Domain name hijacking risk identification method based on DNS resolution path

Abstract

The invention provides a domain name hijacking risk identification method based on a DNS (Domain Name Server) resolution path. The method comprises the following steps: S1, acquiring a resolution path of each recursive server to a specified domain name in a domain name system to be tested; s2, querying each CNAME record in the analysis path of each recursive server and a registration organization of a specified domain name address to obtain registration organization information of the analysis path of each recursive server; s3, respectively constructing an analysis path diagram of each recursive server based on the analysis path and the registration organization information of each recursive server; s4, combining the same nodes in all the analysis path diagrams constructed in the step S3 and reserving all edges so as to combine all the constructed analysis path diagrams into a total analysis path diagram without redundant nodes; and S5, determining the difference degree between each analysis path and all other analysis paths based on the total analysis path diagram, and judging whether the recursive server has a hijacked risk on the specified domain name or not according to the difference degree.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, in particular to the field of domain name hijacking risk identification, and more particularly to a domain name hijacking risk identification method based on DNS resolution path. BACKGROUND

[0002] Domain Name System (DNS) is one of the most important infrastructures in the Internet, which is responsible for resolving user-readable domain names into corresponding IP addresses. With the rapid development of mobile Internet and application ecology, a large number of applications begin to use domain names for service communication. These domain names are no longer used only for web access, but also undertake API calls, content distribution and other tasks, with more diverse forms and more frequent access. At the same time, the problem of DNS hijacking is becoming increasingly serious. DNS hijacking usually redirects access traffic to unauthorized or malicious addresses by tampering with the resolution results returned by DNS, and then achieves the purpose of advertisement injection, phishing fraud or privacy theft. Traditional DNS hijacking detection methods mostly rely on static lists or fixed rules for comparison. On the other hand, the widespread deployment of Content Delivery Network (CDN) introduces high dynamicity to the DNS system. Different regions, operators or terminals resolve the same domain name, and different IPs are often returned.

[0003] The existing DNS hijacking detection schemes mainly include the following four categories. The first category is the method of using static IP list comparison. This method usually compares the real-time resolution result with the list of legal IP addresses to determine whether it is hijacked. However, the introduction of CDN leads to a huge difference in resolution results of the same domain name under different network conditions. The static list cannot cover the dynamic range of legal IPs, resulting in frequent false positives and making it difficult to adapt to the dynamic resolution characteristics in the existing network. The second category is to access the resolved address and analyze the returned web content to determine whether it is normal. However, this method has limited applicability and cannot be applied to domain names that do not provide web services, such as some APIs, emails and IoT domain names. The third category is the method based on passive traffic analysis, which requires long-term collection and analysis of network traffic. This method has high requirements for devices and network environment, and the reaction is lagging. Ordinary users cannot deploy and benefit from it. The fourth category is the method that uses controllable domain names combined with authoritative servers to view resolution behavior. This method can determine whether the current DNS response is hijacked according to the network log. This method is complex to deploy and can only detect whether the special domain name hosted by the authoritative server is hijacked. It cannot achieve detection for all domain names.

[0004] In summary, the existing methods have obvious limitations in real-time, universality, precision and deployment cost, and it is difficult to meet the detection needs of DNS hijacking in large-scale and dynamic environments. Therefore, it is urgent to design a general, fast and adaptable domain name hijacking detection mechanism to meet the security needs of modern network environment.

[0005] It should be noted that the background art is only used to introduce the related information of the present application, so as to help understand the technical solutions of the present application, but does not mean that the related information must be the prior art. In the absence of evidence that the related information has been disclosed before the filing date of the present application, the related information should not be regarded as prior art. SUMMARY

[0006] Therefore, the purpose of the present application is to overcome the defects of the prior art, and to provide a domain name hijacking risk identification method based on DNS resolution path.

[0007] The purpose of the present application is achieved by the following technical solutions:

[0008] According to the first aspect of the present application, a domain name hijacking risk identification method based on DNS resolution path is provided, which is used to detect whether each recursive server in a to-be-tested domain name system has a hijacking risk on a specified domain name. The method comprises the following steps: step S1, obtaining a resolution path of each recursive server in the to-be-tested domain name system for a specified domain name, wherein the resolution path corresponding to each recursive server comprises the specified domain name, a plurality of different CNAME records, a plurality of NS records corresponding to the CNAME records one by one, and a specified domain name address, wherein the CNAME records are arranged in a resolution order; step S2, querying the registration organization of each CNAME record in the resolution path of each recursive server and the specified domain name address by using a registration organization query tool to obtain registration organization information of the resolution path of each recursive server; step S3, based on the resolution path and the registration organization information of each recursive server, constructing a resolution path graph of each recursive server respectively, wherein the nodes of the resolution path graph comprise a first node representing the specified domain name, a plurality of nodes representing the CNAME records arranged in the resolution order, a node representing the specified domain name address, and a tail node representing the end of resolution, the nodes of the resolution path graph further comprise a plurality of nodes representing the NS records connected to the nodes where the corresponding CNAME records are located, and a plurality of nodes representing the registration organizations connected to the nodes where the corresponding CNAME records or the specified domain name address are located; step S4, merging the same nodes in all the resolution path graphs constructed in step S3 and retaining all the edges, so as to combine all the constructed resolution path graphs into a total resolution path graph with no redundant nodes; step S5, determining the difference degree between each resolution path and all other resolution paths based on the total resolution path graph, and determining that the recursive server corresponding to the resolution path whose difference degree with all other resolution paths exceeds a preset threshold has a hijacking risk on the specified domain name.

[0009] Preferably, in step S1, the resolving path of each recursive server is obtained by the following way: step S11, configuring a client at the measuring point, the client is used to send a plurality of request messages for obtaining the resolving path to each recursive server in the recursive system to be measured, and record the response result of each recursive server; step S12, continuously sending CNAME type query message and NS type query message configured with a preset domain name to the current recursive server by the client and recording the CNAME record and NS record responded by the current recursive server until the repeated NS record appears, wherein, in the first sent CNAME type query message and NS type query message, the preset domain name is a specified domain name, in the subsequent sent CNAME type query message and NS type query message, the preset domain name is the domain name in the CNAME record responded by the current recursive server to the previous CNAME type query message; step S13, obtaining the domain name in the CNAME record responded by the current recursive server in step S12 lastly, and sending A type query message to the domain name by the client, and recording the returned specified domain name address; step S14, composing the resolving path of the current recursive server with the specified domain name, all CNAME records and NS records recorded in step S12, and the specified domain name address recorded in step S13, wherein, the CNAME records are arranged according to the response order of the current recursive server.

[0010] Preferably, in step S3, the resolving path graph of each recursive server is constructed by the following way: taking the specified domain name as the first node, adding a plurality of nodes representing CNAME records in the response order of the current recursive server, adding a node representing the specified domain name address, adding a tail node representing the end of the resolving to construct the first resolving path graph of the current recursive server, wherein, each CNAME record in the resolving path of the current recursive server corresponds to a node, and all edges in the first resolving path graph are unidirectional edges from the predecessor node to the successor node; adding each NS record in the resolving path of the current recursive server to the first resolving path graph as a node, and adding a bidirectional edge between each two nodes corresponding to CNAME records and NS records to obtain the second resolving path graph; adding a plurality of nodes representing the registration organization in the second resolving path graph based on the registration organization information of the current recursive server, and adding a bidirectional edge connected to the node where the registration organization corresponding to the CNAME record and NS record is located on the node representing the CNAME record and NS record to obtain the final resolving path graph, wherein, the same registration organization only adds one node.

[0011] Preferably, in step S4, the same nodes in all the parsed path graphs are combined by the following ways: the nodes representing the specified domain names are combined into one node; the nodes representing the same CNAME records are combined into one node; the nodes representing the same NS records are combined into one node; the nodes representing the same registration organization information are combined into one node; all the nodes representing the end of the resolution are combined into one node.

[0012] Preferably, in step S5, the difference degree between each resolution path and all the other resolution paths is determined by the following ways: for each resolution path, the path distance between the resolution path and each of the other resolution paths is calculated by the following ways:

[0013]

[0014] wherein, represents the resolution path , the path distance between and , respectively, represents two different resolution path graphs, is a node set composed of the nodes corresponding to the specified domain name, the CNAME record and the address of the specified domain name in the total resolution path graph in the resolution path , is a node set composed of the nodes corresponding to the specified domain name, the CNAME record and the address of the specified domain name in the total resolution path graph in the resolution path , represents the length of the shortest path from node to node , when node is the same as node , then is a first preset distance, when node has no reachable path to node , then is a second preset distance, represents a function of obtaining the length from the head node to the tail node of the resolution path graph corresponding to the resolution path , represents a function of obtaining the length from the head node to the tail node of the resolution path graph corresponding to the resolution path , represents a function of taking the minimum value; for each resolution path, the mean value of the minimum preset number of path distances of the resolution path is taken as the difference degree between the resolution path and the other resolution paths.

[0015] Preferably, the first preset distance is 1.

[0016] Preferably, the second preset distance is 10.

[0017] Preferably, in step S5, the preset threshold is configured by: arranging the difference degrees of all parsed paths in descending order, obtaining a difference value between the difference degree located at the third quartile and the difference degree located at the first quartile, and adding the obtained difference value to the difference degree located at the third quartile to obtain a sum, and configuring the sum as the preset threshold.

[0018] According to a second aspect of the present application, a computer readable storage medium is provided, having stored thereon a computer program, the computer program being executable by a processor to implement the steps of the method according to any one of the first aspect of the present application.

[0019] According to a third aspect of the present application, an electronic device is provided, comprising: one or more processors; and a memory, wherein the memory is configured to store executable instructions; and the one or more processors are configured to implement the steps of the method according to any one of the first aspect of the present application by executing the executable instructions.

[0020] Compared with the prior art, the present application has the following advantages:

[0021] The present application can simultaneously collect multiple recursive server parsed paths by single point measurement, and construct a directed parsed path graph of each recursive server based on the parsed paths. In addition, the path difference is accurately quantified by node sequence distance, so that the abnormal parsing chain can be identified with high sensitivity and low false alarm under the condition of no additional deployment and no dependence on static white list, and the universality, real-time performance and scalability of DNS hijacking detection are significantly improved. BRIEF DESCRIPTION OF DRAWINGS

[0022] The embodiments of the present application will be further described below with reference to the accompanying drawings, in which:

[0023] Figure 1 FIG. 1 is a schematic diagram of a domain name hijacking risk identification method based on DNS parsed path according to an embodiment of the present application;

[0024] Figure 2 FIG. 2 is a schematic diagram of a parsed path graph according to an embodiment of the present application;

[0025] Figure 3 FIG. 3 is a schematic diagram of a parsed path graph according to an embodiment of the present application;

[0026] Figure 4 FIG. 4 is a schematic diagram of a total parsed path according to an embodiment of the present application. DETAILED DESCRIPTION

[0027] For the purpose of the present application, the technical solutions and advantages are more clear and explicit, the following by specific examples of the present application is further described. It should be understood that the specific examples described herein are only to explain the present application, and not for the definition of the present application.

[0028] As mentioned in the background section, the existing DNS hijacking detection technology has four defects: static IP white list is insufficient due to CDN dynamic scheduling, high false positive rate; content recheck is only applicable to web services, invalid for API, mail and other domain names; passive flow analysis relies on high-cost long-time collection and response lag; controllable domain name log method is complex to deploy, only covers self-built authoritative domain name, lacks of universality. Overall, the existing scheme has obvious short board in dynamic adaptability, service type universality, deployment convenience and detection breadth, which is difficult to meet the needs of network-wide universal, lightweight and real-time hijacking detection.

[0029] To solve the above problems, the present application provides a domain name hijacking risk identification scheme based on DNS resolution path, which is based on the difference of the resolution path of each recursive server in the domain name system for the target domain name. The recursive server with large difference is determined to have hijacking risk on the specified domain name. Compared with the existing scheme, the present scheme has significant advantages in universality, adaptability and deployment cost.

[0030] In order to better understand the present application, the following will be described in detail with reference to the embodiments and the accompanying drawings.

[0031] According to one embodiment of the present application, the present application provides a domain name hijacking risk identification method based on DNS resolution path, referring to the accompanying drawings Figure 1 , in general, the method comprises steps S1, S2, S3, S4, S5, in order to facilitate the understanding of the present application, the following will be described in detail with reference to the embodiments of each step of the present application.

[0032] Step S1, obtaining the resolution path of each recursive server in the domain name system for the specified domain name, wherein the resolution path corresponding to each recursive server comprises the specified domain name, a plurality of different CNAME records, a plurality of NS records corresponding to the CNAME records one by one, and the address of the specified domain name, wherein the CNAME records are arranged in the order of resolution.

[0033] The application judges the hijacking risk existing in the resolving path of the specified domain name by comparing the differences between the resolving paths of the recursive servers in the domain name system. According to an embodiment of the application, a client with the functions of sending and receiving messages is configured on a measuring point (the measuring point can be a server, a host, a mobile terminal or other electronic devices), and the client sends multiple messages to each recursive server in the domain name system, and constructs the resolving path of the specified domain name of each recursive server according to the response results of the recursive servers.

[0034] For a recursive server, the steps of constructing the resolving path of the recursive server include: step S12, the client continuously sends CNAME type query messages and NS type query messages configured with the preset domain name to the current recursive server and records the CNAME records and NS records responded by the current recursive server until the repeated NS records appear, wherein the preset domain name in the first sent CNAME type query message and NS type query message is the specified domain name, and the preset domain name in the subsequent sent CNAME type query message and NS type query message is the domain name in the CNAME record responded by the current recursive server to the previous CNAME type query message; step S13, the domain name in the CNAME record responded by the current recursive server in step S12 is acquired, the client sends an A type query message to the domain name, and the address of the specified domain name returned is recorded; and step S14, the specified domain name, all CNAME records and NS records recorded in step S12 and the address of the specified domain name recorded in step S13 constitute the resolving path of the current recursive server, wherein the CNAME records are arranged according to the response order of the current recursive server.

[0035] According to an embodiment of the application, in step S12, the steps of sending the CNAME type query message and the NS type query message to the recursive server each time are as follows: first, the NS type query message is sent to the recursive server, and the response result (i.e. the NS record) of the current NS type query message is recorded; then, the CNAME type query record is sent to the recursive server, and the response result (i.e. the CNAME record) of the current NS type query message is recorded; if the returned CNAME record is a CNAME record that has not appeared before, the domain name to be measured is modified to the domain name in the CNAME record, and the CNAME type query message and the NS type query message are sent again. In order to better illustrate the resolving path of the recursive server to the specified domain name, example one will be described below.

[0036] Example one

[0037] Suppose an analytic path is: Domain->CNAME1->CNAME2->IP1, wherein Domain represents a specified domain name, CNAME1 and CNAME2 are two CNAME records arranged in response order, IP1 represents an IP address of Domain obtained by the recursive server after resolving Domain, the analytic path further includes a corresponding relationship between the CNAME records and NS records, for example, CNAME1 corresponds to NS1, and CNAME2 corresponds to NS2.

[0038] Step S2, query the registration organization of each CNAME record in the analytic path of each recursive server and the specified domain name address by using a registration organization query tool to obtain the registration organization information of the analytic path of each recursive server.

[0039] In order to provide a reference basis for subsequent identification of hijacking risk, according to an embodiment of the present application, the present application obtains the specified domain name, each CNAME record, and the registration organization of the specified domain name address in each analytic path, and takes them as additional information of each analytic path. Specifically, the registration organization to which the CNAME record and the specified domain name address belong is queried by using a registration organization query tool (such as a Whois query webpage, a Whois query server, etc.). It should be understood that the steps / methods for obtaining the registration organization of the CNAME record and the specified domain name address are well-known techniques in the art, and will not be described in detail here. For example, still referring to Example 1, the Whois query is performed on Domain, CNAME1, CNAME2, and IP1. Suppose the result obtained is that the registration organization to which Domain, CNAME1, CNAME2, and IP1 belong is ORG1. Then the additional information of each analytic path is that the registration organization of Domain, CNAME1, CNAME2, and IP1 is ORG1. It should be understood that the above example is only illustrative, and Domain, CNAME1, CNAME2, and IP1 can also belong to multiple different registration organizations.

[0040] Step S3, based on the analytic path and the registration organization information of each recursive server, an analytic path graph of each recursive server is respectively constructed, wherein the nodes of the analytic path graph include a first node representing the specified domain name, a plurality of nodes representing the CNAME records arranged in the resolving order, a node representing the specified domain name address, and a tail node representing the end of the resolving, the nodes of the analytic path graph further include a plurality of nodes representing the NS records connected to the nodes where the corresponding CNAME records are located, and a plurality of nodes representing the registration organizations connected to the nodes where the corresponding CNAME records or the specified domain name address are located.

[0041] In order to evaluate the difference between the resolving paths, according to an embodiment of the present application, the present application constructs a resolving path graph for each recursive server based on the resolving path of the recursive server and the registration organization information, specifically, a first resolving path graph of the current recursive server is constructed by taking the specified domain name as the first node, adding a plurality of nodes representing CNAME records in the order of the response of the current recursive server, adding a node representing the address of the specified domain name, and adding a tail node representing the end of the resolving, wherein each CNAME record in the resolving path of the current recursive server corresponds to a node, all edges in the first resolving path graph are one-way edges from the predecessor node to the successor node, each NS record in the resolving path of the current recursive server is added to the first resolving path graph as a node, and a bidirectional edge is added between each two nodes corresponding to CNAME records and NS records to obtain a second resolving path graph; a plurality of nodes representing the registration organizations are added to the second resolving path graph based on the registration organization information of the current recursive server, and bidirectional edges are added between the nodes representing the CNAME records and the NS records and the nodes representing the registration organizations corresponding thereto to obtain a final resolving path graph, wherein the same registration organization only has one node. For example, referring to the resolving path in Example 1, i.e., (Domain->CNAME1->CNAME2->IP1), assuming that CNAME1 corresponds to NS1, CNAME2 corresponds to NS2, and the registration organizations of Domain, CNAME1, CNAME2, and IP1 are ORG1, the resolving path graph constructed is as shown in FIG. 2. Figure 2

[0042] Step S4, merging the same nodes in all the resolving path graphs constructed in step S3 and retaining all the edges to merge all the resolving path graphs into a total resolving path graph without redundant nodes.

[0043] In order to better obtain the correlation and difference between the resolving paths, according to an embodiment of the present application, the present application merges the resolving path graphs of the specified domain name of each recursive server in the domain name system into a total resolving path graph, specifically, the nodes representing the specified domain name are merged into one node, the nodes representing the same CNAME record are merged into one node, the nodes representing the same NS record are merged into one node, the nodes representing the same registration organization information are merged into one node, and all the nodes representing the end of the resolving are merged into one node. In addition, the edges between the nodes are retained, for example, node 1, node 2, and node 3 are merged into one node, and all the edges originally connected to node 1, node 2, and node 3 are retained on the merged node. In order to facilitate understanding how to merge a plurality of resolving path graphs into a total resolving path graph, Example 2 will be described below.

[0044] Example 2 ​

[0045] Reference is made to the accompanying drawings Figure 3 , which show three recursive server parsing path graphs, G1, G2 and G3, wherein the nodes with the same name in the graphs represent the same nodes, and the total parsing path graph obtained by merging G1, G2 and G3 is shown in the accompanying drawing Figure 4 , it can be seen that the Domain nodes (representing the nodes of the specified domain name) in the three parsing path graphs are merged into the same node, the End nodes (representing the nodes of the end of parsing) are respectively merged into the same node, NS1 and ORG1 in G1 and G2 are merged into one node, NS1 and ORG2 are respectively merged into one node, and there is no same node of NS3 and ORG3 in G1 and G2 as that in G3, so NS3 and ORG3 remain unchanged. Figure 4

[0046] Step S5, determine the difference degree between each parsing path and all other parsing paths based on the total parsing path graph, and determine that the recursive server corresponding to the parsing path whose difference degree with all other parsing paths exceeds a preset threshold has a hijacking risk on the specified domain name.

[0047] According to an embodiment of the present application, in the present application, first, the inter-path distance between each parsing path and each other parsing path is calculated based on the total parsing path, and then the difference degree between each parsing path and all other parsing paths is determined based on the calculated inter-path distance, wherein the greater the difference degree, the greater the difference degree between the parsing path and other parsing paths, i.e. the higher the risk possibility of the parsing path suspected to be hijacked, and finally the recursive server corresponding to the parsing path whose difference degree exceeds the threshold is determined to have a hijacking risk on the specified domain name.

[0048] According to an embodiment of the present application, in the present application, the inter-path distance between one parsing path and each other parsing path is calculated in the following manner:

[0049]

[0050] wherein, represents the inter-path distance between the parsing paths and , respectively, and represent two different parsing path graphs, is a node set composed of the nodes corresponding to the specified domain name, CNAME record and specified domain name address in the total parsing path graph in the parsing path , is a node set composed of the nodes corresponding to the specified domain name, CNAME record and specified domain name address in the total parsing path graph in the parsing path ,​ denotes a node to a node , the length of the shortest path from the node to the node , when the node is the same as the node , is a first preset distance, when the node has no reachable path to the node , is a second preset distance, denotes a function of obtaining the length of the analysis path corresponding to the analysis path graph from the head node to the tail node, denotes a function of obtaining the length of the analysis path corresponding to the analysis path graph from the head node to the tail node, denotes a function of taking the minimum value, preferably, the first preset distance is 1, and the second preset distance is 10, and it should be understood that the values of the first preset distance and the second preset distance can be configured by the implementer.

[0051] According to one embodiment of the present application, in the present application, for each analysis path, the path distance between the k analysis paths closest to the analysis path and the analysis path is taken and averaged to obtain the difference degree of the analysis path from all other analysis paths, and then the IRQ (Interquartile Range) method is used to find the outlier of all difference degrees, and the outlier is taken as the preset threshold. Specifically, the difference degrees of all analysis paths are arranged in descending order to obtain a difference degree sequence, and the difference value between the difference degree located at the third quartile and the difference degree located at the first quartile in the difference degree sequence is obtained, and the obtained difference value is added to the difference degree located at the third quartile to obtain a sum, and the sum is configured as the preset threshold, which can be expressed by the formula:

[0052]

[0053]

[0054] wherein, denotes the preset threshold, denotes the first quartile, i.e., the difference degree located at the 25% quartile point of the difference degree sequence, denotes the third quartile, i.e., the difference degree located at the 75% quartile point of the difference degree sequence. It should be understood that the IRQ (Interquartile Range) method is a common anomaly detection method based on statistical distribution, which is suitable for identifying abnormal values with large deviation in a data set. The IRQ method is a well-known technology in the art, and will not be described in detail here.

[0055] In summary, the application can simultaneously collect multi-recursion server resolving paths by single point measurement, and construct a directed resolving path graph of each recursion server, and accurately quantify path differences by node sequence distance, thereby identifying abnormal resolving chains with high sensitivity and low false alarm under the condition of no additional deployment and no dependence on static white list, and significantly improving the universality, real-time performance and scalability of DNS hijacking detection.

[0056] It should be noted that although the above describes various steps in a particular order, it does not mean that the various steps must be performed in the above particular order, in fact, some of the steps can be performed concurrently, or even in a changed order, as long as the required functions can be achieved.

[0057] The present application can be a system, a method, and / or a computer program product. The computer program product can include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present application.

[0058] The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium can be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or punched tape, a magneto-optical or other optical medium, and / or any suitable combination of the foregoing. A non-transitory, non-temperable computer-readable storage medium having instructions stored therein for execution by and to program a processor or controller device is also described herein.

[0059] Embodiments of the application have been described above, the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes are obvious to those skilled in the art without departing from the scope and spirit of the described embodiments. The choice of terms used herein is intended to best explain the principles, practical applications, or technical improvements in the art of the embodiments, or to enable other ordinary skilled persons in the art to understand the embodiments disclosed herein.

Claims

1. A DNS resolution path based domain name hijacking risk identification method, used for detecting whether each recursive server in a to-be-tested domain name system has a hijacking risk on a specified domain name, characterized in that, The method comprises: Step S1, acquiring a resolution path of each recursive server in a to-be-tested domain name system for a specified domain name, wherein the resolution path corresponding to each recursive server comprises the specified domain name, a plurality of different CNAME records, a plurality of NS records corresponding to the CNAME records one by one, and an address of the specified domain name, wherein the CNAME records are arranged in a resolution order; Step S2, querying a registration organization of each CNAME record in the resolution path of each recursive server and an address of the specified domain name by using a registration organization query tool to acquire registration organization information of the resolution path of each recursive server; Step S3, constructing a resolution path graph of each recursive server based on the resolution path and the registration organization information of each recursive server, wherein nodes of the resolution path graph comprise, in sequence, a first node representing the specified domain name, a plurality of nodes representing the CNAME records arranged in the resolution order, a node representing the address of the specified domain name, and a tail node representing a resolution end, the nodes of the resolution path graph further comprise a plurality of nodes representing the NS records connected to the nodes representing the CNAME records, and a plurality of nodes representing the registration organizations connected to the nodes representing the CNAME records or the node representing the address of the specified domain name; Step S4, merging the same nodes in all the resolution path graphs constructed in step S3 and retaining all edges to combine all the resolution path graphs into a total resolution path graph without redundant nodes; Step S5, determining a difference degree between each resolution path and all other resolution paths based on the total resolution path graph, and determining that a recursive server corresponding to a resolution path with a difference degree between the resolution path and all other resolution paths exceeding a preset threshold has a hijacking risk on the specified domain name.

2. The method of claim 1, wherein, In step S1, the resolution path of each recursive server is acquired by the following method: Step S11, configuring a client on a measurement point, wherein the client is used to send a plurality of request messages for acquiring the resolution path to each recursive server in a to-be-tested recursive system and record a response result of each recursive server; Step S12, continuously sending a CNAME type query message and an NS type query message configured with a preset domain name to a current recursive server by the client and recording CNAME records and NS records responded by the current recursive server until a repeated NS record appears, wherein the preset domain name in the CNAME type query message and the NS type query message sent for the first time is the specified domain name, and the preset domain name in the CNAME type query message and the NS type query message sent subsequently is a domain name in the CNAME record responded by the current recursive server to a previous CNAME type query message; Step S13, acquiring the domain name in the CNAME record responded by the current recursive server in step S12 for the last time, sending an A type query message to the domain name by the client, and recording a returned address of the specified domain name; Step S14, the specified domain name, all CNAME records recorded in step S12 and NS records, and the address of the specified domain name recorded in step S13 form a parsing path of the current recursive server, wherein the CNAME records are arranged in the response order of the current recursive server.

3. The method of claim 2, wherein, In step S3, the parsing path graph of each recursive server is constructed in the following manner: Taking the specified domain name as the first node, adding multiple nodes representing CNAME records in the response order of the current recursive server, adding a node representing the address of the specified domain name, and adding a tail node representing the end of parsing to construct a first parsing path graph of the current recursive server, wherein each CNAME record in the parsing path of the current recursive server corresponds to a node, and all edges in the first parsing path graph are one-way edges from the predecessor node to the successor node; Each NS record in the parsing path of the current recursive server is added to the first parsing path graph as a node, and a bidirectional edge is added between each two nodes corresponding to CNAME records and NS records to obtain a second parsing path graph; Based on the registration organization information of the current recursive server, multiple nodes representing registration organizations are added to the second parsing path graph, and bidirectional edges are added between the nodes representing CNAME records and NS records and the nodes where the corresponding registration organizations are located to obtain a final parsing path graph, wherein the same registration organization only has one node.

4. The method of claim 3, wherein, In step S4, the same nodes in all parsing path graphs are merged in the following manner: The nodes representing the specified domain name are merged into one node; The nodes representing the same CNAME record are merged into one node; The nodes representing the same NS record are merged into one node; The nodes representing the same registration organization information are merged into one node; All nodes representing the end of parsing are merged into one node.

5. The method of claim 4, wherein, In step S5, the difference degree between each parsing path and all other parsing paths is determined in the following manner: For each parsing path, the path distance between the parsing path and each other parsing path is calculated in the following manner: wherein, represents a resolution path and represents the inter-path distance of and respectively represent two different resolution path graphs, is a node set composed of the nodes corresponding to the specified domain name, CNAME record and specified domain name address in the total resolution path graph in the resolution path , is a node set composed of the nodes corresponding to the specified domain name, CNAME record and specified domain name address in the total resolution path graph in the resolution path , represents the length of the shortest path from node to node , when node is the same as node , then is a first preset distance, when node has no reachable path to node , then is a second preset distance, represents a function of obtaining the length from the head node to the tail node of the resolution path graph corresponding to the resolution path , represents a function of obtaining the length from the head node to the tail node of the resolution path graph corresponding to the resolution path , represents a function of taking the minimum value; For each parsing path, the mean value of the smallest preset number of path distances of the parsing path is taken as the difference degree between the parsing path and other parsing paths.

6. The method of claim 5, wherein, The first preset distance is 1.

7. The method of claim 5, wherein, The second preset distance is 10.

8. The method of claim 1, wherein, In step S5, the preset threshold is configured in the following manner: All difference degrees of the parsing paths are arranged in descending order, the difference value between the difference degree located in the third quartile and the difference degree located in the first quartile is obtained, the obtained difference value is added to the difference degree located in the third quartile, and the sum is configured as the preset threshold.

9. A computer-readable storage medium, characterized in that, A computer program is stored thereon, and the computer program can be executed by a processor to implement the steps of the method in any one of claims 1 to 8.

10. An electronic device, comprising: Comprise: One or more processors; And Memory, wherein the memory is used to store executable instructions; The one or more processors are configured to implement the steps of the method in any one of claims 1 to 8 by executing the executable instructions.

Images