Intranet information leakage detection method, apparatus and device, and readable storage medium

Abstract

The invention provides an intranet information leakage detection method, apparatus and device, and a readable storage medium. The method comprises the following steps: extracting a domain name which is analyzed to a preset intranet address field in PDNS data; determining an authoritative server of the domain name; generating an extended domain name according to the naming feature of the domain name; sending a DNS query message for querying the extended domain name to the authoritative server; and when the IP falling into the intranet address field exists in the analysis result of the extended domain name, generating a leakage record. According to the invention, non-aggressive intranet information leakage can be identified in a public network environment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a method and device for detecting information leakage in an internal network, and a readable storage medium. BACKGROUND

[0002] The Domain Name System (DNS) is one of the basic services of the Internet, used to implement the conversion between domain names and IP addresses. The DNS resolution process usually includes two stages of recursive query and authoritative response, and the user's resolution request will eventually be returned by the authoritative DNS server to the corresponding resource record. The openness and hierarchical structure of the system make it an important channel for information exchange, but also bring potential information leakage risks.

[0003] DNS leakage is a broad network information leakage phenomenon, which refers to the accidental exposure of internal information (such as private IP addresses, internal domain names that are not open for registration, server structure paths, etc.) that should be kept secret in the DNS name resolution process of the target network system, and captured by external observable parties. Once this information is collected and structured, it can become an important "side channel" for identifying internal network structure.

[0004] The prior art proposes a data leakage detection method, which includes the following steps: 1) Obtain a plurality of target DNS requests, and obtain the source IP address, second-level domain name and subdomain name of the second-level domain name in each target DNS request; 2) Divide the obtained plurality of subdomain names into a plurality of groups, wherein the subdomain names in the same group have the same source IP address and second-level domain name, and each group corresponds to a host in the local area network; 3) Splice the subdomain names in the same group to obtain a to-be-detected string; 4) Construct a feature vector corresponding to each group according to the to-be-detected string of each group; 5) Use an anomaly detection model to perform anomaly detection on the feature vector of each group to determine the host in the local area network that exists data leakage according to the detection result of each group.

[0005] The inventors have found that this technology relies on the acquisition of DNS request data within the local area network, and its premise is to deploy a detection device in the target network or have the right to collect traffic, so this method is only suitable for local controlled networks and cannot be used for leakage detection in unknown or external networks in public network environments, lacking wide applicability.

[0006] The prior art also proposes a DNS data leakage detection method based on multi-modal spatiotemporal characteristics, which includes the following steps: 1) For each DNS data stream, it is converted into several different modal images, retaining the timing information and location correlation of DNS data; 2) Spatiotemporal features are extracted from multi-modal, providing accurate deep features for DNS leakage data detection and improving the accuracy of DNS data leakage detection; 3) A deep feature extraction module based on deep residual shrinkage network is designed to integrate supplementary information from different modalities; 4) The deep residual shrinkage network is used to automatically extract deep DNS data leakage features due to its robustness to noise.

[0007] The inventors found that this method focuses on mining deep semantic anomalies in DNS traffic (such as encrypted channel features), thus ignoring active information leakage caused by DNS structural configuration errors (such as internal network resolution results leakage, improper configuration of public network authoritative records, etc.), and lacks the ability to identify "non-attack type leakage".

[0008] In summary, in the detection method of internal network information leakage provided by the prior art, either only applicable to local controlled networks, unable to detect DNS internal network information leakage in unknown or external networks in public network environment, lacking of wide adaptability, or focusing on feature detection of attack behavior, such as identifying hidden channels or abnormal encryption behavior through statistical features, deep model, identifying object mainly with malicious communication behavior, lacking of identification ability for non-attack type leakage caused by internal network resolution result leakage, improper configuration of public network authoritative records, ultimately making the detection effect poor when dealing with non-malicious but also risky DNS information leakage, and the coverage has blind area.

[0009] Therefore, how to identify non-attack type internal network information leakage in public network environment has become a technical problem to be solved in the field. SUMMARY

[0010] The purpose of the present application is to provide a detection method, device and equipment for internal network information leakage and a readable storage medium, which solves the above technical problems in the prior art.

[0011] In one aspect, to achieve the above-mentioned purpose, the present application provides a detection method for internal network information leakage.

[0012] The detection method for internal network information leakage comprises: extracting domain names in PDNS data that are resolved to a preset internal network address segment; determining the authoritative server of the domain name; generating an extended domain name according to the naming characteristics of the domain name; sending a DNS query message to query the extended domain name to the authoritative server; and when there is an IP falling into the internal network address segment in the resolution result of the extended domain name, generating a leakage record.

[0013] Further, the step of extracting the domain name resolved to the preset intranet address segment in the PDNS data comprises: loading the PDNS data into a big data computing framework; screening records with the resolution result located in the intranet address segment through the big data computing framework; and outputting a domain name and intranet address binary tuple set from the screening result.

[0014] Further, the step of determining the authoritative server of the domain name comprises: iteratively querying NS records of the domain name step by step; when the NS record of the domain name is queried, resolving the NS hostname in the NS record to an IP address and adding to a candidate IP address list; when the NS record of the domain name is not queried, querying the SOA record of the domain name to the upper layer authoritative DNS server; extracting the primary authoritative server hostname in the SOA record; resolving the primary authoritative server hostname to an IP address and adding to the candidate IP address list; sending a first DNS query packet for querying the domain name to the candidate IP address in the candidate IP address list; receiving and checking the AA flag in the response header of the first DNS query packet; and when the AA flag is 1, determining whether the candidate IP address points to the authoritative server of the domain name.

[0015] Further, after the step of determining the authoritative server of the domain name, before the step of generating the extended domain name according to the naming characteristics of the domain name, the method further comprises: sending a second DNS query packet for querying the domain name to the authoritative server; receiving and checking the AA flag in the response header of the second DNS query packet; and when the AA flag is 1 and there is an IP falling into the intranet address segment in the resolution result corresponding to the second DNS query packet, performing the step of generating the extended domain name according to the naming characteristics of the domain name.

[0016] Further, the step of generating the extended domain name according to the naming characteristics of the domain name comprises: splitting a variable field from the domain name; constructing a programmable extended domain name template according to the rule of the variable field; and generating the extended domain name by enumerating variable field combinations using the domain name template.

[0017] Further, the variable field comprises a number sequence field, a city abbreviation field and a service type field.

[0018] Further, the leakage record comprises the domain name, the extended domain name, the authoritative server and the resolution result.

[0019] In another aspect, in order to achieve the above-mentioned purpose, the application provides an intranet information leakage detection device.

[0020] The internal network information leakage detection device comprises: an extraction module configured to extract domain names in PDNS data that are resolved to a preset internal network address segment; a determination module configured to determine an authoritative server of the domain names; a first processing module configured to generate extended domain names according to naming features of the domain names; a sending module configured to send a DNS query message for querying the extended domain names to the authoritative server; and a generation module configured to generate a leakage record when an IP falling into the internal network address segment exists in a resolution result of the extended domain names.

[0021] In another aspect, to achieve the above object, the application further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0022] In another aspect, to achieve the above object, the application further provides a computer readable storage medium, which stores a computer program, wherein the computer program is executable on a processor to implement the steps of the above method.

[0023] The internal network information leakage detection method, device, equipment and readable storage medium provided by the application first extract domain names whose resolution results fall into a preset internal network address segment from PDNS data, then determine authoritative servers of the domain names, then generate a plurality of extended domain names according to naming features of each domain name, then send DNS query messages to corresponding authoritative servers to resolve the extended domain names, and when an IP falling into the preset internal network address segment appears again in a resolution result of an extended domain name, a leakage record is generated. Through the application, based on extraction of historical PDNS clues, confirmation of authoritative servers and active detection of extended domain names, effective identification of unknown or external network non-attack type DNS internal network information leakage in a public network environment is realized, the method can discover risks caused by improper domain name configuration or resolution leakage without relying on a local controlled network, significantly expands the detection coverage and improves the detection accuracy of misconfiguration type leakage scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0024] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included to provide a description of the preferred embodiments and are not intended to limit the scope of the application. Moreover, the same reference numerals in different figures represent the same or similar components. In the drawings: Figure 1 A flowchart of the internal network information leakage detection method provided for the first embodiment of the application; Figure 2 A block diagram of the internal network information leakage detection device provided for the second embodiment of the application; Figure 3The hardware structure diagram of the computer device provided for the third embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0025] In order to make the objectives, technical solutions and advantages of the present application clearer and more comprehensible, the present application will be further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making any creative efforts are within the scope of protection of the present application.

[0026] Embodiment One The embodiment of the present application provides a detection method for internal network information leakage. Through the method, non-attack type internal network information leakage can be identified in a public network environment. Specifically, Figure 1 The flowchart of the detection method for internal network information leakage provided for the first embodiment of the present application is shown in the figure. Figure 1 The detection method for internal network information leakage provided by the embodiment includes the following steps S101 to S105.

[0027] Step S101: Extract the domain name in the PDNS data that is resolved to the preset internal network address segment.

[0028] PDNS (Passive DNS, passive domain name resolution) refers to a database system that establishes historical DNS mapping relationship by passively collecting DNS resolution request and response records in the network. Unlike active DNS query, PDNS does not directly initiate a resolution request to the DNS server, but listens to and receives the DNS traffic of real users. Therefore, the acquisition of PDNS data does not require the cooperation of the target network and does not require invasive collection.

[0029] The internal network address segment is a set of IP network prefixes that are only used for internal use of a closed network and cannot be globally routed on the public Internet, which is defined in advance by a configuration file or a code constant table. Optionally, the internal network address segment is determined according to the ETF standard private address space, industry / regulatory recommended prefix and target network self-defined internal prefix.

[0030] In this step, it is found from the PDNS data that the domain name is resolved to the preset internal network address segment, and the possible internal network information leakage clues are preliminarily identified. Further, all domain names resolved to the internal network address segment and the corresponding IP in the PDNS data are extracted by using the Spark big data technology, which provides basic data for subsequent screening, verification and domain name construction.

[0031] Step S102: Determine the authoritative server of the domain name.

[0032] The authoritative server of the domain name refers to the DNS server that has the final resolution right of the domain name. For the leaked domain name obtained in step S101, the authoritative server of the leaked domain name is determined through the joint determination of the DNS NS record and the SOA record in this step. First, the NS record corresponding to the domain name is extracted and parsed into an IP address; when the NS record information is incomplete or there is redirection, the SOA record is further queried to obtain the master authoritative server information. Finally, the original DNS request is initiated to the candidate server, and whether the AA flag bit is included is combined to determine the authority, and the authoritative server of the domain name is determined.

[0033] Step S103: generating an extended domain name according to the naming characteristics of the domain name.

[0034] In this step, the naming characteristics (such as containing a number field, a city abbreviation, an environment label, a service type field, etc.) are extracted from the domain name identified in step S101, a semantic template of the domain name is constructed, and a candidate internal domain name with similar structure is automatically generated as an extended domain name, so as to obtain a wider domain name list. The extended domain name is obtained according to the naming characteristics of the domain name, and the structure is similar to the original domain name but belongs to a new domain name that has not appeared in the PDNS.

[0035] Step S104: sending a DNS query packet for querying the extended domain name to the authoritative server.

[0036] Based on the domain name list constructed in step S103, the active DNS detection request is initiated to the vulnerable DNS authoritative server found in the foregoing steps, and further active verification operation is carried out.

[0037] Step S105: generating a leakage record when there is an IP falling into the intranet address segment in the resolution result of the extended domain name.

[0038] In this step, when there is an IP falling into the intranet address segment in the resolution result of the extended domain name, the intranet information leakage situation can be further confirmed, at this time, a leakage record is generated, an intranet information leakage database is constructed, and it is saved to evaluate the actual range and influence scale of the intranet information leakage. Optionally, in an embodiment, the leakage record includes a domain name, an extended domain name, an authoritative server, and a resolution result.

[0039] In the method for detecting internal network information leakage provided in this embodiment, first, domain names with resolving results falling into a preset internal network address segment are extracted from PDNS data, then the authoritative servers of these domain names are determined, and then a plurality of extended domain names are generated according to the naming characteristics of each domain name, then a DNS query packet is sent to the corresponding authoritative server to resolve these extended domain names, and when the resolving result of a certain extended domain name again appears an IP in the preset internal network address segment, a leakage record is generated. By using the method for detecting internal network information leakage provided in this embodiment, through the extraction of historical PDNS clues, the confirmation of authoritative servers, and the active detection of extended domain names, effective identification of unknown or external network non-attack type DNS internal network information leakage in a public network environment is realized. This method can discover risks caused by improper domain name configuration or external leakage without relying on a local controlled network, significantly expanding the detection coverage and improving the detection accuracy of misconfiguration leakage scenarios.

[0040] Optionally, in an embodiment, the step of extracting domain names resolved to the preset internal network address segment in the PDNS data comprises: loading the PDNS data into a big data computing framework; screening records with resolving results in the internal network address segment through the big data computing framework; and outputting a domain name and internal network address binary tuple set from the screening results.

[0041] Specifically, the PDNS data refers to a passive domain name system log file, which is usually stored in Parquet, Avro or JSON format, and contains time stamp, query domain name (QNAME), response record type (RRType), resolving IP (rdata_ip) and the like. ApacheSpark3.5.0 running on a Yarn cluster or a big data computing framework such as Flink, Presto and the like can be used. First, batch PDNS data is loaded into the big data computing framework, and then the distributed computing capability of the framework is used to screen out log records with resolving IP falling into the preset internal network address segment, for example, UDFisPrivateIp(rdata_ip) is called on SparkDataFrame, O(logN) prefix matching filtering is performed, and only rows with resolving IP falling into the preset internal network address segment are retained. Finally, the domain name and the corresponding internal network address are extracted from the screening results, and output as a binary tuple set, <domain, private_ip> unique pair, written back to distributed storage, providing data basis for subsequent detection steps.

[0042] By using the method for detecting internal network information leakage provided in this embodiment, the parallel processing and memory broadcast characteristics of the big data computing framework are fully utilized, the domain names resolved to the internal network address can be quickly located in the massive logs (TB level), high-throughput and low-latency data preprocessing is realized, the input data of the subsequent authoritative server confirmation and active detection links is ensured to be comprehensive and accurate, and the efficiency and scalability of the overall internal network information leakage detection link are improved.

[0043] Optionally, in an embodiment, the step of determining the authoritative server of the domain name comprises: iteratively querying the NS record of the domain name step by step; when the NS record of the domain name is queried, resolving the NS host name in the NS record to an IP address and adding to the candidate IP address list; when the NS record of the domain name is not queried, querying the SOA record of the domain name to the upper layer authoritative DNS server; extracting the host name of the primary authoritative server in the SOA record; resolving the host name of the primary authoritative server to an IP address and adding to the candidate IP address list; sending the first DNS query message of the domain name to the candidate IP address in the candidate IP address list; receiving and checking the AA flag in the response header of the first DNS query message; and when the AA flag is 1, determining whether the candidate IP address points to the authoritative server of the domain name.

[0044] Specifically, the NS record is used to declare which authoritative servers manage a certain domain name, and the record value is the host name (FQDN) of the authoritative server. In this embodiment, the NS is first requested to the root server, and then the top-level domain (TLD) server, the parent area server, and so on are accessed in turn until the NS record of the current layer is returned, the NS host name in the NS record is resolved to an IP address, the IP address of the authoritative server of the domain name is obtained, and is added to the candidate IP address list. When the NS record information is incomplete or there is redirection, the NS record of the domain name is not queried, the SOA record of the domain name is queried to the upper layer authoritative DNS server, and the authoritative clue is supplemented. The field mname in the SOA record identifies the host name of the primary authoritative server, the host name of the primary authoritative server is resolved to an IP address, and is added to the candidate IP address list.

[0045] The IP address set obtained by resolving the host name of the authoritative server from the NS or SOA with A / AAAA query is stored after deduplication to form the final candidate IP address list. RD=0, QNAME=target domain name, QTYPE=A (or AAAA) are set, and the candidate IP is directly targeted. The AA (Authoritative Answer) bit in the response header of the candidate IP is used to judge whether the returner is authoritative. The 6th bit of the DNS response header is 1, indicating that the server is the authoritative server of the queried domain name, otherwise it is not the authoritative server.

[0046] By using the detection method for internal network information leakage provided in the embodiment, through the closed loop mechanism of step-by-step iteration, NS priority, SOA supplement and AA verification, the real authoritative server of the target domain name can be accurately located without any pre-trust or additional network detection, the misjudgment caused by missing NS record, CNAME rewriting or partition delegation is avoided, the subsequent parsing and verification steps are ensured to be performed only on the real authoritative server, and therefore the accuracy and stability of the internal network information leakage detection link are improved.

[0047] Optionally, in an embodiment, after the step of determining the authoritative server of the domain name, and before the step of generating the extended domain name according to the naming feature of the domain name, the method further comprises: sending a second DNS query message for querying the domain name to the authoritative server; receiving and checking the AA flag in the response header of the second DNS query message; and when the AA flag is 1 and there is an IP falling into the intranet address segment in the resolution result corresponding to the second DNS query message, performing the step of generating the extended domain name according to the naming feature of the domain name.

[0048] In this embodiment, after determining the authoritative server of the domain name, and before generating the extended domain name based on the domain name, the authoritative server is verified again. Specifically, a DNS query message for querying the domain name is sent to the authoritative server in real time. If the AA flag in the response header is 1, and there is still an IP falling into the intranet address segment in the resolution result of the query message, it indicates that the current leakage risk still exists. On this basis, the step of generating the extended domain name according to the naming feature of the domain name is performed. If the AA flag is not 1, it indicates that the response is not authoritative. The authoritative server of the domain name is determined again until the real authoritative server with AA = 1 is found or the candidate IP address list is exhausted. If the resolution IP is not in the preset intranet address segment, the domain name is marked, the extended domain name generation is not performed, and the detection processing of the next domain name is directly entered. And a query is re-initiated after a fixed period of time or a delay.

[0049] By using the detection method for intranet information leakage provided in this embodiment, based on the secondary measurement mechanism, by adding the threshold of real-time resolution and private network IP confirmation of the authoritative server before the extended detection, it can be dynamically determined whether the leakage still continues, avoiding false detection due to invalid historical PDNS records or internal configuration repair, so as to ensure that the subsequent extended domain name enumeration and batch detection are only performed on the premise that there is a current leakage risk, which not only improves the monitoring accuracy, but also saves the subsequent detection resources.

[0050] Optionally, in an embodiment, the step of generating the extended domain name according to the naming feature of the domain name comprises: splitting a variable field from the domain name; constructing a programmable extended domain name template according to the rule of the variable field; and generating the extended domain name by enumerating the variable field combination and using the domain name template. Further optionally, in an embodiment, the variable field comprises a digital serial number field, a city abbreviation field and a service type field.

[0051] Specifically, the complete domain name is split into labels according to delimiters such as a dot "." and a hyphen "-" by using a regular expression, a word segmentation rule or a partition model based on training, and a number string, a city or region abbreviation or a business / environment identifier (test, api, prod, etc.) is detected in each label as a variable field. A fixed part in the domain name is reserved as a constant, and the variable field is represented by a placeholder to form a domain name template, which is stored in JSON or code class definition for direct reading by a subsequent enumeration script. When generating extended domain names by using the domain name template, a preset value range or a generation strategy is set for each placeholder, and a Cartesian product or a hierarchical traversal algorithm is used to batch generate the extended domain names. In the enumeration process, a maximum upper limit or a blacklist is set to control the scale. The number sequence field includes consecutive or leading zero numbers such as 01, 02 and 100. The city abbreviation field is an ISO city code or an enterprise internal abbreviation such as ty (Tokyo) and os (Osaka). The service type field represents a function or an environment such as api, web, prod and test.

[0052] In the method for detecting internal network information leakage provided in the embodiment, the variable fields are first split from the original domain name, then the programmable extended domain name template is constructed according to the value range of the variable fields, and the extended domain names are batch generated by enumerating the combinations of the variable fields by using the template. By using the method for detecting internal network information leakage provided in the embodiment, potential internal domain names with similar structures but not yet appearing in the PDNS data can be systematically derived, the monitoring range is expanded for subsequent active DNS detection, and the coverage rate and discovery efficiency of the misconfiguration type internal network information leakage are greatly improved by parameterized template and automatic enumeration, avoiding manual speculation omission.

[0053] Embodiment Two Corresponding to the above-mentioned embodiment one, the embodiment two of the present application provides a detection device for internal network information leakage. The corresponding technical features and the corresponding technical effects can be referred to the above-mentioned embodiment one, which will not be repeated in this embodiment. Figure 3 The block diagram of the detection device for internal network information leakage provided in the embodiment two of the present application is shown in Figure 3 The device includes an extraction module 201, a determination module 202, a first processing module 203, a sending module 204 and a generation module 205.

[0054] The extraction module 201 is configured to extract a domain name in the PDNS data which is resolved to a preset intranet address segment; the determination module 202 is configured to determine an authoritative server of the domain name; the first processing module 203 is configured to generate an extended domain name according to a naming feature of the domain name; the sending module 204 is configured to send a DNS query message for querying the extended domain name to the authoritative server; and the generation module 205 is configured to generate a leakage record when there is an IP falling into the intranet address segment in a resolution result of the extended domain name.

[0055] Optionally, in an embodiment, the extraction module comprises: a loading unit configured to load the PDNS data to a big data computing framework; a screening unit configured to screen, by the big data computing framework, a record whose resolution result is located in the intranet address segment; and an output unit configured to output a domain name and intranet address binary tuple set from the screening result.

[0056] Optionally, in an embodiment, the determination module comprises: a first query unit configured to iteratively query NS records of the domain name level by level; a first resolution unit configured to, when the NS records of the domain name are queried, resolve NS hostnames in the NS records to IP addresses and add the NS hostnames to a candidate IP address list; a second query unit configured to, when the NS records of the domain name are not queried, query SOA records of the domain name from an upper-level authoritative DNS server; an extraction unit configured to extract a primary authoritative server hostname from the SOA records; a second resolution unit configured to resolve the primary authoritative server hostname to an IP address and add the IP address to the candidate IP address list; a third query unit configured to send a first DNS query message for querying the domain name to a candidate IP address in the candidate IP address list; a processing unit configured to receive and check an AA flag in a response header of the first DNS query message; and a determination unit configured to determine whether the candidate IP address points to the authoritative server of the domain name when the AA flag is 1.

[0057] Optionally, in an embodiment, after the determination module determines the authoritative server of the domain name, and before the first processing module generates the extended domain name according to the naming feature of the domain name, the apparatus further comprises: a query module configured to send a second DNS query message for querying the domain name to the authoritative server; a second processing module configured to receive and check an AA flag in a response header of the second DNS query message; and the first processing module is further configured to, when the AA flag is 1 and there is an IP falling into the intranet address segment in a resolution result corresponding to the second DNS query message, execute the step of generating the extended domain name according to the naming feature of the domain name.

[0058] Optionally, in an embodiment, the first processing module comprises: a splitting unit configured to split a variable field from the domain name; a constructing unit configured to construct a programmable extension domain name template according to a rule of the variable field; and a generating unit configured to generate the extension domain name by enumerating variable field combinations using the domain name template.

[0059] Optionally, in an embodiment, the variable field comprises a number sequence field, a city abbreviation field and a service type field.

[0060] Optionally, in an embodiment, the leakage record comprises the domain name, the extension domain name, the authoritative server and the resolution result.

[0061] Embodiment Three The present embodiment also provides a computer device, such as a smartphone, a tablet computer, a notebook computer, a desktop computer, a rack server, a blade server, a tower server or a cabinet server (including a single server or a server cluster composed of multiple servers), etc. that can execute programs. As shown in Figure 3 The computer device 01 of the present embodiment at least includes but is not limited to a memory 012 and a processor 011 that can be communicatively connected through a system bus, as shown. It should be noted that Figure 3 Figure 3 Only the computer device 01 with the components memory 012 and processor 011 is shown, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be alternatively implemented.

[0062] ​In this embodiment, the memory 012 (i.e., a readable storage medium) includes a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, etc. In some embodiments, the memory 012 can be an internal storage unit of the computer device 01, such as a hard disk or a memory of the computer device 01. In other embodiments, the memory 012 can also be an external storage device of the computer device 01, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the computer device 01. Of course, the memory 012 can also include both the internal storage unit and the external storage device of the computer device 01. In this embodiment, the memory 012 is generally used to store an operating system and various types of reference software installed on the computer device 01, such as the program code of the internal network information leakage detection apparatus of Embodiment Two, etc. In addition, the memory 012 can also be used to temporarily store various types of data that have been output or will be output.

[0063] The processor 011 can be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip in some embodiments. The processor 011 is generally used to control the overall operation of the computer device 01. In this embodiment, the processor 011 is used to run the program code or process data stored in the memory 012, such as the internal network information leakage detection method, etc.

[0064] Embodiment Four This embodiment also provides a computer readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, a server, an App reference mall, etc., having a computer program stored thereon, which, when executed by a processor, implements a corresponding function. The computer readable storage medium of this embodiment is used to store the internal network information leakage detection apparatus, which, when executed by the processor, implements the internal network information leakage detection method of Embodiment One.

[0065] It should be noted that, in this text, the term "comprising", "including" or any other variant thereof is intended to cover a non-exclusive inclusion, so that a process, method, article or apparatus that includes a list of elements not only includes those elements, but also includes other elements not expressly listed or inherent to such process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of other identical elements in the process, method, article or apparatus that includes the element.

[0066] The above-mentioned embodiment numbers of the application are only for description, not representing the advantages and disadvantages of the embodiments.

[0067] Through the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be realized by software and the necessary general hardware platform, of course, they can also be realized by hardware, but in many cases the former is a better embodiment.

[0068] The above is only the preferred embodiment of the application, and does not limit the patent scope of the application, any equivalent structure or equivalent process transformation, or direct or indirect application in other related technical fields, are also included in the patent protection scope of the application.

Claims

1. A method for detecting an internal network information leakage, characterized by, The method comprises: extracting domain names in PDNS data resolved to a preset intranet address segment; determining the authoritative server of the domain name; generating an extended domain name according to the naming characteristics of the domain name; sending a DNS query message to the authoritative server to query the extended domain name; and generating a leakage record when there is an IP falling into the intranet address segment in the resolution result of the extended domain name. The step of extracting domain names in PDNS data resolved to a preset intranet address segment comprises:

2. The method of detecting internal network information leakage according to claim 1, wherein loading PDNS data into a big data computing framework; screening records with resolution results located in the intranet address segment through the big data computing framework; and outputting a domain name and intranet address binary tuple set from the screening results. The step of determining the authoritative server of the domain name comprises:

3. The method of detecting internal network information leakage according to claim 1, wherein iteratively querying NS records of the domain name level by level; when the NS record of the domain name is queried, resolving the NS hostname in the NS record to an IP address and adding it to a candidate IP address list; when the NS record of the domain name cannot be queried, querying the SOA record of the domain name to the upper-level authoritative DNS server; extracting the primary authoritative server hostname from the SOA record; resolving the primary authoritative server hostname to an IP address and adding it to the candidate IP address list; sending a first DNS query message to query the domain name to the candidate IP address in the candidate IP address list; receiving and checking the AA flag in the response header of the first DNS query message; and when the AA flag is 1, determining whether the candidate IP address points to the authoritative server of the domain name. After the step of determining the authoritative server of the domain name and before the step of generating an extended domain name according to the naming characteristics of the domain name, the method further comprises:

4. The method of detecting internal network information leakage according to claim 3, wherein, sending a second DNS query message to query the domain name to the authoritative server; receiving and checking the AA flag in the response header of the second DNS query message; and when the AA flag is 1 and there is an IP falling into the intranet address segment in the resolution result corresponding to the second DNS query message, performing the step of generating an extended domain name according to the naming characteristics of the domain name. The step of generating an extended domain name according to the naming characteristics of the domain name comprises:

5. The method of detecting internal network information leakage according to claim 1, wherein, splitting a variable field from the domain name; constructing a programmable domain name template according to the rules of the variable field; and generating the extended domain name by enumerating variable field combinations using the domain name template. The variable field comprises a number sequence field, a city abbreviation field, and a service type field.

6. The method of detecting internal network information leakage according to claim 5, wherein, The leakage record comprises the domain name, the extended domain name, the authoritative server, and the resolution result.

7. The method of detecting internal network information leakage according to claim 1, wherein, The method comprises:

8. A device for detecting intranet information leakage, characterized in that, an extraction module for extracting domain names in PDNS data resolved to a preset intranet address segment; a determination module for determining the authoritative server of the domain name; a first processing module for generating an extended domain name according to the naming characteristics of the domain name; a sending module for sending a DNS query message to the authoritative server to query the extended domain name; and a generation module for generating a leakage record when there is an IP falling into the intranet address segment in the resolution result of the extended domain name. ​ ​ 9. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 7.

10. A computer readable storage medium having stored thereon a computer program, characterized in that: The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 7.

Images