A domain name access control method, program product, electronic device and storage medium

Abstract

The embodiment of the application provides a domain name access control method, a program product, an electronic device and a storage medium, and relates to the technical field of network security. The domain name access control method comprises the following steps: after a preset period arrives, obtaining detection information of each domain name in a plurality of domain names; wherein the detection information of each domain name comprises at least one of registration information, resolution record and webpage content; performing risk assessment according to the detection information of each domain name to obtain a risk assessment value of each domain name; after receiving a destination domain name access request, querying the risk assessment value of the destination domain name according to the latest obtained risk assessment value of the plurality of domain names; if the risk assessment value of the destination domain name meets a preset value condition, releasing the destination domain name access request, otherwise, rejecting the destination domain name access request. The embodiment of the application can achieve the technical effect of effectively and accurately performing domain name access control.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a domain name access control method, a program product, an electronic device and a storage medium. BACKGROUND

[0002] At present, the commonly used domain name access control methods mainly include a blacklist-based domain name access control method, a whitelist-based domain name access control method and a content filtering-based domain name access control method. Among them, the blacklist-based domain name access control method is to add known illegal domain names to the blacklist to prevent access to the illegal domain names in the blacklist. Before adding unknown illegal domain names to the blacklist, the access device performing the access operation is prone to be attacked due to accessing unknown illegal domain names. The whitelist-based domain name access control method is to add known legal domain names to the whitelist to allow access to the legal domain names in the whitelist. Before adding unknown legal domain names to the whitelist, the access device is prone to mistakenly prevent access to unknown legal domain names. The content filtering-based domain name access control method is to simulate access to a target domain name, and to select to prevent or allow access to the target domain name by analyzing the legality of the accessed web page content. This method needs to consume a large amount of network bandwidth and computing resources to analyze the web page content in real time. For some websites using encrypted transmission, the content filtering method is difficult to take effect, and is prone to mistakenly select to prevent or allow access to the target domain name.

[0003] It can be seen that the above-mentioned several domain name access control methods are all a series of access control operations after receiving a domain name access request, which belong to a passive mode-based domain name access control method and are difficult to effectively and accurately perform domain name access control. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a domain name access control method, a program product, an electronic device and a storage medium, so as to achieve the technical effect of effectively and accurately performing domain name access control.

[0005] In a first aspect, the embodiments of the present application provide a domain name access control method, comprising:

[0006] After a preset period arrives, obtaining detection information of each domain name in a plurality of domain names; wherein the detection information of each domain name includes at least one of registration information, resolution record and web page content;

[0007] Performing risk assessment according to the detection information of each domain name to obtain a risk assessment value of each domain name;

[0008] After receiving a target domain name access request, querying a risk assessment value of the target domain name according to the latest obtained risk assessment values of the plurality of domain names;

[0009] If the risk assessment value of the destination domain name meets a preset value condition, the destination domain name access request is released, otherwise the destination domain name access request is rejected.

[0010] In the implementation process, the plurality of domain names are actively detected according to a preset period, the detection information of each domain name in the plurality of domain names is obtained, the risk assessment of each domain name is performed according to the detection information of each domain name, the risk assessment value of each domain name is obtained, and after receiving a destination domain name access request, the risk assessment value of the destination domain name is queried according to the latest risk assessment values of the plurality of domain names, and the destination domain name access request is released or rejected according to whether the risk assessment value of the destination domain name meets a preset value condition, so that the detection information of the plurality of domain names is periodically obtained based on the active mode, and the risk assessment values of each domain name are comprehensively evaluated, so that after receiving the destination domain name access request, the latest risk assessment value corresponding to the destination domain name can be directly queried for access control, and effective and accurate domain name access control is ensured.

[0011] Further, before obtaining the detection information of each domain name in the plurality of domain names after the preset period arrives, the method further includes:

[0012] Collecting at least one known domain name; wherein the at least one known domain name includes historical access domain names extracted from network traffic data and / or business service domain names configured in a business system;

[0013] Using artificial intelligence technology, at least one potential domain name is obtained by deep analysis based on the at least one known domain name;

[0014] Determining that the plurality of domain names include the at least one known domain name and the at least one potential domain name.

[0015] In the implementation process, the historical access domain names are extracted from the network traffic data and / or the business service domain names configured in the business system as the at least one known domain name, and the artificial intelligence technology is used to obtain at least one potential domain name by deep analysis based on the at least one known domain name, and it is determined that the plurality of domain names include the at least one known domain name and the at least one potential domain name, so that known domain names and potential domain names can be comprehensively collected and periodically detected and risk assessed in advance, so that subsequent access to unknown illegal domain names can be effectively prevented, and the access control capability for unknown domain names can be improved.

[0016] Further, the detection information of each domain name includes a resolution record;

[0017] The detection information of each domain name in the plurality of domain names is obtained, including:

[0018] The resolution record of each domain name is queried from a local cache;

[0019] In a case where the resolution records of at least part of the domain names cannot be queried from the local cache, the resolution records of the at least part of the domain names are queried from a domain name server.

[0020] In the implementation process, by querying the resolution records of the domain names from the local cache first under the premise of selecting the resolution records as the detection information of the domain names, and then querying the resolution records of at least part of the domain names from the domain name server in a case where the resolution records of the at least part of the domain names cannot be queried from the local cache, the advantage of the local cache mechanism can be utilized to update the local cache in time when the resolution records of the domain names change, the query time for the resolution records of the commonly used domain names is significantly shortened, and the query efficiency of the resolution records of the domain names is effectively improved.

[0021] Further, the number of the at least part of the domain names is a plurality of domain names.

[0022] The querying of the resolution records of the at least part of the domain names from the domain name server comprises:

[0023] The at least part of the domain names are divided into at least one domain name group based on a predefined domain name grouping rule.

[0024] For each domain name group in the at least one domain name group, a batch query request for all domain names in the domain name group is sent to the domain name server, and the resolution records of the all domain names returned by the domain name server are obtained.

[0025] In the implementation process, by dividing the at least part of the domain names into at least one domain name group based on a predefined domain name grouping rule under the premise that the number of the at least part of the domain names is a plurality of domain names, and sending a batch query request for all domain names in a domain name group to the domain name server for each domain name group in the at least one domain name group, the resolution records of the all domain names returned by the domain name server are obtained, the batch query mode can be adopted to query the resolution records of all domain names in a domain name group from the domain name server at one time, the number of interactions with the domain name server is effectively reduced, and the query efficiency of the resolution records of the domain names is further improved.

[0026] Further, the detection information of each domain name comprises web page content.

[0027] The detection information of each domain name in the plurality of domain names is obtained by:

[0028] The web page content corresponding to each domain name is captured by using a web crawler technology.

[0029] In the implementation process, the network crawler technology is adopted to automatically capture the webpage contents corresponding to multiple domain names, without consuming a large amount of network bandwidth and computing resources to analyze the webpage contents in real time, so that the webpage contents corresponding to the domain names can be effectively obtained for periodic detection and risk assessment in various network environments, and the subsequent effective and accurate domain name access control is ensured.

[0030] Further, the risk assessment according to the detection information of the respective domain names comprises:

[0031] The detection information of the respective domain names is input into a pre-established risk assessment model to obtain the risk assessment values of the respective domain names.

[0032] In the implementation process, the detection information of the respective domain names in the multiple domain names is input into the pre-established risk assessment model to obtain the risk assessment values of the respective domain names, so that the respective domain names can be quickly and accurately assessed in one or more dimensions, and the efficiency of the domain name access control is further improved.

[0033] Further, the method further comprises:

[0034] In a case where the risk assessment value of the target domain name does not satisfy the preset value condition, a risk prompt message of the target domain name is sent, and the associated information of the target domain name is recorded, wherein the associated information of the target domain name comprises the detection information of the target domain name and the risk assessment value of the target domain name.

[0035] In the implementation process, in a case where the risk assessment value of the target domain name does not satisfy the preset value condition, the risk prompt message of the target domain name is sent, and the associated information such as the detection information and the risk assessment value of the target domain name is recorded, so that the user can timely discover the risk domain name and quickly obtain the associated information of the risk domain name for auditing.

[0036] In a second aspect, an embodiment of the present application provides a domain name access control device, comprising:

[0037] The active detection module is configured to obtain detection information of respective domain names in a plurality of domain names after a preset period arrives, wherein the detection information of the respective domain names comprises at least one of registration information, resolution records and webpage contents.

[0038] The risk assessment module is configured to perform risk assessment according to the detection information of the respective domain names to obtain risk assessment values of the respective domain names.

[0039] The access control module is configured to, after receiving a target domain name access request, query a risk assessment value of the target domain name according to the latest obtained risk assessment values of the plurality of domain names.

[0040] If the risk evaluation value of the destination domain name meets a preset value condition, the destination domain name access request is released, otherwise the destination domain name access request is rejected.

[0041] In a third aspect, an embodiment of the present application provides a computer program product, which comprises instructions, and the instructions, when executed by a computer, cause the computer to implement the method described above.

[0042] In a fourth aspect, an embodiment of the present application provides an electronic device, which comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; and the processor implements the method described above when executing the computer program.

[0043] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, which comprises a stored computer program; and when the computer program runs, the computer-readable storage medium controls a device where the computer-readable storage medium is located to execute the method described above. BRIEF DESCRIPTION OF DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation to the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0045] Figure 1 A flowchart of a domain name access control method provided by the first embodiment of the present application;

[0046] Figure 2 A structural diagram of a domain name access control device provided by the second embodiment of the present application;

[0047] Figure 3 A structural diagram of an electronic device provided by the fourth embodiment of the present application. DETAILED DESCRIPTION

[0048] The technical solutions of the embodiments of the present application will be described below in combination with the drawings in the embodiments of the present application.

[0049] It should be noted that in the description of the present application, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance. At the same time, the step numbers in the text are only for the convenience of the explanation of the embodiments of the present application, and do not serve as a limitation to the execution sequence of the steps.

[0050] In the related art, the commonly used domain name access control methods mainly include a blacklist-based domain name access control method, a whitelist-based domain name access control method and a content filtering-based domain name access control method. Among them, the blacklist-based domain name access control method is to add known illegal domain names to a blacklist to prevent access to the illegal domain names in the blacklist. Before adding unknown illegal domain names to the blacklist, an access device performing an access operation is prone to be attacked due to accessing the unknown illegal domain names. The whitelist-based domain name access control method is to add known legal domain names to a whitelist to allow access to the legal domain names in the whitelist. Before adding unknown legal domain names to the whitelist, the access device is prone to mistakenly prevent access to the unknown legal domain names. The content filtering-based domain name access control method is to simulate access to a target domain name, and to select to prevent or allow access to the target domain name by analyzing the legality of the accessed webpage content. This method needs to consume a large amount of network bandwidth and computing resources to analyze the webpage content in real time. For some websites using encrypted transmission, the content filtering method is difficult to take effect, and is prone to mistakenly select to prevent or allow access to the target domain name.

[0051] It can be seen that the above several domain name access control methods are all performed after receiving a domain name access request, and belong to a passive mode-based domain name access control method, which is difficult to effectively and accurately perform domain name access control.

[0052] Therefore, the present application provides a domain name access control method, which actively detects a plurality of domain names according to a preset period, obtains detection information of each domain name in the plurality of domain names, performs risk assessment according to the detection information of each domain name, obtains a risk assessment value of each domain name, and according to the latest risk assessment value of the plurality of domain names, queries a risk assessment value of a target domain name after receiving a target domain name access request, and selects to release or reject the target domain name access request according to whether the risk assessment value of the target domain name meets a preset value condition. The method can periodically obtain detection information of a plurality of domain names based on an active mode and comprehensively assess risk assessment values of each domain name, so that the latest risk assessment value corresponding to the target domain name can be directly queried for access control after receiving the target domain name access request, and effective and accurate domain name access control can be ensured.

[0053] The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments.

[0054] The method provided in the embodiments of the present application can be executed by a related terminal device, and the following will be described by taking an access device performing an access operation as an execution subject.

[0055] It should be noted that the access device can be a terminal device such as a mobile phone, a tablet computer or a computer held by a user.

[0056] Please refer to Figure 1 , Figure 1 A flowchart of a domain name access control method provided by a first embodiment of the present application is shown. The first embodiment of the present application provides a domain name access control method, which includes steps S101-S104.

[0057] S101, after a preset period arrives, obtaining detection information of each domain name in a plurality of domain names; wherein the detection information of each domain name includes at least one of registration information, resolution record and web page content.

[0058] As an example, according to actual application requirements, the preset period is determined, such as 1 hour.

[0059] After the preset period arrives, a plurality of domain names collected previously are obtained, and each domain name in the plurality of domain names is detected to obtain detection information of each domain name, wherein the detection information of each domain name includes at least one of registration information, resolution record and web page content.

[0060] It should be noted that the registration information of the domain name includes the registration time and the registration authority of the domain name, and the resolution record of the domain name includes the IP address corresponding to the domain name, and the web page content corresponding to the domain name includes the web page title and the meta tag of the domain name.

[0061] S102, risk assessment is performed according to the detection information of each domain name to obtain a risk assessment value of each domain name.

[0062] As an example, after obtaining the detection information of each domain name in the plurality of domain names, risk assessment is performed according to the detection information of the domain name to obtain a risk assessment value of the domain name, thereby obtaining risk assessment values of the plurality of domain names.

[0063] It should be noted that the risk assessment value of the domain name is used to represent the risk degree of accessing the domain name.

[0064] It can be understood that after each preset period arrives, the detection information of each domain name in the plurality of domain names is obtained, and risk assessment is performed according to the detection information of each domain name to obtain risk assessment values of each domain name in the current period, thereby obtaining risk assessment values of the plurality of domain names in the current period.

[0065] S103, after receiving a destination domain name access request, querying a risk assessment value of the destination domain name according to the latest obtained risk assessment values of the plurality of domain names.

[0066] As an example, real-time monitoring of a destination domain name access request initiated by a user is performed to determine a destination domain name to be accessed, and a risk assessment value of the destination domain name is queried according to the latest obtained risk assessment values of the plurality of domain names.

[0067] In actual application, each domain name in the plurality of domain names can be compared with the target domain name respectively, in the case that any domain name in the plurality of domain names is consistent with the target domain name, the latest risk assessment value of the domain name is taken as the risk assessment value of the target domain name, in the case that the plurality of domain names is inconsistent with the target domain name, the target domain name access request can be directly rejected to prevent the user from accessing the target domain name, or the target domain name access inquiry message can be returned to the user to select whether to confirm to continue to access the target domain name, and then the target domain name access request is selected to be released or rejected according to the received target domain name access reply message.

[0068] In S104, if the risk assessment value of the target domain name meets the preset value condition, the target domain name access request is released, otherwise the target domain name access request is rejected.

[0069] For example, the preset value condition is determined according to actual application requirements, such as the risk assessment value being less than a pre-set risk assessment threshold.

[0070] After obtaining the risk assessment value of the target domain name, it is judged whether the risk assessment value of the target domain name meets the preset value condition, in the case that the risk assessment value of the target domain name meets the preset value condition, it is considered that the risk degree of accessing the target domain name is low, at this time, the target domain name access request is released to allow the user to access the target domain name, in the case that the risk assessment value of the target domain name does not meet the preset value condition, it is considered that the risk degree of accessing the target domain name is high, at this time, the target domain name access request is rejected to prevent the user from accessing the target domain name.

[0071] In actual application, the risk assessment value can be a risk score or a risk level.

[0072] The embodiment of the application actively detects the plurality of domain names according to the preset period to obtain the detection information of each domain name in the plurality of domain names, performs risk assessment according to the detection information of each domain name to obtain the risk assessment value of each domain name, so that after receiving the target domain name access request, the risk assessment value of the target domain name is queried according to the latest risk assessment value of the plurality of domain names, and the target domain name access request is selected to be released or rejected according to whether the risk assessment value of the target domain name meets the preset value condition, which can periodically obtain the detection information of the plurality of domain names and comprehensively evaluate the risk assessment value of each domain name based on the active mode, so that after receiving the target domain name access request, the latest risk assessment value corresponding to the target domain name can be directly queried for access control, and effective and accurate domain name access control is ensured.

[0073] In an optional embodiment, before the preset period arrives, the method further comprises: collecting at least one known domain name; wherein the at least one known domain name comprises a historical access domain name extracted from the network traffic data and / or a business service domain name configured in the business system; using an artificial intelligence technology, performing deep analysis on the at least one known domain name to obtain at least one potential domain name; and determining the plurality of domain names to comprise the at least one known domain name and the at least one potential domain name.

[0074] For example, according to the actual application scenario, the network traffic monitoring mode and / or the business system docking mode can be selected to collect the at least one known domain name.

[0075] Real-time monitoring of network traffic, analyzing HTTP (Hypertext Transfer Protocol) data packets and HTTPS (Hypertext Transfer Protocol Secure) data packets and other network traffic data, and extracting historical access domain names from the network traffic data.

[0076] By docking the business system, the business service domain name configured in the business system can be obtained. For example, by docking the internal business system of an enterprise, the business service domain name configured in the business system can be obtained, such as the official service domain name relied on by enterprise office software and the domain name of enterprise self-built application, etc.

[0077] After the above operation, at least one known domain name can be collected, and the at least one known domain name comprises a historical access domain name extracted from the network traffic data and / or a business service domain name configured in the business system.

[0078] It should be noted that the network traffic monitoring mode and / or the business system interfacing mode are selected to collect at least one known domain name, mainly in the following cases: the network traffic monitoring mode is selected to collect at least one known domain name; the business system interfacing mode is selected to collect at least one known domain name; the network traffic monitoring mode and the business system interfacing mode are selected to collect at least one known domain name. The at least one known domain name includes historical access domain names extracted from network traffic data and / or business service domain names configured in the business system, mainly in the following cases: the at least one known domain name includes historical access domain names; the at least one known domain name includes business service domain names; the at least one known domain name includes historical access domain names and business service domain names. If the network traffic monitoring mode is selected to collect at least one known domain name, the collected at least one known domain name includes historical access domain names; if the business system interfacing mode is selected to collect at least one known domain name, the collected at least one known domain name includes business service domain names; if the network traffic monitoring mode and the business system interfacing mode are selected to collect at least one known domain name, the collected at least one known domain name includes one or more of historical access domain names and business service domain names.

[0079] After obtaining the at least one known domain name, the artificial intelligence technology is continued to be used to perform deep analysis according to the at least one known domain name, and at least one potential domain name is obtained.

[0080] In actual application, if the at least one known domain name includes historical access domain names, natural language processing technology can be used to analyze text information in network traffic data corresponding to the historical access domain names, and potential domain names are mined. For example, text information such as network logs and user interaction information corresponding to the historical access domain names is analyzed, semantic analysis is used to generate potential domain names consistent with the context according to the understood semantics, and keyword extraction is used to expand potential domain names similar to the historical access domain names according to the extracted keywords. If the at least one known domain name includes business service domain names, natural language processing technology can be used to expand potential domain names similar to the business service domain names according to the extracted keywords using keyword extraction.

[0081] After obtaining the at least one known domain name and the at least one potential domain name, it is determined that the plurality of domain names include the at least one known domain name and the at least one potential domain name.

[0082] In actual application, after collecting the plurality of domain names, machine learning technology can be continued to be used to classify and store the plurality of domain names currently collected. For example, a classification model based on deep learning is used to divide the plurality of domain names into multiple categories of domain names, such as potential risk domain names, commonly used domain names, and newly discovered domain names, according to the usage of historical access behaviors, usage frequencies, and occurrence times of each domain name in the plurality of domain names, and the domain names are stored in a database.

[0083] The embodiment of the application can extract historical access domain names from network traffic data and / or obtain service domain names configured in a service system as at least one known domain name, and use artificial intelligence technology to perform deep analysis according to the at least one known domain name to obtain at least one potential domain name, so that the plurality of domain names include the at least one known domain name and the at least one potential domain name. The known domain names can be comprehensively collected, and the potential domain names can be predicted in advance for regular detection and risk assessment, so that subsequent access to unknown illegal domain names can be effectively prevented, and the access control capability for unknown domain names can be improved.

[0084] In optional embodiments, the detection information of each domain name includes a resolution record; and the obtaining of the detection information of each domain name in the plurality of domain names includes querying the resolution record of the plurality of domain names from the domain name server.

[0085] For example, when the resolution record is selected as the detection information of the domain name, after a preset period arrives, the plurality of domain names collected previously are queried for the resolution record from the domain name server.

[0086] In actual application, for each domain name in the plurality of domain names, a separate query request for the domain name is sent to the domain name server to obtain the resolution record of the domain name returned by the domain name server, so as to obtain the resolution record of the plurality of domain names.

[0087] The embodiment of the application can directly query the resolution record of the plurality of domain names from the domain name server when the resolution record is selected as the detection information of the domain name, so as to ensure that the resolution record of the plurality of domain names is accurately obtained.

[0088] In optional embodiments, the detection information of each domain name includes a resolution record; and the obtaining of the detection information of each domain name in the plurality of domain names includes querying the resolution record of the plurality of domain names from the domain name server.

[0089] For example, when the resolution record is selected as the detection information of each domain name, in the case that the number of the plurality of domain names is large, if the resolution record of the plurality of domain names is queried from the domain name server, the domain name resolution record query efficiency is low. In order to improve the domain name resolution record query efficiency, the resolution record of the plurality of domain names is first queried from the local cache, and then in the case that the resolution record of at least part of the plurality of domain names cannot be queried from the local cache, the resolution record of the at least part of the plurality of domain names is queried from the domain name server.

[0090] After the preset period arrives, the plurality of domain names collected previously are acquired, and the resolution records of each domain name in the plurality of domain names are queried from the local cache. Since the resolution records of the plurality of domain names can not be stored in the local cache, the resolution records of only part of the plurality of domain names can be stored in the local cache, or the resolution records of the plurality of domain names can be stored in the local cache, so that the resolution records of at least part of the plurality of domain names can not be queried from the local cache.

[0091] In the case that the resolution records of at least part of the plurality of domain names cannot be queried from the local cache, the resolution records of at least part of the plurality of domain names are queried from the domain name server.

[0092] In actual application, for each domain name in the at least part of the plurality of domain names, a separate query request for the domain name is sent to the domain name server, and the resolution record of the domain name returned by the domain name server is obtained, so as to obtain the resolution records of the at least part of the plurality of domain names.

[0093] The embodiment of the application can utilize the advantage that the local cache mechanism can be updated in time when the domain name resolution record changes, significantly shorten the query time of the resolution record of the commonly used domain name, and effectively improve the query efficiency of the domain name resolution record, by querying the resolution records of each domain name from the local cache under the premise of selecting the resolution record as the probe information of the domain name, and querying the resolution records of at least part of the plurality of domain names from the domain name server in the case that the resolution records of at least part of the plurality of domain names cannot be queried from the local cache.

[0094] In an optional embodiment, the number of the at least part of the plurality of domain names is a plurality; and the querying of the resolution records of at least part of the plurality of domain names from the domain name server comprises: dividing the at least part of the plurality of domain names into at least one domain name group based on a pre-defined domain name grouping rule; and for each domain name group in the at least one domain name group, sending a batch query request for all domain names in the domain name group to the domain name server, and obtaining the resolution records of all domain names returned by the domain name server.

[0095] As an example, considering the case that the number of the at least part of the plurality of domain names is large, if each domain name in the at least part of the plurality of domain names is interacted with the domain name server one by one, and the resolution record of each domain name in the at least part of the plurality of domain names is queried from the domain name server, the domain name resolution record query efficiency is low. In order to further improve the domain name resolution record query efficiency, the batch query mode is adopted to query the resolution records of the at least part of the plurality of domain names from the domain name server.

[0096] According to actual application requirements, the domain name grouping rule is pre-defined. For example, the domain name grouping rule can be defined according to the domain name types of all domain names stored in the database, such as grouping all domain names of which the domain name category is a potential risk domain name in the at least part of the plurality of domain names into the same group, and grouping all domain names of which the domain name category is a commonly used domain name in the at least part of the plurality of domain names into the same group.

[0097] The at least part of domain names are divided into at least one domain name group based on a predefined domain name grouping rule, a batch query request for all domain names in each domain name group of the at least one domain name group is generated, the batch query request for all domain names in the domain name group is sent to the domain name server, and the resolution records of all domain names returned by the domain name server are obtained, so that the resolution records of the at least part of domain names are obtained.

[0098] The embodiment of the application can adopt a batch query mode to query the resolution records of all domain names in a domain name group from the domain name server at one time, effectively reduces the number of interactions with the domain name server, and further improves the query efficiency of the domain name resolution records.

[0099] In optional embodiments, the detection information of each domain name includes web page content; and the obtaining of the detection information of each domain name in the plurality of domain names includes: using a web crawler technology to capture the web page content corresponding to each domain name.

[0100] For example, when the web page content is selected as the detection information of the domain name, after a preset period arrives, the web crawler technology is used to capture the web page content corresponding to each domain name in the plurality of domain names.

[0101] It can be understood that the web crawler is a program or script that automatically captures information on the World Wide Web according to certain rules.

[0102] The embodiment of the application can automatically capture the web page content corresponding to the plurality of domain names using the web crawler technology, without consuming a large amount of network bandwidth and computing resources to analyze the web page content in real time, and can effectively obtain the web page content corresponding to the domain name for periodic detection and risk assessment to adapt to various network environments, thereby ensuring effective and accurate domain name access control.

[0103] In optional embodiments, the risk assessment according to the detection information of each domain name to obtain a risk assessment value of each domain name includes: inputting the detection information of each domain name into a pre-established risk assessment model to obtain the risk assessment value of each domain name.

[0104] For example, according to actual application requirements, a risk assessment model is pre-established according to the type of information contained in the detection information of the domain name.

[0105] After obtaining the detection information of each domain name in the plurality of domain names, the detection information of the domain name is input into a pre-established risk assessment model to obtain a risk assessment value of the domain name output by the risk assessment model, thereby obtaining risk assessment values of the plurality of domain names.

[0106] In actual application, the risk assessment model can be a model established based on a plurality of algorithms or a model integrated with a plurality of rules. For example, assuming that the detection information of the domain name includes registration information, resolution record and webpage content, a risk assessment model integrated with a plurality of rules can be pre-established, and the registration information, resolution record and webpage content of the domain name are input into the risk assessment model. The risk assessment model extracts the registration time and registration authority of the domain name from the registration information of the domain name, determines the registration duration of the domain name, that is, the duration between the registration time (i.e., the registration time point) of the domain name and the current time (i.e., the current time point), determines the first risk score corresponding to the registration duration of the domain name based on the pre-defined mapping rule between the registration duration and the risk score, and determines the registration authority scale of the domain name, determines the second risk score corresponding to the registration authority scale of the domain name based on the pre-defined mapping rule between the authority scale and the second risk score. The IP address corresponding to the domain name is extracted from the resolution record of the domain name, the number of times the IP address corresponding to the domain name is used for attack is determined, the third risk score corresponding to the number of times the IP address corresponding to the domain name is used for attack is determined based on the pre-defined mapping rule between the number of times of attack and the risk score, and the risk features such as malicious keywords and phishing links are extracted from the webpage content of the domain name, the risk feature quantity in the webpage content corresponding to the domain name is determined, and the fourth risk score corresponding to the risk feature quantity in the webpage content corresponding to the domain name is determined based on the pre-defined mapping rule between the risk feature quantity and the risk score. The risk assessment value of the domain name is obtained according to the first risk score, the second risk score, the third risk score and the fourth risk score of the domain name. Specifically, the comprehensive risk score of the domain name can be obtained by weighted calculation according to the first risk score, the second risk score, the third risk score and the fourth risk score of the domain name, and the risk assessment value of the domain name can also be obtained by summing the first risk score, the second risk score, the third risk score and the fourth risk score of the domain name, and the risk level corresponding to the risk total score of the domain name is determined as the risk assessment value of the domain name based on the pre-defined mapping rule between the risk total score and the risk level. For example, if the registration duration of a certain domain name is very short, the registration authority is a small unknown institution, the IP address resolved by the domain name has been used for malicious attack many times, and the webpage content corresponding to the domain name contains risk features such as malicious keywords and phishing links, the risk level of the domain name is high.

[0107] To further improve the accuracy of risk assessment, more information of the domain name can be further integrated on the basis of the above. For example, the WHOIS information of the domain name query of the domain name is collected, including the contact information of the domain name owner, the history of the registrar, and the like. These information can reflect the credibility of the domain name from the side.

[0108] The embodiment of the application can quickly and accurately perform one or more dimensional risk assessments on each domain name by pre-establishing a risk assessment model, inputting the detection information of each domain name in the plurality of domain names into the risk assessment model, and obtaining the risk assessment value of each domain name, thereby further improving the efficiency of domain name access control.

[0109] In an optional embodiment, the method further includes step S105:

[0110] S105, in the case where the risk assessment value of the destination domain name does not satisfy the preset value condition, sending a risk prompt message of the destination domain name, and recording the associated information of the destination domain name; wherein the associated information of the destination domain name includes the detection information of the destination domain name and the risk assessment value of the destination domain name.

[0111] As an example, in the case where the risk assessment value of the destination domain name does not satisfy the preset value condition, it is considered that the risk degree of accessing the destination domain name is high, and the destination domain name is a risk domain name. At this time, the risk prompt message of the destination domain name is generated, the risk prompt message of the destination domain name is sent, and the associated information of the destination domain name is sorted, which includes the detection information of the destination domain name and the risk assessment value of the destination domain name. The associated information of the destination domain name is recorded in the log, so that the user can timely discover the risk domain name and quickly obtain the associated information of the risk domain name for auditing.

[0112] The embodiment of the application can ensure that the user can timely discover the risk domain name and conveniently obtain the associated information of the risk domain name for auditing by sending the risk prompt message of the destination domain name and recording the associated information such as the detection information and the risk assessment value of the destination domain name in the case where the risk assessment value of the destination domain name does not satisfy the preset value condition.

[0113] Please refer to Figure 2 , Figure 2A structure schematic diagram of a domain name access control device provided by a second embodiment of the application. The second embodiment of the application provides a domain name access control device, comprising: a proactive detection module 201, configured to obtain detection information of each domain name in a plurality of domain names after a preset period arrives; wherein the detection information of each domain name comprises at least one of registration information, resolution record and webpage content; a risk assessment module 202, configured to perform risk assessment according to the detection information of each domain name to obtain a risk assessment value of each domain name; and an access control module 203, configured to: after receiving a destination domain name access request, query the risk assessment value of the destination domain name according to the latest obtained risk assessment values of the plurality of domain names; if the risk assessment value of the destination domain name meets a preset value condition, release the destination domain name access request, otherwise, reject the destination domain name access request.

[0114] In optional embodiments, the device further comprises a domain name collection module, configured to collect at least one known domain name before the obtaining of the detection information of each domain name in the plurality of domain names after the preset period arrives; wherein the at least one known domain name comprises historical access domain names extracted from network traffic data and / or business service domain names configured in a business system; at least one potential domain name is obtained by deep analysis according to the at least one known domain name by using artificial intelligence technology; and the plurality of domain names are determined to comprise the at least one known domain name and the at least one potential domain name.

[0115] In optional embodiments, the detection information of each domain name comprises resolution record; and the obtaining of the detection information of each domain name in the plurality of domain names comprises: querying the resolution record of each domain name from a local cache; and in a case where the resolution record of at least part of the domain names in the plurality of domain names cannot be queried from the local cache, querying the resolution record of the at least part of the domain names from a domain name server.

[0116] In optional embodiments, the number of the at least part of the domain names is a plurality; and the querying of the resolution record of the at least part of the domain names from the domain name server comprises: dividing the at least part of the domain names into at least one domain name group based on a pre-defined domain name grouping rule; and for each domain name group in the at least one domain name group, sending a batch query request for all domain names in the domain name group to the domain name server to obtain the resolution record of all domain names returned by the domain name server.

[0117] In optional embodiments, the detection information of each domain name comprises webpage content; and the obtaining of the detection information of each domain name in the plurality of domain names comprises: using a web crawler technology to capture the webpage content corresponding to each domain name.

[0118] In optional embodiments, the performing of risk assessment according to the detection information of each domain name to obtain the risk assessment value of each domain name comprises: inputting the detection information of each domain name into a pre-established risk assessment model to obtain the risk assessment value of each domain name.

[0119] In an optional embodiment, the access control module 203 is further configured to send a risk prompt message of the destination domain name and record the association information of the destination domain name when the risk assessment value of the destination domain name does not satisfy the preset value condition; the association information of the destination domain name includes the detection information of the destination domain name and the risk assessment value of the destination domain name.

[0120] The implementation process of the functions and roles of each module in the above device is specifically described in the implementation process of the corresponding steps in the method described in the first embodiment of the present application, which will not be described here.

[0121] The third embodiment of the present application provides a computer program product, which includes instructions. When the instructions are executed by a computer, the computer implements the method described in the first embodiment of the present application and achieves the same beneficial effects.

[0122] The method described in the first embodiment of the present application can be implemented by software, hardware, firmware or any combination thereof, in whole or in part. When implemented by software, it can be implemented in the form of a computer program product in whole or in part. The computer program product includes one or more computer programs or instructions. When the computer programs or instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user equipment, a core network device, an OAM (Open Application Model) or other programmable devices.

[0123] The computer programs or instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, the computer programs or instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center through wired or wireless mode. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center and the like integrated with one or more available media. The available media can be magnetic media, such as floppy disks, hard disks, magnetic tapes; optical media, such as digital video disks; semiconductor media, such as solid state disks. The computer readable storage medium can be volatile or non-volatile storage medium, or can include both volatile and non-volatile storage media.

[0124] Please refer to Figure 3 , Figure 3A structural schematic diagram of an electronic device is provided in the fourth embodiment of the present application. The fourth embodiment of the present application provides an electronic device 30, which comprises a processor 301, a memory 302, and a computer program stored in the memory 302 and configured to be executed by the processor 301; the processor 301 implements the method described in the first embodiment of the present application when executing the computer program, and achieves the same beneficial effects.

[0125] The processor 301 reads the computer program from the memory 302 through the bus 303 and executes the computer program, and the method described in the first embodiment of the present application can be implemented.

[0126] The processor 301 can process digital signals and can include various computing structures. For example, a complex instruction set computer structure, a reduced instruction set computer structure, or a structure implementing a combination of multiple instruction sets. In some examples, the processor 301 can be a microprocessor.

[0127] The memory 302 can be used to store instructions executed by the processor 301 or data related to the execution process of the instructions. These instructions and / or data can include code for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 301 of the embodiments of the present disclosure can be used to execute instructions in the memory 302 to implement the method described in the first embodiment of the present application. The memory 302 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memories well known to those skilled in the art.

[0128] The fifth embodiment of the present application provides a computer readable storage medium, which comprises a stored computer program; wherein the computer program controls the device where the computer readable storage medium is located to execute the method described in the first embodiment of the present application when running, and achieves the same beneficial effects.

[0129] The method described in the first embodiment of the present application can be implemented by software, hardware, firmware, or any combination thereof, in whole or in part. When implemented by software, it can be implemented in the form of a computer program product in whole or in part. The computer program product comprises one or more computer programs or instructions. When loaded and executed on a computer, the computer programs or instructions perform the processes or functions described in the various embodiments of the present application in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user equipment, a core network device, an OAM (Open Application Model), or other programmable devices.

[0130] The computer program or instructions can be stored in or transferred from one computer-readable medium to another computer-readable medium, e.g., from one website site, computer, server, or data center to another website site, computer, server, or data center, through wired or wireless ways. The computer-readable medium can be any available medium accessible by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available medium can be a magnetic medium such as a floppy disk, a hard disk, a magnetic tape; an optical medium such as a digital video disc; and a semiconductor medium such as a solid-state disk. The computer-readable medium can be a volatile or non-volatile storage medium, or can include both volatile and non-volatile storage media.

[0131] In summary, the embodiments of the present application provide a domain name access control method, program product, electronic device and storage medium. The domain name access control method comprises: obtaining detection information of each domain name in a plurality of domain names after a preset period arrives; wherein the detection information of each domain name comprises at least one of registration information, resolution record and web page content; performing risk assessment according to the detection information of each domain name to obtain a risk assessment value of each domain name; after receiving a destination domain name access request, querying the risk assessment value of the destination domain name according to the latest obtained risk assessment values of the plurality of domain names; if the risk assessment value of the destination domain name meets a preset value condition, releasing the destination domain name access request, otherwise rejecting the destination domain name access request. The embodiments of the present application actively detect the plurality of domain names according to the preset period, obtain the detection information of each domain name in the plurality of domain names, perform risk assessment according to the detection information of each domain name to obtain the risk assessment value of each domain name, so as to query the risk assessment value of the destination domain name according to the latest obtained risk assessment values of the plurality of domain names after receiving the destination domain name access request, and select to release or reject the destination domain name access request according to whether the risk assessment value of the destination domain name meets the preset value condition, which can periodically obtain the detection information of the plurality of domain names based on the active mode and comprehensively evaluate the risk assessment value of each domain name, so that the latest risk assessment value corresponding to the destination domain name can be directly queried for access control after receiving the destination domain name access request, and effective and accurate domain name access control can be ensured.

[0132] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can also be implemented by other manners. The apparatus embodiments described above are merely illustrative, for example, the flowcharts and block diagrams in the drawings show the possible implementation architecture, function and operation of the apparatus, method and computer program product according to the embodiments of the present application. In this regard, each block in the flowchart or block diagram can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logic function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different orders from those described in the drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and they can also be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for executing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0133] In addition, the functional modules in the embodiments of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0134] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0135] The above description is merely a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A domain name access control method, characterized in that, include: Collect at least one known domain name; wherein, the at least one known domain name includes historical access domain names extracted from network traffic data and / or business service domain names configured in the business system; Artificial intelligence technology is used to perform deep analysis on the at least one known domain name to obtain at least one potential domain name. The at least one potential domain name is obtained using one or more of the following methods: if the at least one known domain name includes a historical access domain name, the text information corresponding to the historical access domain name is analyzed, including network logs and user interaction information. Semantic analysis is used to generate a context-appropriate potential domain name based on the understood semantics, and keyword extraction is used to expand the potential domain name similar to the historical access domain name based on the extracted keywords. If the at least one known domain name includes a business service domain name, natural language processing technology and keyword extraction are used to expand the potential domain name similar to the business service domain name based on the extracted keywords. The identified multiple domain names include the at least one known domain name and the at least one potential domain name; After a preset period arrives, the detection information of each of the multiple domains is obtained; wherein, the detection information of each domain includes at least one of registration information, DNS records and web page content, the DNS records of each domain include the IP address of each domain, and the web page content of each domain includes the web page title and meta tags corresponding to each domain. Risk assessment is performed based on the detection information of each domain name to obtain the risk assessment value of each domain name; Upon receiving a request to access the target domain, the risk assessment value of the target domain is queried based on the latest risk assessment values ​​of the multiple domains. If the risk assessment value of the target domain name is found, and the risk assessment value of the target domain name meets the preset value conditions, then the access request to the target domain name is allowed; otherwise, the access request to the target domain name is rejected. If the risk assessment value of the target domain name is not found, the access request to the target domain name is rejected; or, a target domain name access query message is sent to select whether to allow or reject the access request based on the returned target domain name access response message.

2. The method according to claim 1, characterized in that, The detection information for each domain name includes DNS records; The acquisition of probe information for each domain among multiple domains includes: Retrieve the DNS records for each of the aforementioned domains from the local cache; If the DNS records for at least some of the domain names cannot be found in the local cache, the DNS server is consulted to retrieve the DNS records for at least some of the domain names.

3. The method according to claim 2, characterized in that, The number of at least some of the domain names is multiple; The querying of the DNS records of at least some of the domain names from the DNS server includes: Based on predefined domain name grouping rules, the at least some domain names are divided into at least one domain name group; For each of the at least one domain group, a batch query request for all domains within the domain group is sent to the domain name server, and the DNS records for all domains returned by the domain name server are obtained.

4. The method according to claim 1, characterized in that, The detection information for each domain name includes the webpage content; The acquisition of probe information for each domain among multiple domains includes: Web crawling technology is used to retrieve the web page content corresponding to each of the domain names.

5. The method according to claim 1, characterized in that, The risk assessment based on the detection information of each domain name to obtain the risk assessment value of each domain name includes: The detection information of each domain name is input into a pre-established risk assessment model to obtain the risk assessment value of each domain name.

6. The method according to any one of claims 1-5, characterized in that, The method further includes: If the risk assessment value of the target domain does not meet the preset value conditions, a risk warning message for the target domain is sent, and the associated information of the target domain is recorded; wherein, the associated information of the target domain includes the detection information of the target domain and the risk assessment value of the target domain.

7. A computer program product, characterized in that, The computer program product includes instructions that, when executed by a computer, cause the computer to perform the method according to any one of claims 1 to 6.

8. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; when the processor executes the computer program, it implements the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program; wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the method according to any one of claims 1 to 6.

Images