A method, device, equipment, medium and product for detecting domain name security

Abstract

The application relates to the technical field of communication security, and discloses a method, device, equipment, medium and product for detecting domain name security, which comprises the following steps: obtaining a domain name to be detected; splitting and recombining the domain name to be detected to obtain a domain name with tampering risk; and performing general domain name resolution detection on the domain name with tampering risk to obtain a security detection result of the domain name to be detected. The application solves the problem that the prior art cannot detect the security risk that the domain name is easy to be tampered with, can efficiently and accurately detect the security of the domain name, discovers potential tampering risks in advance when the domain name is not tampered with, and builds a corresponding preventive protection mechanism.

Description

Technical Field

[0001] This invention relates to the field of communication security technology, specifically to a method, apparatus, device, medium, and product for detecting domain name security. Background Technology

[0002] Domain name services provide a lookup and conversion service from Internet domain names to Internet IP (Internet Protocol) addresses. It is a basic service required for users to access various Internet applications and is regarded as the gateway to the entire Internet. Therefore, domain name security directly affects the security of the entire Internet and is an important aspect of cyberspace security governance.

[0003] Currently, the issue of domain name access security urgently needs to be addressed. While methods such as setting security levels through DNS (Domain Name System) and cloud platform crawlers can be used to detect tampered website domains, they cannot detect website domains that have not been tampered with but have potential security risks. Summary of the Invention

[0004] In view of this, the present invention provides a method, apparatus, device, medium and product for detecting domain name security, so as to solve the problem of being unable to detect domain names with security risks that are easily tampered with.

[0005] In a first aspect, the present invention provides a method for detecting domain name security, the method comprising:

[0006] Obtain the domain name to be tested;

[0007] The domain name to be tested is split and recombined to obtain domain names with the risk of tampering;

[0008] Wildcard DNS resolution is performed on domains at risk of tampering to obtain security test results for the domains under test.

[0009] The method for detecting domain name security provided in this embodiment uses the domain name itself to be detected to split and reassemble to infer all domain names with tampering risks. By detecting whether the domain names with tampering risks use wildcard domain name resolution technology, the potential security of the domain name to be detected is judged. This solves the problem that the existing technology cannot detect the security risks of domain names that are easily tampered with. It can efficiently and accurately detect domain name security, discover potential tampering risks in advance when the domain name has not been tampered with, and build a corresponding preventive protection mechanism.

[0010] In one optional implementation, obtaining the domain name to be detected includes:

[0011] Obtain multiple domain names and determine the domain name length based on specific identifiers of the multiple domain names;

[0012] The domain name level is determined based on the domain name length, and multiple domain names are filtered based on the domain name level to obtain the domain name to be tested.

[0013] The method for detecting domain name security provided in this embodiment determines the domain name level by domain name length, and then filters the domain names to be detected based on the domain name level. This increases the probability of finding all domain names with security risks, more comprehensively detects domain names with tampering risks, saves judgment time and process, and improves judgment efficiency.

[0014] In one optional implementation, the domain name to be detected includes a first domain name string and a top-level domain; the domain name to be detected is split and recombined to obtain a domain name with tampering risk, including:

[0015] The first domain name string is split according to the preset splitting rules to obtain the second domain name string;

[0016] The second domain name string is accumulated and superimposed to obtain the third domain name string;

[0017] By overlaying the third-party domain name string with the top-level domain name, a domain name with the risk of tampering can be obtained.

[0018] The method for detecting domain name security provided in this embodiment decomposes the domain name to be detected according to its components and then reassembles it into all possible domain names to be detected that may be tampered with, so that domain names with tampering risk do not overlap, thus better solving the problem of not being able to detect domain names with security risks that are easily tampered with.

[0019] In one optional implementation, the second domain name string is accumulated and superimposed to obtain the third domain name string, including:

[0020] The priority of the second domain name string is determined based on the distance between the second domain name string and the top-level domain;

[0021] Based on the priority of the second domain name string, the second domain name strings are accumulated and superimposed to obtain the third domain name string.

[0022] The method for detecting domain name security provided in this embodiment accumulates and superimposes the second domain name string based on its priority to obtain the third domain name string, thereby achieving accurate reorganization of the domain name to be detected and improving the efficiency of wildcard domain name resolution detection.

[0023] In one optional implementation, wildcard domain name resolution detection is performed on domain names at risk of tampering to obtain security detection results for the domain names to be detected, including:

[0024] Add a preset string before a domain name that is at risk of being tampered with to obtain a combined domain name;

[0025] Connectivity checks are performed on combined domain names. Based on the connectivity check results, it is determined whether domain names at risk of tampering use wildcard DNS resolution. Based on the determination results, the security check results of the domain names to be checked are determined.

[0026] The method for detecting domain name security provided in this embodiment simulates a security risk by adding a preset string before the domain name that is at risk of tampering, thereby detecting the security of the website domain name more accurately and improving the efficiency of connectivity detection.

[0027] In one optional implementation, connectivity testing is performed on the combined domain name. Based on the connectivity testing results, it is determined whether a domain name with tampering risk uses wildcard DNS resolution. Based on the determination results, the security testing result of the domain name to be tested is determined, including:

[0028] Obtain the connectivity test command, execute the connectivity test command on the combined domain names in sequence, and obtain the returned HTTP status code;

[0029] If the HTTP status code is the default value, the combined domain name will use wildcard DNS resolution, and the security test result for the domain name to be tested will be that the domain name to be tested has security risks.

[0030] The method for detecting domain name security provided in this embodiment achieves security detection of the domain name to be detected by comparing the returned HTTP status code with a preset value, thus avoiding losses caused by the tampering of the domain name to be detected.

[0031] Secondly, the present invention provides an apparatus for detecting domain name security, the apparatus comprising:

[0032] The acquisition module is used to acquire the domain name to be tested;

[0033] The splitting and recombining module is used to split and recombine the domain name to be detected to obtain domain names with tampering risks;

[0034] The detection module is used to perform wildcard domain name resolution detection on domains with tampering risks and obtain the security detection results of the domains to be detected.

[0035] Thirdly, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the method for detecting domain name security described in the first aspect or any corresponding embodiment thereof.

[0036] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to perform the method for detecting domain name security described in the first aspect or any corresponding embodiment thereof.

[0037] Fifthly, the present invention provides a computer program product, including computer instructions for causing a computer to execute the method for detecting domain name security described in the first aspect or any corresponding embodiment thereof. Attached Figure Description

[0038] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0039] Figure 1 This is a flowchart illustrating a method for detecting domain name security according to an embodiment of the present invention;

[0040] Figure 2 This is a flowchart illustrating another method for detecting domain name security according to an embodiment of the present invention;

[0041] Figure 3 This is a flowchart illustrating another method for detecting domain name security according to an embodiment of the present invention;

[0042] Figure 4 This is a flowchart illustrating another method for detecting domain name security according to an embodiment of the present invention;

[0043] Figure 5 This is a schematic diagram of the domain name splitting process according to an embodiment of the present invention;

[0044] Figure 6 This is a schematic flowchart of connectivity detection according to an embodiment of the present invention;

[0045] Figure 7 This is a structural block diagram of a device for detecting domain name security according to an embodiment of the present invention;

[0046] Figure 8 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0048] This invention provides a method for detecting domain name security. It should be noted that the execution subject of this method can be a device for detecting domain name security. This device can be implemented as part or all of an electronic device through software, hardware, or a combination of both. The electronic device can be a server or a terminal. In this embodiment, the server can be a single server or a server cluster composed of multiple servers. The terminal in this embodiment can be a smartphone, personal computer, tablet computer, wearable device, or other intelligent hardware device such as a smart robot. The following method embodiments all use an electronic device as the execution subject for illustration.

[0049] According to an embodiment of the present invention, a method embodiment for detecting domain name security is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0050] This embodiment provides a method for detecting domain name security, which can be used in the aforementioned electronic devices. Figure 1 This is a flowchart of a method for detecting domain name security according to an embodiment of the present invention, such as... Figure 1 As shown, the process includes the following steps:

[0051] Step S101: Obtain the domain name to be tested.

[0052] Specifically, a domain name is a memorable string of characters used on the Internet to identify and locate a computer, server, or website. It serves as an alternative to an IP address, identifies network resources, and provides technical support.

[0053] Step S102: The domain name to be detected is split and recombined to obtain the domain name with the risk of tampering.

[0054] Step S103: Perform wildcard domain name resolution detection on domain names with tampering risk to obtain the security detection results of the domain names to be detected.

[0055] Specifically, wildcard DNS resolution refers to using a wildcard character (such as "*") to match subdomains and resolve them to the same IP address or server. Attackers exploit this feature to tamper with DNS records and redirect traffic to malicious servers. By using wildcard DNS, attackers can create a large number of malicious subdomains to distribute malware, phishing attacks, or SEO (Search Engine Optimization) spam, thereby affecting the main website's ranking and user experience. For example, if the A record of *.example.com is configured to point to the IP address 192.0.2.1, then subdomains such as a.example.com, b.example.com, and xyz.example.com will all be resolved to the IP address 192.0.2.1.

[0056] Furthermore, the domain name to be tested is split and then reassembled to form a new domain name to be tested. The generated new domain name to be tested is a domain name that may be tampered with. Whether the domain name with the risk of tampering uses wildcard DNS resolution technology is investigated. Because the domain name uses wildcard DNS resolution technology to solve the problem of external link vulnerabilities, wildcard DNS resolution technology refers to the user's preset domain name like *.ipv6.abc.com on the DNS. The content of * is arbitrarily variable. Therefore, when website visitors access external link addresses, the * in *.ipv6.abc.com can be arbitrarily replaced with different external link address host domain names, which poses a great security risk and the website link address is easy to be tampered with.

[0057] Furthermore, there are multiple ways to split and reassemble the domain name to be detected. As long as the reassembled domain name does not overlap with the existing domain name, it is possible to detect which newly reassembled domain names to be detected (i.e., domain names with tampering risk) may have used wildcard DNS technology, thereby discovering some domain names with security risks that are easily tampered with. Since these new domain names to be detected are obtained by splitting and reassembling the domain name to be detected, the new domain names to be detected are associated with the original domain name to be detected. This method can be used to obtain domain names with security risks with a relatively accurate directional range.

[0058] Furthermore, the results of wildcard domain name resolution detection are determined by whether the domain name at risk of tampering is connected.

[0059] The method for detecting domain name security provided in this embodiment uses the domain name itself to be detected to split and reassemble to infer all domain names with tampering risks. By detecting whether the domain names with tampering risks use wildcard domain name resolution technology, the potential security of the domain name to be detected is judged. This solves the problem that the existing technology cannot detect the security risks of domain names that are easily tampered with. It can efficiently and accurately detect domain name security, discover potential tampering risks in advance when the domain name has not been tampered with, and build a corresponding preventive protection mechanism.

[0060] This embodiment provides a method for detecting domain name security, which can be used in the aforementioned electronic devices. Figure 2 This is a flowchart of a method for detecting domain name security according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps:

[0061] Step S201: Obtain the domain name to be tested.

[0062] Specifically, step S201 includes:

[0063] Step S2011: Obtain multiple domain names and determine the domain name length based on the specific identifiers of the multiple domain names.

[0064] Specifically, there can be many types of domain names. In order to make the wildcard domain name resolution detection results more accurate, it is necessary to select the longest domain name from the domain names of the website to be tested as the domain name to be tested.

[0065] Furthermore, the specific identifier can be ".". The domain length is determined based on the specific identifier in the domain name. The domain length refers to the total number of characters in the domain name, including letters, numbers, and hyphens ("-"), but excluding the separator (".") between the top-level domain (TLD) and subdomains.

[0066] Furthermore, the determination of domain name length is mainly based on the number of characters in the domain name, including the total length of the main domain name and the top-level domain (TLD); among them, the total length of a single domain name cannot exceed 253 characters, and the length of each tag (i.e. the part separated by dots) cannot exceed 63 characters.

[0067] Step S2012: Determine the domain name level based on the domain name length, and filter multiple domain names based on the domain name level to obtain the domain name to be tested.

[0068] Specifically, domain names are ranked according to their length. The shorter the domain name, the higher the level. Domain names that are extremely concise, easy to remember and input, and have high brand value and scarcity are selected as the domain names to be tested.

[0069] Step S202 involves splitting and recombining the domain name to be detected to obtain domain names with a risk of tampering. For details, please refer to [link to relevant documentation]. Figure 1 Step S102 of the illustrated embodiment will not be described again here.

[0070] Step S203 involves performing wildcard DNS resolution checks on domains at risk of tampering to obtain the security test results for the domains under test. For details, please refer to [link to relevant documentation]. Figure 1 Step S103 of the illustrated embodiment will not be described again here.

[0071] The method for detecting domain name security provided in this embodiment determines the domain name level by domain name length, and then filters the domain names to be detected based on the domain name level. This increases the probability of finding all domain names with security risks, more comprehensively detects domain names with tampering risks, saves judgment time and process, and improves judgment efficiency.

[0072] This embodiment provides a method for detecting domain name security, which can be used in the aforementioned electronic devices. Figure 3 This is a flowchart of a method for detecting domain name security according to an embodiment of the present invention, such as... Figure 3 As shown, the process includes the following steps:

[0073] Step S301: Obtain the domain name to be tested. For details, please refer to [link to relevant documentation]. Figure 2 Step S201 of the illustrated embodiment will not be described again here.

[0074] Step S302: The domain name to be detected is split and recombined to obtain the domain name with the risk of tampering.

[0075] In order to better detect the domain name to be detected and to find the domain name with tampering risk after splitting and recombining the domain name to be detected, it is necessary to determine the appropriate position for splitting. One of the main positions for splitting is determined by the top-level domain. The first domain name string is obtained by removing the top-level domain from the domain name to be detected. The top-level domain is not only the last section of the separator, but can also be a combination of different types of top-level domains. For example, gov and cn are different types of top-level domains and can be combined. It can be gov.cn, or it can be the top-level domain of a website: star.gov.cn.

[0076] Specifically, the domain name to be detected includes a first domain name string and a top-level domain; step S302 above includes:

[0077] Step S3021: Split the first domain name string according to the preset splitting rules to obtain the second domain name string.

[0078] Specifically, splitting the domain name to be detected refers to breaking down a complete domain name into its components to facilitate analysis, processing, or storage. Domain name splitting is commonly used in domain name resolution, log analysis, and network security. In order to make it easier to find all domain names that may have security risks by splitting the domain name to be detected, it is necessary to split the domain name to be detected according to certain preset splitting rules. These preset rules can take many forms. Therefore, the first domain name string is split into the second domain name string according to the preset rules.

[0079] Furthermore, the domain name is split using a separator-based splitting method. From right to left, the domain names are: top-level domains, such as com, org, and cn; second-level domains, such as example (in example.com); and subdomains, such as www, mail, and blog (in www.example.com).

[0080] Furthermore, domain name splitting can also be based on function, such as blog.example.com for blog services and shop.example.com for e-commerce services; based on geolocation, such as us.example.com and cn.example.com; and based on content, such as news.example.com for news content and video.example.com for video content.

[0081] Furthermore, the first domain name string is split from the end of the domain name to be detected that is furthest from the top-level domain according to a preset delimiter to obtain the second domain name string. The second domain name string (i.e., the subdomain) is the first domain name string separated by the preset delimiter, wherein the preset delimiter can be ".", or other fixed letters or other symbols (such as hyphens, underscores, and numbers).

[0082] Step S3022: Accumulate and stack the second domain name strings to obtain the third domain name string.

[0083] Specifically, domain name reconstruction refers to recombining split domain name parts into a complete domain name, or generating a new domain name according to specific rules. This is used in scenarios such as dynamic domain name generation, multi-tenant systems, and URL (Uniform Resource Locator) rewriting. Methods of domain name reconstruction include: direct concatenation, connecting the split domain name parts with "." to generate a complete domain name; dynamic subdomain generation, dynamically generating subdomains based on user input or system rules; partial domain name replacement, replacing certain parts of a domain name to generate a new domain name; and adding prefixes or suffixes, adding specific strings before or after a domain name to generate a new domain name.

[0084] In some optional implementations, step S3022 above includes:

[0085] Step a1: Determine the priority of the second domain name string based on the distance between the second domain name string and the top-level domain.

[0086] Specifically, the second domain name string is sorted according to its distance from the top-level domain, and the second domain name string closest to the top-level domain is given high priority.

[0087] Step a2: Based on the priority of the second domain name string, the second domain name strings are accumulated and superimposed to obtain the third domain name string.

[0088] Specifically, the second domain name strings are accumulated and superimposed in order of priority from high to low to obtain the third domain name string; wherein the third domain name string contains at least one second domain name string, and there are multiple third domain name strings.

[0089] Step S3023: Overlay the third domain name string with the top-level domain name to obtain a domain name with tampering risk.

[0090] Specifically, all domain names at risk of tampering are formed by stacking the third-party domain name strings in the order they appear before the top-level domain name.

[0091] Step S303: Perform wildcard DNS resolution detection on domains with tampering risks to obtain the security detection results for the domains to be tested. For details, please refer to [link to relevant documentation]. Figure 2 Step S203 of the illustrated embodiment will not be described again here.

[0092] The method for detecting domain name security provided in this embodiment decomposes the domain name to be detected according to its components and then reassembles it into all possible domain names to be detected that may be tampered with, so that domain names with tampering risk do not overlap, thus better solving the problem of not being able to detect domain names with security risks that are easily tampered with.

[0093] This embodiment provides a method for detecting domain name security, which can be used in the aforementioned electronic devices. Figure 4 This is a flowchart of a method for detecting domain name security according to an embodiment of the present invention, such as... Figure 4 As shown, the process includes the following steps:

[0094] Step S401: Obtain the domain name to be tested. For details, please refer to [link to relevant documentation]. Figure 3 Step S301 of the illustrated embodiment will not be described again here.

[0095] Step S402 involves splitting and recombining the domain name to be detected to obtain domain names with a risk of tampering. For details, please refer to [link to relevant documentation]. Figure 3 Step S302 of the illustrated embodiment will not be described again here.

[0096] Step S403: Perform wildcard domain name resolution detection on the domain name with tampering risk to obtain the security detection result of the domain name to be detected.

[0097] Specifically, step S403 includes:

[0098] Step S4031: Add a preset string before the domain name that is at risk of being tampered with to obtain the combined domain name.

[0099] Specifically, a preset string is added before all domains that are at risk of being tampered with to obtain a combined domain name. The combined domain name is different from all the domains that may be tampered with and are to be detected. The preset string has a length limit and can be a random string, a fixed string, or a combination of a random string and a fixed string.

[0100] Step S4032: Perform connectivity testing on the combined domain name, determine whether the domain name with tampering risk uses wildcard domain name resolution based on the connectivity testing result, and determine the security testing result of the domain name to be tested based on the judgment result.

[0101] Specifically, the wildcard domain name resolution test results are determined by whether the combined domain names are connected.

[0102] In some optional implementations, step S4032 above includes:

[0103] Step b1: Obtain the connectivity test command. Execute the connectivity test command sequentially on the combined domain names and obtain the returned HTTP status code.

[0104] Specifically, the connectivity of the combined domain name can be determined based on the HTTP status code. If the combined domain name is connected, the detection result of the potentially tampered domain name corresponding to the combined domain name is insecure.

[0105] For example, an HTTP status code of 2xx indicates that the operation was successful; an HTTP status code of 3xx indicates that the client needs to do some extra work (redirection) to get the required resources; an HTTP status code of 4xx indicates that the client encountered an error; and an HTTP status code of 5xx indicates that the server encountered an error.

[0106] In step b2, if the HTTP status code is the preset value, the combined domain name uses wildcard DNS resolution, and the security test result of the domain name to be tested is that the domain name to be tested has security risks.

[0107] The method for detecting domain name security provided in this embodiment simulates a security risk by adding a preset string before the domain name that is at risk of tampering, thereby detecting the security of the website domain name more accurately and improving the efficiency of connectivity detection. Based on the connectivity detection results, it determines whether the domain name at risk of tampering uses wildcard DNS resolution, thus realizing the detection of tampering risk and avoiding the loss caused by the tampering of the domain name to be detected.

[0108] The following specific embodiment illustrates the detailed steps of a method for detecting domain name security.

[0109] Example 1:

[0110] The specific steps for detecting domain name security include:

[0111] 1) Obtain the webpage's link address from the webpage to be tested. The link address with the highest subdomain level can be selected from all links as the domain to be tested, effectively saving time and effort. The domain level can also be determined by counting the number of second domain strings (subdomains) in the first domain string (excluding the website's top-level domain). The second domain string (subdomain) can be obtained by splitting the first domain string using a dot ".". The longer the second domain string after splitting, the higher the domain level. Sort the domain levels and select the highest-level domain as the domain to be tested. For example, http: / / foo.bar.ace.star.gov.cn / abc.html can be used as the domain to be tested, where the top-level domain is star.gov.cn.

[0112] 2) such as Figure 5As shown, the first half of the content excluding the top-level domain is extracted from the domain to be tested as the first domain string: foo.bar.ace. The top-level domain can be gov.cn or the website's top-level domain star.gov.cn.

[0113] 3) Use the "." separator to separate the first domain name string, resulting in multiple second domain name strings, namely foo, bar, and ace. By separating the first domain name string, the domain name level can be obtained, and a second domain name string corresponding to each level can be set. Then, multiple second domain name strings can be combined according to the level, and it can also be determined from which level (second domain name string) the wildcard domain name starts from.

[0114] 4) The position of the subdomain (second domain name string) after splitting is determined by its distance from the top-level domain, with the closest one having the highest priority. For example, ace is closest to the top-level domain, so ace is split first. The second domain name string with the second highest priority is bar, and the second domain name string with the lowest priority is foo. Then, the second domain name strings are accumulated and combined in order of decreasing priority towards the direction away from the top-level domain to form the third domain name string. The resulting third domain name strings are: ace, barace, and foobarace. Among them, ace is the second domain name string that is detected first, except for the top-level domain, so the direction of accumulation and superposition is the reverse of the splitting direction of the second domain name string after splitting by the delimiter, thus achieving the purpose of priority detection.

[0115] 5) By adding preset strings, duplicate detection of the domain to be detected can be avoided with domains at risk of tampering or other unknown domains. These preset strings can be random strings, which will be combined with the third-party domain string to form all domains at risk of tampering. For example, a 6-character random string (assuming the generated random string is "slixge") is generated; subdomains are then combined with the top-level domain in the domain hierarchy order to form new combined domains (domains at risk of tampering). For example, replacing all subdomains level by level (in reverse order) with random strings yields the following domains at risk of tampering: http: / / slixge.ace.star.gov.cn, http: / / slixge.bar.ace.star.gov.cn, and http: / / slixge.foo.bar.ace.star.gov.cn. Note that these domains at risk of tampering are not domains registered by the website; the website will not register domains containing these random strings.

[0116] The specific combination formats for combined domain names include: 1) random string.top-level domain; 2) random string.second-level domain string (highest level).top-level domain; 3) random string.second-level domain string (second level).second-level domain string (highest level).top-level domain; 4) random string.second-level domain string (third level).second-level domain string (second level).second-level domain string (highest level).top-level domain, and so on. Domains at risk of tampering are placed in a queue for detection.

[0117] 6) such as Figure 6 As shown, Linux (an embedded system) commands are used to sequentially execute connectivity testing commands ping (a command used to test network connectivity) or curl (a command used to simulate browser requests) on domains in the queue that are at risk of tampering. The connectivity of each combined domain is determined based on the HTTP status code. If the returned HTTP status code is 200, the domain at risk of tampering is considered to have used wildcard DNS, and the corresponding test result is deemed insecure. If the returned HTTP status code is not 200, wildcard DNS resolution is then performed on the next domain at risk of tampering.

[0118] 7) Perform domain security checks on other links in the webpage to be checked, following steps 1) to 6) above;

[0119] 8) If no domain links with security risks are found after the check, then it is necessary to check them one by one in order from the longest subdomain to the shortest subdomain (removing duplicate subdomains) until the check is completed or the domain with tamper risk is found to be using wildcard DNS technology.

[0120] 9) If a user is unaware of whether the website they are testing uses wildcard DNS, or is unable to detect whether the website's domain name uses wildcard DNS, the software can assist the user in checking whether the domain name or the pages under that domain name uses wildcard DNS. If the website uses wildcard DNS, then the website may be at risk of having its links tampered with.

[0121] This embodiment also provides a device for detecting domain name security, which is used to implement the above embodiments and preferred embodiments, and will not be repeated as already described. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0122] This embodiment provides a device for detecting domain name security, such as... Figure 7 As shown, it includes:

[0123] The acquisition module 701 is used to acquire the domain name to be tested.

[0124] The splitting and recombining module 702 is used to split and recombine the domain name to be detected to obtain a domain name with the risk of tampering.

[0125] The detection module 703 is used to perform wildcard domain name resolution detection on domains with tampering risks and obtain the security detection results of the domains to be detected.

[0126] In some alternative implementations, the acquisition module 701 includes:

[0127] The determination unit is used to obtain multiple domain names and determine the domain name length based on specific identifiers of the multiple domain names.

[0128] The filtering unit is used to determine the domain name level based on the domain name length, and to filter multiple domain names based on the domain name level to obtain the domain name to be tested.

[0129] In some alternative implementations, the split-recombination module 702 includes:

[0130] The splitting unit is used to split the first domain name string according to the preset splitting rules to obtain the second domain name string.

[0131] The first overlay unit is used to accumulate and overlay the second domain name string to obtain the third domain name string.

[0132] The second overlay unit is used to overlay the third domain name string with the top-level domain name to obtain a domain name that is at risk of being tampered with.

[0133] In some alternative implementations, the first stacking unit includes:

[0134] The sub-unit is determined to prioritize the second domain name string based on the distance between the second domain name string and the top-level domain.

[0135] The superposition subunit is used to accumulate and superimpose the second domain name string based on the priority of the second domain name string to obtain the third domain name string.

[0136] In some alternative implementations, the split-recombination module 703 includes:

[0137] Add a unit to add a preset string before a domain name that is at risk of being tampered with, resulting in a combined domain name.

[0138] The connectivity detection unit is used to perform connectivity detection on combined domain names. Based on the connectivity detection results, it determines whether domain names with tampering risks use wildcard domain name resolution, and determines the security detection result of the domain name to be detected based on the judgment result.

[0139] In some alternative implementations, the connectivity detection unit includes:

[0140] The execution subunit is used to obtain connectivity test commands, execute connectivity test commands sequentially on the combined domain names, and obtain the returned HTTP status codes.

[0141] The resolution sub-unit is used to resolve the combined domain name using wildcard domain name resolution if the HTTP status code is a preset value, and the security detection result of the domain name to be tested is that the domain name to be tested has security risks.

[0142] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0143] In this embodiment, the device for detecting domain name security is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit), a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0144] This invention also provides a computer device having the above-described features. Figure 7 The device shown is for detecting domain name security.

[0145] Please see Figure 8 , Figure 8 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 8 As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 8 Take a processor 10 as an example.

[0146] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0147] The memory 20 stores instructions executable by at least one processor 10 to cause at least one processor 10 to perform the method shown in the above embodiments.

[0148] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0149] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0150] The computer device also includes an input device 30 and an output device 40. The processor 10, memory 20, input device 30, and output device 40 can be connected via a bus or other means. Figure 8 Taking the example of a connection between China and Israel via a bus.

[0151] Input device 30 can receive input numerical or character information, and generate key signal inputs related to user settings and function control of the computer device, such as a touchscreen, keypad, mouse, trackpad, touchpad, joystick, one or more mouse buttons, trackball, joystick, etc. Output device 40 may include display devices, auxiliary lighting devices (e.g., LEDs), and haptic feedback devices (e.g., vibration motors). The aforementioned display devices include, but are not limited to, liquid crystal displays, light-emitting diodes, displays, and plasma displays. In some alternative embodiments, the display device may be a touchscreen.

[0152] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0153] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0154] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method of detecting domain name security, characterized by, The method includes: Obtain the domain name to be tested; The domain name to be detected is split and recombined to obtain domain names with the risk of tampering; The domain name with tampering risk is subjected to wildcard domain name resolution detection to obtain the security detection result of the domain name to be detected; The domain name to be detected includes a first domain name string and a top-level domain; the step of splitting and recombining the domain name to be detected to obtain a domain name with tampering risk includes: The first domain name string is split according to the preset splitting rules to obtain the second domain name string; The second domain name string is accumulated and superimposed to obtain the third domain name string; The third domain name string is superimposed on the top-level domain name to obtain the domain name with tampering risk; The step of accumulating and superimposing the second domain name string to obtain the third domain name string includes: The priority of the second domain name string is determined based on the distance between the second domain name string and the top-level domain name; Based on the priority of the second domain name string, the second domain name strings are accumulated and superimposed to obtain the third domain name string; The process of performing wildcard domain name resolution detection on the domain name with tampering risk to obtain the security detection result of the domain name to be detected includes: A preset string is added before the domain name that is at risk of being tampered with to obtain a combined domain name; Connectivity testing is performed on the combined domain name. Based on the connectivity testing results, it is determined whether the domain name with tampering risk uses wildcard domain name resolution. Based on the determination results, the security testing result of the domain name to be tested is determined. The step of performing connectivity testing on the combined domain names, determining whether the domain name at risk of tampering uses wildcard DNS resolution based on the connectivity testing results, and determining the security testing result of the domain name to be tested based on the determination results includes: Obtain the connectivity test command, execute the connectivity test command on the combined domain names in sequence, and obtain the returned HTTP status code; If the HTTP status code is a preset value, then the combined domain name uses wildcard domain name resolution, and the security detection result of the domain name to be tested is that the domain name to be tested has security risks.

2. The method of claim 1, wherein, The process of obtaining the domain name to be detected includes: Obtain multiple domain names and determine the domain name length based on specific identifiers of the multiple domain names; The domain name level is determined based on the domain name length, and multiple domain names are filtered based on the domain name level to obtain the domain name to be tested.

3. An apparatus for detecting domain name security, the apparatus comprising: The device includes: The acquisition module is used to acquire the domain name to be tested; The splitting and recombining module is used to split and recombine the domain name to be detected to obtain a domain name with the risk of tampering; the domain name to be detected includes a first domain name string and a top-level domain name; The detection module is used to perform wildcard domain name resolution detection on the domain name with tampering risk, and obtain the security detection result of the domain name to be detected; The splitting and recombination module includes: The splitting unit is used to split the first domain name string according to a preset splitting rule to obtain the second domain name string; The first overlay unit is used to accumulate and overlay the second domain name string to obtain the third domain name string; The second overlay unit is used to overlay the third domain name string with the top-level domain name to obtain the domain name with tampering risk; The first overlay unit includes: A sub-unit is defined for determining the priority of the second domain name string based on the distance between the second domain name string and the top-level domain name; The superposition subunit is used to accumulate and superimpose the second domain name string based on the priority of the second domain name string to obtain the third domain name string; The splitting and reorganizing module includes: Add a unit to add a preset string before a domain name that is at risk of being tampered with, so as to obtain a combined domain name; The connectivity detection unit is used to perform connectivity detection on the combined domain name, determine whether the domain name with tampering risk uses wildcard domain name resolution based on the connectivity detection result, and determine the security detection result of the domain name to be detected based on the judgment result; The connectivity detection unit includes: The execution subunit is used to obtain connectivity test commands, execute connectivity test commands on the combined domain names in sequence, and obtain the returned HTTP status codes; The resolution sub-unit is used to resolve the combined domain name using wildcard domain name resolution if the HTTP status code is a preset value, and the security detection result of the domain name to be tested is that the domain name to be tested has security risks.

4. A computer device, comprising: include: A memory and a processor are communicatively connected, the memory storing computer instructions, and the processor executing the computer instructions to perform the method for detecting domain name security as described in claim 1 or 2.

5. A computer readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing a computer to perform the method for detecting domain name security as described in claim 1 or 2.

6. A computer program product, characterised in that, Includes computer instructions for causing a computer to perform the method for detecting domain name security as described in claim 1 or 2.

Images