Domain name hijacking detection method and device, electronic equipment and storage medium

Abstract

The invention provides a domain name hijacking detection method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining target passive domain name system data, the target passive domain name system data comprising domain name resolution records of a plurality of domain names in a historical preset time period; on the basis of the target passive domain name system data, according to the incidence relation between the domain name and the IP address, performing dependency graph construction to obtain a dependency graph structure; the types of at least part of nodes in the dependency graph structure are different; performing index feature extraction on each node in the dependency graph structure to obtain an index feature extraction result for each node of the dependency graph structure; and inputting the dependency graph structure and the index feature extraction result into a pre-trained domain name hijacking detection model for domain name hijacking detection to obtain a domain name hijacking detection result. In this way, domain name hijacking detection can be achieved, and the accuracy of domain name hijacking detection can be improved.

Description

Technical Field

[0001] This application relates to the field of Internet security technology, and in particular to a method, apparatus, electronic device and storage medium for detecting domain name hijacking. Background Technology

[0002] The Domain Name System (DNS) is one of the key infrastructures of the Internet, responsible for mapping user-friendly domain names to IP (Internet Protocol) addresses that computers can process. DNS not only supports the stable operation of numerous upper-layer Internet applications such as web browsing and email, but also provides a trust foundation for network security services such as digital certificate issuance, playing a crucial role in the Internet.

[0003] During internet communication, various internet attacks are frequently encountered, including domain hijacking, also known as DNS hijacking. Domain hijacking involves attacking DNS servers or forging DNS to resolve the target website's domain name to an incorrect address, thereby preventing the target website from being accessed.

[0004] Domain hijacking negatively impacts users' online experience, redirecting them to fake websites and preventing them from accessing their target pages. Furthermore, it can trick users into logging into counterfeit sites, leading to the leakage of their private data. The negative consequences of domain hijacking are particularly severe for websites with large user bases. Summary of the Invention

[0005] In view of this, this application provides a domain name hijacking detection method, device, electronic device and storage medium, which can not only detect domain name hijacking, but also improve the accuracy of domain name hijacking detection, thereby helping to improve network communication security.

[0006] According to a first aspect of this application, a method for detecting domain name hijacking is provided, comprising:

[0007] Obtain target passive domain name system data, wherein the target passive domain name system data includes domain name resolution records of at least one domain name within a preset historical time period;

[0008] Based on the target passive domain name system data, a dependency graph is constructed according to the association between domain names and network protocol IP addresses to obtain a dependency graph structure; wherein, at least some nodes in the dependency graph structure are of different types;

[0009] For each node in the dependency graph structure, feature extraction is performed to obtain feature extraction results for each node in the dependency graph structure.

[0010] The dependency graph structure and the extracted index features are input into a pre-trained domain hijacking detection model to perform domain hijacking detection and obtain the domain hijacking detection results.

[0011] In one optional implementation, the step of constructing a dependency graph based on the target passive domain name system data and the association between domain names and network protocol IP addresses to obtain a dependency graph structure includes:

[0012] For each domain name, expand vertically according to the association between the domain name and the IP address to determine multiple nodes and the edges between adjacent nodes;

[0013] For each node, the association between different types of nodes is increased by horizontally expanding the domain name resolution record corresponding to the node, thus obtaining the dependency graph structure.

[0014] In one optional implementation, the horizontal expansion based on the type of the domain name resolution record corresponding to the node to increase the association of different types of nodes includes at least one of the following:

[0015] For fully qualified domain name nodes, add associations with top-level domain name nodes and authoritative server nodes respectively;

[0016] For top-level domain nodes, add associations with fully qualified domain nodes and authoritative server nodes under the top-level domain, respectively;

[0017] For IP address nodes, add association with the subnet nodes of the 24 network segment to which they belong;

[0018] For subnet nodes in the 24 network segment, add association with the Autonomous System (AS) node to which they belong.

[0019] In one optional implementation, different node types correspond to different indicator feature dimensions; the step of extracting indicator features from each node in the dependency graph structure includes:

[0020] For each node in the dependency graph structure, features are extracted from the node according to the node type and the indicator feature dimension corresponding to the node type.

[0021] In one optional implementation, the indicator feature dimensions include at least one of: domain name resolution behavior features, graph topology features, and infrastructure features;

[0022] The step of extracting features from the node according to its type and the corresponding indicator feature dimension includes:

[0023] For domain name nodes, indicator features are extracted according to three indicator feature dimensions: domain name resolution behavior characteristics, graph topology structure characteristics, and infrastructure characteristics.

[0024] For IP address nodes, authoritative server nodes, or 24 network segment subnet nodes, indicator features are extracted according to two indicator feature dimensions: domain name resolution behavior characteristics and graph topology structure characteristics.

[0025] For AS nodes, features are extracted based on one dimension of graph topology features.

[0026] In one optional implementation, obtaining the target passive domain name system data includes:

[0027] Obtain the original passive domain name system data and preprocess the original passive domain name system data to obtain preprocessed domain name system data;

[0028] The preprocessed Domain Name System (DNS) data is timestamped to obtain the target passive DNS data.

[0029] In one optional implementation, the type of the domain name resolution record includes at least one of the following: A record, NS record, and CNAME record.

[0030] According to a second aspect of this application, a domain name hijacking detection device is provided, the device comprising:

[0031] The data acquisition module is used to acquire target passive domain name system data, which includes domain name resolution records of at least one domain name within a preset historical time period;

[0032] The dependency graph construction module is used to construct a dependency graph based on the target passive domain name system data, according to the association between domain names and network protocol IP addresses, to obtain a dependency graph structure; wherein, at least some nodes in the dependency graph structure are of different types;

[0033] The indicator feature extraction module is used to extract indicator features for each node in the dependency graph structure, and obtain the indicator feature extraction results for each node of the dependency graph structure.

[0034] The domain hijacking detection module is used to input the dependency graph structure and the index feature extraction results into a pre-trained domain hijacking detection model to perform domain hijacking detection and obtain the domain hijacking detection results.

[0035] According to a third aspect of this application, an electronic device is provided, comprising: a processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the memory via the bus, and when the machine-readable instructions are executed by the processor, the domain name hijacking detection method described in the first aspect is performed.

[0036] According to a fourth aspect of this application, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, performs the domain name hijacking detection method described in the first aspect.

[0037] The domain hijacking detection method, apparatus, electronic device, and storage medium provided in this application first acquire target passive domain name system (DNS) data. Then, based on the target passive DNS data, a dependency graph structure with domain names and IP addresses as core nodes is constructed. Next, indicator features are extracted from each node in the dependency graph structure to obtain the indicator feature extraction results. Finally, the dependency graph structure and the indicator feature extraction results are input into a pre-trained domain hijacking detection model for domain hijacking detection to obtain the domain hijacking detection results. In this way, not only can domain hijacking detection be achieved, but the dependency graph structure can also effectively capture the behavior patterns of attackers reusing infrastructure (such as IP and NS servers) or collaboratively hijacking multiple domain names, thereby improving the accuracy of domain hijacking detection and enhancing network communication security.

[0038] To make the above-mentioned objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0039] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings used in the embodiments will be briefly described below. These drawings are incorporated in and constitute a part of this specification. They illustrate embodiments conforming to this disclosure and, together with the specification, serve to explain the technical solutions of this disclosure. It should be understood that the following drawings only show some embodiments of this disclosure and should not be considered as limiting the scope. Those skilled in the art can obtain other related drawings based on these drawings without creative effort.

[0040] Figure 1 This is a schematic diagram of the architecture of a service system shown in an exemplary embodiment of this application;

[0041] Figure 2 This is a flowchart illustrating a domain name hijacking detection method according to an exemplary embodiment of this application;

[0042] Figure 3 This is a schematic diagram of a dependency graph shown in an exemplary embodiment of this application;

[0043] Figure 4 This is a functional block diagram of a domain name hijacking detection device illustrated in an exemplary embodiment of this application;

[0044] Figure 5 This is a schematic diagram of the structure of an electronic device shown in an exemplary embodiment of this application. Detailed Implementation

[0045] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0046] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0047] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0048] In this document, the term "and / or" merely describes a relationship, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0049] See Figure 1 As shown, where, Figure 1 This is a schematic diagram of the architecture of a service system provided in an embodiment of this application. Figure 1 As shown, the service system may include a terminal device 100 and a server 200 capable of communicating with the terminal device 100. The terminal device 100 may include mobile devices, user terminals, terminals, in-vehicle devices, computing devices, and wearable devices, etc. For example, the terminal device 100 may include tablet computers, mobile phones, laptops, Ultra Mobile Personal Computers (UMPCs), netbooks, etc.

[0050] Server 200 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud storage, big data, and artificial intelligence platforms; the specific implementation is not limited here. Server 200 may include network communication units, processors, and memory, etc. Specifically, server 200 can provide backend services for the aforementioned clients.

[0051] In practical applications, terminal device 100 and server 200 can communicate via a network. A network connection can be established between them first. After the network connection is established, communication can occur between terminal device 100 and server 200. During network communication, if terminal device 100 is unable to complete the conversion from domain name to IP (Internet Protocol) address from its local cache, terminal device 100 can obtain the local domain name server address from the network parameters configured on the terminal, and then send the domain name to the local domain name server for resolution to obtain the corresponding IP address.

[0052] In the process of domain name resolution through a domain name server, if the domain name server is hijacked, the user obtains a fake IP address, which often leads to risks such as leakage of sensitive information and theft of property.

[0053] Research has found that some technologies utilize passive DNS (Domain Name System) data analysis to detect isolated domains or IPs by analyzing statistical characteristics (such as resolution frequency and changes in lifetime). However, these methods mostly focus on analyzing the surface statistical characteristics of isolated domains or IPs, neglecting deeper patterns of association that attackers may employ during hijacking, such as "infrastructure reuse" and "cross-domain collaborative actions," resulting in low detection accuracy.

[0054] Based on the above research, this application provides a domain name hijacking detection method. First, target passive domain name system (DNS) data is acquired, including DNS resolution records for multiple domains within a preset historical time period. Then, based on the target DNS data, a dependency graph is constructed according to the association between domain names and IP addresses, resulting in a dependency graph structure. Next, indicator features are extracted from each node in the dependency graph structure to obtain indicator feature extraction results for each node. Finally, the dependency graph structure and the indicator feature extraction results are input into a pre-trained domain name hijacking detection model to perform domain name hijacking detection, obtaining the domain name hijacking detection result.

[0055] The domain hijacking detection method provided in this application first acquires target passive DNS data, then constructs a dependency graph structure with domain names and IP addresses as core nodes based on the target passive DNS data. Next, it extracts indicator features from each node in the dependency graph structure to obtain the indicator feature extraction results. Finally, it inputs the dependency graph structure and the indicator feature extraction results into a pre-trained domain hijacking detection model to perform domain hijacking detection, obtaining the domain hijacking detection results. This not only enables domain hijacking detection but also effectively captures the behavior patterns of attackers reusing infrastructure (such as IP and NS servers) or collaboratively hijacking multiple domain names through the dependency graph structure. This overcomes the shortcomings of related methods that analyze domain names or IP addresses in isolation and fail to fully utilize the complex relationships between them, thus improving the accuracy of domain hijacking detection and enhancing network communication security.

[0056] It is understood that the execution subject of the domain name hijacking detection method provided in this application embodiment can be an electronic device. This electronic device may include a server or a terminal device. For specific descriptions of the server and terminal device, please refer to the aforementioned descriptions of terminal device 100 and server 200, which will not be repeated here.

[0057] The domain name hijacking detection method provided in this application embodiment will be described in detail below with reference to the accompanying drawings.

[0058] See Figure 2 As shown, where, Figure 2 A flowchart illustrating a domain name hijacking detection method provided in this application embodiment. The domain name hijacking detection method includes the following steps S101 to S104:

[0059] S101, Obtain target passive domain name system data, the target passive domain name system data including domain name resolution records of multiple domain names within a historical preset time period.

[0060] Domain Name System (DNS) data includes data on the DNS resolution process and the resolution results. DNS resolution is a service that points a domain name to a website's IP address, allowing users to easily access the website through the registered domain name. Since IP addresses are numerical addresses that identify websites on the internet and are difficult for users to remember, domain names are used to identify website addresses in place of IP addresses for easier access. However, users still actually access the website's IP address, hence the need for DNS resolution to convert the user-entered domain name address into an IP address for access. The DNS resolution process is handled by DNS servers.

[0061] Passive DNS is a type of DNS data that is retrieved or queried in reverse. Passive DNS stores secure data related to all historical records of all domain names, servers, and IP addresses involved in public DNS communication. Real-time DNS results can be converted into passive DNS data for use and analysis.

[0062] Understandably, a historical preset time period can also be called a time window, which can be set according to actual needs. For example, the historical preset time period can be one day, 12 hours, 8 hours, or two days or one week, etc., without specific limitations. In addition, the historical preset time period can be the preset time period closest to the current time. For example, the historical preset time period can be 24 hours before the current time, or it can be one month before the current time.

[0063] Specifically, DNS resolution records within a specified time window can be retrieved. For example, the type of the domain name resolution record may include at least one of the following: A record, Name Server (NS) record, and CNAME record.

[0064] An A record resolves a domain name to an IP address, where A stands for Address, specifically a numeric IP address. A CNAME record, on the other hand, resolves a domain name to another domain name. In other words, a CNAME record points several hostnames to an alias, which is essentially the same as pointing them to an IP address, because this alias also needs an A record. An NS record is a Domain Name Server record used to indicate which server is responsible for resolving the domain name.

[0065] In some embodiments, when obtaining the target passive domain name system data in step S101, the following (1) to (2) may be included:

[0066] (1) Obtain the original passive domain name system data and preprocess the original passive domain name system data to obtain preprocessed domain name system data;

[0067] (2) The preprocessed domain name system data is timestamped to obtain the target passive domain name system data.

[0068] Here, after obtaining the raw Passive Domain Name System (DNS) data, it undergoes data preprocessing to remove obviously erroneous or invalid records. For example, records resolving to reserved IP addresses, private IP addresses, or associated with known sinkhole IPs can be removed. A sinkhole IP refers to a malicious domain that is redirected to an unreachable IP address within the network.

[0069] After obtaining the preprocessed DNS data, it can be normalized. Specifically, timestamp alignment can be performed to ensure all records have a uniform timestamp format. Furthermore, aggregation can be performed on the preprocessed DNS data; for example, initial aggregation can be performed on duplicate DNS records of the same domain within a very short period.

[0070] Here, by preprocessing the original passive domain name system data and aligning the timestamps, the validity of the data can be improved, which is beneficial to improving the accuracy of subsequent dependency graph determination.

[0071] S102, based on the target passive domain name system data, a dependency graph is constructed according to the association between the domain name and the network protocol IP address to obtain a dependency graph structure; wherein, at least some of the nodes in the dependency graph structure are of different types.

[0072] Understandably, since there is a correspondence between IP addresses and domain names, after obtaining the target passive domain name system data, a dependency graph can be constructed according to the association between the domain name and the network protocol IP address to obtain the dependency graph structure.

[0073] For example, a dependency graph can be constructed according to the logic of domain name-IP address-domain name-IP address. In this process, if multiple domain names resolve to the same IP address, then the multiple domain names are indirectly associated through that IP address; if a domain name resolves to multiple IP addresses, then the domain name is directly associated with those multiple IP addresses. This method can be used to determine the sharing and reuse of infrastructure (especially IP addresses).

[0074] Specifically, this dependency graph structure may include multiple nodes and edges connecting two nodes. At least some nodes may have different node types. Specifically, node types may include: Fully Qualified Domain Name (FQDN) nodes, Apex Domain nodes, IP address nodes, Name Server (NS) domain name nodes, 24-segment subnet nodes, and Autonomous System (AS) nodes. Edge types may include: the IP address associated with the domain name resolution, the domain name hosted on the IP address, the NS domain to which the FQDN belongs, the authoritative server to which the domain name is delegated, the 24-segment subnet to which the IP address belongs, and the AS to which the subnet belongs. The 24-segment subnet is also called a 24-subnet.

[0075] In some embodiments, when constructing a dependency graph based on the target passive domain name system data and according to the association between domain names and network protocol IP addresses to obtain a dependency graph structure, the following (I) to (II) may be included:

[0076] (I) For each domain name, expand vertically according to the association between the domain name and the IP address to obtain multiple nodes and the edges between adjacent nodes;

[0077] (II) For each node, horizontal expansion is performed according to the type of the domain name resolution record corresponding to the node to increase the association of different types of nodes, thus obtaining the dependency graph structure.

[0078] For example, the acquired target passive DNS data can be traversed. For each domain name, the graph can be expanded vertically in the manner of domain name-IP address-domain name-IP address, adding domain name nodes (fully qualified domain names and top-level domain names) and associations between domain names and IP addresses. During this process, domain names hosted on the same IP address or IP addresses resolved by the same domain name will be associated together. For example, if the domain name hijacked1.com resolves to 1.2.3.4 on a certain day, and the domain name hijacked2.com also resolves to 1.2.3.4 on the same day, then both domain names are associated with node 1.2.3.4 in the graph. Furthermore, if a CNAME record exists, the IP address associated with the CNAME domain name is linked to the original domain name.

[0079] For different types of nodes, horizontal expansion can be performed according to the DNS resource record type corresponding to the node. For example, if the authoritative name server for the domain hijacked1.com is ns1.hijacked1.com, then the diagram should show these two nodes and the relationship between the domain name and NS.

[0080] Specifically, the horizontal expansion based on the type of the domain name resolution record corresponding to the node to increase the association of different types of nodes includes at least one of the following:

[0081] For fully qualified domain name nodes, add associations with top-level domain name nodes and authoritative server nodes respectively;

[0082] For top-level domain nodes, add associations with fully qualified domain nodes under the top-level domain, and add associations with authoritative server nodes under the top-level domain;

[0083] For IP address nodes, add association with the subnet nodes of the 24 network segment to which they belong;

[0084] For subnet nodes in the 24 network segment, add association with the Autonomous System (AS) node to which they belong.

[0085] Here, for different types of nodes, associations can be added with different types of nodes based on their corresponding DNS record types. For example, for fully qualified domain name nodes, associations need to be added with both top-level domain name nodes and authoritative server nodes; for top-level domain name nodes, associations need to be added with both fully qualified domain name nodes and authoritative server nodes under the top-level domain; for IP addresses, associations need to be added with the subnet nodes of the 24 subnet; and for subnet nodes of the 24 subnet, associations need to be added with the AS nodes of the 24 subnet. It should be understood that during this process, if the associated node does not exist on the graph, it needs to be added to the graph.

[0086] See Figure 3 The diagram shown is a schematic representation of a dependency graph structure provided in an embodiment of this application. Figure 3 As shown, the dashed nodes represent the vertical expansion direction, and other nodes to be expanded have been omitted. Among them, APEX represents a top-level domain node, FQDN represents a fully qualified domain name node, IP represents an IP address node, Domain represents a regular domain name node, AS represents an autonomous system node, Subnet represents a 24-segment subnet node, and NS represents an authoritative server node.

[0087] S103, extract indicator features for each node in the dependency graph structure to obtain the indicator feature extraction results for each node in the dependency graph structure.

[0088] For example, different node types can correspond to different indicator feature dimensions. Therefore, when extracting indicator features for each node, the node type can be determined first, and then feature extraction can be performed according to the indicator feature dimensions corresponding to the node type. This not only improves the efficiency of indicator extraction but also improves the accuracy of indicator extraction.

[0089] In some embodiments, when extracting indicator features for each node in the dependency graph structure, the process may include: for each node in the dependency graph structure, extracting features for the node according to the indicator feature dimension corresponding to the node type, based on the node type.

[0090] For example, the indicator feature dimensions may include at least one of: domain name resolution behavior features, graph topology features, and infrastructure features. Specifically, domain name resolution behavior features characterize the association information of nodes in the domain name resolution process; graph topology features reflect the relevant attribute information of nodes in the dependency graph; and infrastructure features reflect the attribute information of the basic network resources associated with the nodes.

[0091] Specifically, for domain name nodes, the corresponding indicator feature dimensions include domain name resolution behavior characteristics, graph topology structure characteristics, and infrastructure characteristics; for IP address nodes, authoritative server nodes, or 24-segment subnet nodes, the corresponding indicator feature dimensions include domain name resolution behavior characteristics and graph topology structure characteristics; and for AS nodes, the corresponding indicator feature dimensions include graph topology structure characteristics.

[0092] In some embodiments, when extracting features from a node according to its type and based on the indicator feature dimension corresponding to that node type, the process may include:

[0093] For domain-type nodes (such as fully qualified domains or top-level domains), indicator features are extracted according to three indicator feature dimensions: domain name resolution behavior characteristics, graph topology structure characteristics, and infrastructure characteristics.

[0094] For IP address nodes, authoritative server nodes, or 24 network segment subnet nodes, indicator features are extracted according to two indicator feature dimensions: domain name resolution behavior characteristics and graph topology structure characteristics.

[0095] For AS nodes, features are extracted based on one dimension of graph topology features.

[0096] Specifically, domain name resolution behavior characteristics may include: the number of historical requests, the number of associated passive DNS records, the number of associated IP addresses, the number of associated NS records, the duration of passive DNS records, and the presence of new A records or new NS records within a time window. Graph topology characteristics may include: in-degree and out-degree, the degree of a node in the dependency graph, and the importance of a node in the graph. Infrastructure characteristics include: the number of autonomous systems to which the resolved IP addresses belong and changes in the geographical location of the IP addresses resolved by the domain name. For detailed indicator characteristics and their corresponding explanations, please refer to Table 1.

[0097] Table 1

[0098]

[0099]

[0100]

[0101] Here, PDNS refers to Passive DNS data, the count value refers to the historical number of requests for a record related to a domain name, and the "count attribute value of all edges connected" refers to the sum of the count values ​​of all edges connected to that node. It is understandable that changes to domain name resolution records are common. This application's embodiments extract distinctive features from three aspects: the historical resolution behavior characteristics of domain name nodes, graph topology characteristics, and infrastructure characteristics, which is beneficial for identifying abnormal patterns related to hijacking intentions.

[0102] Among them, the PageRank score of a node reflects its importance in the topology graph and the degree of dependence of other nodes on it; the size of the community to which a node belongs refers to the number of nodes contained in the community; the ID of the community to which a node belongs is used to uniquely identify the number or label of the community, which is assigned by the community discovery algorithm; the clustering coefficient of a node is used to measure the degree of interconnection between the nodes' neighbors, reflecting the tightness of its local neighborhood, and the value ranges from 0 (no connection) to 1 (fully connected).

[0103] It should be noted that after obtaining the indicator feature extraction results, the indicator feature extraction results also need to be normalized.

[0104] S104, the dependency graph structure and the indicator feature extraction results are input into the pre-trained domain hijacking detection model to perform domain hijacking detection and obtain the domain hijacking detection results.

[0105] For example, after obtaining the dependency graph structure and the indicator feature extraction results, the dependency graph structure and the indicator feature extraction results can be input into a pre-trained domain hijacking detection model to perform domain hijacking detection and obtain the domain hijacking detection result. The domain hijacking detection result can include whether the domain has been hijacked. For example, for any domain, if the probability of hijacking exceeds a preset threshold, it is determined to be hijacked.

[0106] For example, the pre-trained domain hijacking detection model can be a GraphSAGE (Graph Sample and Aggregated) model, which is a graph neural network model based on sampling and aggregation mechanisms.

[0107] The training process of the domain hijacking detection model is explained below.

[0108] It should be understood that the training process of this domain hijacking detection model is similar to the detection process described above. The difference is that during the training process, training samples are required, while during the usage process, test data is obtained.

[0109] For example, the training sample can be obtained in the following way:

[0110] Obtain a list of domains hijacked in historical domain hijacking incidents and use this list as a positive sample. Simultaneously, obtain domains that did not report hijacking during the same period and use them as a negative sample.

[0111] After obtaining the training sample data, you can query the passive DNS database for all A records, NS records, and CNAME records of the positive and negative sample domain names within the corresponding time window, remove records with invalid IPs (such as records that resolve to 127.0.0.1), and then aggregate the IP addresses resolved by the domain names by day to obtain the IP set.

[0112] Then, based on the above data, a dependency graph is constructed to obtain the dependency graph structure. Indicator features are extracted from each node in the dependency graph structure to obtain the feature extraction results. Next, the dependency graph structure and feature extraction results are used as input, and the Adam optimizer and binary cross-entropy loss function are used for training to obtain a trained domain hijacking detection model.

[0113] In some embodiments, in order to improve the detection accuracy of the domain hijacking detection model, the training samples can be divided into a training set, a validation set, and a test set according to a preset ratio (e.g., 8:1:1), and the performance of the model on the test set can be evaluated, recording the accuracy (ACC), precision, recall, F1 score, AUC (Area Under Curve) value, and false positive rate (FPR).

[0114] Table 2 shows the test results of the performance indicators of the domain name hijacking detection model provided in one embodiment of this application.

[0115] Evaluation indicators result Accuracy ACC 0.9879 Precision 0.9797 Recall 0.9966 F1 score 0.9880 AUC 0.9998 FPR 0.0207

[0116] If the results of all the above indicators meet the preset requirements, a well-trained domain name hijacking detection model is obtained.

[0117] Those skilled in the art will understand that, in the above-described method of the specific implementation, the order in which each step is written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0118] Based on the same technical concept, this disclosure also provides a domain hijacking detection device corresponding to the domain hijacking detection method. Since the principle of the device in this disclosure for solving the problem is similar to the domain hijacking detection method described above in this disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0119] Reference Figure 4 The diagram shown is a schematic of a domain name hijacking detection device provided in an embodiment of this disclosure. The domain name hijacking detection device 400 includes:

[0120] The data acquisition module 401 is used to acquire target passive domain name system data, wherein the target passive domain name system data includes domain name resolution records of at least one domain name within a historical preset time period;

[0121] The dependency graph construction module 402 is used to construct a dependency graph based on the target passive domain name system data and according to the association between domain names and network protocol IP addresses, to obtain a dependency graph structure; wherein, at least some nodes in the dependency graph structure are of different types;

[0122] The indicator feature extraction module 403 is used to extract indicator features for each node in the dependency graph structure, and obtain the indicator feature extraction results for each node of the dependency graph structure.

[0123] The domain hijacking detection module 404 is used to input the dependency graph structure and the indicator feature extraction results into a pre-trained domain hijacking detection model to perform domain hijacking detection and obtain domain hijacking detection results.

[0124] In some possible embodiments, the relational graph construction module 402 is specifically used for:

[0125] For each domain name, expand vertically according to the association between the domain name and the IP address to determine multiple nodes and the edges between adjacent nodes;

[0126] For each node, the association between different types of nodes is increased by horizontally expanding the domain name resolution record corresponding to the node, thus obtaining the dependency graph structure.

[0127] In some possible embodiments, the relational graph construction module 402 is specifically used for:

[0128] For fully qualified domain name nodes, add associations with top-level domain name nodes and authoritative server nodes respectively;

[0129] For top-level domain nodes, add associations with fully qualified domain nodes and authoritative server nodes under the top-level domain, respectively;

[0130] For IP address nodes, add association with the subnet nodes of the 24 network segment to which they belong;

[0131] For subnet nodes in the 24 network segment, add association with the Autonomous System (AS) node to which they belong.

[0132] In some possible embodiments, different node types correspond to different indicator feature dimensions; the indicator feature extraction module 403 is specifically used for:

[0133] For each node in the dependency graph structure, features are extracted from the node according to the node type and the indicator feature dimension corresponding to the node type.

[0134] In some possible embodiments, the indicator feature dimensions include at least one of: domain name resolution behavior features, graph topology features, and infrastructure features; the indicator feature extraction module 403 is specifically used for:

[0135] For domain name nodes, indicator features are extracted according to three indicator feature dimensions: domain name resolution behavior characteristics, graph topology structure characteristics, and infrastructure characteristics.

[0136] For IP address nodes, authoritative server nodes, or 24 network segment subnet nodes, indicator features are extracted according to two indicator feature dimensions: domain name resolution behavior characteristics and graph topology structure characteristics.

[0137] For AS nodes, features are extracted based on one dimension of graph topology features.

[0138] In some possible embodiments, the data parsing acquisition module 401 is specifically used for:

[0139] Obtain the original passive domain name system data and preprocess the original passive domain name system data to obtain preprocessed domain name system data;

[0140] The preprocessed Domain Name System (DNS) data is timestamped to obtain the target passive DNS data.

[0141] In some possible embodiments, the type of the domain name resolution record includes at least one of the following: A record, NS record, and CNAME record.

[0142] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without any inventive effort.

[0143] Based on the same technical concept, this disclosure also provides an electronic device. (See also...) Figure 5 The diagram shows the structure of an electronic device 500 provided in this embodiment of the present disclosure, including a processor 501, a memory 502, and a bus 503. The memory 502 is used to store execution instructions and includes a main memory 5021 and an external memory 5022. The main memory 5021, also called internal memory, is used to temporarily store computational data in the processor 501, as well as data exchanged with external memory 5022 such as a hard disk. The processor 501 exchanges data with the external memory 5022 through the main memory 5021.

[0144] In this embodiment, the memory 502 is specifically used to store application code that executes the solution of this application, and its execution is controlled by the processor 501. That is, when the electronic device 500 is running, the processor 501 communicates with the memory 502 through the bus 503, so that the processor 501 executes the application code stored in the memory 502, and then executes the method described in any of the foregoing embodiments.

[0145] The memory 502 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0146] Processor 501 may be an integrated circuit chip with signal processing capabilities. The aforementioned processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor.

[0147] It is understood that the structures illustrated in the embodiments of this application do not constitute a specific limitation on the electronic device 500. In other embodiments of this application, the electronic device 500 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0148] This disclosure also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the simulated robot scheduling method described in the above-described method embodiments. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0149] This disclosure also provides a computer program product carrying program code. The program code includes instructions that can be used to execute the steps of the simulation robot scheduling method in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0150] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium; in another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0151] Furthermore, embodiments of the subject matter and functional operation described in this specification can be implemented in the following ways: digital electronic circuits, tangibly embodied computer software or firmware, computer hardware including the structures disclosed in this specification and their structural equivalents, or combinations thereof. Embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible, non-transitory program carrier for execution by a data processing apparatus or for controlling the operation of a data processing apparatus. Alternatively or additionally, program instructions may be encoded on artificially generated propagation signals, such as machine-generated electrical, optical, or electromagnetic signals, which are generated to encode information and transmit it to a suitable receiving device for execution by the data processing apparatus. The computer storage medium may be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or combinations thereof.

[0152] The processing and logic flow described in this specification can be executed by one or more programmable computers that execute one or more computer programs to perform corresponding functions by operating on input data and generating output. The processing and logic flow can also be executed by dedicated logic circuitry—such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits), and the device can also be implemented as dedicated logic circuitry.

[0153] Suitable computers for executing computer programs include, for example, general-purpose and / or special-purpose microprocessors, or any other type of central processing unit. Typically, the central processing unit receives instructions and data from read-only memory and / or random access memory. The basic components of a computer include a central processing unit for implementing or executing instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include one or more mass storage devices for storing data, such as disks, magneto-optical disks, or optical disks, or the computer will be operatively coupled to such mass storage devices to receive data from or transfer data to them, or both. However, a computer is not required to have such devices. Furthermore, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device such as a universal serial bus (USB) flash drive, to name a few.

[0154] Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, such as semiconductor memory devices (e.g., EPROM, EEPROM, and flash memory devices), magnetic disks (e.g., internal hard disks or removable disks), magneto-optical disks, and CD-ROM and DVD-ROM disks. Processors and memory may be supplemented by or incorporated into dedicated logic circuitry.

[0155] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any invention or the scope of the claims, but rather are primarily intended to describe features of specific embodiments of a particular invention. Certain features described in the various embodiments herein may also be implemented in combination in a single embodiment. Conversely, various features described in a single embodiment may also be implemented separately in various embodiments or in any suitable sub-combination. Furthermore, while features may function in certain combinations as described above and even initially claimed in this way, one or more features from a claimed combination may be removed from that combination in some cases, and a claimed combination may refer to a sub-combination or a variation thereof.

[0156] Similarly, although the operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring these operations to be performed in the specific order shown or sequentially, or requiring all illustrated operations to be performed to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system modules and components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0157] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims may be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings are not necessarily shown in a specific order or sequence to achieve the desired result. In some implementations, multitasking and parallel processing may be advantageous.

[0158] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for detecting domain name hijacking, characterized in that, include: Obtain target passive domain name system data, wherein the target passive domain name system data includes domain name resolution records of at least one domain name within a preset historical time period; Based on the target passive domain name system data, a dependency graph is constructed according to the association between domain names and network protocol IP addresses to obtain a dependency graph structure; wherein, at least some nodes in the dependency graph structure are of different types; For each node in the dependency graph structure, feature extraction is performed to obtain feature extraction results for each node in the dependency graph structure. The dependency graph structure and the extracted index features are input into a pre-trained domain hijacking detection model to perform domain hijacking detection and obtain the domain hijacking detection results.

2. The method according to claim 1, characterized in that, Based on the target passive domain name system data, a dependency graph is constructed according to the association between domain names and network protocol IP addresses to obtain a dependency graph structure, including: For each domain name, expand vertically according to the association between the domain name and the IP address to determine multiple nodes and the edges between adjacent nodes; For each node, the association between different types of nodes is increased by horizontally expanding the domain name resolution record corresponding to the node, thus obtaining the dependency graph structure.

3. The method according to claim 2, characterized in that, The horizontal expansion based on the type of the domain name resolution record corresponding to the node, in order to increase the association of different types of nodes, includes at least one of the following: For fully qualified domain name nodes, add associations with top-level domain name nodes and authoritative server nodes respectively; For top-level domain nodes, add associations with fully qualified domain nodes and authoritative server nodes under the top-level domain, respectively; For IP address nodes, add association with the subnet nodes of the 24 network segment to which they belong; For subnet nodes in the 24 network segment, add association with the Autonomous System (AS) node to which they belong.

4. The method according to claim 1, characterized in that, Different node types correspond to different indicator feature dimensions; the extraction of indicator features for each node in the dependency graph structure includes: For each node in the dependency graph structure, features are extracted from the node according to the node type and the indicator feature dimension corresponding to the node type.

5. The method according to claim 4, characterized in that, The indicator feature dimensions include at least one of the following: domain name resolution behavior features, graph topology features, and infrastructure features; The step of extracting features from the node according to its type and the corresponding indicator feature dimension includes: For domain name nodes, indicator features are extracted according to three indicator feature dimensions: domain name resolution behavior characteristics, graph topology structure characteristics, and infrastructure characteristics. For IP address nodes, authoritative server nodes, or 24 network segment subnet nodes, indicator features are extracted according to two indicator feature dimensions: domain name resolution behavior characteristics and graph topology structure characteristics. For AS nodes, features are extracted based on one dimension of graph topology features.

6. The method according to claim 1, characterized in that, The acquisition of target passive domain name system data includes: Obtain the original passive domain name system data and preprocess the original passive domain name system data to obtain preprocessed domain name system data; The preprocessed Domain Name System (DNS) data is timestamped to obtain the target passive DNS data.

7. The method according to any one of claims 1-6, characterized in that, The types of domain name resolution records include at least one of the following: A record, NS record, and CNAME record.

8. A domain name hijacking detection device, characterized in that, The device includes: The data acquisition module is used to acquire target passive domain name system data, which includes domain name resolution records of at least one domain name within a preset historical time period; The dependency graph construction module is used to construct a dependency graph based on the target passive domain name system data, according to the association between domain names and network protocol IP addresses, to obtain the dependency graph structure; The indicator feature extraction module is used to extract indicator features for each node in the dependency graph structure, and obtain the indicator feature extraction results for each node of the dependency graph structure. The domain hijacking detection module is used to input the dependency graph structure and the indicator feature extraction results into a pre-trained domain hijacking detection model to perform domain hijacking detection and obtain the domain hijacking detection results.

9. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the domain name hijacking detection method as described in any one of claims 1-7 is performed.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the domain name hijacking detection method as described in any one of claims 1-7.

Images