DNS rebinding attack detection method and device, equipment and storage medium

Abstract

The invention provides a DNS rebinding attack detection method and device, equipment and a storage medium, and relates to the technical field of computers. The DNS rebinding attack detection method comprises the following steps: obtaining a to-be-detected DNS data packet, and analyzing the to-be-detected DNS data packet to obtain a to-be-detected domain name and a to-be-detected website corresponding to the to-be-detected domain name; querying a correct website corresponding to the to-be-detected domain name in a historical database, and comparing the correct website with the to-be-detected website; if the to-be-detected website is inconsistent with the correct website, obtaining to-be-detected webpage information features of a target website currently pointed by the to-be-detected website; acquiring historical webpage information characteristics of a correct website pointed by the domain name to be detected in a historical database; and calculating a webpage information feature similarity between the to-be-detected webpage information feature and the historical webpage information feature, and when the webpage information feature similarity is smaller than a preset similarity threshold, determining that the DNS rebinding attack exists in the to-be-detected DNS data packet.

Description

Technical Field

[0001] The present application relates to the technical field of computers, and in particular to a method, apparatus, device and storage medium for detecting a DNS rebinding attack. Background Art

[0002] DNS (Domain Name System) rebinding detection is crucial in the field of network security. Through DNS rebinding detection, threatening network behaviors can be discovered.

[0003] The current technology for detecting DNS rebinding requires the use of DNS requests from uncontaminated DNS servers, and then compares the DNS requests from uncontaminated DNS servers with the DNS requests to be detected to determine whether DNS rebinding exists. However, this detection method may result in false positives when the website has updated its URL, resulting in a high false positive rate. Summary of the invention

[0004] The present application provides a method, apparatus, device and storage medium for detecting a DNS rebinding attack, so as to solve the problem that the existing detection method may cause false alarms when the website has updated its URL, resulting in a high false alarm rate.

[0005] In the first aspect, the present application provides a method for detecting a DNS rebinding attack, comprising: obtaining a DNS data packet to be detected, parsing the DNS data packet to be detected to obtain a domain name to be detected and a web address to be detected corresponding to the domain name to be detected; querying a correct web address corresponding to the domain name to be detected in a historical database, and comparing the correct web address with the web address to be detected; if the web address to be detected is consistent with the correct web address, determining that the DNS data packet does not have a DNS rebinding attack; if the web address to be detected is inconsistent with the correct web address, obtaining web page information features to be detected of a target website currently pointed to by the web address to be detected; obtaining historical web page information features of the correct website pointed to by the domain name to be detected in the historical database; the correct website is also the website pointed to by the correct web address corresponding to the domain name to be detected; calculating the web page information feature similarity between the web page information feature to be detected and the historical web page information feature, and determining that the DNS data packet to be detected has a DNS rebinding attack when the web page information feature similarity is less than a preset similarity threshold.

[0006] In the embodiment of the present application, since the web address to be detected corresponding to the domain name to be detected is inconsistent with the correct web address corresponding to the domain name to be detected, it is impossible to simply determine whether there is a DNS rebinding attack through the web address to be detected. Therefore, in the case where the web address to be detected is inconsistent with the correct web address, the similarity between the web page information features to be detected of the target website currently pointed to by the web address to be detected and the historical web page information features of the correct website pointed to by the domain name to be detected is used to further determine whether there is a DNS rebinding attack. If there is a DNS rebinding attack, the website currently pointed to by the web address to be detected is not the correct website pointed to by the domain name to be detected, but a malicious website. The web page information features of the malicious website are necessarily different from the web page information features of the correct website. If there is no DNS rebinding attack, only the web address is changed, then the two points should be the same website, and the similarity between the web page information features to be detected and the historical web page information features should be high. Therefore, this solution can accurately detect whether it is a DNS rebinding attack or a change of the web address.

[0007] In combination with the technical solution provided in the first aspect above, in some possible implementations, the method also includes: if the correct URL corresponding to the domain name to be detected is not found in the historical database, then obtaining the web page information features corresponding to the target website and storing them in the historical database.

[0008] In the embodiment of the present application, the web page information features corresponding to the target website are stored in a historical database to facilitate subsequent applications.

[0009] In combination with the technical solution provided in the first aspect above, in some possible implementations, the web page information characteristics to be detected include a first 404 response information; obtaining the web page information characteristics to be detected of the target website pointed to by the URL to be detected includes: randomly generating a string of characters; sending the string as request information to the target website; and receiving the first 404 response information returned by the target website.

[0010] In the embodiment of the present application, a randomly generated string is used as request information, so that the target website cannot recognize its specific information, and thus a 404 response information is fed back.

[0011] In combination with the technical solution provided in the first aspect above, in some possible implementations, the web page information features to be detected include the homepage information of a first website and the first 404 response information, and the historical web page information features include the homepage information of a second website and the second 404 response information; when calculating the web page information feature similarity between the web page information features to be detected and the historical web page information features, it includes: concatenating the homepage information of the first website and the first 404 response information to obtain first data; concatenating the homepage information of the second website and the second 404 response information to obtain second data; and calculating the similarity between the first data and the second data to obtain the web page information feature similarity.

[0012] In the embodiment of the present application, since the first data is obtained by splicing the first website homepage information and the first 404 response information, and the second data is obtained by splicing the second website homepage information and the second 404 response information, the similarity between the first data and the second data can reflect the similarity between the characteristics of the web page information to be detected and the characteristics of the historical web page information, so that the similarity between the characteristics of the web page information to be detected and the characteristics of the historical web page information can be obtained by calculating the similarity only once.

[0013] In combination with the technical solution provided in the first aspect above, in some possible implementations, the web page information features to be detected include first website homepage information and first 404 response information, the historical web page information features include second website homepage information and second 404 response information, the web page information feature similarity includes a first similarity and a second similarity, and the similarity threshold includes a first similarity threshold and a second similarity threshold; calculating the web page information feature similarity between the web page information features to be detected and the historical web page information features, and when the web page information feature similarity is lower than a preset similarity threshold, determining that the DNS data packet to be detected has a DNS rebinding attack, including: calculating the similarity between the first website homepage information and the second website homepage information to obtain a first similarity; calculating the similarity between the first 404 response information and the second 404 response information to obtain a second similarity; if the first similarity is less than the preset first similarity threshold, or the second similarity is less than the preset second similarity threshold, determining that the DNS data packet to be detected has a DNS rebinding attack.

[0014] In the embodiment of the present application, the similarity is calculated by integrating the two dimensions of 404 response information and website homepage information, thereby integrating multiple dimensions to determine whether the websites pointed to by the web page information features to be detected and the historical web page information features are the same, so that the final determination result can be more accurate.

[0015] In combination with the technical solution provided in the first aspect above, in some possible implementations, if the correct URL is inconsistent with the URL to be detected, the method also includes: obtaining a first crawler protocol of the target website; obtaining a second crawler protocol corresponding to the correct website in the historical database; calculating the crawler protocol similarity between the first crawler protocol and the second crawler protocol; if the crawler protocol similarity is less than a preset crawler protocol similarity threshold, it is determined that a DNS rebinding attack exists in the DNS data packet to be detected.

[0016] In the embodiment of the present application, if the website currently pointed to by the URL to be detected is the correct website pointed to by the domain name to be detected, then the first crawler protocol and the second crawler protocol should be the same. On the contrary, if the crawler protocol similarity is less than the preset crawler protocol similarity threshold, it indicates that the crawler protocols of the two are different, that is, the website currently pointed to by the URL to be detected is not the correct website pointed to by the domain name to be detected.

[0017] In combination with the technical solution provided in the first aspect above, in some possible implementations, before calculating the crawler protocol similarity between the first crawler protocol and the second crawler protocol, the method also includes: determining whether the first crawler protocol and the second crawler protocol are obtained; if both the first crawler protocol and the second crawler protocol are obtained, calculating the crawler protocol similarity between the first crawler protocol and the second crawler protocol; if neither the first crawler protocol nor the second crawler protocol is obtained, determining that the crawler protocol similarity between the first crawler protocol and the second crawler protocol is 100%; if only one of the first crawler protocol and the second crawler protocol is obtained, determining that the DNS data packet to be detected has a DNS rebinding attack.

[0018] In the embodiment of the present application, since not all websites will set up a crawler protocol, for the same website, it is only possible that a crawler protocol exists or does not exist. Therefore, if only one of the first crawler protocol and the second crawler protocol is obtained, it is determined that a DNS rebinding attack exists in the DNS data packet to be detected.

[0019] In a second aspect, the present application provides a detection device for a DNS rebinding attack, comprising: an acquisition module and a processing module, the acquisition module being used to acquire a DNS data packet to be detected, and to parse the DNS data packet to be detected to obtain a domain name to be detected and a web address to be detected corresponding to the domain name to be detected; the processing module being used to search a historical database for a correct web address corresponding to the domain name to be detected, and to compare the correct web address with the web address to be detected; the processing module being used to determine that there is no DNS rebinding attack in the DNS data packet if the web address to be detected is consistent with the correct web address; the processing module being used to acquire a web page information feature to be detected of a target website pointed to by the web address to be detected if the web address to be detected is inconsistent with the correct web address; acquiring the historical web page information feature of the correct website pointed to by the domain name to be detected in the historical database; calculating the web page information feature similarity between the web page information feature to be detected and the historical web page information feature, and determining that there is a DNS rebinding attack in the DNS data packet to be detected when the web page information feature similarity is lower than a preset similarity threshold.

[0020] In a third aspect, the present application provides an electronic device, comprising: a memory and a processor, the memory and the processor being connected; the memory being used to store programs; and the processor being used to call the programs stored in the memory to execute a method as described in the first aspect above and / or in combination with any possible implementation of the first aspect above.

[0021] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a computer, the computer program executes the method described in the first aspect above and / or in combination with any possible implementation of the first aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 A schematic diagram of a flow chart of a first method for detecting a DNS rebinding attack shown in an embodiment of the present application;

[0024] Figure 2 A schematic diagram of a second method for detecting a DNS rebinding attack shown in an embodiment of the present application;

[0025] Figure 3A structural block diagram of a device for detecting a DNS rebinding attack shown in an embodiment of the present application;

[0026] Figure 4 A structural block diagram of an electronic device shown in an embodiment of the present application. DETAILED DESCRIPTION

[0027] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0028] It should be noted that similar numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it is not necessary to further define and explain it in the subsequent drawings. At the same time, in the description of this application, relational terms such as "first", "second", etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the term "include", "comprise" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements includes not only those elements, but also includes other elements that are not clearly listed, or also includes elements inherent to such process, method, article or equipment. In the absence of more restrictions, the elements limited by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or equipment including the elements.

[0029] The technical solution of the present application will be described in detail below with reference to the accompanying drawings.

[0030] See also Figure 1 , Figure 1 A flow chart of a method for detecting a DNS rebinding attack is shown in an embodiment of the present application. Figure 1 Describe the steps it involves.

[0031] S100: Obtain a DNS data packet to be detected, and parse the DNS data packet to be detected to obtain a domain name to be detected and a website address to be detected corresponding to the domain name to be detected.

[0032] The DNS data packet to be detected can be pre-acquired and stored in a local storage medium, and can be directly called when needed. Alternatively, the DNS data packet to be detected can also be acquired in real time when needed.

[0033] In one implementation, a specific method of obtaining the DNS data packet to be detected may be: first obtaining a traffic data packet, and then filtering the traffic data packet to obtain a DNS data packet, wherein the DNS data packet is a type of traffic data packet.

[0034] For example, the DNS part in the traffic data packet can be filtered using the scapy (a network packet processing program based on Python) command line tool of python (a cross-platform computer programming language), such as the commonly used one-line command dns_packets = [pkt for pkt in packets if DNS in pkt]. Among them, scapy is a tool for parsing and sending custom network protocol data packets under python, which is mainly used for tasks such as network traffic analysis and protocol testing.

[0035] Optionally, a packet capture tool may be used to capture traffic data packets from the target object. The captured traffic data packets are then stored. The specific storage location may be set according to actual needs and is not limited here.

[0036] For example, the packet capture operation may be performed using the packet capture tool Wireshark.

[0037] If this solution is only used to detect whether a personal computer (the target object is a personal computer) is attacked by DNS rebinding, a packet capture tool such as Wireshark can be installed on the personal computer to capture packets (i.e., capture traffic data packets).

[0038] If this solution is used to detect whether the entire intranet (the target object is the intranet) is attacked by DNS rebinding, you can set up a packet capture tool such as Wireshark at the network exit or network exchange of the intranet and perform packet capture to obtain all traffic to the intranet.

[0039] In one implementation, before S100, it is also possible to detect whether there are two DNS packets that are adjacent in time sequence and have the same source IP and target IP. If so, and the URLs obtained by resolving the same domain name in the two DNS packets are different, then the later DNS packet in time sequence is determined as the DNS packet to be detected, and S100 is executed.

[0040] S200: Searching the historical database for the correct website address corresponding to the domain name to be detected, and comparing the correct website address with the website address to be detected.

[0041] The historical database records multiple domain names and the correct URL corresponding to each domain name.

[0042] The correct URL is the URL corresponding to the domain name when there is no DNS rebinding attack.

[0043] Optionally, the specific method of searching the history database for the correct website address corresponding to the domain name to be detected may be: searching the history database for the domain name to be detected to determine whether the domain name to be detected exists. If so, determining the correct website address corresponding to the domain name to be detected.

[0044] Compare the correct URL with the URL to be tested, that is, determine whether the correct URL and the URL to be tested are consistent.

[0045] In one implementation, if the correct URL corresponding to the domain name to be detected is not found in the historical database, the web page information features corresponding to the target website are obtained and stored in the historical database. The web page information features corresponding to the target website are stored in the historical database to facilitate subsequent applications.

[0046] S300: If the URL to be detected is consistent with the correct URL, it is determined that there is no DNS rebinding attack in the DNS data packet.

[0047] Since the URL to be detected is consistent with the correct URL, the website pointed to by the URL to be detected and the correct URL is the same, therefore, it is determined that there is no DNS rebinding attack on the DNS data packet.

[0048] S400: If the URL to be detected is inconsistent with the correct URL, obtain the information features of the web page to be detected of the target website currently pointed to by the URL to be detected.

[0049] Since the URL to be detected is inconsistent with the correct URL, it is necessary to further determine whether it is caused by changing the URL or a DNS rebinding attack.

[0050] Optionally, the web page information feature to be detected may include at least one of the first website homepage information and the first 404 response information.

[0051] Among them, the website homepage information may include at least one of JS (JavaScript, a scripting language used to enhance the interactivity and dynamism of web pages), HTML (HyperText Markup Language, a markup language used to describe web page content), CSS (Cascading Style Sheets, used to define the style of web pages and control the layout and appearance of web pages), etc. The website homepage information is not limited to the content exemplified here.

[0052] Optionally, the website homepage information may be obtained through a crawler.

[0053] Optionally, if the characteristics of the web page information to be detected include the home page information of the first website, the method for obtaining the home page information of the first website may also be: first, the sub-first website home page information (i.e., JS, HTML, CSS, etc.) of the target website (hereinafter referred to as the target website) currently pointed to by the web address to be detected is obtained through a crawler. Then, based on the sub-first website home page information, the built-in fingerprint library is retrieved to determine the type of framework used by the target website. Afterwards, according to the special routes (such as redirect routes, parameterized routes, static resource routes, API routes, etc.) corresponding to the type of framework used by the target website stored in the built-in fingerprint library and the domain name to be detected, the target website currently pointed to by the web address to be detected is accessed to obtain the response information returned by the target website currently pointed to by the web address to be detected. The characteristics of the web page information to be detected include the received response information and the sub-first website home page information. Among them, the special routes corresponding to different websites may be different.

[0054] Access the target website currently pointed to by the URL to be detected, that is, make an HTTP (Hypertext Transfer Protocol) request (the request method is not limited to HTTP request, which is only for ease of understanding), wherein the requested URL (Uniform Resource Locator) is determined by a special route. The method of converting the route into a URL is well known to those skilled in the art, and for the sake of brief description, it will not be repeated here.

[0055] Optionally, the built-in fingerprint library may also store characteristic URLs corresponding to each frame type, and accordingly, the target website may be accessed based on the characteristic URLs.

[0056] Optionally, since many websites use the same template, the framework used by the website can be detected through the content of the website's homepage, so that deeper information can be obtained. Generally, attackers use DNS rebinding to forge web pages, but forged web pages generally only clone the content of the homepage and add some malicious payloads to the content of the homepage to steal information. At this time, using the URL of the fingerprint library (or special route) to make a request will generally only get a 404 response. Therefore, if the target website currently pointed to by the URL to be detected is visited, and the target website returns a 404 response, it can be considered that the DNS data packet to be detected has a DNS rebinding attack and the detection process is stopped.

[0057] In one implementation, the web page information feature to be detected may include the first 404 response information, and the specific method of obtaining the web page information feature to be detected of the target website pointed to by the URL to be detected may be: firstly randomly generate a string of characters, then send the string of characters as request information to the target website, and finally receive the first 404 response information returned by the target website.

[0058] By using a randomly generated string as the request information, the target website cannot recognize its specific information and thus returns a 404 response message.

[0059] The specific length of the string can be set according to actual needs, or can be set to a random length, and the length of the string is randomly determined when the string is generated.

[0060] The 404 response message means "Not Found". When a user browses a web page, if the server cannot find the page requested by the user, it will return a 404 response message. The specific definition of the 404 response message is well known to those skilled in the art, and for the sake of brief description, it will not be repeated here.

[0061] In one implementation mode, if the correct website is inconsistent with the website to be detected, the first crawler protocol of the target website can also be obtained. Then, the second crawler protocol corresponding to the correct website is obtained from the historical database. Then, the crawler protocol similarity of the first crawler protocol and the second crawler protocol is calculated. If the crawler protocol similarity is less than a preset crawler protocol similarity threshold, it is determined that the DNS data packet to be detected has a DNS rebinding attack.

[0062] If the crawler protocol similarity is greater than or equal to a preset crawler protocol similarity threshold, the determination result of the web page information feature similarity and the preset similarity threshold is taken as the final result.

[0063] If the website currently pointed to by the URL to be detected is the correct website pointed to by the domain name to be detected, then the first crawler protocol and the second crawler protocol should be the same. On the contrary, if the crawler protocol similarity is less than the preset crawler protocol similarity threshold, it indicates that the crawler protocols of the two are different, that is, the website currently pointed to by the URL to be detected is not the correct website pointed to by the domain name to be detected.

[0064] In this way, the history database also needs to record the second crawler protocol corresponding to each correct website.

[0065] The crawler protocol similarity between the first crawler protocol and the second crawler protocol may be calculated using any type of similarity calculation method, which is not limited herein.

[0066] Optionally, before calculating the crawler protocol similarity between the first crawler protocol and the second crawler protocol, it may also be determined whether the first crawler protocol and the second crawler protocol are acquired.

[0067] If both the first crawler protocol and the second crawler protocol are obtained, the crawler protocol similarity between the first crawler protocol and the second crawler protocol is calculated.

[0068] If neither the first crawler protocol nor the second crawler protocol is obtained, it is determined that the crawler protocol similarity between the first crawler protocol and the second crawler protocol is 100%.

[0069] If only one of the first crawler protocol and the second crawler protocol is obtained, it is determined that the DNS data packet to be detected has a DNS rebinding attack.

[0070] Since not all websites have crawler protocols, for the same website, it is possible to have crawler protocols or not have crawler protocols. Therefore, if only one of the first crawler protocol and the second crawler protocol is obtained, it is determined that the DNS packet to be detected has a DNS rebinding attack. If neither is obtained, it means that crawler protocols do not exist on both websites. Therefore, it is not possible to determine whether a DNS rebinding attack exists through crawler protocols.

[0071] S500: Acquire historical web page information features of the correct website pointed to by the domain name to be detected in the historical database.

[0072] The correct website is the website pointed to by the correct URL corresponding to the domain name to be detected.

[0073] The types of data included in the historical web page information features acquired in S500 are the same as the types of data included in the to-be-detected web page information features acquired in S400.

[0074] For ease of understanding, taking the example that the characteristics of the web page information to be detected include the first website homepage information and the first 404 response information, obtaining the historical web page information characteristics of the correct website pointed to by the domain name to be detected in the historical database can be: obtaining the second website homepage information and the second 404 response information of the correct website pointed to by the domain name to be detected in the historical database.

[0075] S600: Calculate the web page information feature similarity between the web page information feature to be detected and the historical web page information feature, and when the web page information feature similarity is less than a preset similarity threshold, determine that the DNS data packet to be detected has a DNS rebinding attack.

[0076] Among them, if the similarity of the web page information features is greater than or equal to the preset similarity threshold, it means that the target website currently pointed to by the URL to be detected and the correct website pointed to by the domain name to be detected should be the same website, that is, there is no DNS rebinding attack.

[0077] Since the URL to be detected corresponding to the domain name to be detected is inconsistent with the correct URL corresponding to the domain name to be detected, it is impossible to simply determine whether there is a DNS rebinding attack through the URL to be detected. Therefore, in the case where the URL to be detected is inconsistent with the correct URL, the similarity between the web page information features to be detected of the target website currently pointed to by the URL to be detected and the historical web page information features of the correct website pointed to by the domain name to be detected is used to further determine whether there is a DNS rebinding attack. If there is a DNS rebinding attack, the website currently pointed to by the URL to be detected is not the correct website pointed to by the domain name to be detected, but a malicious website. The web page information features of the malicious website must be different from the web page information features of the correct website. If there is no DNS rebinding attack, only the URL is changed, then the two points should be the same website, and the similarity between the web page information features to be detected and the historical web page information features should be high. Therefore, this solution can accurately detect whether it is a DNS rebinding attack or a URL change.

[0078] In one implementation mode, the web page information feature to be detected includes the home page information of the first website and the first 404 response information, and the historical web page information feature includes the home page information of the second website and the second 404 response information; the specific method of calculating the web page information feature similarity between the web page information feature to be detected and the historical web page information feature can be: splicing the home page information of the first website and the first 404 response information to obtain the first data. And splicing the home page information of the second website and the second 404 response information to obtain the second data. Then, the similarity between the first data and the second data is calculated to obtain the web page information feature similarity.

[0079] Since the first data is obtained by splicing the first website homepage information and the first 404 response information, and the second data is obtained by splicing the second website homepage information and the second 404 response information, and the splicing order is the same, the similarity between the first data and the second data can reflect the similarity between the characteristics of the web page information to be detected and the characteristics of the historical web page information, so that the similarity between the characteristics of the web page information to be detected and the characteristics of the historical web page information can be obtained by calculating the similarity only once.

[0080] Optionally, the web page information feature to be detected includes the first website homepage information and the first 404 response information, and the historical web page information feature includes the second website homepage information and the second 404 response information; the specific method of calculating the web page information feature similarity between the web page information feature to be detected and the historical web page information feature may be: firstly, calculating the similarity between the first website homepage information and the second website homepage information to obtain the first similarity. And calculating the similarity between the first 404 response information and the second 404 response information to obtain the second similarity. Finally, calculating the average of the first similarity and the second similarity, the average is the web page information feature similarity between the web page information feature to be detected and the historical web page information feature.

[0081] In one implementation mode, the web page information feature to be detected includes the home page information of the first website and the first 404 response information, the historical web page information feature includes the home page information of the second website and the second 404 response information, the web page information feature similarity includes the first similarity and the second similarity, and the similarity threshold includes the first similarity threshold and the second similarity threshold; the web page information feature similarity between the web page information feature to be detected and the historical web page information feature is calculated, and when the web page information feature similarity is lower than the preset similarity threshold, the specific method of determining that the DNS data packet to be detected has a DNS rebinding attack may be: firstly, calculating the similarity between the home page information of the first website and the home page information of the second website to obtain the first similarity. And calculating the similarity between the first 404 response information and the second 404 response information to obtain the second similarity.

[0082] If the first similarity is less than a preset first similarity threshold, or the second similarity is less than a preset second similarity threshold, it is determined that a DNS rebinding attack exists in the DNS data packet to be detected.

[0083] If the first similarity is greater than or equal to a preset first similarity threshold, and the second similarity is greater than or equal to a preset second similarity threshold, it is determined that there is no DNS rebinding attack in the DNS data packet to be detected.

[0084] The first similarity threshold and the second similarity threshold can be set according to actual needs, for example, they can be set to 90%, 95%, 99%, 100, etc. The specific values ​​of the first similarity threshold and the second similarity threshold are not limited to the examples given here.

[0085] However, since the content of the website may be updated, the website homepage information may change, so the first similarity threshold may not be set to 100%.

[0086] In order to facilitate the understanding of the above-mentioned DNS rebinding attack detection method, the following Figure 2 Take this as an example to illustrate.

[0087] like Figure 2 As shown, firstly, it is detected whether there are two DNS data packets that are adjacent in time sequence and have the same source IP and target IP. If not, repeat the detection step.

[0088] If so, and the URLs resolved for the same domain name in the two DNS packets are the same, then it is checked again whether there are two DNS packets that are adjacent in time sequence and have the same source IP and target IP.

[0089] If so, and the web addresses resolved for the same domain name in the two DNS data packets are different, then the DNS data packet that is later in time sequence is determined to be the DNS data packet to be detected.

[0090] The DNS data packet to be detected is parsed to obtain the domain name to be detected and the URL to be detected corresponding to the domain name to be detected.

[0091] The correct URL corresponding to the domain name to be detected is searched in the historical database, and the correct URL is compared with the URL to be detected.

[0092] If the URL to be detected is consistent with the correct URL, it is determined that there is no DNS rebinding attack in the DNS data packet to be detected.

[0093] If the URL to be detected is inconsistent with the correct URL, the information characteristics of the web page to be detected and the first crawler protocol of the target website currently pointed to by the URL to be detected are obtained.

[0094] The historical web page information characteristics and the second crawler protocol of the correct website pointed to by the domain name to be detected are obtained in the historical database; the correct website is also the website pointed to by the correct URL corresponding to the domain name to be detected.

[0095] The web page information feature similarity between the web page information feature to be detected and the historical web page information feature is calculated, and when the web page information feature similarity is less than a preset similarity threshold, it is determined that the DNS data packet to be detected has a DNS rebinding attack.

[0096] and calculating the crawler protocol similarity between the first crawler protocol and the second crawler protocol. If the crawler protocol similarity is less than a preset crawler protocol similarity threshold, it is determined that the DNS data packet to be detected has a DNS rebinding attack.

[0097] If the crawler protocol similarity is greater than or equal to a preset crawler protocol similarity threshold, and the web page information feature similarity is greater than or equal to a preset similarity threshold, it is determined that there is no DNS rebinding attack.

[0098] Figure 2 The specific implementation methods and principles of each step shown have been clearly described in the previous text and will not be repeated here for the sake of brevity.

[0099] Based on the same technical concept, the present application also provides a detection device for a DNS rebinding attack, such as Figure 3 As shown, the DNS rebinding attack detection device 100 includes an acquisition module 110 and a processing module 120 .

[0100] The acquisition module 110 is used to acquire a DNS data packet to be detected, and parse the DNS data packet to be detected to obtain a domain name to be detected and a website address to be detected corresponding to the domain name to be detected.

[0101] The processing module 120 is used to search the history database for the correct website address corresponding to the domain name to be detected, and compare the correct website address with the website address to be detected.

[0102] The processing module 120 is further configured to determine that there is no DNS rebinding attack on the DNS data packet if the URL to be detected is consistent with the correct URL.

[0103] The processing module 120 is also used to obtain the web page information features to be detected of the target website pointed to by the web address to be detected if the web address to be detected is inconsistent with the correct web address; obtain the historical web page information features of the correct website pointed to by the domain name to be detected in the historical database; calculate the web page information feature similarity between the web page information features to be detected and the historical web page information features, and when the web page information feature similarity is lower than a preset similarity threshold, determine that the DNS data packet to be detected has a DNS rebinding attack.

[0104] The processing module 120 is further configured to obtain web page information features corresponding to the target website and store the features in the historical database if the correct website address corresponding to the domain name to be detected is not found in the historical database.

[0105] The web page information features to be detected include the first 404 response information; the processing module 120 is specifically used to randomly generate a string of characters; send the string as request information to the target website; and receive the first 404 response information returned by the target website.

[0106] The web page information features to be detected include the homepage information of the first website and the first 404 response information, and the historical web page information features include the homepage information of the second website and the second 404 response information; the processing module 120 is specifically used to splice the first website homepage information and the first 404 response information to obtain first data; splice the second website homepage information and the second 404 response information to obtain second data; calculate the similarity between the first data and the second data to obtain the web page information feature similarity.

[0107] The features of the web page information to be detected include the home page information of the first website and the first 404 response information, the features of the historical web page information include the home page information of the second website and the second 404 response information, the similarity of the web page information features includes the first similarity and the second similarity, and the similarity threshold includes the first similarity threshold and the second similarity threshold; the processing module 120 is specifically used to calculate the similarity between the home page information of the first website and the home page information of the second website to obtain the first similarity; calculate the similarity between the first 404 response information and the second 404 response information to obtain the second similarity; if the first similarity is less than the preset first similarity threshold, or the second similarity is less than the preset second similarity threshold, it is determined that the DNS data packet to be detected has a DNS rebinding attack.

[0108] If the correct URL is inconsistent with the URL to be detected, the processing module 120 is also used to obtain the first crawler protocol of the target website; obtain the second crawler protocol corresponding to the correct website in the historical database; calculate the crawler protocol similarity between the first crawler protocol and the second crawler protocol; if the crawler protocol similarity is less than a preset crawler protocol similarity threshold, it is determined that the DNS data packet to be detected has a DNS rebinding attack.

[0109] Before calculating the crawler protocol similarity between the first crawler protocol and the second crawler protocol, the processing module 120 is also used to determine whether the first crawler protocol and the second crawler protocol are obtained; if both the first crawler protocol and the second crawler protocol are obtained, the crawler protocol similarity between the first crawler protocol and the second crawler protocol is calculated; if neither the first crawler protocol nor the second crawler protocol is obtained, it is determined that the crawler protocol similarity between the first crawler protocol and the second crawler protocol is 100%; if only one of the first crawler protocol and the second crawler protocol is obtained, it is determined that the DNS data packet to be detected has a DNS rebinding attack.

[0110] The DNS rebinding attack detection device 100 provided in the embodiment of the present application has the same implementation principle and technical effects as those of the aforementioned DNS rebinding attack detection method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference may be made to the corresponding contents in the aforementioned DNS rebinding attack detection method embodiment.

[0111] See also Figure 4 , which is an electronic device 200 provided in an embodiment of the present application. The electronic device 200 includes: a processor 210 and a memory 220.

[0112] The memory 220 and the processor 210 are electrically connected to each other directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other via one or more communication buses or signal lines. The memory 220 is used to store computer programs, such as storing Figure 3 The software function module shown in the figure is the detection device 100 for DNS rebinding attack. The detection device 100 for DNS rebinding attack includes at least one software function module that can be stored in the memory 220 in the form of software or firmware or solidified in the operating system (OS) of the electronic device 200. The processor 210 is used to execute the executable module stored in the memory 220, such as the software function module or computer program included in the detection device 100 for DNS rebinding attack. At this time, the processor 210 is used to obtain the DNS data packet to be detected, parse the DNS data packet to be detected to obtain the domain name to be detected and the website address to be detected corresponding to the domain name to be detected; query the correct website address corresponding to the domain name to be detected in the historical database, and compare the correct website address with the website address to be detected; if the website address to be detected is consistent with the correct website address, it is determined that there is no DNS rebinding attack in the DNS data packet to be detected; if the website address to be detected is inconsistent with the correct website address, obtain the web page information features to be detected of the target website currently pointed to by the website address to be detected; obtain the historical web page information features of the correct website pointed to by the domain name to be detected in the historical database; the correct website is also the website pointed to by the correct website address corresponding to the domain name to be detected; calculate the web page information feature similarity between the web page information feature to be detected and the historical web page information feature, and when the web page information feature similarity is less than the preset similarity threshold, determine that there is a DNS rebinding attack in the DNS data packet to be detected.

[0113] Among them, the memory 220 can be, but is not limited to, RAM (Random Access Memory), ROM (Read Only Memory), PROM (Programmable Read-Only Memory), EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electric Erasable Programmable Read-Only Memory), etc.

[0114] The processor 210 may be an integrated circuit chip with signal processing capabilities. The above-mentioned processor may be a general-purpose processor, including a CPU (Central Processing Unit), an NP (Network Processor), etc.; it may also be a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The various methods, steps and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. A general-purpose processor may be a microprocessor or the processor 210 may also be any conventional processor, etc.

[0115] The electronic device 200 mentioned above includes but is not limited to a personal computer, a server, etc.

[0116] The embodiment of the present application also provides a computer-readable storage medium (hereinafter referred to as storage medium), on which a computer program is stored, and when the computer program is run by a computer such as the above-mentioned electronic device 200, the above-mentioned DNS rebinding attack detection method is executed. The computer-readable storage medium includes: a U disk, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk, and other media that can store program codes.

[0117] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for detecting a DNS rebinding attack, characterized in that: include: Obtain a DNS data packet to be detected, and parse the DNS data packet to be detected to obtain a domain name to be detected and a website address to be detected corresponding to the domain name to be detected; Searching the history database for the correct website address corresponding to the domain name to be detected, and comparing the correct website address with the website address to be detected; If the URL to be detected is consistent with the correct URL, it is determined that there is no DNS rebinding attack on the DNS data packet to be detected; If the URL to be detected is inconsistent with the correct URL, then obtaining the information characteristics of the web page to be detected of the target website currently pointed to by the URL to be detected; Acquire the historical web page information features of the correct website pointed to by the domain name to be detected in the historical database; the correct website is also the website pointed to by the correct website address corresponding to the domain name to be detected; The web page information feature similarity between the web page information feature to be detected and the historical web page information feature is calculated, and when the web page information feature similarity is less than a preset similarity threshold, it is determined that the DNS data packet to be detected has a DNS rebinding attack.

2. The method according to claim 1, characterized in that: The method further comprises: If the correct website address corresponding to the domain name to be detected is not found in the historical database, the web page information features corresponding to the target website are obtained and stored in the historical database.

3. The method according to claim 1, characterized in that The web page information feature to be detected includes the first 404 response information; obtaining the web page information feature to be detected of the target website pointed to by the URL to be detected includes: Generate a random string; Sending the string as request information to the target website; Receive the first 404 response information returned by the target website.

4. The method according to claim 1, characterized in that The web page information characteristics to be detected include the first website homepage information and the first 404 response information, and the historical web page information characteristics include the second website homepage information and the second 404 response information; When calculating the web page information feature similarity between the web page information feature to be detected and the historical web page information feature, it includes: The first website homepage information and the first 404 response information are concatenated to obtain first data; The second website homepage information and the second 404 response information are concatenated to obtain second data; The similarity between the first data and the second data is calculated to obtain the web page information feature similarity.

5. The method according to claim 1, characterized in that The web page information feature to be detected includes the home page information of the first website and the first 404 response information, the historical web page information feature includes the home page information of the second website and the second 404 response information, the web page information feature similarity includes the first similarity and the second similarity, and the similarity threshold includes the first similarity threshold and the second similarity threshold; Calculating the web page information feature similarity between the web page information feature to be detected and the historical web page information feature, and determining that the DNS data packet to be detected has a DNS rebinding attack when the web page information feature similarity is lower than a preset similarity threshold, including: Calculating the similarity between the first website homepage information and the second website homepage information to obtain a first similarity; Calculating the similarity between the first 404 response information and the second 404 response information to obtain a second similarity; If the first similarity is smaller than a preset first similarity threshold, or the second similarity is smaller than a preset second similarity threshold, it is determined that a DNS rebinding attack exists in the DNS data packet to be detected.

6. The method according to claim 1, characterized in that If the correct URL is inconsistent with the URL to be detected, the method further includes: Obtaining a first crawler protocol of the target website; Obtaining a second crawler protocol corresponding to the correct website from the historical database; Calculating crawler protocol similarity between the first crawler protocol and the second crawler protocol; If the crawler protocol similarity is less than a preset crawler protocol similarity threshold, it is determined that a DNS rebinding attack exists in the DNS data packet to be detected.

7. The method according to claim 6, characterized in that Before calculating the crawler protocol similarity between the first crawler protocol and the second crawler protocol, the method further includes: Determining whether the first crawler protocol and the second crawler protocol are obtained; If both the first crawler protocol and the second crawler protocol are obtained, calculating the crawler protocol similarity between the first crawler protocol and the second crawler protocol; If neither the first crawler protocol nor the second crawler protocol is obtained, determining that the crawler protocol similarity between the first crawler protocol and the second crawler protocol is 100%; If only one of the first crawler protocol and the second crawler protocol is obtained, it is determined that a DNS rebinding attack exists in the DNS data packet to be detected.

8. A detection device for DNS rebinding attack, characterized in that: include: An acquisition module is used to acquire a DNS data packet to be detected, and parse the DNS data packet to be detected to obtain a domain name to be detected and a URL to be detected corresponding to the domain name to be detected; A processing module, used for searching the historical database for the correct website address corresponding to the domain name to be detected, and comparing the correct website address with the website address to be detected; The processing module is further configured to determine that there is no DNS rebinding attack on the DNS data packet if the URL to be detected is consistent with the correct URL; The processing module is further configured to obtain the information features of the web page to be detected of the target website pointed to by the web address to be detected if the web address to be detected is inconsistent with the correct web address; Obtain historical web page information features of the correct website pointed to by the domain name to be detected in the historical database; calculate the web page information feature similarity between the web page information features to be detected and the historical web page information features, and when the web page information feature similarity is lower than a preset similarity threshold, determine that the DNS data packet to be detected has a DNS rebinding attack.

9. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are connected; The memory is used to store programs; The processor is used to call the program stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a computer, the method according to any one of claims 1 to 7 is executed.

Images