Domain name detection method and device, storage medium and program product
By listening and resolving terminal data packets in the kernel state, combining the whitelist provided by the user state to block malicious domain name access, the problem of malicious domain name attacks in DNS domain name resolution is solved, and the risk of security threats is effectively reduced.
Patent Information
- Application Number
- CN202510052051.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-01-13
- Publication Date
- 2025-04-18
AI Technical Summary
While DNS domain name resolution brings convenience, it has also become an attack vector frequently used by cyber attackers. Malicious domain names may lead to terminal device infection, which will lead to serious consequences such as data loss and privacy leakage.
In the kernel state, the terminal transmits a data packet outward, parses the target data packet to determine the domain name to be accessed, and determines whether the domain name meets the blocking access conditions based on the whitelist sent by the user state. If so, the terminal blocks access to the domain name.
Through the judgment of the conditions for accessing the domain name, the terminal can effectively prevent access to malicious websites or domain names with security risks, reduce the risk of spreading security threats such as viruses and Trojans, and protect the security of internal networks and data of the terminal.
Smart Images
Figure CN119854017A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to a domain name detection method, device, storage medium and program product. Background Art
[0002] As one of the key services of the Internet, the Domain Name System (DNS) can convert domain names that are easy to remember into Internet Protocol (IP) addresses that can be recognized by computers. This process can be called domain name resolution. The emergence of DNS has greatly facilitated users, allowing them to access various Internet resources without having to remember complicated IP addresses.
[0003] However, while DNS domain name resolution brings many conveniences, it has also become a frequently used attack medium and means by network attackers. Malicious domain names often carry various types of malware. Once a terminal device accesses these malicious domain names, it may be infected, leading to serious consequences such as data loss and privacy leakage. Summary of the invention
[0004] The present application provides a domain name detection method, device, storage medium and program product, which can effectively prevent terminals from accessing malicious websites or domain names with security risks.
[0005] In order to achieve the above objectives, this application adopts the following technical solutions:
[0006] In a first aspect, the present application provides a domain name detection method, the method comprising: monitoring in kernel state whether a terminal sends a data packet outward; if the terminal is monitored to send a data packet outward, parsing the target data packet in kernel state to determine the domain name to be accessed of the terminal; the target data packet is a data packet sent outward by the terminal; in kernel state, based on a whitelist sent in user state, judging whether the domain name to be accessed meets an access blocking condition; the access blocking condition is used to characterize the condition for blocking terminal access; if the domain name to be accessed meets the access blocking condition, blocking the terminal from accessing the domain name to be accessed in kernel state.
[0007] Based on the above technical solution, the present application can effectively prevent the terminal from accessing malicious websites or domain names with security risks by making conditional judgments on the domain names to be accessed, thereby reducing the risk of spreading security threats such as viruses and Trojans, and protecting the terminal's internal network and data security.
[0008] In one possible method, in kernel state, based on the whitelist sent from user state, it is determined whether the domain name to be accessed meets the access blocking condition, including: in kernel state, based on the whitelist, determining whether the domain name to be accessed is a malicious domain name; a malicious domain name is a domain name that is not in the whitelist; if the domain name to be accessed is a malicious domain name, determining in kernel state that the domain name to be accessed meets the access blocking condition.
[0009] In a possible manner, if the domain name to be accessed does not meet the access blocking condition, the terminal is allowed to access the domain name to be accessed in the kernel state.
[0010] In one possible manner, the method further includes: recording domain name control information in user mode; the domain name control information includes allowing the terminal to access the domain name to be accessed or blocking the terminal from accessing the domain name to be accessed.
[0011] In one possible manner, the method further includes: determining, in user state, domain names that are allowed to be accessed based on Internet acquisition and / or according to user needs; and adding the domain names that are allowed to be accessed to a whitelist in kernel state.
[0012] In one possible method, the target data packet is parsed in the kernel state to determine the domain name to be accessed by the terminal, including: parsing the target data packet in the kernel state to obtain the protocol type of the target data packet; if the protocol type of the target data packet is DNS access, then parsing the domain name corresponding to the DNS access in the kernel state to obtain the domain name to be accessed.
[0013] In a second aspect, the present application provides a domain name detection device, which includes: a monitoring unit, a determination unit, a judgment unit and a processing unit; the monitoring unit is used to monitor whether the terminal sends a data packet to the outside in the kernel state; the determination unit is used to parse the target data packet in the kernel state if it monitors that the terminal sends a data packet to the outside, and determine the domain name to be visited of the terminal; the target data packet is the data packet sent outward by the terminal; the judgment unit is used to judge whether the domain name to be visited meets the blocking access condition in the kernel state based on the white list sent in the user state; the blocking access condition is used to characterize the condition for blocking terminal access; the processing unit is used to block the terminal from accessing the domain name to be visited in the kernel state if the domain name to be visited meets the blocking access condition.
[0014] In one possible method, the judgment unit is specifically used to: determine whether the domain name to be accessed is a malicious domain name based on the whitelist in the kernel state; a malicious domain name is a domain name that is not in the whitelist; if the domain name to be accessed is a malicious domain name, determine in the kernel state that the domain name to be accessed meets the access blocking conditions.
[0015] In a possible manner, the processing unit is further configured to allow the terminal to access the domain name to be accessed in the kernel state if the domain name to be accessed does not meet the access blocking condition.
[0016] In one possible manner, the processing unit is further used to record domain name control information in user mode; the domain name control information includes allowing the terminal to access the domain name to be accessed or blocking the terminal from accessing the domain name to be accessed.
[0017] In one possible manner, the determination unit is further used to determine the domain name allowed to be accessed based on Internet acquisition and / or according to user needs in user state; the processing unit is further used to add the domain name allowed to be accessed to the whitelist in kernel state.
[0018] In one possible method, the determination unit is also used to parse the target data packet in the kernel state to obtain the protocol type of the target data packet; if the protocol type of the target data packet is DNS access, the domain name corresponding to the DNS access is parsed in the kernel state to obtain the domain name to be accessed.
[0019] In a third aspect, the present application provides a domain name detection device, comprising: a processor and a communication interface; the communication interface and the processor are coupled, and the processor is used to run a computer program or instruction to implement the domain name detection method described in the first aspect and any possible implementation method of the first aspect.
[0020] In a fourth aspect, the present application provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a terminal, the terminal executes the domain name detection method described in the first aspect and any possible implementation of the first aspect.
[0021] In a fifth aspect, an embodiment of the present application provides a computer program product comprising instructions. When the computer program product is run on a domain name detection device, the domain name detection device executes the domain name detection method as described in the first aspect and any possible implementation manner of the first aspect.
[0022] In a sixth aspect, an embodiment of the present application provides a chip, the chip including a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run a computer program or instructions to implement the domain name detection method as described in the first aspect and any possible implementation method of the first aspect.
[0023] Specifically, the chip provided in the embodiment of the present application also includes a memory for storing computer programs or instructions.
[0024] In this application, the name of the domain name detection device does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear with other names. As long as the functions of each device or functional module are similar to those of this application, they fall within the scope of the claims of this application and their equivalent technologies.
[0025] These and other aspects of the present application will become more apparent from the following description.
[0026] Based on any of the above aspects, the technical solution provided by this application brings at least the following beneficial effects:
[0027] By making conditional judgments on the domain names to be accessed, terminals can be effectively prevented from accessing malicious websites or domain names that pose security risks, thereby reducing the risk of spreading security threats such as viruses and Trojans, and protecting the terminal's internal network and data security. BRIEF DESCRIPTION OF THE DRAWINGS
[0028] Figure 1 A schematic diagram of the hardware structure of a terminal device provided in an embodiment of the present application;
[0029] Figure 2 A schematic diagram of a software structure of a terminal device provided in an embodiment of the present application;
[0030] Figure 3 A schematic diagram of the structure of a domain name detection device provided in an embodiment of the present application;
[0031] Figure 4 A flowchart of a domain name detection method provided in an embodiment of the present application;
[0032] Figure 5 A schematic diagram of a domain name detection process provided in an embodiment of the present application;
[0033] Figure 6 A schematic diagram of another domain name detection process provided in an embodiment of the present application;
[0034] Figure 7 A schematic diagram of the structure of another domain name detection device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0035] The domain name detection method and device provided in the embodiments of the present application are described in detail below with reference to the accompanying drawings.
[0036] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.
[0037] The terms "first" and "second" and the like in the specification and drawings of this application are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.
[0038] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.
[0039] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.
[0040] In order to facilitate the understanding of the technical content of this solution, the following technical terms and related technologies are introduced.
[0041] Kernel state: Kernel state is the execution mode of the operating system kernel, also known as management state or privileged state. In kernel state, code can execute any central processing unit (CPU) instructions, access any memory address, and perform all system calls and hardware access operations. Programs in kernel state usually include the operating system kernel itself, device drivers, interrupt handlers, etc.
[0042] Since programs in kernel mode have the highest permissions, they can perform direct control over system resources and hardware devices. This includes modifying memory mappings, managing processes and threads, handling I / O operations, etc. However, this high permission also brings potential security risks, because if there are vulnerabilities in the kernel code, attackers can exploit these vulnerabilities to gain complete control of the system.
[0043] User state: User state is the execution mode of an application, also known as target state or non-privileged state. In user state, code can only execute a restricted set of CPU instructions and can only access memory areas allocated to it. Programs in user state usually include various applications, library functions, etc.
[0044] Since programs in user mode have lower permissions, they cannot directly access hardware or perform privileged operations. If an application needs to perform privileged operations (such as file reading and writing, network communication, etc.), it needs to request services from the operating system kernel through the system call interface (API). After receiving the request, the operating system kernel will switch to kernel mode to perform the corresponding operation, and switch back to user mode after completion, and return the result to the application.
[0045] The above is an explanation of the technical terms involved in this application, which will not be repeated below.
[0046] As one of the key services of the Internet, the core function of DNS is to convert domain names that are easy for people to remember into Internet Protocol IP addresses that can be recognized by computers. This process is called domain name resolution. The introduction of DNS has greatly simplified the Internet experience, allowing users to easily access the required resources by simply entering easy-to-remember domain names without having to remember complex and difficult-to-recognize IP addresses.
[0047] However, while DNS provides convenience, it has also become a vulnerable link targeted by cyber attackers. Malicious domain names are often associated with various malware. These malware trick terminal devices into visiting malicious domain names by disguising themselves as legitimate websites or taking advantage of links that users inadvertently click on. Once a device visits these domain names, it may be infected by malware, resulting in serious consequences such as data loss, privacy leakage, and system crashes.
[0048] Related art proposes a method of blocking and isolating access to malicious domain names by deploying middleware on a server running DNS server software. The domain name control mechanism provided by the middleware is used to effectively block access to malicious domain names.
[0049] However, this method has little impact on the normal domain name resolution service performance, but it does not fundamentally solve the problem of the spread of malicious domain name access at the terminal level.
[0050] In other words, even if blocking is implemented at the DNS level, malicious domain name access may still be able to spread within the terminal through other channels.
[0051] In response to the above-mentioned technical defects, the domain name detection method provided by the present application can monitor in the kernel state whether the terminal sends a data packet to the outside. If the terminal is monitored to send a data packet to the outside, the target data packet can be parsed in the kernel state to determine the domain name to be accessed by the terminal. Then, in the kernel state, based on the whitelist sent in the user state, it is judged whether the domain name to be accessed meets the access blocking condition. If the domain name to be accessed meets the access blocking condition, the terminal is blocked from accessing the domain name to be accessed in the kernel state.
[0052] Based on this, this application can effectively prevent terminals from accessing malicious websites or domain names with security risks by making conditional judgments on the domain names to be accessed, thereby reducing the risk of spreading security threats such as viruses and Trojans, and protecting the terminal's internal network and data security.
[0053] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments.
[0054] The domain name detection method provided in the embodiment of the present application can be applied in a terminal device. The terminal device can also be called a terminal, user equipment (UE), mobile station (MS), mobile terminal (MT), electronic equipment, etc.
[0055] In the embodiments of the present application, the terminal device may be a mobile phone, a computer, a two-in-one notebook, a two-in-one tablet computer, a laptop computer, a smart TV, a tablet computer (Pad), a computer with wireless transceiver function, an augmented reality (AR) terminal device\virtual reality (VR) device, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), an artificial intelligence (AI) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical surgery, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc. The embodiments of the present application do not limit the specific technology and specific device form adopted by the terminal device.
[0056] Figure 1 A schematic diagram of the hardware structure of the terminal device 100 is shown.
[0057] The terminal device 100 may include a processor 110 , an external memory interface 120 , an internal memory 121 , a radio frequency module 130 , a communication module 140 , an audio module 150 , a sensor module 160 , a camera 170 , a display screen 180 , and the like.
[0058] The structure illustrated in the embodiment of the present application does not constitute a limitation on the terminal device 200. It may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.
[0059] The processor 110 may include one or more processing units, for example, the processor 210 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.
[0060] The controller can generate operation control signals according to the instruction operation code and timing signal to complete the control of instruction fetching and execution.
[0061] The processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor is a high-speed cache memory, which can store instructions or data that the processor has just used or cyclically used. If the processor needs to use the instruction or data again, it can be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor, and thus improves the efficiency of the system.
[0062] In some embodiments, the processor 110 may include one or more interfaces. The interface may include an inter integrated circuit (I2C) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.
[0063] The MIPI interface can be used to connect the processor 110 with peripheral devices such as the display screen 180 and the camera 170. The MIPI interface includes a camera serial interface (CSI), a display serial interface (DSI), etc. In some embodiments, the processor 110 and the camera 170 communicate via the CSI interface to implement the shooting function of the terminal device 100. The processor 110 and the display screen 180 communicate via the DSI interface to implement the display function of the terminal device 100.
[0064] The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the terminal device 100. The external memory card communicates with the processor through the external memory interface to implement a data storage function, such as storing music, video and other files in the external memory card.
[0065] The internal memory 121 can be used to store computer executable program codes, and the executable program codes include instructions. The processor 110 executes various functional applications and data processing of the terminal device 100 by running the instructions stored in the internal memory 121. The memory 121 may include a program storage area and a data storage area. Among them, the program storage area can store an operating system, an application required for at least one function, etc. The data storage area can store data created during the use of the terminal device 100, etc. In addition, the memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, other volatile solid-state storage devices, a universal flash storage (UFS), etc.
[0066] The wireless communication function of the terminal device 100 can be implemented through antenna 1, antenna 2, RF module 130, communication module 140, modulation and demodulation processor and baseband processor. Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. RF module 130 can provide a communication processing module for wireless communication solutions including 2G-5G etc. applied to the terminal device 100.
[0067] The modulation and demodulation processor may include a modulator and a demodulator. Among them, the modulator is used to modulate the low-frequency baseband signal to be sent into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. The communication module 140 can provide a communication processing module for wireless local area networks (WLAN) (such as wireless fidelity (WiFi) network), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication technology (NFC), infrared technology (IR) and other wireless communication solutions applied to the terminal device 100. The communication module 140 can be one or more devices integrating at least one communication processing module. The communication module receives electromagnetic waves via antenna 2, modulates the electromagnetic wave signal and filters it, and sends the processed signal to the processor. The communication module 140 can also receive the signal to be sent from the processor 110, modulate it, amplify it, and convert it into electromagnetic waves for radiation through antenna 2.
[0068] In some embodiments, antenna 1 of terminal device 100 is coupled to a radio frequency module, and antenna 2 is coupled to a communication module, so that terminal device 100 can communicate with a network and other devices through wireless communication technology.
[0069] The audio module 150 is used to convert digital audio information into analog audio signal output, and also used to convert analog audio input into digital audio signal. The audio module can also be used to encode and decode audio signals.
[0070] The sensor module 160 of the terminal device 100 may specifically include: a pressure sensor, a distance sensor, an ambient light sensor, a fingerprint sensor, a temperature sensor, and a touch sensor, etc. The touch sensor is also called a "touch panel" and may be provided on a display screen to detect a touch operation on or near it.
[0071] In the embodiment of the present application, the sensor module 160 can capture the user operation. For example, the sensor module 160 can capture the user's domain name access operation. The sensor module 160 can forward the user's domain name access operation to the processor 110. The processor 110 can process the user's domain name access operation.
[0072] The camera 170 is used to capture static images or videos. In some embodiments, the terminal device 100 may include 1 or N cameras, where N is a positive integer greater than 1. For example, the camera 170 may be used to scan a QR code and send the QR code information to the processor 110. The processor 110 may process the QR code information and detect the domain name information contained in the QR code information.
[0073] The terminal device 100 implements the display function through a graphics processing unit (GPU), a display screen 180, and an application processor. The GPU is a microprocessor for image processing, which connects the display screen 180 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs that execute program instructions to generate or change display information.
[0074] The display screen 180 is used to display images, videos, etc. In some embodiments, the terminal device 100 may include 1 or N display screens, where N is a positive integer greater than 1. In the embodiment of the present application, the display screen 180 is used to display images with different refresh rates.
[0075] In the embodiment of the present application, the display screen 180 can be used to display access results and warning information about the domain name to be accessed.
[0076] Of course, the terminal device 100 may also include a charging management module, a power management module, a battery, buttons, indicators, a universal serial bus (USB) interface, and one or more SIM card interfaces, etc., and the embodiments of the present application do not impose any restrictions on this.
[0077] Figure 2 A schematic diagram showing a software structure of a terminal device.
[0078] In one embodiment, the software structure of the terminal device may also be the software structure of the domain name detection system in the terminal device, and this application does not impose any specific restrictions on this.
[0079] In a possible implementation, the software structure of the domain name detection system is divided into three layers, namely, a function management module 201, a network driver module 202, and an operating system 203. A communication connection can be established between the function management module 201 and the network driver module 202. A communication connection can be established between the function management module 201 and the operating system 203. A communication connection can be established between the network driver module 202 and the operating system 203.
[0080] Optionally, Figure 2The function management module 201, the network driver module 202, and the operating system 203 in the system may be function modules integrated in the same device, or may be two devices independently provided. This application does not impose any limitation on this.
[0081] It is easy to understand that when the function management module 201, the network driver module 202, and the operating system 203 are function modules integrated in the same device, the communication mode between the function management module 201, the network driver module 202, and the operating system 203 is the communication between the internal modules of the device. In this case, the communication process between the function management module 201, the network driver module 202, and the operating system 203 is the same as "the communication process between the function management module 201, the network driver module 202, and the operating system 203 when they are independently set up".
[0082] For ease of understanding, the present application is mainly explained by taking the example that the function management module 201, the network driver module 202, and the operating system 203 are independently configured.
[0083] In some embodiments, the network driver module 202 can monitor in the kernel state whether the terminal sends a data packet to the outside. If the terminal is monitored to send a data packet to the outside, the target data packet is parsed in the kernel state to determine the domain name to be visited by the terminal, and in the kernel state based on the white list sent in the user state, it is judged whether the domain name to be visited meets the blocking access condition. The blocking access condition is used to characterize the condition for blocking terminal access. If the domain name to be visited meets the blocking access condition, the terminal is blocked from accessing the domain name to be visited in the kernel state.
[0084] The function management module 201 can record domain name control information in user state, determine domain names allowed to be accessed based on Internet acquisition and / or according to user needs in user state, and add domain names allowed to be accessed to the whitelist in kernel state.
[0085] The operating system 203 may have two execution models, namely, kernel mode and user mode, to provide the network driver module 202 and the function management module 201 for use.
[0086] Optionally, the operating system 203 can be set according to actual needs. For example, the operating system 203 can be a Windows operating system or a Linux operating system. This application does not make specific restrictions on this.
[0087] In actual implementation, Figure 2 The functions of the network driver module 202, the function management module 201 and the operating system 203 can all be implemented by the monitoring unit, the determination unit, the judgment unit and the processing unit in the domain name processing device. The specific execution process can refer to the description of the method part in the above embodiment, which will not be repeated here.
[0088] It is understood that the structure illustrated in the embodiment of the present application does not constitute a limitation on the domain name detection system. It may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.
[0089] Figure 3 A schematic structural diagram of a domain name detection device 300 is shown.
[0090] In a possible implementation manner, the domain name detection device 300 may include a client 310 , a server 320 , and an alarm storage 330 .
[0091] The client 310 may include a user state 311 and a kernel state 312 .
[0092] The domain name detection device 300 can obtain and issue a domain name whitelist in the user state 311, and report a domain name blocking alarm through a configured communication module.
[0093] The domain name detection device 300 can identify and block domain names based on the configured network filtering driver module in the kernel state 312.
[0094] The server 320 may include a whitelist configuration module, a whitelist issuing module, an alarm storage module, and an alarm query and display module.
[0095] The whitelist configuration module can be used to configure the whitelist. The whitelist delivery module can be used to deliver the whitelist. The alarm storage module is used to receive the domain name blocking alarm and store the domain name blocking alarm in the alarm storage 330. The alarm query and display module can be used to query the domain name blocking alarm from the alarm storage 330 and display the domain name blocking alarm.
[0096] It is to be understood that the structure illustrated in the embodiment of the present application does not constitute a limitation on the domain name detection device 300. It may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.
[0097] In a possible implementation, the domain name detection device 300 can send registration information to the operating system of the terminal in the kernel state 312 to register for domain name detection. After the registration is completed, the kernel state 312 can identify and block the domain name based on the configured network filtering driver module.
[0098] Exemplarily, when the operating system of the terminal is a Windows system, the domain name detection device 300 can send registration information to the Windows Filtering Platform (WFP) of the terminal's operating system in the kernel state 312, so that the kernel state 312 after registration can implement various network filtering, modification and monitoring functions at multiple levels of the network stack to achieve domain name identification and blocking.
[0099] Optionally, when the operating system of the terminal is a system other than Windows, the other system may also have a function similar to the Windows filtering platform, so as to receive the registration information of the kernel state 312, so that the kernel state 312 can realize the identification and blocking of the domain name. This application does not make specific restrictions on this.
[0100] In actual implementation, Figure 3 The functions of the client 310, the server 320 and the alarm storage 330 can all be implemented by the monitoring unit, the determination unit, the judgment unit and the processing unit in the domain name processing device. The specific execution process can refer to the description of the method part in the above embodiment, which will not be repeated here.
[0101] like Figure 4 The figure is a flow chart of a domain name detection method provided in an embodiment of the present application. The domain name detection method can be applied to Figure 3 The domain name detection device 300 shown. The domain name detection method includes: S401-S404.
[0102] S401, monitoring in kernel mode whether the terminal sends a data packet outward.
[0103] In a possible implementation, the domain name detection device can send registration information to the operating system of the terminal in the kernel state to perform domain name detection registration. The domain name detection device can monitor whether the terminal sends a data packet outward based on the kernel after completing the registration.
[0104] S402: If it is monitored that the terminal sends a data packet, the target data packet is parsed in the kernel state to determine the domain name to be accessed by the terminal.
[0105] The target data packet may be a data packet sent outward by the terminal.
[0106] In a possible implementation, after monitoring the terminal sending a data packet outward, the domain name detection device can intercept or obtain the data packet sent outward by the terminal, that is, the target data packet. The domain name detection device can parse the target data packet in the kernel state to obtain the protocol type of the target data packet. If the protocol type of the target data packet is DNS access, the domain name detection device can parse the domain name corresponding to the DNS access in the kernel state to obtain the domain name to be accessed to determine the domain name to be accessed of the terminal.
[0107] Alternatively, if the protocol type of the target data packet is other data types except DNS access, the domain name detection device may allow the terminal to perform an operation corresponding to the target data packet.
[0108] S403: In the kernel state, based on the whitelist sent from the user state, determine whether the domain name to be accessed meets the access blocking condition.
[0109] The access blocking condition may be used to represent a condition for blocking terminal access.
[0110] In a possible implementation, the domain name detection device can determine whether the domain name to be accessed is a malicious domain name based on a whitelist in kernel state.
[0111] Among them, malicious domain names are domain names that are not in the whitelist.
[0112] Specifically, the domain name detection device can retrieve whether the domain name to be accessed is in the whitelist in the kernel state. If the domain name to be accessed is in the whitelist, the domain name detection device can determine that the domain name to be accessed is a non-malicious domain name. At this time, the domain name detection device can determine that the domain name to be accessed does not meet the access blocking condition, and further execute the processing strategy of the domain name to be accessed not meeting the access blocking condition in the kernel state.
[0113] Alternatively, if the domain name to be accessed is not in the whitelist, the domain name detection device can determine that the domain name to be accessed is a malicious domain name. At this time, the domain name detection device can determine that the domain name to be accessed meets the access blocking conditions, and further execute the processing strategy of the domain name to be accessed meeting the access blocking conditions in the kernel state.
[0114] In a possible implementation, the domain name detection device can determine the domain name allowed to be accessed based on Internet acquisition and / or according to user needs in user mode. The domain name detection device can add the domain name allowed to be accessed to the whitelist in kernel mode.
[0115] Optionally, the data structure of the whitelist can be set according to actual needs. For example, the data structure of the whitelist can be a hash table or a linked list. This application does not make specific restrictions on this.
[0116] Based on this, the domain name detection device can make conditional judgments on the domain names to be accessed based on the real-time updated whitelist, effectively preventing the terminal from accessing malicious websites or domain names with security risks.
[0117] S404: If the domain name to be accessed satisfies the access blocking condition, the terminal is blocked from accessing the domain name to be accessed in kernel mode.
[0118] In a possible implementation, if the domain name to be accessed is a malicious domain name, the domain name detection device can block the terminal from accessing the domain name to be accessed in the kernel state, that is, prevent the terminal from accessing the domain name to be accessed to ensure the security of the terminal.
[0119] Alternatively, if the domain name to be accessed does not meet the access blocking condition, the terminal is allowed to access the domain name to be accessed in the kernel state.
[0120] In a possible implementation manner, after determining to block the terminal from accessing the domain name to be accessed or to allow the terminal to access the domain name to be accessed, the domain name detection device may record the domain name control information in the user state.
[0121] The domain name control information includes allowing the terminal to access the domain name to be accessed or blocking the terminal from accessing the domain name to be accessed.
[0122] In one possible implementation, the domain name detection device may display the domain name management and control information through a terminal for users to view.
[0123] Based on the above technical solution, the present application can effectively prevent the terminal from accessing malicious websites or domain names with security risks by making conditional judgments on the domain names to be accessed, thereby reducing the risk of spreading security threats such as viruses and Trojans, and protecting the terminal's internal network and data security.
[0124] In one example, combining Figure 3 ,like Figure 5 The figure shows a schematic diagram of a domain name detection process provided by the present application.
[0125] In one possible implementation, the function management module can send the whitelist to the network driver module. The network driver module can send registration information to the operating system to configure the domain name detection function. The network driver module can build a domain name hash table based on the whitelist. The network driver module can obtain the domain name access request sent by the terminal. The network driver module can search the domain name hash table based on the domain name access request and perform domain name matching. The network driver module can block or release the domain name to be accessed based on the matching results. The network driver module can release the domain names in the whitelist and block those not in the whitelist. The network driver module can report domain name control information.
[0126] In one example, combining Figure 3 ,like Figure 6As shown, it is a schematic diagram of another domain name detection process provided by this application.
[0127] The network driver module can monitor whether the terminal sends data packets outward. The network driver module can parse data packets and determine the protocol type of the data packets. The network driver module can parse the domain name when the protocol type is a DNS request, otherwise, the data packet is released. The network driver module can release terminal access when the domain name is in the whitelist, otherwise, the terminal access is blocked.
[0128] For example, Figure 7 FIG. 1 is a schematic diagram of a domain name detection device provided in an embodiment of the present application. The domain name detection device is used to execute the domain name detection method provided in the present application. For example, the above Figure 4 The domain name detection method in the domain name detection device may include: a monitoring unit 701, a determining unit 702, a judging unit 703 and a processing unit 704.
[0129] In a possible manner, the monitoring unit 701 is used to monitor in kernel mode whether the terminal sends a data packet outward.
[0130] In a possible manner, the determining unit 702 is configured to parse the target data packet in the kernel state to determine the domain name to be accessed by the terminal if the terminal is monitored to send a data packet outward.
[0131] In a possible manner, the judgment unit 703 is used to judge whether the domain name to be accessed meets the access blocking condition in the kernel state based on the whitelist sent in the user state.
[0132] In a possible manner, the processing unit 704 is configured to block the terminal from accessing the domain name to be accessed in kernel mode if the domain name to be accessed meets the access blocking condition.
[0133] In one possible method, the judgment unit 703 is specifically used to: determine whether the domain name to be accessed is a malicious domain name based on the whitelist in the kernel state; a malicious domain name is a domain name that is not in the whitelist; if the domain name to be accessed is a malicious domain name, determine in the kernel state that the domain name to be accessed meets the access blocking condition.
[0134] In a possible manner, the processing unit 704 is further configured to allow the terminal to access the domain name to be accessed in the kernel state if the domain name to be accessed does not meet the access blocking condition.
[0135] In a possible manner, the processing unit 704 is further configured to record domain name control information in a user state; the domain name control information includes allowing the terminal to access the domain name to be accessed or blocking the terminal from accessing the domain name to be accessed.
[0136] In a possible manner, the determination unit 702 is further configured to determine the domain name that is allowed to be accessed based on Internet acquisition and / or according to user requirements in user mode.
[0137] In a possible manner, the processing unit 704 is further configured to add the domain name allowed to be accessed to the whitelist in kernel mode.
[0138] In a possible manner, the determination unit 702 is further configured to parse the target data packet in the kernel state to obtain the protocol type of the target data packet. If the protocol type of the target data packet is DNS access, the domain name corresponding to the DNS access is parsed in the kernel state to obtain the domain name to be accessed.
[0139] also, Figure 7 The technical effects of the domain name detection device can refer to the technical effects of the domain name detection method in the above embodiment, which will not be repeated here.
[0140] Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.
[0141] An embodiment of the present application provides a computer program product including instructions. When the computer program product is run on a computer, the computer is enabled to execute the domain name detection method in the above method embodiment.
[0142] The embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a computer, the computer executes the domain name detection method in the method flow shown in the above method embodiment.
[0143] Among them, the computer readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a register, a hard disk, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above, or any other form of computer readable storage medium known in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application-specific integrated circuit (ASIC). In the embodiments of the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program, which may be used by or in conjunction with an instruction execution system, apparatus, or device.
[0144] Since the domain name detection device, computer-readable storage medium, and computer program product in the embodiments of the present application can be applied to the above method, the technical effects that can be obtained can also refer to the above method embodiments, and the embodiments of the present application will not be repeated here.
[0145] The above is only a specific real-time method of the present application, but the protection scope of the present application is not limited thereto, and any changes or replacements within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.
Claims
1. A domain name detection method, characterized in that: Applied to a terminal, the method comprises: Monitor in kernel mode whether the terminal sends data packets outward; If the terminal is monitored to send a data packet outward, the target data packet is parsed in the kernel state to determine the domain name to be accessed by the terminal; the target data packet is the data packet sent outward by the terminal; In the kernel state, based on the whitelist sent in the user state, determining whether the domain name to be accessed meets a blocking access condition; the blocking access condition is used to represent a condition for blocking access by the terminal; If the domain name to be accessed satisfies the access blocking condition, the terminal is blocked from accessing the domain name to be accessed in the kernel state.
2. The method according to claim 1, characterized in that The determining, in the kernel state based on the whitelist sent in the user state, whether the domain name to be accessed meets the access blocking condition includes: In the kernel state, based on the whitelist, determining whether the domain name to be accessed is a malicious domain name; the malicious domain name is a domain name that is not in the whitelist; If the domain name to be accessed is a malicious domain name, it is determined in the kernel state that the domain name to be accessed meets the access blocking condition.
3. The method according to claim 2, characterized in that If the domain name to be accessed does not satisfy the access blocking condition, the terminal is allowed to access the domain name to be accessed in the kernel state.
4. The method according to claim 1 or 3, characterized in that: The method further comprises: The domain name control information is recorded in the user state; the domain name control information includes allowing the terminal to access the domain name to be accessed or blocking the terminal from accessing the domain name to be accessed.
5. The method according to claim 4, characterized in that The method further comprises: In the user state, determining a domain name that is allowed to be accessed based on the Internet and / or according to user needs; In the kernel state, the domain name allowed to be accessed is added to the whitelist.
6. The method according to claim 1, characterized in that The step of parsing the target data packet in the kernel state to determine the domain name to be accessed by the terminal includes: Parsing the target data packet in the kernel state to obtain a protocol type of the target data packet; If the protocol type of the target data packet is DNS access, the domain name corresponding to the DNS access is parsed in the kernel state to obtain the domain name to be accessed.
7. A domain name detection device, characterized in that: The device comprises: a monitoring unit, a determining unit, a judging unit and a processing unit; The monitoring unit is used to monitor in kernel mode whether the terminal sends a data packet outward; The determining unit is used to parse the target data packet in the kernel state to determine the domain name to be accessed by the terminal if the terminal is monitored to send a data packet outward; the target data packet is the data packet sent outward by the terminal; The judging unit is used to judge whether the domain name to be accessed satisfies a blocking access condition in the kernel state based on the whitelist sent in the user state; the blocking access condition is used to represent a condition for blocking the terminal access; The processing unit is configured to block the terminal from accessing the domain name to be accessed in kernel mode if the domain name to be accessed satisfies the access blocking condition.
8. A domain name detection device, characterized in that: include: A processor and a communication interface; the communication interface is coupled to the processor, and the processor is used to run a computer program or instruction to implement the domain name detection method as described in any one of claims 1-6.
9. A computer-readable storage medium, wherein instructions are stored in the computer-readable storage medium, characterized in that: When a computer executes the instruction, the computer executes the domain name detection method described in any one of claims 1 to 6.
10. A computer program product comprising instructions, characterized in that When the instructions are executed by a computer, the computer executes the domain name detection method according to any one of claims 1 to 6.