Browser search based dns server security's non-sensing detection system

Abstract

The application discloses a DNS server security non-sensing detection system based on browser search and belongs to the technical field of network security detection. The system is deployed in a browser, and the browser is used as a security verification node and a network sensing terminal. The system comprises a receiving module, a legality approval and credibility screening module, a multi-layer verification module and a health state monitoring and dynamic risk assessment module. The multi-layer verification module comprises a reality checking module, a multi-path request and consistency comparison module and a comparison analysis and redundancy screening module. The system can realize security protection of the conversion process from a keyword to a URL when a user uses the browser to input the keyword to access a network and can realize non-sensing detection of a local DNS server. The system can identify more potential attacks and data tampering risks through multi-layer verification and consistency comparison and can construct a full-link security protection system from a user end to network infrastructure.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security detection, and particularly relates to a DNS server security non-sensing detection system based on browser search. BACKGROUND

[0002] With the rapid development of the Internet, users usually access websites in the browser in a keyword search manner, which involves a multi-level resolution process from keywords to URL (Uniform Resource Locator) and then to IP addresses. In this process, there are security risks such as DNS tampering and domain name hijacking. In particular, when the local DNS server (LDNS) is attacked or improperly configured, users may be directed to malicious sites.

[0003] In order to realize the security detection of the DNS domain name server, many companies in the industry use direct detection or multiple detection points. This method has a large cost overhead, requires the maintenance of multiple detection points, increases the cost of infrastructure and the complexity of operation and maintenance, and is easily detected by the domain name server. Frequent detection requests may be identified by the target domain name server, resulting in countermeasures such as blocking specific IP or traffic, i.e. it is difficult to achieve non-sensing.

[0004] Currently, there is DNS resolution using a cache mechanism. Many DNS servers cache query results to improve the response speed of subsequent requests. This method relies on the effectiveness of the cache to reduce network latency. However, this method has the following disadvantages: (1) if the cache is invalid, i.e. if the data in the cache expires or is tampered with, the user will receive outdated or incorrect resolution results, resulting in security risks; (2) due to different cache update times of different DNS servers, users may obtain inconsistent resolution results in different network environments; (3) attackers can use cache poisoning and other means to interfere with DNS resolution results, causing users to access malicious websites, i.e. there is a risk of cache pollution. SUMMARY

[0005] In view of the problems of large cost overhead, difficulty in achieving non-sensing detection, and great dependence on cache effectiveness when detecting the security of DNS domain name servers, the present application proposes a DNS server security non-sensing detection system based on browser search. Through a multi-dimensional security check and active monitoring mechanism, a full-link security protection system from the user end to the network infrastructure is constructed. This technical solution is implemented in compliance with relevant laws and regulations for personal information protection, and meets the relevant circumstances of legal use.

[0006] The application provides a browser search-based DNS server security non-invasive detection system, which takes a browser as a security verification node and a network perception terminal, and is deployed in the browser.

[0007] A user inputs a request using the browser, a receiving module performs standardized processing on the user request, and outputs keywords in a preset format. The legality approval and credibility screening module performs the following operations: first, performs semantic analysis and expansion on the keywords output by the receiving module, generates a candidate URL list based on the keywords and expanded words, further screens the candidate URL in combination with user historical access records and current context, then performs legality check on the screened candidate URL, finally evaluates the credibility of the legal candidate URL, and outputs the candidate URL in order from high to low according to the credibility.

[0008] The multi-layer verification module initiates a DNS resolution request for the candidate URL, including sending resolution requests to a local DNS server and K external trusted DNS servers, obtaining resolution paths and results, and performing security monitoring on the resolution paths and results of the local DNS server; K is greater than 1; the multi-path request and consistency comparison module simultaneously sends resolution requests for the candidate URL to the K external trusted DNS servers and the local DNS server, compares the resolution results of the local DNS server with the resolution results returned by the external DNS servers, and if they are inconsistent, triggers the security verification mechanism in the authenticity verification module.

[0009] The authenticity verification module realizes the following functions: detecting whether the local DNS is tampered with; verifying the resolution paths and results of the external trusted DNS servers; performing abnormal analysis on the historical resolution mode of the local DNS server by using a graph neural network; taking the IP address resolved by the local DNS server as a target website, dynamically generating an HTTP request conforming to the business characteristics of the target website by using an intelligent camouflage engine, and performing security verification on the target website.

[0010] The comparison analysis and redundancy screening module removes the redundancy of the resolution results returned by the external trusted DNS servers, compares the differences between the resolution results of the local DNS server and the external trusted DNS servers, and makes a final decision output in the principle of giving priority to the resolution results of the external trusted DNS servers.

[0011] The health state monitoring and dynamic risk assessment module monitors the health state and performance of the local DNS server in real time.

[0012] The realness verification module takes the IP address resolved by the local DNS server as a target website, and performs security verification, and the verification mode is: crawling historical traffic data of the target website, and extracting typical traffic characteristics of the target website from the historical traffic data, including HTTP request header information, request time interval law and user interaction behavior; then, the intelligent camouflage engine generates simulated HTTP GET or POST requests conforming to the business characteristics of the target website according to the extracted typical traffic characteristics, and initiates requests to the target website at a randomized request interval; finally, by comparing the differences in responses of the target website to the business node and the pure probing node, the man-in-the-middle attack or page hijacking behavior is detected and identified.

[0013] The health state monitoring and dynamic risk assessment module constructs a three-dimensional monitoring matrix of the local DNS server, including: (1) at the infrastructure level, real-time DNS resolution data is collected from the terminal browser by using the invisible probe technology, including DNS resolution delay, TTL value, resolution path; the invisible probe technology refers to embedding a lightweight HTTP verification request in a normal user request, processing the user request traffic by using a traffic feature confusion algorithm to simulate the statistical characteristics of real user traffic, and then sending the real-time collected DNS resolution data to the terminal browser; (2) at the user behavior level, user behavior data is collected, including page loading track, resource request time sequence and interaction event stream; (3) at the security protection layer, the server side monitors the TLS handshake process, certificate chain integrity and HSTS protocol compliance of user access in real time.

[0014] The health state monitoring and dynamic risk assessment module uses the constructed health assessment model to monitor the risk of the local DNS server and identify abnormalities; the health assessment model contains 21 dimensional data, which are: DNS resolution response time, DNS return result consistency, DNS resolution path topology structure change, TTL abnormal fluctuation condition, DNS server IP geographical location exception, recursive query depth exception, DNS response data packet size exception, DNS server load abnormal feature, domain name resolution failure frequency, DNSSEC verification state, EDNS0 expansion field exception condition, DNS response cache hit rate, DNS server software version exception, DNS request redirection abnormal feature, DNS server response type proportion exception, DNS server accessibility, DNS resolution success rate fluctuation, domain name blacklist trigger record, DNS server historical abnormal event frequency, DNS return IP and expected IP difference, and DNS response message flag bit exception. Among them, DNSSEC represents EDNS0, which is an extension mechanism of DNS protocol.

[0015] The advantages and positive effects of the application are:

[0016] (1) The system of the present application can identify more potential attacks and data tampering risks through multi-layer verification and consistency comparison, significantly improving security. The system of the present application first performs trusted authentication on the candidate URL, and simultaneously initiates a distributed resolution request to the LDNS and other hierarchical DNS servers, realizes multi-verification through cross-comparison of resolution results, not only verifies the domain name to IP mapping relationship, but also dynamically simulates HTTP requests conforming to the real user traffic characteristics of the target website through the intelligent camouflage engine, effectively avoiding the problem that pure dialing test traffic is easy to be detected and shielded.

[0017] (2) The legality approval and credibility screening module of the system of the present application combines semantic expansion technology to expand the key words in the user request, establishes a dynamic URL candidate pool, further screens the candidate URL in combination with the user historical access record and the current context, performs legality check based on the threat intelligence library and HTTPS certificate validity, and performs credibility scoring. The system of the present application innovatively constructs a multi-dimensional intelligent screening mechanism integrating semantic expansion, historical behavior analysis and real-time intelligence perception (i.e. current context), ensuring high security and credibility of user access URL.

[0018] (3) The system of the present application can reduce inaccurate resolution caused by single source error by comparing the results of external authoritative DNS and local DNS, further improving resolution accuracy. Unlike traditional dialing test solutions, the system of the present application fully utilizes the group perception advantage of browser terminals, collects massive user behavior data, refines network traffic characteristics in real scenarios, dynamically selects the most matched simulation request parameters and traffic mode during security dialing test, generates highly simulated detection requests, and improves the concealment and effectiveness of dialing test. At the same time, the system of the present application establishes a resolution path tracing mechanism, accurately locates and isolates abnormal resolution nodes, and ensures that users always obtain safe and reliable resolution services.

[0019] (4) When using the system of the present application, users can enjoy faster response time and smoother access experience due to the background non-perception security access mechanism and real-time health monitoring, and the overall user experience is significantly improved.

[0020] (5) Using the system of the present application solves the problems of large cost overhead, difficulty in realizing non-perception detection, and great dependence on cache effectiveness in the prior art, and constructs a full-link security protection system from the user end to the network infrastructure through multi-dimensional security check and active monitoring mechanism. BRIEF DESCRIPTION OF DRAWINGS

[0021] Figure 1 is a schematic diagram of a non-perception detection system of a DNS server security based on browser search according to an embodiment of the present application;

[0022] Figure 2 This is a flowchart illustrating the functional implementation of the legality verification and credibility screening module in this embodiment of the invention.

[0023] Figure 3 This is a flowchart illustrating the functional implementation of the authenticity verification module in an embodiment of the present invention. Detailed Implementation

[0024] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments.

[0025] like Figure 1 As shown in the figure, the browser-based DNS server security detection system of this invention mainly includes the following modules:

[0026] 1) Receiving module: Responsible for receiving user input requests, performing preliminary standardization processing on the request content, and outputting keywords according to a preset format.

[0027] 2) Legality verification and credibility screening module: This module is mainly responsible for generating a list of candidate URLs and verifying their legality and credibility by combining multiple data sources such as context and historical access records.

[0028] 3) Multi-layer verification module: Responsible for initiating DNS resolution requests and monitoring the security of resolution paths and results. This module includes an authenticity verification module, a multi-path request and consistency comparison module, and a comparison analysis and redundancy screening module.

[0029] 4) Authenticity Verification Module: Verifies the authenticity of DNS resolution results by means of multi-source cross-validation, data consistency checks, etc., to ensure the validity and integrity of the resolved data.

[0030] 5) Multipath Request and Consistency Comparison Module: This module initiates multipath requests to multiple external authoritative DNS servers to obtain independent resolution results and compares them with the local DNS results to identify potential tampering or attack risks.

[0031] 6) Comparison Analysis and Redundancy Screening Module: Responsible for comparing resolution data from different DNS sources and performing data consistency and redundancy screening.

[0032] 7) Health Status Monitoring and Dynamic Risk Assessment Module: Monitors the health status and performance of the local DNS server in real time, including indicators such as response time, availability, and resolution accuracy.

[0033] Through the above modules, the present invention achieves the following two key objectives:

[0034] (1) In the process of keyword to URL conversion when the user uses the browser to input the keyword to access the network, the security protection. After the user inputs the keyword in the browser, the receiving module performs preliminary preprocessing on the keyword, such as removing meaningless characters and uniform formatting processing; then, the legitimacy approval and credibility screening module will combine the semantic expansion technology (based on the existing natural language processing model, such as BERT or GPT) to perform semantic analysis on the keyword, intelligently generate synonymous or near-synonymous expansion of the keyword, and thus establish a dynamic URL candidate pool. Then, combined with the threat intelligence library and blacklist mechanism, the candidate URL is checked for legitimacy, and based on the domain name reputation score, HTTPS certificate validity and other standards, security filtering and sorting are implemented. In this process, a multi-dimensional intelligent screening mechanism integrating semantic expansion, historical behavior analysis and real-time intelligence perception is innovatively constructed to ensure the high security and credibility of the user's access to the URL.

[0035] (2) While protecting the security of the user using the browser to input the keyword, the local DNS server is realized without sensing detection. When the user normally searches and accesses through the browser, the multi-layer verification module implicitly initiates a resolution request to the local DNS server, and simultaneously triggers multiple external authoritative DNS servers for distributed resolution, and innovatively adopts a distributed multi-path comparison verification mechanism. On this basis, the present application introduces an intelligent camouflage engine, uses historical user access behavior characteristic data to construct a dynamic HTTP request parameter model (including request header characteristics, request timing characteristics, interaction behavior characteristics, etc.), to simulate real user request traffic, and evade the identification and countermeasures of the DNS server to the detection behavior. At the same time, the system also innovatively deploys a stealth probe technology, which embeds a lightweight detection request with feature confusion in normal user traffic, so that the security monitoring traffic and normal user traffic are almost indistinguishable, thus realizing truly unperceived detection.

[0036] The implementation functions of each module are described below.

[0037] The receiving module first acquires the request keyword input by the user through the browser after receiving the user request; then performs content preliminary processing, including basic standardization processing of the keyword, such as removing irrelevant characters and formatting; finally, the request data is structured, and the request is converted into a structured data format for easy subsequent analysis and processing.

[0038] As Figure 2As shown, the legality approval and credibility screening module first performs semantic analysis on the keywords output by the receiving module, performs semantic expansion on the keywords, finds related expansion words, and then generates a candidate URL list based on the keywords and related expansion words; then, in combination with the user's historical access records, the high-relevance candidate URLs are screened from the list; then, the candidate URLs are further screened according to the current context such as time, place, etc.; then, legality approval is performed, that is, the domain name reputation score, HTTPS detection and other technologies are used to check the legality of the candidate URLs, and the candidate URLs are verified for legality based on the threat intelligence database and the blacklist and whitelist mechanism; finally, credibility evaluation is performed, and multiple-dimensional evaluation indexes such as the fusion page reputation rating, certificate validity, service continuity, etc. are integrated to evaluate the credibility of the candidate URLs. The method for generating the URL candidate list by the legality approval and credibility screening module of the embodiment of the application is as follows: after the keywords are obtained, the module first automatically identifies and expands the semantic synonyms and associated words of the keywords through a semantic expansion algorithm such as the BERT model based on the Transformer architecture, generates a list of candidate URLs based on the keywords and expansion words; then, in combination with the user's historical click behavior data such as the user's past keyword-URL click records, and real-time context information such as time, region, the high-relevance candidate URL list is screened from the list. This process integrates existing natural language processing technology and historical data analysis, but its application method in DNS security detection belongs to one of the innovations of the application.

[0039] The legality approval and credibility screening module of the system of the application integrates user keyword requests, real-time environment data (including geographic location, network environment, etc.) and a multi-dimensional intelligent analysis engine (covering semantic understanding, context association, historical behavior modeling), constructs a dynamic URL candidate pool, and implements hierarchical security filtering. On the one hand, the legality approval and credibility screening module verifies the legality of the candidate URLs based on the threat intelligence database and the blacklist and whitelist mechanism, and on the other hand, the candidate URLs are sorted by security weight through the credibility evaluation model. The credibility evaluation model of the embodiment of the application is constructed by integrating page reputation rating, certificate validity, service continuity and other indexes.

[0040] The multi-layer verification module verifies the candidate URL in sequence, and preferentially processes the candidate URL with high credibility, including: first, initiating a DNS resolution request, including sending a resolution request to a local DNS server, obtaining a target IP address, and initiating a request to an authoritative DNS, which can simultaneously initiate a resolution request to multiple trusted external authoritative DNSs to obtain a resolution path and result; then, monitoring the DNS resolution path in real time to identify potential security risks; and finally, performing IP consistency checking, i.e., checking the consistency of the target IP address of the resolution result with the expected target IP address from the authoritative resolution data recorded in the trusted URL list from the legitimacy approval and credibility screening module. To strengthen the verification system, the system constructs a multi-level cross-verification architecture, not only initiates a recursive query to the local DNS, but also triggers a global DNS resolution by a cloud distributed detection node, and accesses a blockchain storage system to realize resolution path tracing.

[0041] The multi-path request and consistency comparison module first initiates a resolution request to multiple authoritative DNS servers and trusted external DNS servers, obtains the resolution path and resolution result returned by each DNS server, and simultaneously obtains the resolution result of the local DNS server. Subsequently, the resolution results of the local DNS and the resolution results returned by the external DNS are compared using a hash comparison technique to quickly identify differences between the resolution results; when the results are found to be inconsistent, the system will automatically trigger the security verification mechanism in the authenticity verification module.

[0042] The authenticity verification module receives the local and external authoritative DNS resolution paths and results from the multi-path request and consistency comparison module, compares the resolution paths and timestamps using a hash technique to detect whether the local DNS has been tampered with. At the same time, by using a DNS root server signature chain based on a blockchain, the historical resolution results, resolution paths, resolution IP addresses, TTL (Time To Live) values, and signature data of the authoritative DNS server for key domain names are verified to prevent malicious tampering of resolution records and improve the credibility of the results. In addition, a graph neural network such as GCN or GraphSAGE is used to perform anomaly analysis on the historical resolution patterns of the local DNS server. The input data of the graph neural network includes: the topology of the local DNS server resolving the URL, the servers providing DNS services as nodes, and the resolution path as edges; node features, represented as a DNS resolution feature vector including TTL fluctuations, resolution delays, IP consistency, etc.; and historical interaction relationships between nodes, such as historical resolution path changes. The graph neural network outputs an abnormal risk score for each node and the nodes or paths with high-risk abnormal behavior in the network to assist in identifying potential abnormal risks.

[0043] At the level of security verification mechanism, the authenticity verification module of the application adopts intelligent camouflage engine to dynamically generate HTTP request conforming to the business characteristics of the target website, including Header fingerprint simulation, request interval jitter, interactive behavior reproduction and other technologies, so that the verification process has both real user behavior characteristics and can evade the anti-detection mechanism of malicious nodes. The specific implementation manner is: first, obtaining the historical traffic of the target website, through historical traffic analysis and machine learning, such as using classification algorithm in supervised learning or deep learning model such as LSTM network, extracting typical traffic features of the target website, including HTTP request header information such as User-Agent, Accept-Encoding, request time interval law such as request frequency, access peak period, and user interactive behavior such as Cookie usage mechanism, API request characteristics, form submission and the like; second, the intelligent camouflage engine uses the extracted feature data to generate simulated HTTP GET or POST request conforming to the typical access business characteristics of the target website, and initiates the request with randomized request interval (jitter); finally, by comparing the response differences of the data returned by the target website to the business node and the pure detection node in terms of structure, loaded resources, Cookie processing, interactive logic and the like, the possible man-in-the-middle attack or page hijacking behavior is detected and identified. The system of the application dynamically adjusts the HTTP request parameters according to the extracted features of the target website to simulate the real user traffic characteristics, effectively avoiding the problem that pure detection traffic is easy to be detected and shielded. In the above implementation, although the feature extraction and behavior simulation involve existing machine learning and traffic simulation technologies, the application innovatively applies them to the field of non-perception security detection of DNS server, and significantly improves the concealment and effectiveness of the detection behavior.

[0044] The system of the present application fully develops the group awareness advantage of the browser terminal, and extracts the network traffic characteristics in the real scene through the collection of massive user behavior data. The strategy library is pre-set in the intelligent camouflage engine, and the data models stored therein include: typical traffic characteristics of different industries and different types of websites, such as HTTP header information, cookie usage characteristics, request time distribution, page interaction event sequence; historical records of various attacks and abnormal events and corresponding traffic characteristics; dynamic environmental factors such as statistical characteristics of access requests under different geographical locations, network conditions and time periods. When the system performs security dialing test, according to the typical traffic characteristics of the current target website, the corresponding data model is called from the strategy library in real time, based on the context information of the current request including target URL type, user location, time, etc., the most matched simulation request parameters and traffic mode are dynamically selected to generate high-simulation probe request, thereby improving the concealment and effectiveness of dialing test. At the same time, the strategy library has a self-optimization mechanism, which periodically extracts features from new terminal access data through machine learning algorithms (such as supervised learning and reinforcement learning), and automatically updates and improves the data model, thereby continuously improving the adaptability of the dialing test strategy library. The strategy library can provide intelligent guidance for cloud robot dialing test, and realize the security mode change from passive defense to active prediction. At the same time, the present application establishes an analysis path tracing mechanism, and implements accurate positioning and isolation of abnormal analysis nodes, so as to ensure that the user always obtains safe and reliable analysis service.

[0045] The comparison analysis and redundancy screening module compares the analysis results of the candidate URL and removes the redundant analysis results returned from the outside. The comparison analysis and redundancy screening module combines the analysis results of the local DNS and the external authoritative DNS server, and uses a difference detection algorithm such as Levenshtein distance to identify abnormal differences in the local analysis results. According to the comparison analysis result, a final decision is made, the analysis result from the external trusted source is preferentially used, and the domain name reputation score provided by the legality approval and credibility screening module is combined to adjust and optimize the final output result, so as to ensure the accuracy and credibility of the analysis result. The final decision includes the resolved IP address, the analysis path, the credibility score, etc.

[0046] The health state monitoring and dynamic risk assessment module monitors the response time, availability, resolution accuracy and other key indicators of the local DNS server in real time to determine the health state of the LDNS. The health state monitoring and dynamic risk assessment module deeply mines the perception capability of the browser terminal and constructs a three-dimensional monitoring matrix of the LDNS: 1) the infrastructure layer collects network metadata such as DNS resolution delay, TTL value, resolution path in real time; 2) the user behavior layer analyzes page loading track, resource request timing, interaction event stream and other operation characteristics; 3) the security protection layer implements TLS (Transport Layer Security) handshake monitoring, certificate chain verification, HSTS (HTTP Strict Transport Security, HTTP Strict Transport Security) compliance check. Through the multi-modal risk assessment model (integrating traffic fingerprint analysis, protocol compliance verification, behavior baseline comparison), dynamic threat scoring is realized. The health state monitoring and dynamic risk assessment module of the application first collects DNS resolution data such as TTL value, resolution path, resolution delay from the terminal browser in real time through the invisible probe; secondly, the JavaScript script records the page loading track, resource request timing, interaction event stream and other user behavior data in the user terminal; finally, the server side monitors the TLS handshake process, certificate chain integrity, HSTS protocol usage compliance of user access in real time.

[0047] To achieve the balance between security and experience, the system of the application introduces invisible probe technology, which is a lightweight HTTP verification request embedded in normal user requests. Lightweight verification requests are embedded in the normal access process of users, and a traffic feature confusion algorithm is used to confuse the verification request traffic of security detection with the traffic of normal business requests of users, which is indistinguishable. Then the user request traffic is sent to the terminal browser, and the terminal browser parses the HTTP verification request to obtain the DNS resolution data collected in real time. The application innovatively embeds lightweight HTTP verification requests in the normal access process of users. These requests are processed by a traffic feature confusion algorithm to simulate the statistical characteristics of real user traffic, such as request interval, packet size, HTTP header characteristics, etc., so that the security monitoring traffic and the real business traffic are difficult to distinguish in statistical and behavioral characteristics, avoiding the detection request from being identified and blocked by the DNS server or network equipment.

[0048] More specifically, in the embodiments of the present application, the health status monitoring and dynamic risk assessment module obtains 21 dimensions of network status data according to the process data of the local DNS server resolving the URL, including: DNS resolution response time, DNS return result consistency, DNS resolution path topology structure change, TTL (Time to Live) abnormal fluctuation, DNS server IP geographical location abnormality, recursive query depth abnormality, DNS response packet size abnormality, DNS server load abnormality, domain name resolution failure frequency, DNSSEC (DNS Security Extensions) verification status, EDNS0 extension field abnormality, DNS response cache hit rate, DNS server software version abnormality, DNS request redirection abnormality, DNS server response type proportion abnormality, DNS server reachability, DNS resolution success rate fluctuation, domain name blacklist trigger record, DNS server historical abnormal event frequency, DNS returned IP and expected IP difference, and DNS response message flag abnormality. The health assessment model of the local DNS server is constructed by comprehensively constructing the above dimensions, and real-time risk monitoring and abnormality identification of the DNS server are realized. EDNS0 is an extension mechanism of the DNS protocol.

[0049] The health status monitoring and dynamic risk assessment module of the present application collects data in the three-dimensional monitoring matrix of the local DNS server, and statistically analyzes the average value, variance and resolution success rate trend change of the DNS resolution response time. The time series analysis technology (such as ARIMA model or LSTM neural network) is used to dynamically analyze the risk trend of the above indexes. The time series analysis technology is used to evaluate the dynamic risk state of the DNS server and predict potential problems. The abnormal detection algorithm such as Isolation Forest or the abnormal detection model based on autoencoder is used to identify abnormal conditions such as significant increase in DNS response delay, abnormal decrease in resolution success rate or abnormal fluctuation of resolution accuracy, so as to ensure the stability of the DNS service.

[0050] The health status monitoring and dynamic risk assessment module processes the collected data through a multi-modal risk assessment model (fusing machine learning algorithms such as random forest, graph neural network and sequence model) to output the dynamic threat score of the DNS resolution node, so as to effectively identify the abnormality and attack behavior in the DNS resolution link. The above data collection and model evaluation method involves existing data analysis and machine learning technology, but the present application innovatively integrates three layers of data monitoring mode to form a collaborative monitoring and risk assessment system, and realizes comprehensive, real-time and accurate monitoring and protection of the security risk of the DNS server.

[0051] The application also introduces an intelligent learning mechanism, based on a large number of terminal collected abnormal access modes, such as DNS resolution abnormalities, page hijacking cases, DNS server response abnormal records, etc., a cloud robot dialing test strategy library is constructed, and machine learning (such as clustering algorithm and reinforcement learning) is used to continuously optimize the dialing test strategy, to adapt to new security threats and realize dynamic adjustment, to realize the minute-level synchronization from regional risk early warning to global defense strategy. Finally, a security enhanced DNS resolution ecology of "terminal perception-intelligent decision-making-cloud evolution" is formed, which provides inductive security escort while building personalized trusted access space for each user.

[0052] In general, the embodiments disclosed herein can be implemented in hardware or special-purpose circuits, software, firmware, logic, or any combination thereof. Some aspects can be implemented in hardware, while other aspects can be implemented in firmware or software which can be executed by a controller, microprocessor or other computing device, Although the various aspects of the application can be illustrated and described as block diagrams, flow charts, or using some other pictorial representation, it is well understood that these blocks, apparatus, systems, techniques or methods described herein can be implemented in, as non-limiting examples, hardware, software, firmware, special purpose circuits or logic, general purpose hardware or controller or other computing devices, or some combination thereof.

[0053] In addition to the technical features described in the specification, they are known to those skilled in the art. The application omits the description of known components and known technologies to avoid redundancy and unnecessary limitation of the application. The embodiments described in the above embodiments do not represent all embodiments consistent with the present application. Various modifications or variations made by those skilled in the art without creative labor on the basis of the technical solutions of the present application are still within the protection scope of the present application.

Claims

1. A system for browser search based DNS server security with passive probing, characterized in that, The system comprises a receiving module, a legality approval and credibility screening module, a multi-layer verification module, and a health state monitoring and dynamic risk assessment module, the multi-layer verification module comprises a authenticity verification module, a multi-path request and consistency comparison module, and a comparison analysis and redundancy screening module; The browser is used as a security verification node and a network-aware terminal, the system is deployed in the browser, a user inputs a request by using the browser, the receiving module performs standardized processing on the user request, and outputs keywords in a preset format; The legality approval and credibility screening module performs semantic analysis and expansion on the keywords output by the receiving module, generates a candidate URL list based on the keywords and the expanded keywords, further screens the candidate URL in combination with user historical access records and a current context, performs legality checking on the screened candidate URL, evaluates the credibility of the legal candidate URL, and outputs the candidate URL in a descending order of the credibility; The multi-layer verification module initiates a DNS resolution request for the candidate URL, including sending resolution requests to a local DNS server and K external trusted DNS servers, acquiring resolution paths and results, and performing security monitoring on the resolution paths and results of the local DNS server; K is greater than 1; The multi-path request and consistency comparison module simultaneously sends resolution requests for the candidate URL to the K external trusted DNS servers and the local DNS server, compares the resolution results of the local DNS server with the resolution results returned by the external DNS servers, if the resolution results are inconsistent, triggers the authenticity verification module, otherwise directly calls the comparison analysis and redundancy screening module; The authenticity verification module implements the following functions: detecting whether the local DNS is tampered with; verifying the resolution paths and results of the external trusted DNS servers; performing abnormal analysis on the historical resolution mode of the local DNS server by using a graph neural network; taking the IP address resolved by the local DNS server as a target website, and generating an HTTP request conforming to the business characteristics of the target website by using an intelligent camouflage engine to perform security verification on the target website; The comparison analysis and redundancy screening module removes the redundancy of the resolution results returned by the external trusted DNS servers, compares the differences between the resolution results of the local DNS server and the external trusted DNS servers, and makes a final decision output in the principle of giving priority to the resolution results of the external trusted DNS servers; The health state monitoring and dynamic risk assessment module monitors the health state and performance of the local DNS server in real time.

2. The system of claim 1, wherein, The legality approval and credibility screening module performs legality checking on the candidate URL, including using domain name reputation scores and HTTPS detection to check legality, and checking legality based on a threat intelligence database and a blacklist and whitelist mechanism.

3. The system of claim 1, wherein, The authenticity verification module receives the resolution paths and results of the local DNS server and the external trusted DNS servers, compares the resolution paths and timestamps by using a hash, and detects whether the local DNS is tampered with.

4. The system of claim 1, wherein, The authenticity verification module verifies historical resolution results, resolution paths, TTL values and signatures of an external trusted DNS server through a DNS root server signature chain based on a block chain.

5. The system of claim 1, wherein, The authenticity verification module uses a graph neural network to perform abnormality analysis on historical resolution modes of the local DNS server, and the input data of the graph neural network includes: a topology structure of URL resolution of the local DNS server, a server providing DNS service is taken as a node, and an edge is constructed according to a resolution path; node features are represented by a DNS resolution feature vector, and the vector includes TTL fluctuation, resolution delay and IP consistency; and historical interaction relationships between nodes are represented as historical resolution path changes; the graph neural network outputs an abnormal risk score of each node and a node or path with high-risk abnormal behavior existing in the network.

6. The system of claim 1, wherein, The authenticity verification module takes an IP address resolved by the local DNS server as a target website, and performs security verification in the following manner: crawling historical traffic data of the target website, and extracting typical traffic features of the target website from the historical traffic data, including HTTP request header information, request time interval rules and user interaction behaviors; Then, the intelligent camouflage engine generates simulated HTTP GET or POST requests conforming to the business characteristics of the target website according to the extracted typical traffic features, and initiates requests to the target website at a randomized request interval; finally, by comparing the differences in responses of the target website to business nodes and pure probing nodes, a man-in-the-middle attack or page hijacking behavior is detected and identified.

7. The system of claim 6, wherein, The intelligent camouflage engine is provided with a policy library, and the data models stored in the policy library include: typical traffic features of websites of different industries and different types, historical records of various attacks and abnormal events and corresponding traffic features, and statistical features of access requests in a dynamic environment; the intelligent camouflage engine selects the most matched simulation request parameters and traffic patterns from the policy library according to the typical traffic features of the current target website, and generates HTTP GET or POST requests.

8. The system of claim 1, wherein, The health state monitoring and dynamic risk assessment module constructs a three-dimensional monitoring matrix of the local DNS server, including: (1) at the infrastructure level, real-time DNS resolution data is collected from terminal browsers by using a stealth probe technology, including DNS resolution delay, TTL value and resolution path; the stealth probe technology refers to embedding a lightweight HTTP verification request in a normal user request, processing the user request traffic by using a traffic feature confusion algorithm to simulate the statistical features of real user traffic, and then sending the real-time collected DNS resolution data to the terminal browser; (2) at the user behavior level, user behavior data is collected, including page loading tracks, resource request time sequences and interaction event streams; (3) at the security protection layer, the server side monitors TLS handshake processes, certificate chain integrity and HSTS protocol compliance of user access in real time; TLS represents a transmission layer security protocol, and HSTS represents an HTTP strict transport security protocol.

9. The system of claim 1 or 8, wherein, The health status monitoring and dynamic risk assessment module uses a constructed health assessment model to monitor the risk and identify abnormalities of the local DNS server; the health assessment model contains 21 dimensional data, which are: DNS resolution response time, DNS return result consistency, DNS resolution path topology structure change, TTL abnormal fluctuation, DNS server IP geographical location abnormality, recursive query depth abnormality, DNS response data packet size abnormality, DNS server load abnormality, domain name resolution failure frequency, DNSSEC verification state, EDNS0 extension field abnormality, DNS response cache hit rate, DNS server software version abnormality, DNS request redirection abnormality, DNS server response type proportion abnormality, DNS server accessibility, DNS resolution success rate fluctuation, domain name blacklist trigger record, DNS server historical abnormal event frequency, DNS return IP and expected IP difference, and DNS response message flag abnormality. DNSSEC represents DNS security extension.

Images