A secure access control method and system for DNS resolution

Abstract

The present invention discloses a secure access control method and system for DNS resolution, which relates to the field of network security technology. The method includes collecting and preprocessing DNS data, calculating dynamic spectrum intensity based on the preprocessed DNS data, calculating threat level based on the dynamic spectrum intensity, constructing a long-short-term memory network model to predict future threat levels and draw a threat level trend curve, constructing a visual interface to display the threat level trend curve, and storing the collected and analyzed DNS data. By using multi-scale embedding technology and nonlinear dimensionality reduction methods to generate a reduced dimension feature matrix, the method achieves rapid detection and protection against potential network threats, improves the ability to prevent potential network attacks, and enhances sensitivity to complex attack behaviors by combining nonlinear dynamic weighted threat calculation to improve the accuracy of identifying abnormal DNS traffic behavior and reduce the probability of security vulnerabilities.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a DNS resolution-oriented security access control method and system. Background Art

[0002] With the widespread use of the Internet and the rapid development of information technology, network security has become a key issue of global concern. The Domain Name System (DNS), as one of the basic services of the Internet, is responsible for resolving domain names into IP addresses and is a key component of network communications. However, during its widespread use, DNS services have also exposed many security risks. DNS attacks occur frequently, especially malicious behaviors such as DNS cache poisoning, DNS amplification attacks, and data transmission through DNS tunnels. These attacks not only threaten users' network security, but also expose the systems of enterprises and service providers to greater security risks. The security issues of DNS are becoming increasingly prominent. In order to improve the security of DNS services, researchers and network security experts have proposed various security protection solutions based on traffic analysis and behavior monitoring. These solutions usually rely on detailed analysis of the characteristics of DNS requests in network traffic to improve the accuracy of attack detection.

[0003] Although existing technologies have made certain progress in DNS traffic analysis and anomaly detection, there are still many shortcomings. DNS traffic analysis technologies often rely on static rules or simple statistical methods, which are easily affected by environmental changes and have difficulty coping with highly complex attack patterns. Existing threat assessments usually only rely on simple threshold judgments and lack real-time monitoring and detailed analysis of dynamic changes in traffic, resulting in high false alarm and missed alarm rates. Summary of the Invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a secure access control method and system for DNS resolution, which solves the problem that the existing DNS traffic analysis technology often relies on static rules or simple statistical methods, is easily affected by environmental changes, and has difficulty in coping with highly complex attack modes. Existing threat assessments usually only rely on simple threshold judgments and lack real-time monitoring and detailed analysis of dynamic changes in traffic, resulting in high false alarm and missed alarm rates.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides a security access control method for DNS resolution, which includes collecting and preprocessing DNS data, calculating dynamic spectrum intensity based on the preprocessed DNS data; calculating threat level based on the dynamic spectrum intensity, constructing a long-short-term memory network model to predict future threat levels and draw a threat level trend curve; constructing a visual interface to display the threat level trend curve, and storing, collecting and analyzing the generated DNS data.

[0008] As a preferred solution of the DNS resolution-oriented security access control method of the present invention, wherein: collecting DNS data and preprocessing it refers to using a traffic monitoring tool to collect DNS data in network traffic and preprocess it;

[0009] The DNS data includes timestamp, latency, request size, and request frequency;

[0010] The preprocessing includes using the NTP protocol to unify the time of the collected DNS data, using a hash algorithm to perform a deduplication operation, using an interpolation method to fill in missing data, and normalizing the DNS data.

[0011] As a preferred solution of the DNS resolution-oriented security access control method of the present invention, wherein: the calculation of dynamic spectrum intensity based on pre-processed DNS data refers to extracting the time window using the time window feature extraction method based on the pre-processed DNS data. The features of , where i is the index of the time window, and the features of all time windows are stacked into a time series feature matrix ;

[0012] Based on the time series feature matrix , using the Gaussian function to define the embedding function , where a is the embedding dimension index

[0013] Compute embedding function Gradient ; embed the function ,gradient Embed Center Combine and calculate the Gaussian kernel embedding value , the formula is:

[0014] ,in For embedded centers;

[0015] For the time series feature matrix Perform wavelet transform to extract frequency domain components , generate the frequency domain component matrix;

[0016] Calculate the phase angle of the frequency component using Fast Fourier Transform based on each column of the frequency domain component matrix , where u is the index of the frequency component;

[0017] Gaussian kernel embedding , frequency domain components and phase angle , use multi-scale embedding technology to perform nonlinear dimensionality reduction on the time series feature matrix to generate a reduced dimensionality feature matrix , the formula is: ,

[0018] Where M is the number of frequency components and k is the number of embedding scales;

[0019] Calculate the Euclidean distance between data points using the Euclidean distance method based on the reduced dimension feature matrix ,in and is the data point, l and j are the indexes of the data point;

[0020] Use the nearest neighbor radius method to set the number of nearest neighbors L and calculate the distance from each data point to the Lth nearest neighbor , based on the density of the nearest neighbor distance, calculate the local reachability density

[0021] Based on local reachability density , use the density ratio method to calculate the local anomaly factor ;

[0022] Calculate local anomaly factor The mean of the abnormal threshold is set as , use the ratio analysis method to calculate the time window The proportion of abnormal points ;

[0023] Use the percentile method to set the judgment threshold, compare the abnormal point ratio with the judgment threshold, mark the abnormal point ratio greater than the judgment threshold as an abnormal window, and generate an abnormal point set;

[0024] Extract abnormal window features from the abnormal point set using the time window feature extraction method, and stack the features of all abnormal windows into a traffic matrix;

[0025] Use standard quantum state representation to map the flow matrix into quantum states

[0026] Quantum state Superposition is performed to obtain the comprehensive state ;

[0027] Comprehensive Perform measurements and extract the contribution of characteristic frequencies ;

[0028] Based on the columns in the traffic matrix, piecewise linear interpolation is performed using linear interpolation to obtain the eigenvalue at time t. ;

[0029] Contribution based on characteristic frequency and the eigenvalues ​​at time t Perform weighted summation to calculate the dynamic spectrum intensity at time t , the formula is: ,

[0030] Where m is the total number of features.

[0031] As a preferred solution of the DNS resolution-oriented security access control method of the present invention, wherein: the threat degree calculated based on dynamic spectrum intensity refers to the dynamic spectrum intensity based on time t Each time point is defined as a node in the graph. The edge weight is calculated according to the difference in dynamic spectrum intensity between time points. The edge weight greater than 0 is selected to construct a dynamic spectrum graph.

[0032] Filter out edge weights greater than 0 and define them as a neighborhood set. Calculate the sum of the edge weights in the neighborhood set to obtain the total neighborhood weight. Use the proportional distribution calculation method to calculate the importance distribution of nodes in the neighborhood in the dynamic spectrum graph.

[0033] The local topological entropy is calculated using Shannon entropy, and the mean of the local topological entropy is set as the benchmark. , calculate the local topological entropy change by subtracting the topological entropy change from the baseline , where o is a node 's index;

[0034] Based on the change of local topological entropy , using nonlinear dynamic weighting to calculate the threat level of the node , the formula is: , use the percentile method to set the judgment threshold, compare the threat level with the judgment threshold, if the threat level is greater than or equal to the judgment threshold, it is judged as a high threat, the parsing is rejected, and an error response is returned; if the threat level is less than the judgment threshold, it is judged as a low threat, the parsing is allowed, and an early warning is issued and recorded in the access log.

[0035] As a preferred embodiment of the DNS resolution-oriented security access control method of the present invention, the method of constructing a long short-term memory network model to predict future threat levels and draw a threat level trend curve comprises collecting and preprocessing historical DNS data with labels, calculating the historical threat level using weighted fusion, and generating a training set.

[0036] Constructing a long short-term memory network model includes input layer, hidden layer and fully connected output layer;

[0037] Set the input layer to threat level;

[0038] Use the training set to train the long short-term memory network model, and use the loss function and Adam optimizer to iteratively optimize the model parameters;

[0039] Input the threat level of the node into the trained long short-term memory network model to predict the future threat level;

[0040] Sort the future threat levels by time t and use Matplotlib to draw a threat level trend curve.

[0041] As a preferred solution of the DNS resolution-oriented security access control method of the present invention, wherein: the construction of a visual interface to display the threat level trend curve refers to using the front-end framework React to construct a visual interface, including a main chart area and a top information bar;

[0042] Displays the threat level trend curve in the main chart area and the threat level in the top information bar;

[0043] Users who have passed real-name verification are allowed to view the information.

[0044] As a preferred solution of the DNS resolution-oriented security access control method described in the present invention, the storage of the DNS data collected and analyzed refers to storing the collected DNS data and the threat trend curve generated by the analysis in a central database, and setting security access measures. The central database backs up the stored data in the cloud, and regularly performs integrity checks on the stored data and backup data. After the test is completed, an integrity test record is generated and synchronously stored in the central database.

[0045] In a second aspect, the present invention provides a secure access control system for DNS resolution, comprising:

[0046] A collection and calculation module is used to collect and pre-process DNS data, and calculate the dynamic spectrum intensity based on the pre-processed DNS data;

[0047] The threat construction module is used to calculate the threat level based on the dynamic spectrum intensity, build a long-short-term memory network model to predict the future threat level and draw a threat level trend curve;

[0048] The visualization storage module is used to build a visualization interface to display the threat trend curve and store the DNS data collected and analyzed.

[0049] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, any step of the secure access control method for DNS resolution as described in the first aspect of the present invention is implemented.

[0050] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the secure access control method for DNS resolution as described in the first aspect of the present invention.

[0051] The beneficial effects of the present invention are as follows: the present invention collects DNS data and preprocesses it, calculates the dynamic spectrum intensity based on the preprocessed DNS data; calculates the threat level based on the dynamic spectrum intensity, constructs a long-short-term memory network model to predict the future threat level and draws a threat level trend curve; improves the recognition accuracy of abnormal DNS traffic behavior, reduces the probability of security vulnerabilities, and enhances the ability to prevent potential network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0053] Figure 1 This is a flowchart of the secure access control method for DNS resolution in Example 1.

[0054] Figure 2 This is a structural diagram of the secure access control system for DNS resolution in Example 1. DETAILED DESCRIPTION

[0055] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0056] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0057] Secondly, the term "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in various places throughout this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive of other embodiments.

[0058] Example 1, with reference to Figure 1 and Figure 2 , which is the first embodiment of the present invention, provides a secure access control method for DNS resolution, including the following steps:

[0059] S1. Collect and preprocess DNS data, and calculate dynamic spectrum intensity based on the preprocessed DNS data;

[0060] Specifically, collecting DNS data and preprocessing it means using traffic monitoring tools to collect DNS data in network traffic and preprocessing it;

[0061] The DNS data includes timestamp, latency, request size, and request frequency;

[0062] The preprocessing includes using the NTP protocol to unify the time of the collected DNS data, using a hash algorithm to perform a deduplication operation, using an interpolation method to fill in missing data, and normalizing the DNS data.

[0063] During the DNS data collection process, clock deviations may exist between different network devices, and inconsistent timestamps can lead to errors in data analysis. By unifying the timestamps using the NTP protocol, not only can the time differences between devices be eliminated, but the time synchronization of DNS data in analysis can also be ensured, thereby improving the accuracy of data analysis. In particular, when performing time series feature extraction and anomaly detection, the interference caused by time synchronization problems can be avoided. Deduplication through the hash algorithm can ensure that each DNS request and response is only counted once in the analysis, thereby improving data processing efficiency and reducing the waste of computing resources. The interpolation method can restore the coherence of the data, reduce the analysis errors caused by missing data, and further improve the robustness of the system. Normalization can not only improve the efficiency of the algorithm, but also enhance the generalization ability of the analysis model, enabling it to more accurately identify various abnormal behaviors and security threats.

[0064] Furthermore, anomaly detection analysis based on preprocessed DNS data refers to extracting time windows using time window feature extraction method based on preprocessed DNS data. Features ,in 、 and Time windows The mean of request latency, mean of request size, and total number of requests, i is the index of the time window, and the features of all time windows are stacked into a time series feature matrix ;

[0065] Based on the time series feature matrix , using the Gaussian function to define the embedding function , the formula is: ,in For embedded centers, is the width of the embedding function, and a is the embedding dimension index;

[0066] Compute embedding function Gradient , the formula is: , embed the function ,gradient Embed Center Combine and calculate the Gaussian kernel embedding value , the formula is:

[0067] ,

[0068] Time series data usually has nonlinear and local characteristics. Linear dimensionality reduction methods (such as PCA) cannot capture these complex patterns. The Gaussian kernel function can capture the similarity of local regions in the time series through nonlinear mapping. Time series may contain multiple scales. The kernel width of the Gaussian kernel function can capture features of different scales. Although other kernel methods (such as polynomial kernels) can capture nonlinear relationships, they are less sensitive to distance and lack flexible adaptation to multiple scales. High-variance regions in time series may cause excessive interference to the embedding results. Traditional embedding techniques (such as linear weighting) usually rely on manually setting the weights of feature points, while gradient adjustment automatically adjusts the embedding value according to the rate of change of feature points to avoid subjectivity. Gradient modulus adjustment dynamically balances the contributions of high-variance and low-variance regions by measuring the rate of change of feature points. The importance of feature points is dynamically adjusted through gradient modulus and logarithmic compression to avoid the subjectivity and noise amplification problems of traditional weight allocation.

[0069] For the time series feature matrix Perform wavelet transform to extract frequency domain components , generate the frequency domain component matrix;

[0070] Calculate the phase angle of the frequency component using Fast Fourier Transform based on each column of the frequency domain component matrix ;

[0071] Gaussian kernel embedding , frequency domain components and phase angle , use multi-scale embedding technology to perform nonlinear dimensionality reduction on the time series feature matrix to generate a reduced dimensionality feature matrix , the formula is: ,

[0072] Where M is the number of frequency components, k is the number of embedding scales, and u is the index of the frequency component;

[0073] Time series data usually contains noise. The wavelet transform can suppress noise during the decomposition process, enhance the stability of features, weight frequency components, highlight the main frequency features, and suppress the interference of secondary frequency features. Normalization ensures the balance of feature components by adjusting the relative weights of different frequency components. Compared with direct normalization, the introduction of amplitude and phase joint processing enhances the expressiveness of frequency components, suppresses the contribution of low-amplitude and high-noise components, and enhances the robustness of dimensionality reduction results. The wavelet transform has good resolution in both time and frequency space and can better describe the local characteristics of time series than the Fourier transform. Through square sum normalization, the influence of amplitude differences of different frequency components is reduced, and the stability of the embedding results is enhanced. The introduction of phase angle and sine-cosine weighting mechanism enhances the ability to distinguish frequency components while avoiding the dominance of low-frequency components on the results. The Gaussian kernel function combined with multi-scale analysis can capture the details and trend characteristics in the time series, making the embedding results more robust.

[0074] Calculate the Euclidean distance between data points using the Euclidean distance method based on the reduced dimension feature matrix ,in and is the data point, l and j are the indexes of the data point;

[0075] Use the nearest neighbor radius method to set the number of nearest neighbors L and calculate the distance from each data point to the Lth nearest neighbor , based on the density of the nearest neighbor distance, calculate the local reachability density , the formula is: ,in For data points The L-nearest neighbor set of ;

[0076] Based on local reachability density , use the density ratio method to calculate the local anomaly factor , the formula is: , calculate the local anomaly factor The mean of the abnormal threshold is set as , use the ratio analysis method to calculate the time window The proportion of abnormal points , the formula is: ,Use the percentile method to set the judgment threshold, compare the abnormal point ratio with the judgment threshold, mark the abnormal point ratio greater than the judgment threshold as an abnormal window, and generate an abnormal point set;

[0077] Extract abnormal window features from the abnormal point set using the time window feature extraction method, and stack the features of all abnormal windows into a traffic matrix;

[0078] Use standard quantum state representation to map the flow matrix into quantum states , the formula is: , where m is the total number of features, is the eigenvalue, Characterized by Orthogonal basis of ;

[0079] Quantum state Superposition is performed to obtain the comprehensive state , the formula is: ,

[0080] Where n is the total number of time windows;

[0081] Comprehensive Perform measurements and extract the contribution of characteristic frequencies , the formula is: ,

[0082] Based on the columns in the traffic matrix, piecewise linear interpolation is performed using linear interpolation to obtain the eigenvalue at time t. ;

[0083] Contribution based on characteristic frequency and the eigenvalues ​​at time t Perform weighted summation to calculate the dynamic spectrum intensity at time t , the formula is: .

[0084] By dividing DNS data into different time windows, the feature extraction method can analyze the traffic characteristics within each time period and capture the timing changes in DNS requests. The Gaussian function helps reduce the impact of noise through its smoothing characteristics, ensures the stability of the data during the embedding process, enhances the analyzability of the data, and ensures that the system accurately captures abnormal traffic. By extracting frequency domain features, it can reveal periodic changes and potential attack patterns in DNS traffic. Multi-scale embedding technology can significantly improve the data expression ability after dimensionality reduction by capturing the nonlinear relationship and multi-level features of the data. Quantum state representation and weighted summation methods can achieve efficient information compression and enhanced feature extraction by quantizing the traffic data. Weighted summation further enhances the sensitivity to frequency contribution and time characteristics, enabling the system to accurately calculate the dynamic spectrum intensity and further improve the detection and response capabilities of security threats.

[0085] S2. Calculate the threat level based on the dynamic spectrum intensity, build a long-short-term memory network model to predict the future threat level and draw a threat level trend curve;

[0086] Specifically, the threat level calculated based on dynamic spectrum intensity refers to the dynamic spectrum intensity based on time t Each time point is defined as a node in the graph. The edge weight is calculated according to the difference in dynamic spectrum intensity between time points. The edge weight greater than 0 is selected to construct a dynamic spectrum graph.

[0087] Filter out edge weights greater than 0 and define them as a neighborhood set. Calculate the sum of the edge weights in the neighborhood set to obtain the total neighborhood weight. Use the proportional distribution calculation method to calculate the importance distribution of nodes in the neighborhood in the dynamic spectrum graph.

[0088] The local topological entropy is calculated using Shannon entropy, and the mean of the local topological entropy is set as the benchmark. , calculate the local topological entropy change by subtracting the topological entropy change from the baseline , where o is a node 's index;

[0089] Based on the change of local topological entropy , using nonlinear dynamic weighting to calculate the threat level of the node , the formula is: ,

[0090] Use the percentile method to set the judgment threshold and compare the threat level with the judgment threshold. If the threat level is greater than or equal to the judgment threshold, it is judged as a high threat, the parsing is rejected, and an error response is returned. If the threat level is less than the judgment threshold, it is judged as a low threat, the parsing is allowed, and an alert is issued and recorded in the access log.

[0091] The change of local topological entropy directly reflects the important characteristics of the complexity and degree of change of local structure, and quantifies the topological relationship between nodes and neighbors. This characteristic cannot be completely replaced by other simple features (such as degree centrality, path length, etc.). The node relationship in the dynamic spectrum graph changes over time. Local topological entropy can capture this change characteristic, especially when dealing with graph heterogeneity. It is more sensitive than a single global feature (such as global entropy or network density). It introduces the combination of local and global information. Local topological entropy provides fine-grained node features, and the baseline enhances the ability to compare anomalies. In existing technologies, local features usually use simple weighted centrality or neighborhood statistics, but do not utilize the nonlinear measurement characteristics of topological entropy. In the graph structure, local topological entropy may have extremely high or low values. High values ​​are smoothed by logarithmic functions to prevent excessive values ​​from dominating the threat degree calculation. Existing technologies usually use linear weighting to process local eigenvalues, lacking sensitivity control for extreme values. Exponential functions can dynamically amplify the contribution of nodes with large entropy changes to the threat degree, thereby making abnormal nodes more prominent in the calculation. In existing technologies, the calculation of threat degree usually uses simple linear accumulation or multiplication models, lacking effective control over extreme values. This formula reasonably balances the contribution of high and low values ​​to the results through fractional form. The fractional design also introduces nonlinear complexity, making the formula more adaptable to different feature distributions. The combination of logarithmic and exponential functions enhances the processing capabilities of extreme values ​​and highly sensitive features, avoiding the common problem of calculation result bias in existing technologies.

[0092] By constructing a dynamic spectrum graph based on the differences in spectral intensity between time points, the system can transform complex time series data into a graph structure, making the changing patterns in DNS traffic more intuitive. The combined use of Shannon entropy and local topological entropy allows for more accurate capture of traffic complexity and its unusual fluctuations when analyzing DNS traffic. This combined analysis enables more comprehensive identification of potential threats, particularly in complex network environments, where subtle changes in attack behavior can be sensitively detected. A nonlinear dynamic weighting method, by weighting changes in local topological entropy, accurately assesses the threat level of each node. Unlike traditional linear weighting, this method adapts to complex nonlinear relationships in the data, improving the accuracy of threat level assessment. This automated threat response mechanism significantly improves network defense efficiency and avoids the lag and errors associated with manual intervention. The threat level calculation method based on dynamic spectrum graphs and local topological entropy provides the system with real-time assessment of DNS traffic security. The threat level determines the system's response strategy. By setting a threshold judgment mechanism, the system can promptly detect abnormal traffic and respond quickly, reducing false positives and false negatives, enabling efficient and accurate threat detection across varying traffic volumes and network dynamics.

[0093] Furthermore, a long short-term memory network model is constructed to predict the future threat level and draw a threat level trend curve. This involves collecting and preprocessing labeled historical DNS data, using weighted fusion to calculate the historical threat level, and generating a training set.

[0094] Constructing a long short-term memory network model includes input layer, hidden layer and fully connected output layer;

[0095] Set the input layer to threat level;

[0096] Use the training set to train the long short-term memory network model, and use the loss function and Adam optimizer to iteratively optimize the model parameters;

[0097] Input the threat level of the node into the trained long short-term memory network model to predict the future threat level;

[0098] Sort the future threat levels by time t and use Matplotlib to draw a threat level trend curve.

[0099] Labeled data refers to DNS data that has been annotated with real-world threat scenarios. By analyzing and preprocessing this data, the model can learn the relationship between threat severity and DNS traffic characteristics. DNS data at different time points or of different types may have varying degrees of impact on threat severity predictions. Through weighted fusion, the system can more accurately identify and process this data, especially when dealing with unbalanced or noisy data, reducing model errors and improving prediction accuracy. After receiving historical threat severity input from a node, the LSTM model automatically extracts potential patterns and trends from historical data through multi-level temporal feature modeling. Using the Adam optimizer, the LSTM model adaptively adjusts the learning rate of each parameter during training, quickly converging to the optimal solution. By sorting the future threat severity predicted by the LSTM by time and plotting a trend curve using Matplotlib, the system can intuitively display future threat severity changes. By analyzing the fluctuations in the trend curve, security teams can promptly identify possible attack patterns or abnormal traffic changes and take appropriate defensive measures. By continuously tracking changes in threat severity, the system provides data support for network security policy formulation, ensuring that security protection keeps pace with evolving threat dynamics.

[0100] S3: Build a visual interface to display threat trend curves and store the DNS data collected and analyzed.

[0101] Specifically, building a visual interface to display the threat trend curve involves using the front-end framework React to build a visual interface, including a main chart area and a top information bar;

[0102] Displays the threat level trend curve in the main chart area and the threat level in the top information bar;

[0103] Users who have passed real-name verification are allowed to view the information.

[0104] The React framework makes the display of threat level trend curves more dynamic. Users can monitor changes in network security threats in real time through an intuitive interface. Through dynamically drawn trend curves, users can quickly understand future fluctuations in threat levels and make corresponding response strategies. This not only improves the readability of the data, but also provides decision-making support for security managers, helping them to predict potential network security issues. By displaying the threat level value or graph in real time in the information bar, users can quickly understand the current network security status and discover potential threat problems in a timely manner. Real-name verification ensures system access control and protects the security of sensitive data. The real-name verification system can effectively prevent data from being viewed or tampered with by unauthorized users, ensuring the implementation of network security protection measures.

[0105] Furthermore, storing the DNS data collected and analyzed means storing the collected DNS data and the threat trend curve generated by the analysis in a central database, and setting up security access measures. The central database will back up the stored data to the cloud, and regularly perform integrity checks on the stored data and backup data. After the test is completed, an integrity test record will be generated and stored synchronously in the central database.

[0106] By storing and analyzing DNS data, real-time tracking, backtracking, and historical comparison can be performed in subsequent network security monitoring, thereby better identifying potential attack behaviors and trend changes. Strict security control measures are taken for access to the central database to effectively prevent data leakage, tampering, and unauthorized access. Cloud backup provides reliable redundant storage for DNS data and threat trend curves. Even if local storage fails, data can be restored from the cloud. Through cloud backup, the system can maintain business continuity and avoid serious consequences caused by data loss. By comparing the hash value or checksum of the data, the integrity of the data is checked to ensure the accuracy and credibility of the data. The integrity detection record is part of the log and can be used for system troubleshooting, malicious attack analysis, and other security incident investigations.

[0107] This embodiment also provides a secure access control system for DNS resolution, including:

[0108] A collection and calculation module is used to collect and pre-process DNS data, and calculate the dynamic spectrum intensity based on the pre-processed DNS data;

[0109] The threat construction module is used to calculate the threat level based on the dynamic spectrum intensity, build a long-short-term memory network model to predict the future threat level and draw a threat level trend curve;

[0110] The visualization storage module is used to build a visualization interface to display the threat trend curve and store the DNS data collected and analyzed.

[0111] This embodiment also provides a computer device suitable for the case of a secure access control method for DNS resolution, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement the secure access control method for DNS resolution proposed in the above embodiment.

[0112] The computer device may be a terminal, comprising a processor, memory, a communication interface, a display, and an input device connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores an operating system and computer programs. The internal memory provides an environment for the operating system and computer programs stored in the non-volatile storage media. The communication interface of the computer device is used to communicate with external terminals via wired or wireless communication. Wireless communication may be achieved via Wi-Fi, a carrier network, NFC (near-field communication), or other technologies. The display of the computer device may be a liquid crystal display or an electronic ink display. The input device may be a touchscreen overlay on the display, buttons, a trackball, or a touchpad on the computer device housing, or an external keyboard, touchpad, or mouse.

[0113] This embodiment also provides a storage medium having a computer program stored thereon, which, when executed by a processor, implements the secure access control method for DNS resolution proposed in the above embodiment; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0114] In summary, the present invention collects and preprocesses DNS data, calculates dynamic spectrum intensity based on the preprocessed DNS data, calculates threat severity based on the dynamic spectrum intensity, constructs a long-short-term memory network model to predict future threat severity and plots a threat severity trend curve. This improves the accuracy of identifying abnormal DNS traffic behavior, reduces the probability of security vulnerabilities, and enhances the ability to prevent potential network attacks.

[0115] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A secure access control method for DNS resolution, characterized by: include, Collect and preprocess DNS data, and calculate dynamic spectrum intensity based on the preprocessed DNS data; Calculate threat level based on dynamic spectrum intensity, build long-short-term memory network model to predict future threat level and draw threat level trend curve; Build a visual interface to display threat trend curves and store DNS data collected and analyzed; Based on the time series feature matrix , using the Gaussian function to define the embedding function , where a is the embedding dimension index; Compute embedding function Gradient ; Embed the function ,gradient and Embedded Center Combine and calculate the Gaussian kernel embedding value ; Calculate the phase angle of the frequency component using Fast Fourier Transform based on each column of the frequency domain component matrix , where u is the index of the frequency component; Gaussian kernel embedding , frequency domain components and phase angle , use multi-scale embedding technology to perform nonlinear dimensionality reduction on the time series feature matrix to generate a reduced dimensionality feature matrix ; The local topological entropy is calculated using Shannon entropy, and the mean of the local topological entropy is set as the benchmark. , calculate the local topological entropy change by subtracting the topological entropy change from the baseline , where o is a node 's index; Based on the change of local topological entropy , using nonlinear dynamic weighting to calculate the threat level of the node .

2. The secure access control method for DNS resolution according to claim 1, wherein: The collecting and pre-processing of DNS data refers to using traffic monitoring tools to collect and pre-process DNS data in network traffic; The DNS data includes timestamp, latency, request size, and request frequency; The preprocessing includes using the NTP protocol to unify the time of the collected DNS data, using a hash algorithm to perform a deduplication operation, using an interpolation method to fill in missing data, and normalizing the DNS data.

3. The secure access control method for DNS resolution according to claim 2, wherein: The calculation of dynamic spectrum intensity based on pre-processed DNS data refers to extracting the time window using the time window feature extraction method based on the pre-processed DNS data. The features of , where i is the index of the time window, and the features of all time windows are stacked into a time series feature matrix ; The calculation of Gaussian kernel embedding value , the formula is: in For embedded centers; For the time series feature matrix Perform wavelet transform to extract frequency domain components , generate the frequency domain component matrix; The generated dimension reduction feature matrix , the formula is: , where M is the number of frequency components and k is the number of embedding scales; Calculate the Euclidean distance between data points using the Euclidean distance method based on the reduced dimension feature matrix ,in and is the data point, l and j are the indexes of the data point; Use the nearest neighbor radius method to set the number of nearest neighbors L and calculate the distance from each data point to the Lth nearest neighbor , based on the density of the nearest neighbor distance, calculate the local reachability density ; Based on local reachability density , use the density ratio method to calculate the local anomaly factor ; Calculate local anomaly factor The mean of the abnormal threshold is set as , use the ratio analysis method to calculate the time window The proportion of abnormal points ; Use the percentile method to set the judgment threshold, compare the abnormal point ratio with the judgment threshold, mark the abnormal point ratio greater than the judgment threshold as an abnormal window, and generate an abnormal point set; Extract abnormal window features from the abnormal point set using the time window feature extraction method, and stack the features of all abnormal windows into a traffic matrix; Use standard quantum state representation to map the flow matrix into quantum states ; Quantum state Superposition is performed to obtain the comprehensive state ; Comprehensive Perform measurements and extract the contribution of characteristic frequencies ; Based on the columns in the traffic matrix, piecewise linear interpolation is performed using linear interpolation to obtain the eigenvalue at time t. ; Contribution based on characteristic frequency and the eigenvalues ​​at time t Perform weighted summation to calculate the dynamic spectrum intensity at time t , the formula is: , where m is the total number of features.

4. The secure access control method for DNS resolution according to claim 3, wherein: The threat level calculation based on dynamic spectrum intensity refers to the dynamic spectrum intensity based on time t Each time point is defined as a node in the graph. The edge weight is calculated according to the difference in dynamic spectrum intensity between time points. The edge weight greater than 0 is selected to construct a dynamic spectrum graph. Filter out edge weights greater than 0 and define them as a neighborhood set. Calculate the sum of the edge weights in the neighborhood set to obtain the total neighborhood weight. Use the proportional distribution calculation method to calculate the importance distribution of nodes in the neighborhood in the dynamic spectrum graph. The threat level of the node is calculated using nonlinear dynamic weighting , the formula is: , use the percentile method to set the judgment threshold, compare the threat level with the judgment threshold, if the threat level is greater than or equal to the judgment threshold, it is judged as a high threat, the parsing is rejected, and an error response is returned; if the threat level is less than the judgment threshold, it is judged as a low threat, the parsing is allowed, and an early warning is issued and recorded in the access log.

5. The secure access control method for DNS resolution according to claim 4, wherein: Constructing a long short-term memory network model to predict future threat levels and draw a threat level trend curve involves collecting and preprocessing labeled historical DNS data, calculating the historical threat level using weighted fusion, and generating a training set. Constructing a long short-term memory network model includes input layer, hidden layer and fully connected output layer; Set the input layer to threat level; Use the training set to train the long short-term memory network model, and use the loss function and Adam optimizer to iteratively optimize the model parameters; Input the threat level of the node into the trained long short-term memory network model to predict the future threat level; Sort the future threat levels by time t and use Matplotlib to draw a threat level trend curve.

6. The method for secure access control oriented to DNS resolution according to claim 5, characterized in that: The said constructing a visual interface to display the threat level trend curve refers to constructing a visual interface using the front-end framework React, including a main chart area and a top information bar; Displays the threat level trend curve in the main chart area and the threat level in the top information bar; Users who have passed real-name verification are allowed to view the information.

7. The secure access control method for DNS resolution according to claim 6, wherein: The storage of DNS data collected and analyzed refers to storing the collected DNS data and the threat trend curve generated by the analysis in a central database, and setting security access measures. The central database will back up the stored data to the cloud, and regularly perform integrity checks on the stored data and backup data. After the test is completed, an integrity test record will be generated and stored synchronously in the central database.

8. A secure access control system for DNS resolution, based on the secure access control method for DNS resolution according to any one of claims 1 to 7, characterized in that: include, A collection and calculation module is used to collect and pre-process DNS data, and calculate the dynamic spectrum intensity based on the pre-processed DNS data; The threat construction module is used to calculate the threat level based on the dynamic spectrum intensity, build a long-short-term memory network model to predict the future threat level and draw a threat level trend curve; The visualization storage module is used to build a visualization interface to display the threat trend curve and store the DNS data collected and analyzed.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the DNS resolution-oriented security access control method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the secure access control method for DNS resolution according to any one of claims 1 to 7 are implemented.

Images