DNS authorization security detection method and device

Abstract

The invention belongs to the technical field of information, and relates to a DNS authorization security detection method and device. The method comprises the following steps: performing data configuration according to a domain name authorization scene construction requirement; sending a query message to a recursive analysis service through a message receiving and transmitting module; an authoritative simulator is constructed, the authoritative simulator simulates a cascade authoritative analysis service and an attack target authoritative analysis service according to data configuration, and a message receiving and transmitting module is scheduled to receive and respond to a query message of a recursive analysis service; receiving a response message of the recursive analysis service through a message receiving and transmitting module; and counting query messages of the recursive resolution service received by the cascade authoritative resolution service and the attack target authoritative resolution service, and analyzing the domain name authorization security risk of the recursive resolution service. According to the method, the authorization potential safety hazard of the recursive analysis service can be analyzed, evaluated and found in time.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of information technology, and particularly relates to a DNS authorization security detection method and device. BACKGROUND

[0002] The domain name authorization mechanism is the basis of the domain name resolution process. According to the international domain name agreement standard, domain name resolution needs to be carried out step by step from the root zone, the top-level domain to the second and third-level domain, and in this process, the authorization dependency relationship is inevitably generated. In addition, with the popularization and application of CDN (Content Delivery Network) technology, the CNAME (alias) record in the domain name system is widely used, which makes the domain name authorization dependency relationship more complex. As shown in Figure 1 The resolution process of a multi-segment domain name c1(M+1).c1M..c14.c13.c12.c11.cn involves parent-child cascading and alias mapping:

[0003] Parent-child cascading: the recursive resolution service can obtain the NS (Name Server) of the c12.c11.cn zone from the c11.cn zone, forming a cascade of the two layers of authoritative services, and similarly, the NS of the c13.c12.c11.cn zone can be obtained from the c12.c11.cn zone, and so on, forming a vertical authorization chain.

[0004] Alias cascading: the recursive resolution service obtains the CNAME alias record of the domain name "c1(M+1).c1M..c12.c11.cn" from the c1M..c12.c11.cn zone, and points the domain name to a new domain name: "c2(M+1).c2M..c22.c21.cn", and then the parent-child cascading resolution process will be repeated. The domain name "c2(M+1).c2M..c22.c21.cn" can also be pointed to "c3(M+1).c3M..c32.c31.cn" through the CNAME alias record, and so on, forming a multi-layer alias cascade, and the alias cascade further increases the complexity of the authorization relationship.

[0005] The complex domain name authorization dependency relationship introduces new DNS attacks and security risks, such as Figure 1When a large number of invalid NSs are directed to the victim zone (victim.cn) during the analysis process, the victim zone will be subjected to traffic pressure, forming an NXNS Attack (Non-Existing NS Record Attack). This makes the authorized security detection imminent, and it is difficult to verify whether the authorized implementation mechanism logic of the DNS resolution software is correct and reasonable. Currently, there are two common methods, one is to analyze the code implementation logic, however, this method is not suitable for non-open source DNS resolution software or public resolution services. The second method is to build a real authoritative service and construct a real domain name authorization test environment to test and analyze the resolution software. This method is difficult to build a complex authorization chain, one is that too many authoritative services will lead to more hardware resource consumption, and two is that complex authorization dependencies require complex authorization association data to support, which is complicated to configure and difficult to organize. Therefore, a flexible and efficient DNS authorization security detection method is needed to reduce resource consumption while achieving rapid DNS authorization dependency environment construction and DNS authorization security evaluation. SUMMARY

[0006] The present application is directed to the above problems, and proposes an authorization security detection method and device for DNS resolution software and public recursive DNS service, which can timely analyze, evaluate and find the authorization security risks of recursive resolution service.

[0007] The technical solution adopted by the present application is as follows:

[0008] In a first aspect, the present application provides a DNS authorization security detection method, comprising the following steps:

[0009] Data configuration is performed according to the domain name authorization scene construction requirements;

[0010] The message transceiver module sends a query message to the recursive resolution service;

[0011] An authority simulator is constructed, which simulates the cascaded authoritative resolution service and the attack target authoritative resolution service according to the data configuration, and dispatches the message transceiver module to receive and respond to the query message of the recursive resolution service;

[0012] The message transceiver module receives the response message of the recursive resolution service;

[0013] The query message of the recursive resolution service received by the cascaded authoritative resolution service and the attack target authoritative resolution service is counted, and the domain name authorization security risk of the recursive resolution service is analyzed.

[0014] Further, the message transceiver module is used for bidirectional communication simulation: one is to simulate the client, send the query message to the recursive resolution service and receive the final response message; the other is to serve as the communication module of the authority simulator, which is dispatched by the authority simulator and used for receiving the outgoing query message of the recursive resolution service and returning the response message.

[0015] Further, the authoritative simulator comprises a multi-layer authoritative resolution simulator and an attack target authoritative resolution simulator, which respectively simulate the cascading authoritative resolution service and the attack target authoritative resolution service.

[0016] Further, the data configuration according to the domain name authorization scene construction requirement comprises configuring the following data:

[0017] Zone suffix: define the zone suffixes of all the cascading zones and the attack target zones;

[0018] Parent-child cascading quantity: the quantity of the parent-child cascading layers, which is also the quantity of the cascading authoritative resolution service layers;

[0019] Cascading zone prefix: the naming rule of the cascading zones at different layers is “zone prefix”+“alias cascading layer number”+“parent-child cascading layer number”+“previous layer cascading zone name”+“zone suffix”;

[0020] NS quantity of the cascading zone: the quantity of the NSs of the next layer cascading zone configured in the cascading zone;

[0021] Attack target zone name: the zone name of the attack target zone governed by the authoritative resolution service to which the attack behavior is finally directed;

[0022] NS prefix pointing to the attack target zone and NS prefix for cascading: the NSs of each layer of the authoritative resolution service comprise the NSs pointing to the attack target zone and the NSs for cascading; the NSs pointing to the attack target zone are “NS prefix pointing to the attack target zone”+“number”+“attack target zone name”; the NSs for cascading are “NS prefix for cascading”+“next layer cascading zone name”;

[0023] Attack target zone response message: the response message returned by the attack target zone after receiving the query, which is NXDOMAIN or refuse message;

[0024] Alias cascading quantity: the quantity of the alias cascading layers;

[0025] Authoritative resolution service listening IP: configure the listening IP of the cascading authoritative resolution service and the attack target authoritative resolution service.

[0026] Further, the packet transceiver module sends the query message to the recursive resolution service, wherein the segment number of the query domain name is one more than the configured parent-child cascading quantity.

[0027] Further, the authoritative simulator simulates the cascading authoritative resolution service and the attack target authoritative resolution service according to the data configuration, and dispatches the packet transceiver module to receive and respond to the query message of the recursive resolution service, wherein the query content and the response content comprise:

[0028] Query content: The query domain name sent by the message transceiver module to the recursive resolution service; Response content: Each cascading authoritative resolution service returns the cascading zone NS of the next level service, and the number and content of the NS are determined according to the configuration; but if it is the last layer of the cascading authoritative resolution service, a CNAME record pointing to the next level name is returned;

[0029] Query content: The next layer of the cascading zone name; Response content: Each cascading authoritative resolution service returns the cascading zone NS of the next level service, and the number and content of the NS are determined according to the configuration; but if it is the last layer of the cascading authoritative resolution service, a CNAME record pointing to the next level name is returned;

[0030] Query content: A or AAA of NS for cascading; Response content: IP listened by the next layer of the cascading authoritative resolution service;

[0031] Query content: A or AAA of NS pointing to the attack target zone; Response content: According to the configuration, a response message is returned, including NXDOMAIN message, refuse message;

[0032] Query content: The name of the cascading zone in this layer; Response content: SOA record of the cascading zone in this layer;

[0033] Query content: Other domain names of non-cascading zones and attack target zones; Response content: Refuse message.

[0034] Further, the query messages received by each layer of the cascading authoritative resolution service and the attack target authoritative resolution service in the statistical query process are analyzed to analyze the domain name authorization security risk of the recursive resolution service, including:

[0035] 1) Statistics and analysis of the number and type of messages received by the cascading authoritative resolution service;

[0036] 2) Statistics and analysis of the number and type of messages received by the attack target authoritative resolution service;

[0037] 3) Integration of the analysis results of 1) and 2), analysis of the processing logic of the recursive resolution server to the authorization record, and identification of potential risks; if the number of query messages received by the attack target authoritative resolution service is linearly increased with the number of NS of the cascading zone, it indicates that the recursive resolution service does not implement reasonable restrictions on external authorization queries, and there is a NXNSAttack attack risk; if each layer of the cascading authoritative resolution service receives a query message as the number of parent-child cascades increases, it indicates that the recursive resolution service does not limit the depth of domain name query, and may be used to construct a deep cascading attack chain, and there is a DDoS attack risk.

[0038] In a second aspect, the application provides a DNS authorization security detection device, which comprises:

[0039] a data configuration module configured to configure data according to a domain name authorization scenario construction requirement;

[0040] an authority simulator configured to simulate an authority resolution service, and divided into a multi-layer authority resolution simulator and an attack target authority resolution simulator, which are configured to simulate a cascading authority resolution service and an attack target authority resolution service, respectively;

[0041] a message transceiving module configured to perform bidirectional communication simulation, that is, to simulate a client to send a query message to a recursive resolution service and receive a final response message therefrom, and to serve as a communication module of the authority simulator, which is dispatched by the authority simulator to receive an outgoing query message from the recursive resolution service and return a response message;

[0042] a statistical analysis module configured to count the query messages from the recursive resolution service received by the cascading authority resolution service and the attack target authority resolution service, and analyze domain name authorization security risks of the recursive resolution service.

[0043] In a third aspect, the present application provides a computer device, which comprises a memory and a processor, the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing the above-mentioned method of the present application.

[0044] In a fourth aspect, the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a computer to implement the above-mentioned method of the present application.

[0045] The advantages and beneficial effects of the present application are as follows:

[0046] (1) The present application provides a visual arrangement capability of domain name authorization relationship, supports flexible construction of complex scenes such as parent-child cascading and alias cascading, and can quickly build an attack link model and realize efficient and accurate domain name authorization security risk detection through multi-authority resolution service simulation.

[0047] (2) The risk detection process is safe. The present application includes the attack target into a controlled processing flow, ensures that the attack traffic is controlled in an isolated environment, and avoids causing damage or legal risks to the actual system.

[0048] (3) The detection process is controllable and monitorable. The present application constructs an attack data stream by itself, the traffic size and traffic content are controllable, monitoring is convenient, and in-depth authorization risk analysis can be performed. BRIEF DESCRIPTION OF DRAWINGS

[0049] Figure 1 is a schematic diagram of a domain name resolution process.

[0050] Figure 2 is a schematic diagram of a DNS authorization security detection device.

[0051] Figure 3 is a DNS authorization security detection process.

[0052] Figure 4 is a DNS authorization relationship construction.

[0053] Figure 5 is a DNS authorization security detection example. DETAILED DESCRIPTION

[0054] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application will be further described in detail below through specific examples and drawings.

[0055] The present application proposes a DNS authorization security detection device, as shown in Figure 2 , comprising an authority simulator, a data configuration module, a message transceiving module and a statistical analysis module.

[0056] The authority simulator is used to simulate authoritative resolution services, which are divided into multi-layer authoritative resolution simulators and attack target authoritative resolution simulators, which simulate cascaded authoritative resolution services and attack target authoritative resolution services, respectively, to construct a complex multi-segment domain name authorization topology and support attack scene simulation.

[0057] The data configuration module is used to customize corresponding response messages for different authority simulators according to the authorization scene construction needs.

[0058] The message transceiving module is used for bidirectional communication simulation, which is used to simulate a client, send query messages to a recursive resolution server and receive its final response messages; and is used as a communication module of the authority simulator, which is dispatched by the authority simulator, used to receive outgoing query messages of the recursive resolution server and return customized response messages.

[0059] The statistical analysis module is used to statistically analyze the transceiving message situation to analyze the behavior of the recursive side and find authorization security risks.

[0060] The present application proposes a DNS authorization security detection method, and the specific DNS authorization security detection process is as shown in Figure 3 , comprising the following steps:

[0061] (1) According to the domain name authorization scene construction needs, prepare the test environment and data, and perform data configuration as shown in Table 1.

[0062] Table 1. Data configuration

[0063]

[0064] Cascade authoritative resolution service: A multi-level topology used to build complex relationships such as parent-child cascades, alias cascades, etc., simulating attacks based on authorization mechanisms.

[0065] Attack target authoritative resolution service: The final target authoritative resolution service for implementing attacks based on authorization mechanisms.

[0066] Cascade zone: A zone managed by a cascade authoritative resolution service, used to build complex relationships such as parent-child cascades, alias cascades, etc., in a multi-level topology.

[0067] Attack target zone: The zone governed by the authoritative resolution service that is the final target of attack behavior, referred to as the attack target zone. The association between the cascade zone and the attack target zone is established through data configuration, building malicious resolution paths and directing resolution traffic to the target authoritative resolution service.

[0068] (2) The message transceiver module sends a query message to the recursive resolution service, and the number of segments of the query domain name in the query message is one more than the configured "number of parent-child cascades."

[0069] (3) The authoritative simulator simulates the cascade authoritative resolution service and the attack target authoritative resolution service according to the data configuration, and dispatches the message transceiver module to receive and respond to the query message of the recursive resolution service. The query content and response content are shown in Table 2.

[0070] Table 2. Query content and response content

[0071]

[0072] (4) After the recursive resolution service is sent out, the message transceiver module receives the response message from the recursive resolution service.

[0073] (5) The statistical analysis module counts the number of query messages received by each cascade authoritative resolution service and the attack target authoritative resolution service during the entire query process. It analyzes the reasonableness of the processing of the recursive resolution service's authorization records and the risks in the domain name authorization processing process. The specific analysis process is as follows:

[0074] 1) Count and analyze the number and type of messages received by the cascade authoritative resolution service.

[0075] 2) Count and analyze the number and type of messages received by the attack target authoritative resolution service.

[0076] 3) integrate the analysis results of 1) and 2), analyze the processing logic of the recursive resolution server for the authorization record, and identify potential risks. For example, in an extreme case, if the number of query messages received by the target authoritative resolution service is linearly increased with the number of NS in the cascade area, it indicates that the recursive resolution service does not implement reasonable restrictions on external authorized queries, and there is a risk of NXNSAttack attack; if with the increase of the number of parent-child cascades, each level of the cascade authoritative resolution service receives query messages, it indicates that the recursive resolution service does not limit the depth of domain name query (parent-child cascade or alias cascade), and may be used to construct a deep cascade attack chain, which has a risk of DDoS attack.

[0077] The key points of the present application are as follows:

[0078] (1) The simulator replaces the real authoritative resolution server, and a few server resources can quickly realize the functions of multiple authoritative resolution services, significantly reducing the hardware cost and operation and maintenance complexity.

[0079] (2) Different domain name authorization chains can be flexibly customized through data configuration to meet the needs of diversified domain name authorization security detection.

[0080] (3) The detection object covers self-built recursive services and public recursions, and is widely used in various domain name recursive resolution scenarios, providing comprehensive analysis and detection capabilities.

[0081] (4) By simulating the target, it is isolated from the real environment to avoid affecting the real service and improve security.

[0082] The steps of an example of NXNSAttack detection of the present application are described as follows:

[0083] (1) As shown in Table 3, data configuration is performed to build a domain name authorization structure as shown in Table 3. Figure 4

[0084] Table 3. Data configuration for authorization security detection

[0085]

[0086] (2) The authorization security detection device interacts with the recursive resolution service, and the interaction process is as shown in Table 3. Figure 5

[0087] 1) The message transceiver module sends a query domain name "c14.c13.c12.c11.test.cn" to the recursive resolution service.

[0088] 2) The recursive service sends a query domain name "c14.c13.c12.c11.test.cn" to the three-layer cascade authoritative resolution simulator.

[0089] ​​3) The three-layer cascading authority resolution simulator sends a response message, returning the NS of the four-layer authority resolution service, including: 1 NS for cascading: ns.c12.c11.test.cn (pointing to the four-layer cascading authority resolution simulator), and 50 NSs pointing to the attack target area: fake1~50.target.test.cn.

[0090] 4) The recursive service sends a query message to the attack target area authority resolution simulator, and the query content is all or part of the A / AAAA records in the domain name range of fake1.target.test.cn to fake50.target.test.cn obtained in step 3).

[0091] 5) The attack target area authority resolution simulator returns an NXDOMAIN response message to the query message in step 4) to the recursive resolution service. NXDOMAIN is the abbreviation of “Non-Existent Domain”, indicating that the DNS server cannot find the corresponding domain name record.

[0092] 6) Repeat steps 2)~5) in turn towards the four-layer and five-layer hierarchical authority resolution simulators.

[0093] 7) The recursive resolution service finally returns a SERVFAIL response message to the message transceiver module. SERVFAIL indicates that the recursive resolution service encountered an internal error when attempting to resolve the request and was unable to complete the query.

[0094] 8) The data statistics module counts the number of query messages sent by the recursive resolution service to the authority simulators and the attack area authority simulators during the entire interaction process.

[0095] 9) Adjust the test parameters, increase the number of parent-child cascades and the number of NSs in the cascade area, repeat all the above steps, and analyze the trend of the number of query messages sent by the recursive resolution service. If it grows linearly, there is a risk of NXNSAttack attack.

[0096] It should be understood that the method and device disclosed in the above embodiments of the present application can be implemented in other ways. For example, the division of the above modules can have another division manner in actual implementation, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Each module in the present application can be implemented in the form of a software function unit and can be stored in a computer readable storage medium, including a plurality of instructions for causing a computer device to execute some or all of the steps of the method of the present application. For example, an embodiment of the present application provides a computer device (computer, server, smart phone, etc.), which includes a memory and a processor, the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing each step of the method of the present application. For example, another embodiment of the present application provides a computer readable storage medium (such as ROM / RAM, magnetic disk, optical disk, etc.), which stores a computer program, and the computer program is executed by a computer to implement each step of the method of the present application.

[0097] The specific embodiments of the present application disclosed above are intended to help understand the content of the present application and to implement the present application. Those skilled in the art can understand that various replacements, changes and modifications are possible without departing from the spirit and scope of the present application. The present application should not be limited to the content disclosed in the embodiments of the present application, and the protection scope of the present application is defined by the scope of the claims.

Claims

1. A DNS authorization security detection method, characterized in that, The method comprises the following steps: According to the domain name authorization scene construction requirement, data configuration is carried out; Through the message transceiver module, a query message is sent to the recursive resolution service; An authoritative simulator is constructed, which simulates the cascading authoritative resolution service and the attack target authoritative resolution service according to the data configuration, and dispatches the message transceiver module to receive and respond to the query message of the recursive resolution service; Through the message transceiver module, the response message of the recursive resolution service is received; The query message of the recursive resolution service received by the cascading authoritative resolution service and the attack target authoritative resolution service is counted, and the domain name authorization security risk of the recursive resolution service is analyzed.

2. The method of claim 1, wherein, The message transceiver module is used for bidirectional communication simulation: one is to simulate the client, send the query message to the recursive resolution service and receive the final response message; the other is the communication module of the authoritative simulator, which is dispatched by the authoritative simulator, used to receive the outgoing query message of the recursive resolution service and return the response message.

3. The method of claim 1, wherein, The authoritative simulator comprises a multi-layer authoritative resolution simulator and an attack target authoritative resolution simulator, which respectively simulate the cascading authoritative resolution service and the attack target authoritative resolution service.

4. The method of claim 1, wherein, According to the domain name authorization scene construction requirement, the data configuration comprises the following data: Zone suffix: define the zone suffix of all cascading zones and attack target zones; Parent-child cascade number: the number of parent-child cascades, which is also the number of cascading authoritative resolution service levels; Cascade zone name prefix: the naming rule of cascading zones at different levels is: "zone name prefix" + "cascade level number" + "parent-child cascade level number" + "previous cascade zone name" + "zone suffix"; Cascade zone NS number: the number of NSs of the next level cascade zone configured in the cascade zone; Attack target zone name: the zone name of the authoritative resolution service governed by the zone to which the attack behavior is finally directed; NS prefix pointing to the attack target zone and NS prefix for cascading: the NS of each level of authoritative resolution service includes the NS pointing to the attack target zone and the NS for cascading; the NS pointing to the attack target zone is: "NS prefix pointing to the attack target zone" + "number" + "attack target zone name"; the NS for cascading is: "NS prefix for cascading" + "next level cascade zone name"; Attack target zone response message: the response message returned by the attack target zone after receiving the query: NXDOMAIN or refuse message; Alias cascade number: the number of alias cascades; Authoritative resolution service listening IP: configure the listening IP of the cascading authoritative resolution service and the attack target authoritative resolution service.

5. The method of claim 4, wherein, The message transceiver module is used for bidirectional communication simulation: one is to simulate the client, send the query message to the recursive resolution service and receive the final response message; the other is the communication module of the authoritative simulator, which is dispatched by the authoritative simulator, used to receive the outgoing query message of the recursive resolution service and return the response message.

6. The method of claim 4, wherein, The authoritative simulator comprises a multi-layer authoritative resolution simulator and an attack target authoritative resolution simulator, which respectively simulate the cascading authoritative resolution service and the attack target authoritative resolution service. According to the domain name authorization scene construction requirement, the data configuration comprises the following data: Zone suffix: define the zone suffix of all cascading zones and attack target zones; Parent-child cascade number: the number of parent-child cascades, which is also the number of cascading authoritative resolution service levels; Cascade zone name prefix: the naming rule of cascading zones at different levels is: "zone name prefix" + "cascade level number" + "parent-child cascade level number" + "previous cascade zone name" + "zone suffix"; Cascade zone NS number: the number of NSs of the next level cascade zone configured in the cascade zone; Attack target zone name: the zone name of the authoritative resolution service governed by the zone to which the attack behavior is finally directed; NS prefix pointing to the attack target zone and NS prefix for cascading: the NS of each level of authoritative resolution service includes the NS pointing to the attack target zone and the NS for cascading; the NS pointing to the attack target zone is: "NS prefix pointing to the attack target zone" + "number" + "attack target zone name"; the NS for cascading is: "NS prefix for cascading" + "next level cascade zone name"; Attack target zone response message: the response message returned by the attack target zone after receiving the query: NXDOMAIN or refuse message; Alias cascade number: the number of alias cascades; Authoritative resolution service listening IP: configure the listening IP of the cascading authoritative resolution service and the attack target authoritative resolution service. The message transceiver module is used for bidirectional communication simulation: one is to simulate the client, send the query message to the recursive resolution service and receive the final response message; the other is the communication module of the authoritative simulator, which is dispatched by the authoritative simulator, used to receive the outgoing query message of the recursive resolution service and return the response message. The authoritative simulator comprises a multi-layer authoritative resolution simulator and an attack target authoritative resolution simulator, which respectively simulate the cascading authoritative resolution service and the attack target authoritative resolution service. According to the domain name authorization scene construction requirement, the data configuration comprises the following data: Query content: The query domain name sent by the message transceiver module to the recursive resolution service; Response content: Each level of the cascading authoritative resolution service returns the next level service of the cascading zone NS, the number and content of NS are determined according to the configuration; but if it is the last layer of the cascading authoritative resolution service, return the CNAME record pointing to the next level alias; Query content: The next level of the cascading zone name; Response content: Each level of the cascading authoritative resolution service returns the next level service of the cascading zone NS, the number and content of NS are determined according to the configuration; but if it is the last layer of the cascading authoritative resolution service, return the CNAME record pointing to the next level alias; Query content: A or AAA of NS for cascading; Response content: IP listened by the next level of the cascading authoritative resolution service; Query content: A or AAA of NS pointing to the attack target zone; Response content: According to the configuration, return the response message, including NXDOMAIN message, refuse message; Query content: The name of the cascading zone in this layer; Response content: SOA record of the cascading zone in this layer; Query content: Other domain names of non-cascading zones and attack target zones; Response content: Refuse message.

7. The method of claim 1, wherein, The statistical query process receives the query message of the recursive resolution service by each level of the cascading authoritative resolution service and the attack target authoritative resolution service, and analyzes the domain name authorization security risk of the recursive resolution service, including: 1) Statistics and analysis of the number and type of messages received by the cascading authoritative resolution service; 2) Statistics and analysis of the number and type of messages received by the attack target authoritative resolution service; 3) Integrate the analysis results of 1) and 2), analyze the processing logic of the recursive resolution server to the authorization record, and identify potential risks; if the number of query messages received by the attack target authoritative resolution service is linearly increased with the number of NS of the cascading zone, it indicates that the recursive resolution service does not implement reasonable restrictions on external authorization queries, and there is a NXNSAttack attack risk; if each level of the cascading authoritative resolution service receives query messages as the number of parent-child cascading increases, it indicates that the recursive resolution service does not limit the depth of domain name query, and may be used to construct a deep cascading attack chain, and there is a DDoS attack risk.

8. A DNS-Auth security detection apparatus, characterized by, It includes: A data configuration module for data configuration according to domain name authorization scene construction requirements; An authoritative simulator for simulating authoritative resolution services, divided into multiple layers of authoritative resolution simulators and attack target authoritative resolution simulators, respectively simulating cascading authoritative resolution services and attack target authoritative resolution services; A message transceiver module for bidirectional communication simulation: one is a simulated client that sends query messages to the recursive resolution service and receives the final response message; Two is the communication module of the authoritative simulator, which is dispatched by the authoritative simulator, used to receive the query message of the recursive resolution service and return the response message; A statistical analysis module for statistical analysis of the query message of the recursive resolution service received by the cascading authoritative resolution service and the attack target authoritative resolution service, and analysis of the domain name authorization security risk of the recursive resolution service.

9. A computer device, comprising: comprising a memory storing a computer program configured to be executed by a processor, the computer program comprising instructions for performing the method of any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, which, when executed by a computer, implements the method of any one of claims 1-7.

Images