Domain name alarm source analysis method, device and storage medium

Abstract

The application discloses a domain name alarm source analysis method and device and a storage medium, and relates to the field of communication data analysis.The method comprises the following steps: obtaining corresponding device logs according to domain name alarm information; determining network access information in the device logs; accessing a corresponding network according to the network access information; and determining that the alarm source is the network when a domain name alarm occurs in the process of accessing the network.The application determines the source of current DNS alarm information according to the DNS alarm occurring in the process of access, which not only significantly improves the analysis accuracy, but also automatically realizes the analysis process, does not require manual analysis, and is also high in work efficiency.

Description

Technical Field

[0001] This invention relates to the field of communication data analysis, specifically to a method, device, and storage medium for analyzing the source of Domain Name System (DNS) alarms. Background Technology

[0002] In the field of endpoint security, domain name alerts triggered by abnormal DNS resolution in browsers are of great significance for detecting malicious browsers and security incidents exploiting browser vulnerabilities. For example, in endpoint security protection, if it is necessary to determine whether a browser alert is caused by a user installing a malicious counterfeit browser or by an attack exploiting a vulnerability, or whether the alert is triggered by the browser normally accessing certain resources on a website, the source of the DNS alert must first be verified and confirmed to ensure the accuracy of alert analysis and the timeliness of response.

[0003] The traditional method for analyzing the source of DNS alerts is to check whether there is any dangerous intelligence related to the domain name in the DNS alert information, whether there are more intelligence details, especially whether it indicates what might have triggered access to this malicious domain name; if not, the source of the DNS alert cannot be determined, and manual analysis by professional engineers is required. Summary of the Invention

[0004] In view of the deficiencies in the existing technology, the technical problem solved by the present invention is: how to improve the accuracy of analyzing the source of domain name alarms.

[0005] To achieve the above objectives, in a first aspect, embodiments of this application provide a method for analyzing the source of domain name alarms. The method includes the following steps: obtaining the corresponding device logs based on the domain name alarm information; determining network access information in the device logs; accessing the corresponding network based on the network access information; and determining the source of the alarm as the network when a domain name alarm occurs during the access to the network.

[0006] In conjunction with the first aspect, in one implementation, the process of accessing the corresponding network based on network access information includes: accessing the corresponding network based on the network access information closest to the domain name alarm time, until a domain name alarm occurs.

[0007] In conjunction with the first aspect, in one implementation, the network access information includes at least one of DNS and URL; when the network access information includes both DNS and URL, the process of accessing the corresponding network based on the network access information further includes: first accessing the network corresponding to the URL; if all URLs are accessed and no domain name alarm occurs, then accessing the network corresponding to the DNS.

[0008] In conjunction with the first aspect, in one implementation, the criterion for determining whether a domain name alarm message appears during the process of accessing the network is: the domain name resolution request determined by packet capture data of accessing the network contains a domain name alarm message.

[0009] In conjunction with the first aspect, in one implementation, the process of accessing the corresponding network based on network access information includes: accessing the corresponding network through a local proxy based on the network access information; the criteria for determining whether a domain name alarm message appears during the access to the network are specifically: the domain name resolution request contains domain name alarm information, or the response message of the local proxy contains domain name alarm information.

[0010] In conjunction with the first aspect, in one implementation, the process of obtaining the corresponding device logs based on the domain name alarm information includes: obtaining the device logs corresponding to the domain name alarm information within a specified time period before and after the alarm time.

[0011] In conjunction with the first aspect, in one implementation, the domain name alarm information is a terminal ID or a terminal IP, and the domain name alarm information is obtained from the original domain name alarm message; when both the terminal ID and the terminal IP exist in the domain name alarm message, the terminal ID is used as the domain name alarm information.

[0012] In conjunction with the first aspect, in one implementation, the domain name alarm information is generated based on the set alarm conditions.

[0013] Secondly, embodiments of this application provide a domain name alarm source analysis device, which includes a processor, a memory, and a domain name alarm source analysis program stored in the memory and executable by the processor. When the domain name alarm source analysis program is executed by the processor, it implements the steps of the domain name alarm source analysis method provided in the first aspect.

[0014] Thirdly, embodiments of this application provide a computer-readable storage medium storing an analysis program for the source of domain name alarms, wherein when the analysis program for the source of domain name alarms is executed, it implements the steps of the analysis method for the source of domain name alarms provided in the first aspect.

[0015] Compared with the prior art, the advantages of the present invention are as follows:

[0016] After determining the corresponding website access information based on DNS alarm information, this application accesses the corresponding website according to the website access information. If a DNS alarm occurs during the access process, it can be determined that the source of the current DNS alarm information is the website accessed above.

[0017] Therefore, compared with the prior art that infers the source of alarms based solely on the danger intelligence of DNS alarm information, this application determines the source of the current DNS alarm information by the occurrence of DNS alarms during the access process. This not only significantly improves the accuracy of analysis, but also allows the analysis process to be automated, eliminating the need for manual analysis and increasing work efficiency. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating the method for analyzing the source of domain name alerts in an embodiment of the present invention.

[0020] Figure 2 This is a schematic diagram of the hardware structure of the domain name alarm source analysis device involved in the embodiment of this application. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] The flowchart shown in the attached diagram is for illustrative purposes only and does not necessarily include all content and operations / steps, nor does it necessarily have to be performed in the order described. For example, some operations / steps can be broken down, combined, or partially merged, so the actual execution order may change depending on the actual situation.

[0023] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0024] First, the research and development process of this application will be introduced.

[0025] The applicant's analysis of existing technology revealed that when no danger intelligence is present related to the domain name in the DNS alarm information, the user certainly cannot determine the source of the DNS alarm. At the same time, when danger intelligence is present related to the domain name in the DNS alarm information, the accuracy of determining the source of the alarm as the corresponding domain name solely based on the presence of danger intelligence is also low. This is because: the presence of danger intelligence related to the domain name does not necessarily mean that the current DNS alarm is related to that domain name; it may also be a DNS alarm caused by other domain names.

[0026] Based on this, in a first aspect, embodiments of this application provide a method for analyzing the source of a domain name alarm. The method includes the following steps: obtaining the corresponding device log based on the DNS alarm information; determining website access information in the device log; accessing the corresponding website based on the website access information; and determining the website as the source of the alarm when a DNS alarm occurs during the access to the website.

[0027] Therefore, this application determines the corresponding website access information based on DNS alarm information, accesses the corresponding website according to the website access information, and if a DNS alarm occurs during the access process, it can be determined that the source of the current DNS alarm information is the website accessed above.

[0028] Therefore, compared with the prior art that infers the source of alarms based solely on the danger intelligence of DNS alarm information, this application determines the source of the current DNS alarm information by the occurrence of DNS alarms during the access process. This not only significantly improves the accuracy of analysis, but also allows the analysis process to be automated, eliminating the need for manual analysis and increasing work efficiency.

[0029] The above method will be further explained through several examples below.

[0030] In one embodiment, the DNS alarm information in the above method is generated according to the set alarm conditions. The alarm conditions can be default or added by the user. For example, when the alarm process comes from the browser (chrome, ie, firefox, edge, etc.) process list, the user automatically sets the process name (proc_name).

[0031] In one embodiment, the process of obtaining the corresponding device log based on the DNS alarm information in the above method includes: obtaining the device log corresponding to the DNS alarm information within a specified time range (30~300s) before and after the alarm time; the reason for obtaining the device log within a certain time range before and after the alarm time is to avoid the situation of partial log loss or errors in the order of log recording time as much as possible; the specified time range is generally 30~300s, and can be adjusted according to different needs in actual situations.

[0032] In one embodiment, the DNS alarm information in the above method is a terminal ID or a terminal IP, and the DNS alarm information is obtained from the original DNS alarm message; when both the terminal ID and the terminal IP exist in the DNS alarm message, the terminal ID is used as the DNS alarm information; the reason is that the terminal IP may not be unique, while the terminal ID is basically unique, and the preferred terminal ID can accurately determine the device log corresponding to the DND alarm.

[0033] In one embodiment, the process of accessing the corresponding website based on website access information in the above method includes: obtaining all website access information in the device logs; accessing the corresponding website based on the website access information closest to the DNS alarm time; if no DNS alarm occurs during the access process, then accessing the corresponding website based on the next website access information closest to the DNS alarm time, until a DNS alarm occurs. The reason for this implementation is that the source of a DNS alarm is most likely the website access information closest to the alarm time, and setting the matching access order accordingly can effectively improve the efficiency of subsequent alarm source identification.

[0034] Furthermore, the website access information in the above method includes at least one of DNS and URL (Uniform Resource Locator); when the website access information includes both DNS and URL, the process of accessing the corresponding website based on the website access information also includes: firstly accessing the website corresponding to the URL, and if all URLs are accessed and no DNS alarm occurs, then accessing the website corresponding to the DNS.

[0035] It should be noted that this application determines the source of a DNS alert after it occurs during the access process and no longer considers access information from other websites. This is because, under normal circumstances, a single DNS alert can determine the source of the alert in the manner described above. In actual use, users can also configure the system to continue monitoring all website access information after a DNS alert occurs.

[0036] At the same time, during the implementation of this application, there may be instances where DNS alerts are not generated after accessing all websites based on the corresponding access information. In such cases, professional engineers need to intervene and conduct manual analysis.

[0037] In one embodiment, the criterion for determining the occurrence of DNS alarm information during the process of accessing the website in the above method is: the DNS resolution request determined by the packet capture data of the website access contains DNS alarm information.

[0038] Meanwhile, in one embodiment, the process of accessing the corresponding website based on the website access information in the above method includes: accessing the corresponding website based on the website access information through a local proxy; based on this, the criteria for determining the occurrence of DNS alarm information during the process of accessing the website are specifically: the DNS resolution request contains DNS alarm information, or the response message of the local proxy contains DNS alarm information.

[0039] The reason for adding a local proxy instead of relying solely on DNS resolution is that some malicious websites' scripts are set to trigger only when certain conditions are met, such as triggering only when accessing the website from a specific region, and not triggering when accessing from other regions. Therefore, relying solely on DNS resolution is insufficient to ensure triggering, while adding a local proxy can address different situations, thereby achieving comprehensive analysis of the source of alerts and further improving the accuracy of the analysis.

[0040] The implementation process of the above method is illustrated below from a timing perspective through a specific embodiment.

[0041] See Figure 1 As shown, the process in this embodiment includes:

[0042] S1: Set alarm conditions. See the corresponding section above for the setting method.

[0043] S2: After triggering a DNS alarm based on alarm conditions and generating a DNS alarm message, determine the DNS alarm information (terminal ID) from the DNS alarm message; obtain the device logs corresponding to the current terminal ID within one minute before and after the alarm time; the device is such as terminal DNS or network DLP (Data Leakage Prevention, a security protection system based on network protocol analysis and control technology).

[0044] S3: Obtain all website access information (DNS and URL) from the device logs. Website access information can come from endpoint security collection, DNS server logs, or network NTA logs, etc.

[0045] S4: The detection rule is to detect the URL first and then the DNS. Based on the website access information closest to the alarm time, the corresponding website is accessed through a local proxy until a DNS alarm occurs during the access process.

[0046] S5: Identify the source of the DNS alert as the website accessed when the DNS alert occurred in S4.

[0047] Specifically, this embodiment simulates normal user access by using a headless browser (which can be done via Selenium + Chromium) to access the website. During access, the headless browser is configured to run on a local HTTPS proxy server. The proxy server is configured with certificate trust and can proxy and resolve HTTPS traffic. Packet capture is configured before the access is executed, and capture ends after one access (packet capture can be performed using the scapy library wrpcap, which allows for better integration with the headless browser startup configuration; alternatively, other methods such as tcpdump can also be used).

[0048] Assuming the DNS alert information is for domain name 'a', then during the access process, if the response message of the HTTPS request contains domain name 'a', or if the DNS resolution request in the packet capture data contains the resolution of domain name 'a', then a DNS alert is determined to have occurred.

[0049] In summary, this application optimizes detection speed by automatically extracting website access information based on DNS alerts and combining it with sorting adjustments. It uses a headless browser to traverse the domains or URLs in the context one by one to detect HTTP proxy traffic or DNS resolution records, thereby automatically analyzing whether the DNS alerts triggered by the browser originate from website access and from which specific website. During the process, security engineers do not need to manually analyze or collect survey data through traditional query methods, which greatly improves the efficiency and accuracy of security operations.

[0050] Secondly, embodiments of this application provide a domain name alarm source analysis device, which can be a personal computer (PC), laptop computer, server, or other device with data processing capabilities.

[0051] Reference Figure 2 , Figure 2 This is a schematic diagram of the hardware structure of the domain name alarm source analysis device involved in the embodiments of this application. In this embodiment, the domain name alarm source analysis device may include a processor, a memory, a communication interface, and a communication bus.

[0052] The communication bus can be of any type and is used to interconnect the processor, memory, and communication interface.

[0053] The communication interface includes input / output (I / O) interfaces, physical interfaces, and logical interfaces used for interconnecting internal components of the domain name alarm source analysis device, as well as interfaces used for interconnecting the domain name alarm source analysis device with other devices (such as other computing devices or user equipment). Physical interfaces can be Ethernet interfaces, fiber optic interfaces, ATM interfaces, etc.; user equipment can be displays, keyboards, etc.

[0054] Memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0055] The processor can be a general-purpose processor, which can call the domain name alarm source analysis program stored in the memory and execute the domain name alarm source analysis method provided in the embodiments of this application. For example, the general-purpose processor can be a central processing unit (CPU). The method executed when the domain name alarm source analysis program is called can be referred to the various embodiments of the domain name alarm source analysis method of this application, and will not be repeated here.

[0056] Those skilled in the art will understand that Figure 2 The hardware structure shown does not constitute a limitation of this application and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0057] Thirdly, embodiments of this application also provide a computer-readable storage medium.

[0058] The computer-readable storage medium of this application stores an analysis program for the source of domain name alarms, wherein when the analysis program for the source of domain name alarms is executed by a processor, it implements the steps of the domain name alarm source analysis method as described above.

[0059] The method implemented when the domain name alarm source analysis program is executed can be referred to in the various embodiments of the domain name alarm source analysis method of this application, and will not be repeated here.

[0060] It should be noted that the sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0061] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device to execute the methods described in the various embodiments of this application.

[0062] The terms "comprising" and "having," and any variations thereof, in the specification, claims, and accompanying drawings of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus. The terms "first," "second," and "third," etc., are used to distinguish different objects, etc., and do not indicate a sequence, nor do they limit "first," "second," and "third" to different types.

[0063] In the description of the embodiments of this application, terms such as "exemplary," "for example," or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplary," "for example," or "for instance" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary," "for example," or "for instance" is intended to present the relevant concepts in a concrete manner.

[0064] In the description of the embodiments of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The "and / or" in the text is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in the description of the embodiments of this application, "multiple" means two or more.

[0065] In some processes described in the embodiments of this application, multiple operations or steps are included in a specific order. However, it should be understood that these operations or steps may not be executed in the order they appear in the embodiments of this application, or they may be executed in parallel. The sequence number of the operation is only used to distinguish different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed sequentially or in parallel, and these operations or steps may be combined.

[0066] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device to execute the methods described in the various embodiments of this application.

[0067] The above are merely specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the scope of the claims.

Claims

1. A method for analyzing the source of domain name alerts, characterized in that, The method includes the following steps: obtaining the corresponding device logs based on the domain name alarm information; determining the network access information in the device logs; accessing the corresponding network based on the network access information; when a domain name alarm occurs during the access to the network, determining that the alarm source is the network. Specifically, accessing the website through a headless browser simulates normal user access. During access, the headless browser is configured to run on a local HTTPS proxy service to automatically analyze the source of the domain name alarm triggered by the browser.

2. The method for analyzing the source of domain name alerts as described in claim 1, characterized in that, The process of accessing the corresponding network based on network access information includes: accessing the corresponding network based on the network access information closest to the domain name alarm time, until a domain name alarm occurs.

3. The method for analyzing the source of domain name alarms as described in claim 2, characterized in that: The network access information includes at least one of DNS and URL; When network access information includes both DNS and URL, the process of accessing the corresponding network based on the network access information further includes: first accessing the network corresponding to the URL; if all URLs are accessed and no domain name alarm occurs, then accessing the network corresponding to the DNS.

4. The method for analyzing the source of domain name alerts as described in claim 1, characterized in that, The criterion for determining the occurrence of domain name alarm information during the access to the network is: the domain name resolution request determined by the packet capture data of the network access contains domain name alarm information.

5. The method for analyzing the source of domain name alerts as described in claim 1, characterized in that, The process of accessing the corresponding network based on network access information includes: accessing the corresponding network through a local proxy based on the network access information; the criteria for determining whether a domain name alarm message appears during the access to the network are: the domain name resolution request contains a domain name alarm message, or the response message of the local proxy contains a domain name alarm message.

6. The method for analyzing the source of domain name alerts as described in any one of claims 1 to 5, characterized in that, The process of obtaining the corresponding device logs based on the domain alarm information includes: obtaining the device logs corresponding to the domain alarm information within a specified time period before and after the alarm time.

7. The method for analyzing the source of domain name alerts as described in any one of claims 1 to 5, characterized in that: The domain name alarm information is the terminal ID or terminal IP, and the domain name alarm information is obtained from the original domain name alarm message; When both the terminal ID and the terminal IP are present in the domain alarm message, the terminal ID is used as the domain alarm information.

8. The method for analyzing the source of domain name alerts as described in any one of claims 1 to 5, characterized in that: The domain name alarm information is generated based on the set alarm conditions.

9. An analysis device for the source of domain name alerts, characterized in that, The domain name alarm source analysis device includes a processor, a memory, and a domain name alarm source analysis program stored in the memory and executable by the processor, wherein when the domain name alarm source analysis program is executed by the processor, it implements the steps of the domain name alarm source analysis method as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores an analysis program for the source of domain name alarms, wherein when the analysis program for the source of domain name alarms is executed, it implements the steps of the method for analyzing the source of domain name alarms as described in any one of claims 1 to 8.

Images