Large-scale resolver-oriented directional domain name record hijacking detection method and device

Abstract

The invention provides a directional domain name record hijacking detection method and device for a large-scale resolver, and the method comprises the steps: analyzing each domain name in a monitoring list, and sequentially obtaining multi-level data corresponding to the domain names through a set priority; detecting a domain name resolution result by using a baseline detection algorithm and a differential detection algorithm, outputting an abnormal domain name set in the detection, and if the two algorithms both judge that the domain name is abnormal, judging that the domain name is abnormal; and hijacking detection iteration is carried out on the abnormal domain name set, multi-level abnormal screening is carried out through certificates and pages in sequence, and domain names with anomalies in multiple levels are regarded as hijacked domain names. According to the method, whether the resolver has the hijacking behavior or not is judged for the first time by fusing the two detection methods of baseline detection and differential detection, and then iterative judgment is performed through the multi-level hijacking detection result, so that the problems of high false alarm rate and low detection efficiency in a large-scale scene in the prior art can be solved.

Description

Technical Field

[0001] The present application relates to the technical field of domain name record hijacking detection, and in particular to a method and device for detecting directional domain name record hijacking for large-scale resolvers. Background Art

[0002] Domain name hijacking detection technology for resolvers is mainly based on baseline detection methods and differential detection methods. Based on actively obtained resolver data, it determines whether the resolver has tampered with the resolution record for a specific domain name or has been attacked by cache pollution, thereby detecting specific domain name hijacking incidents and improving the security of network infrastructure.

[0003] Since the internet's inception, the Domain Name System (DNS) has been a crucial component of the internet. Its primary function is to convert memorable domain names into IP addresses used by computing systems to locate network resources, a necessary prerequisite for establishing actual network connections. The DNS is a distributed query database comprised of multiple components, including root servers, top-level domain servers, authoritative domain name servers, recursive resolvers, and forwarding resolvers. A typical resolution process involves the following: When a user enters a domain name in a browser, the DNS client initiates a query request to the forwarding resolver, which forwards the request to the recursive resolver. The recursive resolver then resolves the domain name, starting with the root servers and working its way down to the authoritative servers until it finds the corresponding IP address. Resolvers are crucial entry points for domain name queries and play a role in load balancing within the resolution system.

[0004] Domain hijacking attacks occur when attackers tamper with Domain Name System (DNS) resolution results, redirecting users to malicious or phishing websites. These attacks are typically carried out through malware infection, DNS server tampering, or man-in-the-middle attacks. The purposes of domain hijacking include phishing attacks, ad injection, malware distribution, and data theft. Domain hijacking attacks targeting public resolvers are a major challenge facing current Internet infrastructure. Because public resolvers handle the majority of Internet resolution requests, domain hijacking attacks against them can have extremely serious consequences. Therefore, effective detection methods for resolver-targeted domain hijacking attacks are needed.

[0005] Although there are some relevant detection methods for the problem of targeted domain name hijacking for resolvers, these detection methods are not suitable for domain name detection in large-scale scenarios due to various reasons. First, there are limitations on data collection by passive methods. Passive method collection mainly refers to the deployer of the resolver collecting the log records of the resolver and discovering anomalies based on these log records. However, for the monitoring needs of large-scale resolvers, it is difficult to obtain the log data of all resolvers due to ownership restrictions, so there are major limitations. Second, changes in domain name services lead to an increase in false positives. Domain name services have introduced new service models such as domain name hosting, and at the same time, they are deeply integrated with content delivery network services, resulting in large changes in the resolved IP addresses, which leads to more false positives.

[0006] While the aforementioned methods can theoretically be applied to the detection of targeted domain name hijacking, for example, Chinese patent CN115412265A discloses a domain name hijacking monitoring method, apparatus, device, and computer-readable storage medium that detects abnormal domain names by comparing queried domain name resolution records with trusted domain name resolution records. However, in real-world scenarios, due to the diverse deployment of domain name services, these methods can generate a large number of false positives, reducing their usability and making them difficult to apply in practice. Summary of the Invention

[0007] The present application aims to solve one of the technical problems in the related art at least to a certain extent.

[0008] To this end, the first purpose of this application is to propose a targeted domain name record hijacking detection method for large-scale resolvers.

[0009] The second purpose of this application is to propose a directional domain name record hijacking detection device for large-scale resolvers.

[0010] The third objective of this application is to provide an electronic device.

[0011] The fourth object of this application is to provide a computer-readable storage medium.

[0012] A fifth object of this application is to provide a computer program product.

[0013] To achieve the above objectives, the first embodiment of the present application proposes a method for detecting hijacking of targeted domain name records for large-scale resolvers, including:

[0014] Resolve each domain name in the monitoring list and obtain the multi-level data corresponding to the domain name in sequence according to the set priority. The multi-level data includes the resolved IP, certificate, and page.

[0015] The domain name resolution results are tested using the baseline detection algorithm and the differential detection algorithm to generate a set of abnormal domain names in this round of detection. If both algorithms determine that the domain name is abnormal, the domain name is considered abnormal.

[0016] Hijacking detection is iterated on the abnormal domain name set, and multi-level abnormality screening is performed through certificates and pages in turn, and domain names with abnormalities at multiple levels are regarded as hijacked domain names.

[0017] Optionally, obtaining multi-level data corresponding to the domain name includes:

[0018] Collect the A record and AAAA record corresponding to the domain name, indicating the resolved IP address corresponding to the domain name;

[0019] Collect the certificate information deployed on the resolution IP pointed to by the domain name;

[0020] Collect the HTML content corresponding to the resolved IP address pointed to by the domain name.

[0021] Optionally, also include:

[0022] Preprocessing the multi-level data, wherein the preprocessing steps include format integration and elimination of erroneous data;

[0023] Based on the processed data, domain name and certificate data are stored in a relational database, while page data is stored in a non-relational database.

[0024] Optionally, before using the baseline detection algorithm and the differential detection algorithm to detect the domain name resolution result, the following steps are performed:

[0025] Deploy the resolution service software on the probe, use the domain name query tool to specify the locally deployed resolution service software as the recursive server, query the A record of the monitored domain name list after confirming that there is no abnormal interference, and collect the record results TR after the query;

[0026] A domain name query tool is used on the probe to query the monitoring resolver for the A record of the monitoring domain name list, and the record result TE after the query is collected.

[0027] Optionally, the detecting the domain name resolution result by using a baseline detection algorithm and a differential detection algorithm includes:

[0028] Apply the baseline detection algorithm to compare TR and TE, and filter out abnormal domain names as set R1;

[0029] A differential detection algorithm is applied to compare the A records of the same domain name returned by different resolvers in R1, and the list of abnormal domain name A records is filtered out as set R2.

[0030] Optionally, the application of a baseline detection algorithm to compare TR and TE and screen abnormal domain names as set R1 includes:

[0031] A baseline is dynamically generated based on the domain name resolution data of the top 50% in TR frequency and stored historical data. The size of the dynamic pane is limited based on the dynamic change pattern of historical data.

[0032] Compare the resolution A record D1_TE in TE for the same domain name D1 with the A record D1_TR in TR;

[0033] If the A record D1_TE in TE is the same as or a subset of the A record D1_TR in TR, it is determined to be normal; otherwise, it is determined to be abnormal.

[0034] Optionally, the differential detection algorithm is applied to compare the A records of the same domain name returned by different resolvers in R1, and a list of abnormal domain name A records is screened as set R2, including:

[0035] The A records returned by each resolver in R1 for the same domain name D1 are considered independent samples;

[0036] Count the singular values ​​of each A record and regard A records with a ratio below the threshold as abnormal.

[0037] Optionally, the hijacking detection is iterated on the abnormal domain name set, and multi-level abnormality screening is performed in sequence through certificates and pages, and domain names with abnormalities at multiple levels are regarded as hijacked domain names, including:

[0038] Perform reverse domain name resolution on set R2, filter out potential CDN IP addresses based on the PTR records returned, and use the remaining IP addresses as set R3 for the next stage.

[0039] Perform certificate screening on set R3 to check the validity of the security certificate associated with the domain name, the issuing authority, and whether the certificate has expired. If the certificate signature does not match or the certificate has expired, the domain name is judged to be an abnormal domain name, and set R4 is obtained;

[0040] The page of set R4 is screened to determine whether there are malicious redirection links or unknown file downloads in the page. If so, the domain name is determined to be a hijacked domain name.

[0041] To achieve the above objectives, the second embodiment of the present application proposes a targeted domain name record hijacking detection device for large-scale resolvers, comprising:

[0042] The data analysis and collection module is used to analyze each domain name in the monitoring list and obtain the multi-level data corresponding to the domain name in sequence according to the set priority. The multi-level data includes the analyzed IP, certificate, and page;

[0043] The hijacking detection and judgment module is used to detect domain name resolution results using the baseline detection algorithm and the differential detection algorithm, and output a set of abnormal domain names in this round of detection. If both algorithms determine that the domain name is abnormal, the domain name is considered abnormal.

[0044] The hijacking detection iteration module is used to perform hijacking detection iteration on the abnormal domain name set, perform multi-level abnormality screening through certificates and pages in turn, and regard domain names with abnormalities at multiple levels as hijacked domain names.

[0045] To achieve the above-mentioned purpose, a third embodiment of the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0046] The memory stores computer-executable instructions;

[0047] The processor executes the computer-executable instructions stored in the memory to implement the method as described in any one of the first aspects above.

[0048] To achieve the above-mentioned purpose, the fourth embodiment of the present application proposes a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method as described in any one of the above-mentioned first aspects.

[0049] To achieve the above-mentioned purpose, the fifth embodiment of the present application proposes a computer program product, including a computer program, which, when executed by a processor, implements the method as described in any one of the above-mentioned first aspects.

[0050] The technical solutions provided by the embodiments of this application bring at least the following beneficial effects:

[0051] This application provides a method for detecting resolver domain hijacking in a wide range of scenarios, reducing false positive rates in large-scale deployment scenarios of content distribution networks while improving detection accuracy. This application is based on the principles of DNS resolution and multi-step screening during network resource usage, using a multi-dimensional baseline comparison method to eliminate potential normal network service resources. This method has a low false positive rate while accurately identifying hijacking behavior. Compared to existing hijacking detection methods, this application has the following advantages:

[0052] 1. It has a high accuracy rate and a low false alarm rate. Based on the detection of 14,760 selected key domain names for two weeks, it can be found that 80% of the alarms are hijacked.

[0053] 2. Based on a multi-step screening process, it fully utilizes different levels of analytical information to screen in sequence, while ensuring high accuracy and low false alarm rate, it has high detection efficiency.

[0054] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0056] Figure 1 A text flow diagram of a method for detecting hijacking of directional domain name records for large-scale resolvers provided in an embodiment of the present application;

[0057] Figure 2 A simplified flowchart of a method for detecting hijacking of directional domain name records for large-scale resolvers provided in an embodiment of the present application;

[0058] Figure 3 Detection schematic diagram of the baseline detection algorithm and the differential detection algorithm provided in the embodiments of the present application;

[0059] Figure 4 A detection diagram of the baseline detection algorithm provided in an embodiment of the present application;

[0060] Figure 5 A detection diagram of the differential detection algorithm provided in an embodiment of the present application;

[0061] Figure 6 A schematic diagram of the results of two weeks of continuous monitoring of 14,760 domain names provided in an embodiment of the present application;

[0062] Figure 7 A schematic diagram of the structure of a large-scale resolver-oriented domain name record hijacking detection device provided in an embodiment of the present application; DETAILED DESCRIPTION

[0063] The following describes in detail embodiments of the present application. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0064] In order to solve the problems existing in the prior art, the present invention provides a method for detecting hijacking of domain name records for large-scale resolvers. Figure 1 and Figure 2 This is a flow chart of a method for detecting hijacking of directional domain name records for large-scale resolvers provided by an embodiment of the present application. Figure 1 As shown, the method includes the following steps:

[0065] Step 101: parse each domain name in the monitoring list and obtain multi-level data corresponding to the domain name in sequence according to the set priority.

[0066] In this embodiment, step 101 resolves each domain name in the monitoring list and retrieves multiple levels of data for each domain name, including the domain name resolution IP address, certificate information, and page content, in order of priority. This process provides sufficient basic data for subsequent hijacking detection, ensuring accuracy and comprehensiveness.

[0067] Specifically, the following is the detailed implementation process of each link:

[0068] In an embodiment of the present application, the domain name is first resolved and the IP address is obtained. To this end, the embodiment of the present application uses the ZDNS tool, which is the main tool for domain name resolution and can send A record and AAAA record requests to the resolvers in the monitoring list. The A record is used to obtain the IPv4 address of the domain name, while the AAAA record is used to obtain the IPv6 address of the domain name. Each domain name will obtain its corresponding IP address from the resolver by sending a request. These IP addresses are the key elements of the connection between the domain name and the network, and can help identify the server or host to which the domain name points. The resolved IP data obtained by the ZDNS tool will be parsed and processed, and eventually stored in the database as the basis for subsequent anomaly detection and analysis.

[0069] Secondly, obtaining certificate information is the second key step in step 101. In modern networks, domain names are usually encrypted through the HTTPS protocol, so the SSL certificate information is important data for verifying the security of the domain name.

[0070] As a possible implementation method, this application uses a Python script to use the SSL library to initiate an SSL connection request to port 443 of each resolved IP address. Port 443 is the standard port of the HTTPS protocol and is usually used to encrypt and transmit data. After establishing the SSL connection, this application uses the cryptography library to parse the certificate and extract key information in the certificate, including the certificate validity period, issuing authority, certificate type, signature algorithm, etc. These certificate information not only helps to verify the authenticity of the domain name, but also helps the embodiment of this application detect whether there are abnormal situations such as certificate expiration and certificate signature discrepancies. The parsing results of the certificate will be stored in the database and used in subsequent anomaly detection.

[0071] The acquisition of page content is the third step in step 101. After obtaining the IP address and certificate information corresponding to the domain name, this application also needs to perform complete data collection by obtaining page content.

[0072] As a possible implementation method, the acquisition of page content is implemented by a Python script, and the script uses the requests library to send HTTP requests to port 80 (HTTP) and port 443 (HTTPS) of the parsed record. These two ports correspond to the standard non-encrypted and encrypted transmission of web pages, respectively. After sending a request to these two ports, the web page content of the response will be returned to the client. Subsequently, the embodiment of the present application utilizes the beautifulsoup4 library to parse the returned HTML page and extract the structured data in the page, such as the title, content, links, etc. of the web page. The acquisition of these data can not only help us check whether the page has abnormal content, but also provide data support for subsequent page hijacking detection. The parsed page content will be stored in the database for subsequent page analysis and hijacking detection.

[0073] It is understandable that due to various uncertainties in the network environment, there may be problems such as format anomalies or request failures in the original data, so these problems need to be dealt with to improve the accuracy of subsequent analysis. The first step in data preprocessing is format integration. All data from different sources (such as parsed IP, certificates, and page content) need to be in a unified format to ensure that they are compatible and can smoothly enter the subsequent storage and analysis links. For example, the structures of parsed IP, certificates, and page content may be different, and they need to be formatted to convert them into a unified and standardized data format. In addition, erroneous data caused by network interruptions, request failures, etc. also needs to be eliminated. Through this preprocessing link, the data that finally enters the database will be of high quality and can support subsequent hijacking detection and anomaly analysis.

[0074] Finally, after data preprocessing is completed, the processed data will be stored in different ways according to different types of characteristics.

[0075] For structured data, such as parsing IP and certificate information, this embodiment of the application chooses to use a relational database for storage. Relational databases have powerful data query and storage capabilities, can efficiently manage structured data, and use indexing and other technologies to improve data query efficiency. Data storage design usually includes table structure, field definition, and data index creation to ensure fast access and processing of large amounts of data.

[0076] For page data, due to its unstructured nature and large amount of page content, using a relational database to store it will lead to performance issues. Therefore, the embodiment of the present application chooses to use a non-relational database for storage. Non-relational databases (such as MongoDB) can flexibly process document data and support the storage and query of complex, unstructured data. Through non-relational databases, we can effectively store the page content of each domain name and quickly access these page data during subsequent queries and analysis.

[0077] In addition, when there are many detection objects or the detection time is too long, resulting in a large amount of data, the above strategy can be integrated with the distributed storage strategy to reduce the storage pressure of a single node. This application does not make specific restrictions and explanations on this, and the specific selection will be based on the actual scenario.

[0078] Through the above steps, this embodiment achieves comprehensive resolution of each domain name in the monitoring list and acquisition of multi-level data, and provides high-quality support for subsequent hijacking detection through data preprocessing and differentiated storage strategies.

[0079] Step 102: Use the baseline detection algorithm and the differential detection algorithm to detect the domain name resolution result, and generate a set of abnormal domain names in this round of detection. If both algorithms determine that the domain name is abnormal, then the domain name is determined to be abnormal.

[0080] In this embodiment of the present application, the purpose of step 102 is to use the baseline detection algorithm and the differential detection algorithm to detect the domain name resolution results, thereby generating a set of abnormal domain names in this round of detection. If both algorithms determine that a domain name is abnormal, then the domain name is considered to be abnormal.

[0081] The main process and technical details of this step are as follows:

[0082] It should be noted that before using the baseline detection algorithm and the differential detection algorithm, it is first necessary to collect the resolution data of the domain name. In this link, the embodiment of the present application obtains the resolution results of each domain name by deploying the resolution service software and using the domain name query tool. Specifically, first deploy the resolution service software on the probe, configure it as a recursive server, and after ensuring that there is no abnormal interference, query the A record of the monitored domain name list through the domain name query tool. The resolution data collected through this query is called record TR. TR contains the resolution information of the domain name and is the basic data for subsequent analysis.

[0083] In addition to the local recursive server, another important data source is the monitoring resolver. In this embodiment, a domain name query tool is used on the probe to initiate the same A record query to the monitoring resolver. The collected resolution data is called a record TE. In this way, this application can collect resolution data for the same domain name from different resolvers and use this data as a basis for comparison.

[0084] After the data collection is completed, the baseline detection algorithm and differential detection algorithm will be used to detect the domain name resolution results. Figure 3 shown.

[0085] (1) Baseline detection process.

[0086] Once the TR and TE records are collected, the next step is to identify potential abnormal domain names through baseline detection algorithms, such as Figure 4 shown.

[0087] In this embodiment, the baseline detection algorithm dynamically generates a baseline to model the normal state of domain name resolution data. During this process, the application extracts the domain name resolution data with the top 50% frequency from the TR. These high-frequency resolution data typically represent normal resolution behavior and are therefore used to dynamically generate the baseline.

[0088] It should be noted that to ensure that the baseline can accurately reflect the dynamic changes in domain name resolution, the generation of the baseline depends not only on the current resolution data, but also on the stored historical data. The introduction of historical data makes the baseline generation more stable and able to adapt to long-term changing trends.

[0089] When generating a baseline, the size of the dynamic pane is limited based on the dynamic changes in historical data. Specifically, the pane size is selected based on the fluctuation characteristics of the historical data and can be set based on time periods such as two, three, or four weeks. This process analyzes the volatility of historical data to adjust the sensitivity and range of the baseline, ensuring the stability and flexibility of the baseline and avoiding over-response to occasional data fluctuations.

[0090] Then, when the TE's resolution result D1_TE for the same domain name is compared with the TR's resolution result D1_TR, if the A record D1_TE in the TE is identical to or a subset of the A record D1_TR in the TR, the domain name resolution is considered normal. This indicates that the TE's resolution result is consistent with the existing data in the baseline, indicating that the domain name resolution behavior is as expected and there are no anomalies. If the TE's resolution result is not in the baseline, the domain name resolution is inconsistent with the normal state and is considered an anomaly.

[0091] (2) Differential detection process.

[0092] In the differential detection algorithm, the embodiment of the present application further analyzes the domain names screened in R1, such as Figure 5 shown.

[0093] First, this application treats the A records returned by each resolver in R1 for the same domain name D1 as independent samples. This means that data from different resolvers is treated as independent sources and may return different resolution results for the same domain name. By performing differential testing on these independent samples, embodiments of this application can more deeply analyze the behavior of each resolver and identify potential anomalies.

[0094] It should be noted that the core method of differential detection is to perform singular value statistics on each A record. A singular value refers to the difference between the A record returned by a particular resolver and the records returned by other resolvers. For example, if the A record returned by a resolver is significantly different from the records returned by most other resolvers, this difference will be considered a singular value. By counting these singular values, embodiments of the present application can identify which resolved records deviate from the normal pattern.

[0095] During the differential detection process, this application will calculate the singular value of each A record and count the proportion of these singular values. If the singular value of an A record is lower than the preset threshold ratio, then the A record will be judged as abnormal. In other words, only when the A record returned by the resolver is significantly different from the results of other resolvers, and this difference reaches a certain proportion, will this application consider the record to be abnormal. In this way, the differential detection algorithm can accurately identify potential abnormal resolution records and further filter out abnormal domain names.

[0096] It's understandable that the combination of these two components is reflected in the complementary effects of baseline detection and differential detection. The baseline detection algorithm dynamically generates a baseline and compares it with the TE's resolution results, effectively screening out domain names that don't conform to normal resolution behavior. The differential detection algorithm, on the other hand, performs differentiated analysis of the resolution results of different resolvers, further filtering out abnormal resolution records based on baseline detection. This combination ensures high-precision anomaly detection while enhancing the algorithm's flexibility and adaptability.

[0097] By combining a baseline detection algorithm with a differential detection algorithm, the present invention provides an efficient and reliable method for detecting domain name anomalies. Baseline detection effectively identifies anomalies in resolution behavior by dynamically generating a baseline and comparing it with the current resolution result. Differential detection, on the other hand, identifies potential anomalous resolution records by performing a differential analysis of the A records returned by the resolver. These two algorithms complement each other, improving detection accuracy and reliability.

[0098] Step 103, iteratively perform hijacking detection on the abnormal domain name set, perform multi-level abnormality screening through certificates and pages in turn, and regard domain names with abnormalities at multiple levels as hijacked domain names.

[0099] In this embodiment of the present application, the goal of step 103 is to perform further hijacking detection iterations on the set of domain names that have been detected as abnormal, and ultimately determine which domain names are hijacked through multi-level screening of certificates and page content. This process uses progressively deeper anomaly screening to ultimately determine domain names that have anomalies at multiple levels as hijacked domains.

[0100] The following are the detailed implementation steps and technical details:

[0101] During this step, the set of anomalous domain names (R2) derived from baseline and differential detection is first fed into the hijacking detection results iteration phase. This phase further identifies which domains are at risk of hijacking through a layer-by-layer screening process. Specifically, the hijacking detection iteration process includes three primary screening layers: reverse domain name resolution, certificate screening, and page content screening.

[0102] (1) Reverse domain name resolution (set R2).

[0103] In this embodiment of the present application, reverse domain name resolution is first performed on the domain names in the abnormal domain name set R2. Reverse domain name resolution obtains relevant information by querying the PTR record of the IP address pointed to by the domain name. The PTR record is used to map the IP address to the domain name. Reverse resolution can help us identify potential CDN (Content Delivery Network) usage.

[0104] During this process, the results of reverse DNS lookup are used to filter out potential CDN IP addresses. CDNs often point multiple domain names to the same IP address, which can cause different domain names to resolve to the same IP address. Therefore, this situation needs to be eliminated during the inspection process. After reverse DNS lookup is complete, the remaining IP addresses are passed as set R3 to the next stage, the certificate screening stage.

[0105] (2) Certificate screening (set R3).

[0106] The embodiment of the present application performs certificate screening based on the IP address set R3 obtained by reverse domain name resolution. The main purpose of this step is to check the validity of the SSL / TLS security certificate associated with the domain name.

[0107] Specifically, the following checks are performed on the certificate:

[0108] Certificate validity check: Checks whether the certificate is still valid, that is, whether the certificate's validity period has not expired.

[0109] Issuing agency check: Check whether the issuing agency of the certificate is trustworthy and whether the certificate is issued by a legitimate certification body.

[0110] Certificate signature check: If the certificate signature does not match, it means that the certificate may have been tampered with or forged, and is therefore judged as abnormal.

[0111] Certificate expiration check: If the certificate has expired, it will also be marked as an exception.

[0112] Through these checks, this application can identify certificates that fail to meet security requirements. If a domain's certificate does not meet these conditions, it will be identified as an abnormal domain and form set R4. Set R4 contains all domains with problematic certificates. These domains may be considered hijacked domains due to certificate anomalies.

[0113] (3) Page screening (set R4).

[0114] Finally, this application performs page content screening on the domain names in set R4.

[0115] This step further determines whether there are signs of hijacking by analyzing the webpage content corresponding to the domain name. Specific screening methods include:

[0116] Malicious redirect link check: Checks whether there are malicious redirect links on the page. Malicious redirect is usually a common method in hijacking attacks, which will direct users' visits to malicious sites.

[0117] Unknown file download behavior check: Detects whether the page has unknown file download behavior. Malicious web pages usually download malicious files without the user's knowledge.

[0118] If a malicious redirect link or file download behavior is found on the page, the domain name will be determined to be a hijacked domain name.

[0119] It is understood that after multiple levels of screening, including certificate screening and page screening, the final hijacking event determination process will determine whether a hijacking event has actually occurred based on the results of all screening steps. If a domain name exhibits abnormal characteristics at all levels (reverse resolution, certificate, and page screening), it is considered a hijacked domain name. If a domain name is considered normal at a certain level, that is, it does not exhibit abnormal characteristics, then it will not be determined to have been hijacked.

[0120] In the embodiment of the present application, step 103 gradually conducts an in-depth analysis of abnormal domain names through three levels of screening (reverse domain name resolution, certificate screening, and page screening), and determines whether there is hijacking behavior through multiple screening. Each level plays a role in strengthening the judgment standard, thereby improving the accuracy and reliability of the final judgment. Through this multi-level hijacking detection iterative process, hijacked domain names can be effectively identified, providing a solid foundation for subsequent security protection.

[0121] In one possible embodiment, the method of the present application is used to continuously monitor 14,760 domain names for two weeks. The monitoring effect is as follows: Figure 6 shown.

[0122] In order to implement the above embodiment, the present application also proposes a directional domain name record hijacking detection device for large-scale resolvers. Figure 7 A schematic diagram of a large-scale resolver-oriented domain name record hijacking detection device provided in an embodiment of the present application. Figure 7 As shown, the device includes:

[0123] The data analysis and collection module 100 is used to analyze each domain name in the monitoring list and obtain the multi-level data corresponding to the domain name in sequence according to the set priority. The multi-level data includes the analyzed IP, certificate, and page;

[0124] Hijacking detection and judgment module 200 is used to detect domain name resolution results using a baseline detection algorithm and a differential detection algorithm to generate a set of abnormal domain names in this round of detection. If both algorithms determine that a domain name is abnormal, then the domain name is considered abnormal.

[0125] The hijacking detection iteration module 300 is used to perform hijacking detection iteration on the abnormal domain name set, perform multi-level abnormality screening through certificates and pages in turn, and regard domain names with abnormalities at multiple levels as hijacked domain names.

[0126] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0127] In order to implement the above embodiments, the present application also proposes an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method provided by the above embodiments.

[0128] In order to implement the above embodiments, the present application also proposes a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the methods provided by the above embodiments.

[0129] In order to implement the above embodiments, the present application also proposes a computer program product, including a computer program, which implements the methods provided by the above embodiments when executed by a processor.

[0130] The collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in this application are in compliance with relevant laws and regulations and do not violate public order and good morals.

[0131] It is important to note that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold beyond these legitimate uses. Furthermore, such collection / sharing should be conducted only after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes the relevant user information before using the feature. Furthermore, any necessary steps must be taken to safeguard and secure access to such personal information and ensure that others with access to personal information comply with its privacy policy and procedures.

[0132] This application contemplates providing implementations that allow users to selectively block the use or access of personal information data. Specifically, this disclosure contemplates providing hardware and / or software to prevent or block access to such personal information data. Risks can be minimized by limiting data collection and deleting data once it is no longer needed. Furthermore, where applicable, such personal information can be de-identified to protect user privacy.

[0133] In the descriptions of the foregoing embodiments, the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" mean that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are mutually inconsistent.

[0134] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of such features. Throughout the description of this application, "plurality" means at least two, for example, two, three, etc., unless otherwise specifically defined.

[0135] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may be performed out of the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present application belong.

[0136] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and a portable compact disc read-only memory (CDROM). Furthermore, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing it in another suitable manner if necessary, and then storing it in a computer memory.

[0137] It should be understood that various parts of the present application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0138] Those skilled in the art will understand that all or part of the steps in the method of the above embodiment can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiment.

[0139] In addition, the functional units in the various embodiments of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into a module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0140] The storage medium mentioned above may be a read-only memory, a magnetic disk, or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present application. Persons skilled in the art may make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present application.

[0141] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this application can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of this application can be achieved. This is not limited herein.

[0142] The above specific embodiments do not constitute a limitation on the scope of protection of this application. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application shall be included within the scope of protection of this application.

Claims

1. A method for detecting hijacking of directional domain name records for large-scale resolvers, characterized in that: include: Resolve each domain name in the monitoring list and obtain the multi-level data corresponding to the domain name in sequence according to the set priority. The multi-level data includes the resolved IP, certificate, and page. The domain name resolution results are tested using the baseline detection algorithm and the differential detection algorithm to generate a set of abnormal domain names in this round of detection. If both algorithms determine that the domain name is abnormal, the domain name is considered abnormal. Hijacking detection is iterated on the abnormal domain name set, and multi-level abnormality screening is performed through certificates and pages in turn, and domain names with abnormalities at multiple levels are regarded as hijacked domain names.

2. The method according to claim 1, characterized in that The obtaining of multi-level data corresponding to the domain name includes: Collect the A record and AAAA record corresponding to the domain name, indicating the resolved IP address corresponding to the domain name; Collect the certificate information deployed on the resolution IP pointed to by the domain name; Collect the HTML content corresponding to the resolved IP address pointed to by the domain name.

3. The method according to claim 2, characterized in that Also includes: Preprocessing the multi-level data, wherein the preprocessing steps include format integration and elimination of erroneous data; Based on the processed data, domain name and certificate data are stored in a relational database, while page data is stored in a non-relational database.

4. The method according to claim 3, characterized in that Before using the baseline detection algorithm and differential detection algorithm to test the domain name resolution results, the following steps are performed: Deploy the resolution service software on the probe, use the domain name query tool to specify the locally deployed resolution service software as the recursive server, query the A record of the monitored domain name list after confirming that there is no abnormal interference, and collect the record results TR after the query; A domain name query tool is used on the probe to query the monitoring resolver for the A record of the monitoring domain name list, and the record result TE after the query is collected.

5. The method according to claim 3, characterized in that The domain name resolution result is detected by using the baseline detection algorithm and the differential detection algorithm, including: Apply the baseline detection algorithm to compare TR and TE, and filter out abnormal domain names as set R1; A differential detection algorithm is applied to compare the A records of the same domain name returned by different resolvers in R1, and the list of abnormal domain name A records is filtered out as set R2.

6. The method according to claim 5, characterized in that The baseline detection algorithm is applied to compare TR and TE, and abnormal domain names are screened as set R1, including: A baseline is dynamically generated based on the domain name resolution data of the top 50% of TR frequencies and stored historical data. The size of the dynamic pane is limited based on the dynamic change pattern of historical data. Compare the resolution A record D1_TE in TE for the same domain name D1 with the A record D1_TR in TR; If the A record D1_TE in TE is the same as or a subset of the A record D1_TR in TR, it is determined to be normal; otherwise, it is determined to be abnormal.

7. The method according to claim 6, characterized in that The differential detection algorithm is applied to compare the A records of the same domain name returned by different resolvers in R1, and a list of abnormal domain name A records is filtered as set R2, including: The A records returned by each resolver in R1 for the same domain name D1 are considered independent samples; Count the singular values ​​of each A record and regard A records with a ratio below the threshold as abnormal.

8. The method according to claim 7, characterized in that The hijacking detection is iterated on the abnormal domain name set, and multi-level abnormality screening is performed in turn through certificates and pages, and domain names with abnormalities at multiple levels are regarded as hijacked domain names, including: Perform reverse domain name resolution on set R2, filter out potential CDN IP addresses based on the PTR records returned, and use the remaining IP addresses as set R3 for the next stage. Perform certificate screening on set R3 to check the validity of the security certificate associated with the domain name, the issuing authority, and whether the certificate has expired. If the certificate signature does not match or the certificate has expired, the domain name is judged to be an abnormal domain name, and set R4 is obtained; The page of set R4 is screened to determine whether there are malicious redirection links or unknown file downloads in the page. If so, the domain name is determined to be a hijacked domain name.

9. A directional domain name record hijacking detection device for large-scale resolvers, characterized in that: include: The data analysis and collection module is used to analyze each domain name in the monitoring list and obtain the multi-level data corresponding to the domain name in sequence according to the set priority. The multi-level data includes the analyzed IP, certificate, and page; The hijacking detection and judgment module is used to detect domain name resolution results using the baseline detection algorithm and the differential detection algorithm, and output a set of abnormal domain names in this round of detection. If both algorithms determine that the domain name is abnormal, the domain name is considered abnormal. The hijacking detection iteration module is used to perform hijacking detection iteration on the abnormal domain name set, perform multi-level abnormality screening through certificates and pages in turn, and regard domain names with abnormalities at multiple levels as hijacked domain names.

10. An electronic device, characterized in that: include: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 8.

Images