Domain name resource record ttl tampering trace positioning method based on resolution chain reasoning

Abstract

The application discloses a domain name resource record TTL tampering tracing positioning method based on analytic chain reasoning and belongs to the technical field of Internet security monitoring. The method comprises the following steps: deploying a system, the system comprising a special server for managing domain names, a plurality of forwarders and a plurality of recursive resolvers located upstream of the forwarders, and setting a TTL reference value stored in the special server; selecting a target forwarder, a user initiating a plurality of DNS query requests with time intervals to the target forwarder; determining the cache mode of the target forwarder based on the TTL values in the responses corresponding to the DNS query requests, and determining the object that tampers the TTL reference value based on the cache mode of the target forwarder and the TTL values in the responses corresponding to the DNS query requests. The application is used for realizing hierarchical positioning of the TTL tampering responsibility party.

Description

Technical Field

[0001] This invention belongs to the field of Internet security monitoring technology, and in particular relates to a method for tracing and locating domain name resource record TTL tampering based on parsing chain reasoning. Background Technology

[0002] In the Domain Name System (DNS), the forwarding resolver (or simply forwarder) acts as the entry point for users to access the internet, undertaking the crucial function of relaying queries. Caching mechanisms refer to storing recently resolved resource records to reduce the frequency of repeated queries for the same domain name, thereby reducing network load and improving DNS resolution efficiency. In the context of forwarders, their caching behavior directly impacts resolution latency, system stability, and security risks.

[0003] In the caching mechanism of the Domain Name System (DNS) forwarder, there are two main operating modes: The first mode is the independent caching mode, which means that the forwarder builds and maintains its own local DNS resource record (RR) cache copy. When a user initiates a query, the forwarder first searches the local cache. If a valid record exists, it responds directly without querying the upstream. Only when the cache is missing or invalid will it relay the query to the upstream recursive resolver, achieving traffic localization through local storage and autonomous decision-making. The second mode is the transparent caching mode, which means that the forwarder only acts as a query relay agent and does not maintain any cache itself. All queries are directly forwarded to the upstream recursive resolver for processing. After the resolver returns the result, the forwarder transparently passes it to the user. Its caching logic completely depends on the upstream, and the forwarder does not need to manage the cache, thus significantly reducing the complexity of development and maintenance.

[0004] In the Domain Name System (DNS), the Time To Live (TTL) is typically set by the domain registrar. However, current research has found that DNS resolvers frequently violate TTL rules, meaning that resolvers do not strictly adhere to the set TTL when processing resource records, arbitrarily extending or shortening the TTL. This unauthorized modification of the TTL by forwarders impacts the stability and security of the DNS system.

[0005] The current mainstream method for determining the location of TTL violations is to send query requests to multiple authoritative DNS servers and compare the returned TTL values ​​with the results from the local DNS resolver. If the TTL value returned by the local resolver differs significantly from that of the authoritative servers, there may be local cache tampering or the forwarder illegally shortening the TTL. This method is suitable for detecting abnormal behavior such as ISP DNS hijacking or router DNS proxying. In addition, log analysis of the resolver is also a common method, which involves examining the logs of the recursive resolver or forwarder to observe the TTL value processing flow. For example, the logs should record the TTL decrementing process of the local cache (e.g., the initial query TTL = 3600 seconds, decreasing to 3300 seconds after 300 seconds); if the logs show abrupt changes in the TTL value, there may be cache synchronization failure or an upstream recursive resolver malfunction.

[0006] Since the repeater is downstream of the recursive resolver, if it illegally modifies the TTL in independent caching mode, log analysis can detect the anomaly by comparing the TTL received recursively from the upstream repeater with the TTL returned to the client. However, this method cannot detect TTL tampering occurring in the upstream recursive resolver. Furthermore, current technology relies heavily on passive detection and lacks proactive detection mechanisms. Relying solely on log analysis to passively discover problems without actively injecting probe signals means that the data needed for tracing origins may be from the operator, potentially leading to data forgery and other issues, resulting in tracing failures or even disputes.

[0007] In summary, due to the complex relationship between forwarders and recursive resolvers in the DNS resolver ecosystem, existing studies, when analyzing TTL violations, are unable to locate specific nodes in the resolution link across different levels. It is difficult to accurately distinguish whether TTL tampering occurred on a forwarder or a recursive resolver, and it is impossible to accurately pinpoint the responsible party for the TTL violation. Therefore, we urgently need a method that can accurately trace and identify the specific level at which the violation occurred. Summary of the Invention

[0008] This invention proposes a method for tracing and locating domain resource record TTL tampering based on parsing chain reasoning, thereby solving the technical problems mentioned above.

[0009] The first aspect of this invention proposes a method for tracing and locating domain name resource record (TTL) tampering based on parse chain reasoning, the method comprising:

[0010] Step S1: Deploy the system, which includes a dedicated server for managing domain names, multiple forwarders, and several recursive resolvers located upstream of the forwarders. There is a many-to-many correspondence between the forwarders and the recursive resolvers they directly route to; set the TTL baseline value stored on the dedicated server.

[0011] Step S2: Select the target forwarder, and the user sends multiple DNS query requests with time intervals to the target forwarder;

[0012] The response to each DNS query request, including the unique subdomain of the dedicated server and the TTL value, is returned by the target forwarder. The caching mode of the target forwarder is determined based on the TTL value in the response to each DNS query request. The object that tampered with the TTL base value is determined based on the caching mode of the target forwarder and the TTL value in the response to each DNS query request.

[0013] The target forwarder's caching modes include independent caching mode and transparent caching mode. In independent caching mode, the target forwarder itself caches and maintains local domain name resource records; in transparent caching mode, the target forwarder does not maintain local domain name resource records.

[0014] When the target forwarder is in transparent caching mode, and when the target forwarder is in independent caching mode and the target forwarder's own cache does not hit the DNS query request, the DNS query request is sequentially routed through the target forwarder and the recursive resolver directly routed by the target forwarder to the dedicated server, and the dedicated server returns the response corresponding to the DNS query request.

[0015] When the target forwarder is in independent caching mode and its own cache hits a DNS query request, the target forwarder returns the response corresponding to the DNS query request.

[0016] Preferably, in step S2, determining the caching mode of the target forwarder based on the TTL value in the response to each DNS query request includes:

[0017] Sort all TTL values ​​according to the time order of the response returned for each DNS query request. If the sorting result is linearly decreasing, the caching mode is independent caching mode.

[0018] Sort all TTL values ​​according to the time sequence of the responses returned for each DNS query request. If the sorting result shows multiple linear jumps, the caching mode is transparent caching mode.

[0019] Preferably, in step S2, determining the object whose TTL baseline value has been tampered with based on the target forwarder's caching mode and the TTL value in the response to each DNS query request includes:

[0020] The recursive resolver directly routed to by the target forwarder is denoted as the directly connected recursive resolver;

[0021] When the target repeater is in independent buffer mode and there is a TTL value that deviates from the TTL baseline:

[0022] When all TTL values ​​are equal and deviate from the TTL baseline value, the final tracing result is that the target repeater tampered with the TTL baseline value;

[0023] When the TTL value partially deviates from the TTL baseline value and partially matches the TTL baseline value, the initial tracing result is that the direct-connect recursive parser tampered with the TTL baseline value;

[0024] When the target repeater is in transparent buffer mode and there are TTL values ​​that deviate from the TTL baseline value, the TTL values ​​received by the user are sorted according to the time order returned from the dedicated server to obtain the TTL sequence; when the TTL values ​​in the TTL sequence show a linear decreasing trend, the preliminary tracing result is that the direct-connect recursive parser tampered with the TTL baseline value.

[0025] Based on the system's network topology and preliminary tracing results, the final tracing result is determined.

[0026] Preferably, based on the system's network topology and preliminary tracing results, the final tracing results are determined, including:

[0027] The same DNS auxiliary query task is initiated to each of the other forwarders, which are forwarders that use the same direct recursive resolver as the target forwarder; the DNS auxiliary query task accesses the dedicated server via the other forwarders and the direct recursive resolver; the TTL value in the response corresponding to each DNS auxiliary query task is obtained;

[0028] If the TTL values ​​in the responses of all other repeaters deviate from the TTL baseline value, the final tracing result is that the direct-connect recursive parser tampered with the TTL baseline value;

[0029] If some of the TTL values ​​in the responses of all other transponders do not deviate from the TTL baseline value, then the final tracing result is that the target transponder tampered with the TTL baseline value.

[0030] Preferably, the TTL baseline value is configured by the dedicated server based on the resource records under its domain name.

[0031] Preferably, deviation from the TTL reference value means that the TTL value in the response is not equal to the TTL reference value.

[0032] Preferably, the TTL value in the TTL sequence exhibits a linear decreasing trend, and the determination method is as follows:

[0033] By fitting a linear equation to all TTL values ​​in the TTL sequence, the coefficients of determination R and R' of the linear equation are determined. 2 When the TTL value is greater than or equal to the discrimination value, it is determined that the TTL value in the TTL sequence shows a linear decreasing trend.

[0034] A second aspect of this invention proposes a domain name resource record TTL tampering tracing and location device based on parse chain reasoning, the device comprising:

[0035] Initialization module: Configured for system deployment. The system includes a dedicated server for managing domain names, multiple forwarders, and several recursive resolvers located upstream of the forwarders. There is a many-to-many correspondence between the forwarders and the recursive resolvers they directly route to; Set the TTL baseline value stored on the dedicated server.

[0036] Location module: Configured to select a target forwarder, the user initiates multiple DNS query requests with time intervals to the target forwarder;

[0037] The response to each DNS query request, including the unique subdomain of the dedicated server and the TTL value, is returned by the target forwarder. The caching mode of the target forwarder is determined based on the TTL value in the response to each DNS query request. The object that tampered with the TTL base value is determined based on the caching mode of the target forwarder and the TTL value in the response to each DNS query request.

[0038] The target forwarder's caching modes include independent caching mode and transparent caching mode. In independent caching mode, the target forwarder itself caches and maintains local domain name resource records; in transparent caching mode, the target forwarder does not maintain local domain name resource records.

[0039] When the target forwarder is in transparent caching mode, and when the target forwarder is in independent caching mode and the target forwarder's own cache does not hit the DNS query request, the DNS query request is sequentially routed through the target forwarder and the recursive resolver directly routed by the target forwarder to the dedicated server, and the dedicated server returns the response corresponding to the DNS query request.

[0040] When the target forwarder is in independent caching mode and its own cache hits a DNS query request, the target forwarder returns the response corresponding to the DNS query request.

[0041] A third aspect of the present invention provides an electronic device, the electronic device comprising:

[0042] At least one processor; and

[0043] A memory communicatively connected to the at least one processor; wherein,

[0044] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method as described above.

[0045] A fourth aspect of the present invention provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to perform the method described above.

[0046] This invention identifies the party responsible for TTL tampering by analyzing the DNS caching behavior of forwarders and resolvers. Applicable to DNS protocol compliance auditing and security threat assessment, this invention employs a dual-path verification strategy combined with a caching behavior pre-classification mechanism to achieve hierarchical identification of the party responsible for TTL tampering. Through hierarchical detection, it solves the core problem of existing technologies' inability to distinguish whether tampering occurs at the forwarder layer or the recursive resolver layer. By actively probing, it can accurately identify DNS resource record TTL tampering behavior and pinpoint the responsible party, providing technical support for DNS protocol compliance auditing. Attached Figure Description

[0047] Figure 1 This is a flowchart illustrating the domain name resource record TTL tampering tracing and location method based on parsing chain reasoning provided by the present invention. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0049] like Figure 1 As shown, a method for tracing and locating domain resource record (TTL) tampering based on parse chain reasoning includes:

[0050] Step S1: Deploy the system, which includes a dedicated server for managing domain names, multiple forwarders, and several recursive resolvers located upstream of the forwarders. There is a many-to-many correspondence between the forwarders and the recursive resolvers they directly route to; set the TTL baseline value stored on the dedicated server.

[0051] Step S2: Select the target forwarder, and the user sends multiple DNS query requests with time intervals to the target forwarder;

[0052] The response to each DNS query request, including the unique subdomain of the dedicated server and the TTL value, is returned by the target forwarder. The caching mode of the target forwarder is determined based on the TTL value in the response to each DNS query request. The object that tampered with the TTL base value is determined based on the caching mode of the target forwarder and the TTL value in the response to each DNS query request.

[0053] The target forwarder's caching modes include independent caching mode and transparent caching mode. In independent caching mode, the target forwarder itself caches and maintains local domain name resource records; in transparent caching mode, the target forwarder does not maintain local domain name resource records.

[0054] When the target forwarder is in transparent caching mode, and when the target forwarder is in independent caching mode and the target forwarder's own cache does not hit the DNS query request, the DNS query request is sequentially routed through the target forwarder and the recursive resolver directly routed by the target forwarder to the dedicated server, and the dedicated server returns the response corresponding to the DNS query request.

[0055] When the target forwarder is in independent caching mode and its own cache hits a DNS query request, the target forwarder returns the response corresponding to the DNS query request.

[0056] Further, in step S2, determining the caching mode of the target forwarder based on the TTL value in the response to each DNS query request includes:

[0057] Sort all TTL values ​​according to the time order of the response returned for each DNS query request. If the sorting result is linearly decreasing, the caching mode is independent caching mode.

[0058] Sort all TTL values ​​according to the time sequence of the responses returned for each DNS query request. If the sorting result shows multiple linear jumps, the caching mode is transparent caching mode.

[0059] Further, in step S2, determining the object whose TTL baseline value has been tampered with based on the target forwarder's caching mode and the TTL value in the response to each DNS query request includes:

[0060] The recursive resolver directly routed to by the target forwarder is denoted as the directly connected recursive resolver;

[0061] When the target repeater is in independent buffer mode and there is a TTL value that deviates from the TTL baseline:

[0062] When all TTL values ​​are equal and deviate from the TTL baseline value, the final tracing result is that the target repeater tampered with the TTL baseline value;

[0063] When the TTL value partially deviates from the TTL baseline value and partially matches the TTL baseline value, the initial tracing result is that the direct-connect recursive parser tampered with the TTL baseline value;

[0064] When the target repeater is in transparent buffer mode and there are TTL values ​​that deviate from the TTL baseline value, the TTL values ​​received by the user are sorted according to the time order returned from the dedicated server to obtain the TTL sequence; when the TTL values ​​in the TTL sequence show a linear decreasing trend, the preliminary tracing result is that the direct-connect recursive parser tampered with the TTL baseline value.

[0065] Based on the system's network topology and preliminary tracing results, the final tracing result is determined.

[0066] Furthermore, based on the system's network topology and preliminary tracing results, the final tracing results are determined, including:

[0067] The same DNS auxiliary query task is initiated to each of the other forwarders, which are forwarders that use the same direct recursive resolver as the target forwarder; the DNS auxiliary query task accesses the dedicated server via the other forwarders and the direct recursive resolver; the TTL value in the response corresponding to each DNS auxiliary query task is obtained;

[0068] If the TTL values ​​in the responses of all other repeaters deviate from the TTL baseline value, the final tracing result is that the direct-connect recursive parser tampered with the TTL baseline value;

[0069] If some of the TTL values ​​in the responses of all other transponders do not deviate from the TTL baseline value, then the final tracing result is that the target transponder tampered with the TTL baseline value.

[0070] This invention generates unique subdomains for a dedicated server to ensure that user-initiated batch subdomain query tasks bypass caching. Simultaneously, it obtains a TTL baseline value from the dedicated server, then sends these subdomain query tasks to the target forwarder and collects the returned TTL values. The tampering party is identified by comparing and analyzing the distribution patterns of the TTL values ​​returned by the forwarder.

[0071] This invention's analysis of forwarder caching behavior facilitates more granular investigations of resolver TTL violations, helping to determine which entity is responsible for such tampering. For forwarders with independent caches, from the forwarder's perspective, the forwarder relies on multiple upstream recursive resolvers. These upstream resolvers, even those from the same DNS provider, may have heterogeneous deployment configurations to improve service reliability. Therefore, if some recursive resolvers tamper with the TTL, forwarders using different resolvers will receive resource records with inconsistent TTLs, i.e., the TTL resource records are not entirely identical.

[0072] The TTL baseline value is configured by the dedicated server based on the resource records under its domain name. An accurate TTL baseline value, unaffected by any intermediate cache, can be obtained by directly initiating a DNS query request to this dedicated server.

[0073] In this invention, the caching mode of each repeater in the system is fixed, but it is unknown to the user equipment or the probe server. The caching mode of the repeater needs to be determined by the TTL value in the response.

[0074] In this invention, a user initiates multiple DNS query requests with time intervals to the target forwarder; the response corresponding to each DNS query request, including the unique subdomain name of the dedicated server and its TTL value, is returned by the target forwarder, wherein: the user equipment or the probe server sends a DNS query request for the unique subdomain name of the dedicated server to the IP address of the target forwarder; the target forwarder processes the DNS query request according to its caching mode:

[0075] When the target forwarder is in independent caching mode and its own cache hits the DNS query request, the target forwarder directly returns the response corresponding to the DNS query request, including the unique subdomain of the dedicated server and the TTL value, wherein the current TTL value recorded in the target forwarder is used as the TTL value.

[0076] When the target forwarder is in transparent caching mode or in independent caching mode and its own cache does not hit the DNS query request, the DNS query request passes sequentially through the target forwarder and the direct recursive resolver to reach the dedicated server. The dedicated server then returns a response to the target forwarder via the direct recursive resolver, including the dedicated server's unique subdomain and TTL value. When the target forwarder is in independent caching mode, the response is stored in its own cache, and the target forwarder returns the response to the user device or probe server. When the target forwarder is in transparent caching mode, the target forwarder returns the response to the user device or probe server. In this case, the direct recursive resolver performs recursive resolution to ensure that the DNS query request reaches the dedicated server.

[0077] Deviation from TTL baseline value means that the TTL value in the response is not equal to the TTL baseline value.

[0078] Furthermore, the TTL values ​​in the TTL sequence exhibit a linear decreasing trend, and the determination method is as follows:

[0079] By fitting a linear equation to all TTL values ​​in the TTL sequence, the coefficients of determination R and R' of the linear equation are determined. 2When the TTL value is greater than or equal to the discriminant value, it is determined that the TTL value in the TTL sequence shows a linear decreasing trend. In this invention, the determination coefficient should be adjusted according to the actual network situation. After multiple experiments, the discriminant value is set to 0.98.

[0080] This invention, under the premise that the target parser is a forwarder that depends on multiple upstream recursive parsers, refines the TTL tampering location down to the layer by actively probing the cache behavior type of the forwarder and combining a multi-layer TTL comparison mechanism.

[0081] This invention provides a specific embodiment of a method for tracing and locating domain resource record TTL tampering based on parsing chain reasoning.

[0082] (1) Deploy experimental domain name: In order to prevent interference with the normal production environment, deploy a dedicated experimental domain name for data collection in advance (such as ttl-test-exp.com) and set its TTL to a fixed value.

[0083] (2) Cache behavior identification: Under the premise that the target resolver is a forwarder that depends on multiple upstream recursive resolvers, send 10 DNS queries for the same subdomain of the experimental domain name to the target forwarder. The query interval is less than the TTL value of the domain name record. Record the obtained TTL value and the query time.

[0084] (3) Cache mode determination: Analyze the TTL value sequence obtained from the query, and draw a distribution map with the query time as the horizontal axis and the TTL value as the vertical axis. If the TTL decreases in a single straight line, the cache mode is determined to be independent cache; if the TTL changes in multiple straight lines, the cache mode is determined to be transparent cache.

[0085] (4) Determination of responsibility for tampering: If the forwarder cache mode is transparent cache, the responsibility for tampering will inevitably lie with the upstream recursive parser since the forwarder has no local cache intervention capability; if the forwarder cache mode is independent cache, independent cache verification will be performed.

[0086] (5) Independent cache verification: Send 10 different queries for the experimental domain name subdomain to the target forwarder to ensure that the cache is not hit and record the TTL value. If all TTLs are the same but not the original value, it is because the forwarder itself has tampered with it. If some TTLs match the original value, it is because the recursive resolver has tampered with it.

[0087] This invention provides a specific application example of a domain name resource record TTL tampering tracing and location method based on parsing chain reasoning.

[0088] A company discovered abnormal fluctuations in response latency on its website API service domain pay.example.com. Upon investigation, it was suspected that TTL tampering occurred during DNS resolution (assuming the original TTL was 60 seconds), causing clients to frequently initiate redundant queries. The source of the tampering needs to be located for accountability. The following is the process for using the source tracing method proposed in this application:

[0089] (1) Test domain deployment: Deploy a dedicated authoritative name server for tracing, assuming its domain name is ttl-audit-fin.com, the basic TTL value is 60s, and the subdomain sequence is: s{1..10}.ttl-audit-fin.com.

[0090] (2) Data collection: Ten consecutive queries were made to s1.ttl-audit-fin.com for the suspected target repeater, with an interval of δ=1s. The TTL sequence and query time were recorded. The results are assumed to be as shown in Table 1 below:

[0091] Table 1. TTL Sequence and Query Time Comparison Table

[0092]

[0093] (3) Cache mode determination: By analyzing the TTL sequence, it is found that the TTL decreases at a fixed slope, which is consistent with the characteristics of independent cache.

[0094] (4) Determination of responsibility for tampering: Initiate 10 more queries targeting the subdomain (s1 to s10), assuming the data obtained is as shown in Table 2 below:

[0095] Table 2. Response TTL for Subdomain Queries

[0096]

[0097] It can be seen that the obtained TTL sequence partially matches the original value, indicating that the recursive parser has tampered with it, and the responsibility lies with the recursive server cluster.

[0098] The apparatus provided for carrying out the present invention will be described below. The specific implementation process and technical effects are as described above and will not be repeated below.

[0099] Optionally, embodiments of the present invention provide a domain name resource record TTL tampering tracing and location device based on parsing chain reasoning, the device comprising:

[0100] Initialization module: Configured for system deployment. The system includes a dedicated server for managing domain names, multiple forwarders, and several recursive resolvers located upstream of the forwarders. There is a many-to-many correspondence between the forwarders and the recursive resolvers they directly route to; Set the TTL baseline value stored on the dedicated server.

[0101] Location module: Configured to select a target forwarder, the user initiates multiple DNS query requests with time intervals to the target forwarder;

[0102] The response to each DNS query request, including the unique subdomain of the dedicated server and the TTL value, is returned by the target forwarder. The caching mode of the target forwarder is determined based on the TTL value in the response to each DNS query request. The object that tampered with the TTL base value is determined based on the caching mode of the target forwarder and the TTL value in the response to each DNS query request.

[0103] The target forwarder's caching modes include independent caching mode and transparent caching mode. In independent caching mode, the target forwarder itself caches and maintains local domain name resource records; in transparent caching mode, the target forwarder does not maintain local domain name resource records.

[0104] When the target forwarder is in transparent caching mode, and when the target forwarder is in independent caching mode and the target forwarder's own cache does not hit the DNS query request, the DNS query request is sequentially routed through the target forwarder and the recursive resolver directly routed by the target forwarder to the dedicated server, and the dedicated server returns the response corresponding to the DNS query request.

[0105] When the target forwarder is in independent caching mode and its own cache hits a DNS query request, the target forwarder returns the response corresponding to the DNS query request.

[0106] The above-described device is used to execute the method provided in the foregoing embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.

[0107] These modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more digital signal processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together as a system-on-a-chip (SOC).

[0108] The modules described above can be connected or communicate with each other via wired or wireless connections. Wired connections may include metal cables, optical fibers, hybrid cables, or any combination thereof. Wireless connections may include connections via LAN, WAN, Bluetooth, ZigBee, or NFC, or any combination thereof. Two or more modules can be combined into a single module, and any module can be divided into two or more units. Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the method embodiments, and will not be repeated here.

[0109] It should be noted that these modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more Digital Signal Processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). Furthermore, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Additionally, these modules can be integrated together to form a System-on-a-Chip (SOC).

[0110] The electronic device includes a processor, memory, communication interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, Near Field Communication (NFC), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.

[0111] The present invention also provides a program product, such as a computer-readable storage medium, including a program that, when executed by a processor, is used to perform the above-described method embodiments.

[0112] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0113] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0114] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0115] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A method for tracing and locating domain name resource record (TTL) tampering based on parse chain reasoning, characterized in that, The methods include: Step S1: Deploy the system, which includes a dedicated server for managing domain names, multiple forwarders, and several recursive resolvers located upstream of the forwarders. There is a many-to-many correspondence between the forwarders and the recursive resolvers they directly route to; set the TTL baseline value stored on the dedicated server. Step S2: Select the target forwarder, and the user sends multiple DNS query requests with time intervals to the target forwarder; The response to each DNS query request, including the unique subdomain of the dedicated server and the TTL value, is returned by the target forwarder. The caching mode of the target forwarder is determined based on the TTL value in the response to each DNS query request. The object that tampered with the TTL base value is determined based on the caching mode of the target forwarder and the TTL value in the response to each DNS query request. The target forwarder's caching modes include independent caching mode and transparent caching mode. In independent caching mode, the target forwarder itself caches and maintains local domain name resource records; in transparent caching mode, the target forwarder does not maintain local domain name resource records. When the target forwarder is in transparent caching mode, and when the target forwarder is in independent caching mode and the target forwarder's own cache does not hit the DNS query request, the DNS query request is sequentially routed through the target forwarder and the recursive resolver directly routed by the target forwarder to the dedicated server, and the dedicated server returns the response corresponding to the DNS query request. When the target forwarder is in independent caching mode and its own cache hits the DNS query request, the target forwarder returns the response corresponding to the DNS query request. In step S2, the object whose TTL baseline value has been tampered with is determined based on the target forwarder's caching mode and the TTL value in the response to each DNS query request, including: The recursive resolver directly routed to by the target forwarder is denoted as the directly connected recursive resolver; When the target repeater is in independent buffer mode and there is a TTL value that deviates from the TTL baseline: When all TTL values ​​are equal and deviate from the TTL baseline value, the final tracing result is that the target repeater tampered with the TTL baseline value; When the TTL value partially deviates from the TTL baseline value and partially matches the TTL baseline value, the initial tracing result is that the direct-connect recursive parser tampered with the TTL baseline value; When the target repeater is in transparent buffer mode and there are TTL values ​​that deviate from the TTL baseline value, the TTL values ​​received by the user are sorted according to the time order returned from the dedicated server to obtain the TTL sequence; when the TTL values ​​in the TTL sequence show a linear decreasing trend, the preliminary tracing result is that the direct-connect recursive parser tampered with the TTL baseline value. Based on the system's network topology and preliminary tracing results, the final tracing result is determined.

2. The method as described in claim 1, characterized in that, In step S2, determining the caching mode of the target forwarder based on the TTL value in the response to each DNS query request includes: Sort all TTL values ​​according to the time order of the response returned for each DNS query request. If the sorting result is linearly decreasing, the caching mode is independent caching mode. Sort all TTL values ​​according to the time sequence of the responses returned for each DNS query request. If the sorting result shows multiple linear jumps, the caching mode is transparent caching mode.

3. The method as described in claim 2, characterized in that, Based on the system's network topology and preliminary tracing results, the final tracing results are determined, including: The same DNS auxiliary query task is initiated to each of the other forwarders, which are forwarders that use the same direct recursive resolver as the target forwarder; the DNS auxiliary query task accesses the dedicated server via the other forwarders and the direct recursive resolver; the TTL value in the response corresponding to each DNS auxiliary query task is obtained; If the TTL values ​​in the responses of all other repeaters deviate from the TTL baseline value, the final tracing result is that the direct-connect recursive parser tampered with the TTL baseline value; If some of the TTL values ​​in the responses of all other transponders do not deviate from the TTL baseline value, then the final tracing result is that the target transponder tampered with the TTL baseline value.

4. The method according to any one of claims 1-3, characterized in that, The TTL baseline value is configured by the dedicated server based on the resource records under its domain name.

5. The method as described in claim 3, characterized in that, Deviation from TTL baseline value means that the TTL value in the response is not equal to the TTL baseline value.

6. The method as described in claim 3, characterized in that, The method for determining whether the TTL value in the TTL sequence shows a linear decreasing trend is: By fitting all TTL values ​​in the TTL sequence, a linear equation is obtained, and the determination coefficient R of the linear equation is determined. When R² is greater than or equal to the discriminant value, it is determined that the TTL values ​​in the TTL sequence show a linear decreasing trend.

Images