warning information exists in the domain name resolution request determined by the packet capture data of the access to the network.

5. The method for analyzing the domain name alarm source according to claim 1, characterized in that: The process of accessing the corresponding network according to the network access information includes: accessing the corresponding network according to the network access information through a local agent; the judgment criteria for the occurrence of domain name warning information during the access to the network are specifically: the presence of domain name warning information in the domain name resolution request, or the presence of domain name warning information in the response message of the local agent.

6. The method for analyzing domain name alarm sources according to any one of claims 1 to 5, characterized in that: The process of obtaining the corresponding device log according to the domain name alarm information includes: obtaining the device log corresponding to the domain name alarm information within a specified time period before and after the alarm time.

7. The method for analyzing domain name alarm sources according to any one of claims 1 to 5, characterized in that: The terminal ID or the terminal IP is used, and the domain name alarm information is obtained in the domain name alarm message; when the domain name alarm message contains both the terminal ID and the terminal IP, the terminal ID is used as the domain name alarm information.

8. The method for analyzing domain name alarm sources according to any one of claims 1 to 5, characterized in that: The domain name alarm information is generated according to the set alarm conditions.

9. A device for analyzing domain name alarm sources, characterized in that: The domain name alarm source analysis device includes a processor, a memory, and a domain name alarm source analysis program stored in the memory and executable by the processor. When the domain name alarm source analysis program is executed by the processor, the steps of the domain name alarm source analysis method as described in any one of claims 1 to 8 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a domain name alarm source analysis program, wherein when the domain name alarm source analysis program is executed, the steps of the domain name alarm source analysis method as described in any one of claims 1 to 8 are implemented.

Images