Domain name hijacking detection method and device, equipment, storage medium and program product

Abstract

The invention provides a domain name hijacking detection method and device, equipment, a storage medium and a program product. The method comprises the following steps: constructing an analysis baseline of a target domain name, wherein the analysis baseline comprises attribute characteristics of at least one of an IP address, a CNAME record and an NS record; comparing the latest resolution behavior data of the target domain name with the resolution baseline to generate an abnormal score; under the condition that the abnormal score exceeds an abnormal threshold value, performing multi-point analysis on the target domain name at different geographic position analysis points to obtain an analysis result; determining a hijacking attack type according to the analysis result and triggering a hijacking alarm; and performing correction measures in a targeted manner according to the hijacking attack type. The method is used for improving the detection accuracy and effectively reducing the business interruption risk and the data leakage risk caused by domain name hijacking.

Description

Technical Field

[0001] This application relates to the field of network technology, and in particular to a domain name hijacking detection method, apparatus, device, storage medium, and program product. Background Technology

[0002] When a user accesses a website via a domain name, the DNS service translates the domain name into a corresponding IP address, thus establishing a network connection. However, domain hijacking attacks can tamper with the DNS resolution results, causing users to access malicious websites or experience service interruptions. Summary of the Invention

[0003] This application provides a domain name hijacking detection method, apparatus, device, storage medium, and program product for detecting whether domain name hijacking has occurred.

[0004] Firstly, this application provides a method for detecting domain name hijacking, including:

[0005] Construct a resolution baseline for the target domain name, wherein the resolution baseline includes at least one of the following attribute characteristics: Internet Protocol IP address, canonical name CNAME record, and name server NS record;

[0006] The latest DNS resolution behavior data of the target domain name is compared with the DNS resolution baseline to generate an anomaly score;

[0007] If the abnormal score exceeds the abnormal threshold, the target domain name is resolved at multiple points in different geographical locations to obtain the resolution result;

[0008] The hijacking attack type is determined based on the analysis results, and a hijacking alert is triggered.

[0009] Implement targeted corrective measures based on the type of hijacking attack described.

[0010] In one possible implementation, constructing the resolution baseline for the target domain name includes:

[0011] Obtain at least one of the following: the set of IP addresses, the set of CNAME records, and the set of NS records for the target domain.

[0012] Autonomous system, organization information and address properties are extracted from the IP address set to generate an IP address baseline;

[0013] Extract the second-level domain, record type, and provider from the CNAME record set to generate a CNAME record baseline;

[0014] The second-level domain, record type, and provider are extracted from the NS record set to generate the NS record baseline.

[0015] In one possible implementation, the step of comparing the latest resolution behavior data of the target domain name with the resolution baseline to generate an anomaly score includes:

[0016] When the latest resolution data of the target domain name is received, attribute features are extracted from the IP address, CNAME record and NS record in the latest resolution data to generate the latest resolution behavior data;

[0017] The latest analytical behavior data is compared item by item with the analytical baseline to obtain the anomaly indication value corresponding to each attribute feature;

[0018] The anomaly score is obtained by weighted summation of the anomaly indication values ​​corresponding to each attribute feature.

[0019] In one possible implementation, the step of performing multi-point resolution on the target domain name at different geographical location resolution points to obtain the resolution result includes:

[0020] Obtain a pre-configured set of resolution points located in different geographical locations; the set of resolution points includes local network resolution points and multiple cross-regional network resolution points;

[0021] Each of the resolution points in the set of resolution points resolves the target domain name to obtain the latest resolution data for each resolution point;

[0022] The step of determining the hijacking attack type and triggering a hijacking alarm based on the parsing results includes:

[0023] For each of the resolution points, attribute features are extracted from the IP address, CNAME record, and NS record in the latest resolution data of the resolution point to generate the latest resolution behavior data of the resolution point;

[0024] The latest parsing behavior data of each parsing point is compared with the parsing baseline to obtain the comparison results;

[0025] Based on the comparison results of each of the aforementioned analysis points, the type of hijacking attack is determined and a hijacking alarm is triggered.

[0026] In one possible implementation, determining the hijacking attack type and triggering a hijacking alarm based on the comparison results of each of the parsing points includes:

[0027] If the comparison results of the local network resolution point and the comparison results of each cross-regional network resolution point are consistent with the resolution baseline, then the hijacking attack type is determined to be the first type and the first type alarm is triggered;

[0028] If the comparison result of the local network resolution point is consistent with the latest resolution behavior data of the target domain name, and the comparison result of each cross-regional network resolution point is consistent with the resolution baseline, then the hijacking attack type is determined to be the second type and a second type alarm is triggered.

[0029] If the comparison results of the local network resolution point and the comparison results of each cross-regional network resolution point are consistent with the latest resolution behavior data of the target domain name, then the hijacking attack type is determined to be the third type and a third type alarm is triggered.

[0030] In one possible implementation, the targeted remedial measures based on the type of hijacking attack include:

[0031] If the hijacking attack type is the first type, then identify the recursive server that was poisoned and reset the cache;

[0032] If the hijacking attack type is the second type, then the communication path outside the network is checked to determine the location where the tampering occurred and repair it;

[0033] If the hijacking attack type is the third type, then determine whether the domain name resolution behavior belongs to a legitimate change of owner or a hijacking by attacker, and update the resolution baseline according to the determination result;

[0034] Updating the analytical baseline based on the determined result includes:

[0035] If the domain name resolution behavior is due to a legitimate change of owner, then based on the differences between the latest resolution behavior data and the resolution baseline, a replacement strategy or an addition strategy is adopted to update the resolution baseline;

[0036] If the domain name resolution behavior is due to hijacking by an attacker, then determine the location where the tampering occurred and fix it.

[0037] Secondly, this application provides a domain name hijacking detection device, comprising:

[0038] The building module is used to build the resolution baseline of the target domain name, wherein the resolution baseline includes at least one of the attribute characteristics of Internet Protocol IP address, canonical name CNAME record, and name server NS record;

[0039] The comparison module is used to compare the latest resolution behavior data of the target domain name with the resolution baseline and generate an anomaly score;

[0040] The resolution module is used to perform multi-point resolution on the target domain name at different geographical location resolution points when the abnormal score exceeds the abnormal threshold, so as to obtain the resolution result;

[0041] The alarm module is used to determine the hijacking attack type based on the parsing results and trigger a hijacking alarm;

[0042] The correction module is used to perform targeted correction measures based on the type of hijacking attack.

[0043] Thirdly, this application provides an electronic device, including: a processor and a memory communicatively connected to the processor;

[0044] The memory stores computer-executed instructions;

[0045] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0046] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible embodiments of the first aspect.

[0047] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0048] The domain hijacking detection method, apparatus, equipment, storage medium, and program products provided in this application cover all levels of hijacking attacks by constructing a multi-dimensional resolution baseline (IP address, CNAME record, NS record), which helps overcome the limitations of related technologies that only target recursive-level hijacking. By comparing the latest resolution behavior data of the target domain name with the resolution baseline, abnormal changes are quantified to distinguish between legitimate changes and malicious hijacking. Through comparative analysis of multiple geographical location resolution points, the attack type is determined, facilitating targeted corrective measures, improving detection accuracy, and effectively reducing the risks of business interruption and data leakage caused by domain hijacking. Attached Figure Description

[0049] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0050] Figure 1 A schematic diagram of the system architecture for the domain hijacking detection method provided in this application;

[0051] Figure 2 Flowchart of the domain hijacking detection method provided in this application Figure 1 ;

[0052] Figure 3Flowchart of the domain hijacking detection method provided in this application Figure 2 ;

[0053] Figure 4 A schematic diagram of the domain name hijacking detection device provided in this application;

[0054] Figure 5 A schematic diagram of the structure of the electronic device provided in this application.

[0055] The accompanying drawings have illustrated specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to specific embodiments. Detailed Implementation

[0056] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0057] DNS (Domain Name System): Domain Name System.

[0058] TLD (Top-Level Domain): Top-level domain.

[0059] NS (Name Server): Name server.

[0060] SLD (Second-Level Domain): A second-level domain.

[0061] Zone file: A DNS zone file that stores domain name resolution configurations.

[0062] IP (Internet Protocol) address: Internet Protocol address.

[0063] JSON (JavaScript Object Notation): A lightweight data interchange format.

[0064] Domain name resolution is a fundamental step in accessing internet services, widely used in enterprise business systems, cloud computing platforms, Content Delivery Networks (CDNs), and everyday user network access. For example, when a user accesses a website via a domain name, the domain name resolution service translates the domain name into its corresponding IP address, thus establishing a network connection. However, domain hijacking attacks can tamper with the resolution results, causing users to access malicious websites or experience service interruptions.

[0065] Domain hijacking can be divided into three types:

[0066] (1) TLD hijacking. Attackers modify the NS record in the TLD zone file of the subdomain, i.e. the authoritative server, through certain means, and hijack the resolution of the subdomain to the server specified by the attacker.

[0067] (2) SLD hijacking. Attackers use certain methods to modify the Canonical Name (CNAME) or Address (A) records stored in the SLD zone file, hijacking the resolution of third-level or lower-level domain names to a specified server.

[0068] (3) Recursive resolution hijacking. Attackers tamper with the cache records of the domain name recursive resolver through attack methods such as cache poisoning, and hijack the resolution of the corresponding domain name to a designated server.

[0069] Current detection methods primarily focus on recursive cache poisoning scenarios, lacking sufficient detection capabilities for TLD and SLD-level hijacking. This allows attackers to target higher-level domain name resolution chains, bypassing existing defense mechanisms. Furthermore, domain name hijacking attacks are often characterized by high stealth and complex attack paths. For example, attackers may tamper with authoritative domain name server records or hijack routing nodes in the communication path, making the attack difficult to detect and locate in a timely manner.

[0070] This application addresses the limitations of existing technologies by first identifying a blind spot in the detection of full-level hijacking attacks: current detection methods only cover recursive-level hijacking, while TLD / SLD-level hijacking lacks effective detection methods. To address this, it proposes constructing a multi-dimensional resolution baseline (IP address, CNAME, NS record, etc.) and detecting anomalies by comparing baseline changes. Secondly, it introduces an active verification mechanism: deploying resolution points in different geographical locations and comparing resolution results to confirm the authenticity of anomalies. Finally, it combines an attack type localization mechanism to implement targeted corrective measures. Through this series of technological advancements, a detection scheme covering full-level hijacking and combining baseline comparison with active verification is ultimately formed.

[0071] Figure 1This is a schematic diagram of the system architecture of the domain hijacking detection method provided in this application, as shown below. Figure 1 As shown, the system architecture includes electronic device 10.

[0072] Electronic device 10 is used to detect whether domain name hijacking has occurred. Optionally, electronic device 10 is a server, which may be an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing basic cloud computing services.

[0073] like Figure 1 As shown, electronic device 10 acquires passive DNS data, constructs a resolution baseline, compares it with the resolution baseline, and actively verifies if there is an anomaly to determine the type of hijacking attack. If a hijacking alarm is triggered, corrective measures are executed.

[0074] The application scenarios covered by this application include enterprise-level DNS services, cloud platforms, and Internet infrastructure.

[0075] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0076] Figure 2 Flowchart of the domain hijacking detection method provided in this application Figure 1 ,like Figure 2 As shown, the method includes:

[0077] S201. Construct a resolution baseline for the target domain name. The resolution baseline includes at least one of the following attribute characteristics: IP address, CNAME record, and NS record.

[0078] The target domain is any domain that is to be tested to see if domain hijacking has occurred.

[0079] For a target domain Its IP address set is Its CNAME record set is Its second-level domain's NS record set is The number of elements n in each set is usually a different value.

[0080] When a client queries a target domain name and receives a response (such as an A record, CNAME record, NS record, etc.), the response content is collected and stored in the passive DNS database. In this application, it is assumed that the network where the source location of the passive DNS data is located is Network0. The source location refers to the network location where the passive DNS data is collected or observed, that is, from which network node (such as a recursive server, traffic mirror point, etc.) the data is captured.

[0081] Passive DNS data captures and stores various mapping relationships that have appeared in the DNS resolution process of the target domain name in history, thus providing a data foundation for analyzing the behavior, ownership, change trends and potential threats of the target domain name.

[0082] A resolution baseline is a set of benchmark values ​​for the DNS resolution records of a target domain under normal conditions, used to detect abnormal changes.

[0083] Optionally, the resolution baseline includes at least one of the following: IP address baseline, CNAME record baseline, and NS record baseline.

[0084] The IP address baseline includes at least one attribute characteristic of the IP address, specifically including at least one of the following: the set of IP addresses, the set of autonomous systems to which the IP addresses belong, the set of organizations to which the IP addresses belong, and the properties of the IP addresses.

[0085] The CNAME record baseline includes at least one attribute characteristic of the CNAME record, specifically including at least one of the following: the set of CNAME records, the set of CNAME subdomains, the CNAME property, and the CNAME provider.

[0086] The NS record baseline includes at least one attribute characteristic of the NS record, specifically including at least one of the following: NS record set, NS record subdomain, NS record nature, and NS server provider.

[0087] S202. Compare the latest resolution behavior data of the target domain name with the resolution baseline to generate an anomaly score.

[0088] Latest analysis of behavioral data latest ) is generated from the latest DNS resolution data (Data_latest) of the target domain name according to the construction method of the DNS resolution baseline.

[0089] The anomaly score quantifies the degree of anomaly in the latest resolved data. A higher anomaly score indicates a greater likelihood of domain hijacking of the target domain; conversely, a lower anomaly score indicates a less likely domain hijacking of the target domain.

[0090] This application sets an anomaly threshold (T), which is the critical value for distinguishing normal changes from abnormal changes.

[0091] If T ≤ score, it indicates that the resolution of the domain name has undergone abnormal changes, and active verification of the domain name resolution is required, that is, steps S203 - S204 are executed.

[0092] If 0 < score < T, it indicates that the resolution of the target domain name has undergone normal changes, and then the baseline is updated based on behavior latest to update the baseline.

[0093] Optionally, according to the difference content between the latest parsing behavior data and the parsing baseline, a replacement strategy or an addition strategy is used to update the parsing baseline. Among them, the replacement strategy means completely using behavior latest to replace the baseline. The addition strategy means merging the newly emerged items in behavior latest with the baseline as the new baseline.

[0094] If score = 0, there is no need to update the baseline.

[0095] S203. In the case where the anomaly score exceeds the anomaly threshold, multi-point resolution of the target domain name is performed at different geographical location resolution points to obtain the resolution results.

[0096] The geographical location resolution point refers to the DNS resolution servers deployed at different geographical locations. Different geographical locations represent different network positions.

[0097] The resolution result obtained by resolving at any geographical location resolution point contains the latest parsing data of that resolution point.

[0098] S204. Determine the hijacking attack type based on the resolution results and trigger a hijacking alarm.

[0099] The hijacking attack type refers to the attack type judged according to the difference in the resolution results, including cache poisoning attack, communication path hijacking or authoritative level hijacking.

[0100] Triggering a hijacking alarm can be implemented as outputting an alarm message to prompt the user that a domain name hijacking has occurred.

[0101] S205. Execute corrective measures according to the hijacking attack type.

[0102] This application can pre-configure different corrective measures for different hijacking attack types, so as to facilitate the targeted execution of corrective measures.

[0103] The relevant techniques primarily target cache poisoning attacks on recursive resolvers (i.e., recursive hijacking), but cannot detect hijacking attacks at the TLD or SLD level (such as NS record or CNAME record tampering). Attackers can directly hijack the domain name resolution chain by modifying records on authoritative name servers, bypassing the detection mechanism of recursive resolution levels.

[0104] This application constructs a multi-dimensional DNS resolution baseline (IP address, CNAME record, NS record) to cover all levels of hijacking attacks, overcoming the limitations of related technologies that only target recursive-level hijacking. By comparing the latest DNS resolution behavior data of the target domain with the resolution baseline, abnormal changes are quantified to distinguish between legitimate changes and malicious hijacking. Through comparative analysis of multiple geographical location DNS resolution points, the attack type is determined, facilitating targeted corrective measures, improving detection accuracy, and effectively reducing the risks of business interruption and data leakage caused by domain hijacking.

[0105] In one possible implementation, step S201, namely the specific implementation process of constructing the resolution baseline of the target domain name, includes S2011-S2014.

[0106] S2011. Obtain at least one of the following: the set of IP addresses, the set of CNAME records, and the set of NS records for the target domain name.

[0107] For ease of description, this application uses the example of resolving baselines including IP address baselines, CNAME record baselines, and NS record baselines. Accordingly, this step involves obtaining the IP address set, CNAME record set, and NS record set.

[0108] S2012. Extract autonomous system, organization information and address properties from the set of IP addresses to generate an IP address baseline.

[0109] The IP address baseline (baseline_ip) includes at least one of the following:

[0110] IP address set: .

[0111] The set of autonomous systems to which the IP belongs: It is This is obtained by retrieving the Autonomous System Number (ASN) from all IP addresses and then removing duplicates. An Autonomous System (ASN) refers to the network management domain to which an IP address belongs, used to identify the management boundary in a network path.

[0112] The set of organizations to which the IP belongs: It is This is obtained by deduplicating the organizations to which the ASNs belong for all IP addresses.

[0113] IP address properties: If If all IP addresses in a given network originate from third-party public providers, then the IP addresses are considered public. For example... ;if If none of the IP addresses in the list are provided by a third-party public provider, then the IP addresses are considered private. If it falls under other categories, the IP address type is "other," for example... .

[0114] S2013. Extract the second-level domain, record type, and provider from the CNAME record set to generate a CNAME record baseline.

[0115] if If a DNS record contains a CNAME record, then its CNAME record baseline (baseline_cname) includes at least one of the following:

[0116] CNAME record set: .

[0117] A collection of subdomains for CNAME records: It is This is obtained by deduplicating all CNAME records after retrieving their subdomains.

[0118] CNAME properties: If all CNAME records in the CNAME record set are services provided by a public provider, then If all CNAME records in the CNAME record set are services provided by a private provider, then If it falls under other categories, then the CNAME status is "other," for example... The specific nature of a CNAME record is determined based on the set of CNAME records through methods such as keyword matching.

[0119] CNAME provider: It is determined by keyword matching and other methods based on the set of CNAME records.

[0120] It should be noted that if If there is no CNAME record in the DNS records, then the baseline of its CNAME record is empty.

[0121] S2014. Extract the second-level domain, record type, and provider from the NS record set to generate the NS record baseline.

[0122] The NS record baseline (baseline_ns) includes at least one of the following:

[0123] NS record collection: .

[0124] The set of second-level domains for NS records: It is This is obtained by deduplicating all NS records after retrieving their second-level domains.

[0125] NS record properties: If all NS records in the NS record set are services provided by public providers, then If all NS records in the NS record set are services provided by private providers, then If it falls under other circumstances, then The properties of NS records are determined based on the NS records in the NS record set through methods such as keyword matching.

[0126] NS server provider: It is determined based on the NS record set through keyword matching and other methods.

[0127] For example, the resolution baseline of the target domain name can be represented in JSON format:

[0128] baseline ={

[0129] “baseline_ip”=

[0130] “baseline_cname”=

[0131] “baseline_ns”=

[0132] }

[0133] In related technologies, domain hijacking detection primarily relies on machine learning-based anomaly detection methods. These methods typically train models to identify abnormal resolution behavior by analyzing DNS query logs and historical data of resolution results. For example, they can determine the presence of anomalies by statistically analyzing the IP address distribution and resolution time latency of domain name resolutions, combined with clustering or classification algorithms.

[0134] Machine learning-based detection methods require a large amount of high-quality historical data for training. However, in the absence of verified normal parsing data, the model may not be able to accurately distinguish between legitimate changes and malicious attacks, leading to false positives or false negatives.

[0135] This application can construct a resolution baseline based on verified and confirmed correct passive DNS data, thus ensuring a high level of confidence in the baseline. In the absence of verified data, it assumes that the first DNS data encountered is normal to reduce the risk of misjudgment. In other words, a resolution baseline can also be constructed solely based on unverified passive DNS data. This assumes that domain hijacking is extremely rare, therefore the first passive DNS data encountered is highly likely to be normal and unhijacked resolution data.

[0136] This application constructs a multidimensional resolution baseline to provide a benchmark reference for subsequent anomaly detection. The resolution baseline extracts key attributes such as the domain name's IP address, CNAME record, and NS record to form a multidimensional feature set.

[0137] In one possible implementation, step S202, which involves comparing the latest resolution behavior data of the target domain name with the resolution baseline to generate an anomaly score, includes steps S2021-S2023.

[0138] S2021. When the latest resolution data of the target domain name is received, extract the attribute features of the IP address, CNAME record and NS record in the latest resolution data to generate the latest resolution behavior data.

[0139] The implementation method of this step is the same as that of step S201, and will not be repeated here.

[0140] For example, the latest DNS resolution behavior data for a target domain can be represented in JSON format:

[0141] behavior latest ={

[0142] “baseline_ip_latest”=

[0143] “baseline_cname_latest”=

[0144] “baseline_ns_latest”=

[0145] }

[0146] S2022. Compare the latest analytical behavior data with the analytical baseline item by item to obtain the anomaly indication value corresponding to each attribute feature.

[0147] Anomaly indicator values ​​are used to indicate whether an attribute or characteristic is abnormal. For example, if the anomaly indicator value is 0, it means that the attribute or characteristic is normal; conversely, if the anomaly indicator value is 1, it means that the attribute or characteristic is abnormal.

[0148] S2023. The anomaly score is obtained by weighted summation of the anomaly indication values ​​corresponding to each attribute feature.

[0149] The initial anomaly score for each comparison is 0. Anomaly weights are assigned to each attribute feature, for example... The anomaly weight is w2, if and If they are the same, the score remains unchanged; otherwise, if and If there is inconsistency, the new outlier score is increased by w2. Here, consistency refers to… and Completely identical or yes A subset of.

[0150] And so on, comparing the baseline with the behavior one by one. latest Each element in the equation yields the final score.

[0151] Assume that an IP address of 203.0.113.67 (not an IP address from the Baseline) is added to Data_latest, while the CNAME and NS records remain unchanged. Based on the weights (e.g., the anomaly weight of the IP address w1 = 0.5), an anomaly score of 0.5 is calculated. If the anomaly threshold T = 0.3, active verification is triggered.

[0152] Weighted scoring methods comprehensively assess the degree of anomaly by assigning weights to different attribute features. For example, changes in IP addresses are generally more likely to represent hijacking attacks than changes in CNAME records, and therefore are given higher weights. Furthermore, other methods that measure offset can be used to calculate anomaly scores, including but not limited to machine learning algorithms.

[0153] In one possible implementation, the specific implementation process of performing multi-point resolution on the target domain name at different geographical location resolution points in step S203 to obtain the resolution result includes steps S2031-S2032.

[0154] S2031. Obtain a pre-configured set of resolution points located in different geographical locations; the set of resolution points includes local network resolution points and multiple cross-regional network resolution points.

[0155] This application pre-configures a set of resolution points R={ r0,r1,…,r...} located in different geographical locations. m-1} Here, r0 represents the local network resolver, which is the same location as the passive DNS data source and is located within Network0. The remaining resolvers are cross-region network resolvers, which are located outside the passive DNS data source and have a certain geographical or network distance. The number of resolvers is m, and the specific value can be set according to actual needs.

[0156] S2032. Each resolution point in the resolution point set resolves the target domain name to obtain the latest resolution data for each resolution point.

[0157] This step is performed in R={r0,r1,…,r...} m-1 Each resolution point in the} performs a complete resolution of the target domain name, that is, it does not rely on caching, but obtains the latest and most authoritative resolution records by communicating with the authoritative servers at all levels of the target domain name.

[0158] In one possible implementation, step S204, that is, the specific implementation process of determining the hijacking attack type based on the parsing result and triggering the hijacking alarm, includes steps S2041-S2043:

[0159] S2041. For each resolution point, extract attribute features from the IP address, CNAME record, and NS record in the latest resolution data of that resolution point, and generate the latest resolution behavior data for that resolution point.

[0160] For example, at the i-th resolution point r i The latest parsed data obtained is a i The analytical baseline construction function is used to construct a i Attribute feature extraction was performed, and the latest parsed behavioral data obtained was b. i The value of i ranges from [0, m-1].

[0161] S2042. Compare the latest analytical behavior data of each analytical point with the analytical baseline to obtain the comparison results.

[0162] The implementation method of this step is the same as the item-by-item comparison in step S2022, and will not be repeated here.

[0163] The comparison results can be represented using anomaly indicator values, which indicate whether there are any anomalies in the attribute features of the latest parsed behavioral data. For example, if the anomaly indicator value is 0, it means that the attribute features are normal, that is, consistent with the attribute features in the parsing baseline; conversely, if the anomaly indicator value is 1, it means that the attribute features are abnormal, that is, inconsistent with the attribute features in the parsing baseline.

[0164] S2043. Based on the comparison results of each analysis point, determine the hijacking attack type and trigger a hijacking alarm.

[0165] In one possible implementation, the specific implementation process of step S2043 includes the following cases.

[0166] The first scenario: If the comparison results of the local network resolution point and the comparison results of each cross-regional network resolution point are consistent with the resolution baseline, then the hijacking attack type is determined to be the first type and the first type alarm (Alert0) is triggered.

[0167] If {b0, b1, ..., b m-1 The fact that every element in} matches the baseline indicates that a cache poisoning attack targeting the recursive resolver occurred within Network0, causing domain name resolution errors. This is because passive DNS data is typically based on the recursive resolver cache, which is now experiencing resolution errors; while other locations resolve normally without relying on the cache.

[0168] The second scenario: If the comparison result of the local network resolution point represents the latest resolution behavior data of the target domain name... latest If the results of the comparison of each cross-regional network resolution point are consistent with the resolution baseline, then the hijacking attack type is determined to be the second type and a second type alarm (Alert1) is triggered.

[0169] If b0 is related to behavior latest The corresponding attribute characteristics are consistent, while other parsing points {b1,…,b} are consistent. n The fact that all values ​​are consistent with the baseline indicates that the DNS resolution of Network0 was intercepted and tampered with externally, resulting in the hijacking of the resolution of the target domain name within the Network0 zone.

[0170] The third scenario: If the comparison results of the local network resolution point and the comparison results of each cross-regional network resolution point all indicate that they are consistent with the latest resolution behavior data of the target domain name, then the hijacking attack type is determined to be the third type and the third type alarm (Alert2) is triggered.

[0171] If {b0, b1, ..., b n Both are related to behavior latest Consistency can be considered as the target domain name's resolution being consistent across the entire network, or at least within the range of {b0, b1, ..., b}. n DNS hijacking occurred within the network where the network is located.

[0172] In one possible implementation, step S205, that is, the specific implementation process of performing targeted corrective measures according to the type of hijacking attack, includes the following situations.

[0173] Scenario 1: If the hijacking attack type is Type 1, then the infected recursive server is identified, and its cache is reset. Specifically, if a hijacking alert Alert0 is triggered, the communication of the recursive servers within Network 0 is analyzed and detected to identify the infected recursive server and reset its cache.

[0174] The second scenario: If the hijacking attack is of type two, the communication paths outside the network are checked to determine the location where the tampering occurred and then repaired. Specifically, if a hijacking alarm Alert1 is triggered, the communication paths outside Network0 are checked to find the location where the tampering occurred and then repaired. During this process, the parsed data in the baseline can be temporarily used as a cache to respond to client requests within the network.

[0175] The third scenario: If the hijacking attack type is the third type, then it is necessary to determine whether the domain name resolution behavior is due to a legitimate change of ownership or hijacking by the attacker, and update the resolution baseline based on the determination result. Specifically, if a hijacking alert Alert2 is triggered, it is necessary to further confirm whether the target domain name's resolution behavior is due to a legitimate change of ownership or malicious hijacking by the attacker.

[0176] Possible methods for determining this include actively requesting the resource pointed to by the domain name, verifying the digital certificate obtained from the resolved IP address, and manually contacting the domain name owner.

[0177] Optionally, the specific implementation process of updating the DNS resolution baseline based on the determined results includes: if the domain name resolution behavior is due to a legitimate change of owner, then based on the differences between the latest resolution behavior data of the target domain name and the DNS resolution baseline, a replacement strategy or an addition strategy is adopted to update the DNS resolution baseline. If the domain name resolution behavior is due to hijacking by an attacker, then the location where the tampering occurred is determined and repaired.

[0178] Specifically, if it is confirmed that the change of domain owner is legitimate, then it is based on behavior. latest Update the baseline. There are two update strategies: replacement and addition. See the relevant description in step S202 for details, which will not be repeated here.

[0179] If it is determined that the attack has maliciously hijacked the data, the relevant tampered data needs to be corrected. During this process, the parsed data in the baseline can be temporarily used as a cache to respond to client requests within the network.

[0180] Optionally, the location of the hijacking can be further confirmed based on the locations where inconsistencies occur:

[0181] If behavior latestIf the inconsistency with the baseline appears in the "baseline_ns_latest" section, it suggests that an attacker may have tampered with the domain name resolution at the DNS root domain or top-level domain, leading to domain hijacking. Otherwise, if the behavior... latest If the inconsistency with the baseline appears in the "baseline_cname_latest" or "baseline_ip_latest" section, it is considered that the attacker has tampered with the domain name resolution from the second-level domain, resulting in domain hijacking.

[0182] Figure 3 Flowchart of the domain hijacking detection method provided in this application Figure 2 ,like Figure 3 As shown, in this embodiment... Figure 2 Based on the embodiments, the domain name hijacking detection method is illustrated by way of example. The method includes:

[0183] S301. Establish the resolution baseline for the target domain name.

[0184] S302. When the latest resolution data of the target domain name is received, extract the attribute features of the IP address, CNAME record and NS record in the latest resolution data to generate the latest resolution behavior data.

[0185] S303. Compare the latest analytical behavior data with the analytical baseline item by item to obtain the anomaly indication value corresponding to each attribute feature.

[0186] S304. The anomaly score is obtained by weighted summation of the anomaly indication values ​​corresponding to each attribute feature.

[0187] If the abnormal score exceeds the abnormal threshold, proceed to steps S305-S310; if the abnormal score exceeds 0 but does not exceed the abnormal threshold, proceed to step S311; if the abnormal score is 0, proceed to step S312.

[0188] S305. Obtain a pre-configured set of resolution points located in different geographical locations; the set of resolution points includes local network resolution points and multiple cross-regional network resolution points.

[0189] S306. Each resolution point in the resolution point set resolves the target domain name to obtain the latest resolution data for each resolution point.

[0190] S307. For each resolution point, extract attribute features from the IP address, CNAME record, and NS record in the latest resolution data of that resolution point, and generate the latest resolution behavior data for that resolution point.

[0191] S308. Compare the latest analytical behavior data of each analytical point with the analytical baseline to obtain the comparison results.

[0192] S309. Based on the comparison results of each analysis point, determine the type of hijacking attack and trigger a hijacking alarm.

[0193] S310. Implement targeted corrective measures based on the type of hijacking attack.

[0194] S311. Based on the differences between the latest parsed behavioral data and the parsing baseline, update the parsing baseline using a replacement strategy or an addition strategy.

[0195] S312. Keep the analytical baseline unchanged.

[0196] The implementation of each step in this embodiment is the same as in the above embodiment, and will not be repeated here.

[0197] like Figure 1 As shown, this application extracts the IP address, CNAME record, and NS record of the target domain name from verified DNS data or passive NDS traffic to construct a multi-dimensional DNS resolution baseline. The latest resolution data is acquired in real time, and an anomaly score is calculated by comparing the resolution baseline with the latest resolution behavior data using a weighted scoring method. If the score exceeds the anomaly threshold, active verification is triggered. Resolution points are deployed in different geographical locations, and the resolution results are compared with the resolution baseline. Based on the consistency of the resolution results, the type of hijacking attack (such as cache poisoning, communication path hijacking, or authority level hijacking) is determined. Targeted remediation is performed according to the type of hijacking attack, and the baseline is dynamically updated to adapt to legitimate changes.

[0198] Figure 4 This is a schematic diagram of the domain name hijacking detection device provided in this application, as shown below. Figure 4 As shown, the domain name hijacking detection device 40 provided in this embodiment includes:

[0199] Module 401 is used to construct the resolution baseline of the target domain name. The resolution baseline includes at least one of the following attribute characteristics: Internet Protocol IP address, canonical name CNAME record, and name server NS record.

[0200] Comparison module 402 is used to compare the latest resolution behavior data of the target domain name with the resolution baseline and generate anomaly score;

[0201] The resolution module 403 is used to perform multi-point resolution on the target domain name at different geographical locations when the abnormal score exceeds the abnormal threshold, and obtain the resolution result.

[0202] Alarm module 404 is used to determine the hijacking attack type based on the parsing results and trigger a hijacking alarm;

[0203] The correction module 405 is used to perform targeted correction measures based on the type of hijacking attack.

[0204] In one alternative implementation, module 401 is used for:

[0205] Obtain at least one of the following: the set of IP addresses, the set of CNAME records, and the set of NS records for the target domain.

[0206] Extract autonomous system, organization information and address properties from the set of IP addresses to generate an IP address baseline;

[0207] Extract subdomains, record types, and providers from the CNAME record set to generate a CNAME record baseline;

[0208] Extract the second-level domain, record type, and provider from the NS record set to generate the NS record baseline.

[0209] In one alternative implementation, comparison module 402 is used for:

[0210] When the latest DNS resolution data for the target domain is received, attribute features are extracted from the IP address, CNAME record, and NS record in the latest DNS resolution data to generate the latest DNS resolution behavior data.

[0211] The latest analytical behavior data is compared item by item with the analytical baseline to obtain the anomaly indication value corresponding to each attribute feature;

[0212] The anomaly score is obtained by weighted summation of the anomaly indication values ​​corresponding to each attribute feature.

[0213] In one alternative implementation, the parsing module 403 is used for:

[0214] Obtain a pre-configured set of resolution points located in different geographical locations; the set of resolution points includes local network resolution points and multiple cross-regional network resolution points;

[0215] Each resolution point in the resolution point set resolves the target domain name, and the latest resolution data of each resolution point is obtained;

[0216] Alarm module 404 is used for:

[0217] For each DNS resolution point, attribute features are extracted from the IP address, CNAME record, and NS record in the latest DNS resolution data to generate the latest DNS resolution behavior data for that point.

[0218] The latest analytical behavior data of each analytical point is compared with the analytical baseline to obtain the comparison results;

[0219] Based on the comparison results of each analysis point, the type of hijacking attack is determined and a hijacking alarm is triggered.

[0220] In one alternative implementation, alarm module 404 is used for:

[0221] If the comparison results of the local network resolution point and the comparison results of each cross-regional network resolution point are consistent with the resolution baseline, then the hijacking attack type is determined to be the first type and the first type alarm is triggered.

[0222] If the comparison results of the local network resolution point are consistent with the latest resolution behavior data of the target domain name, and the comparison results of each cross-regional network resolution point are consistent with the resolution baseline, then the hijacking attack type is determined to be the second type and a second type alarm is triggered.

[0223] If the comparison results of the local network resolution point and the comparison results of each cross-regional network resolution point all indicate that they are consistent with the latest resolution behavior data of the target domain name, then the hijacking attack type is determined to be the third type and a third type alarm is triggered.

[0224] In one alternative implementation, the correction module 405 is used for:

[0225] If the hijacking attack type is Type 1, then identify the recursive server that was poisoned and reset its cache;

[0226] If the hijacking attack is of type 2, then check the communication paths outside the network to determine the location where the tampering occurred and repair it;

[0227] If the hijacking attack type is the third type, determine whether the domain name resolution behavior is a legitimate change of owner or a hijacking by attacker, and update the resolution baseline according to the determination result;

[0228] Update the analytical baseline based on the determined results, including:

[0229] If the domain name resolution behavior is due to a legitimate change of ownership, the resolution baseline will be updated by adopting a replacement strategy or an addition strategy based on the differences between the latest resolution behavior data of the target domain name and the resolution baseline.

[0230] If the domain name resolution behavior is due to hijacking by an attacker, then determine the location where the tampering occurred and fix it.

[0231] The domain name hijacking detection device 40 provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0232] Figure 5 A schematic diagram of the structure of the electronic device provided in this application. Figure 5As shown, the electronic device 10 provided in this embodiment includes a processor 101 and a memory 102 that is communicatively connected to the processor 101.

[0233] Optionally, the electronic device 10 also includes a communication component 103. The processor 101, memory 102, and communication component 103 are connected via a bus.

[0234] In the specific implementation process, the processor 101 executes the computer execution instructions stored in the memory 102, causing the processor 101 to perform the above-described method.

[0235] The specific implementation process of processor 101 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0236] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0237] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0238] Buses can be Industry Standard Architecture (ISA) buses, Peripheral Component Interconnect (PCI) buses, or Extended Industry Standard Architecture (EISA) buses, etc. Buses can be categorized into address buses, data buses, control buses, etc.

[0239] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0240] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0241] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as read-only memory (ROM), static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0242] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an application-specific integrated circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0243] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0244] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0245] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0246] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device to execute all or part of the steps of the methods of the various embodiments of the present invention.

[0247] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A method for detecting domain name hijacking, characterized in that, include: Construct a resolution baseline for the target domain name, wherein the resolution baseline includes at least one of the following attribute characteristics: Internet Protocol IP address, canonical name CNAME record, and name server NS record; The latest DNS resolution behavior data of the target domain name is compared with the DNS resolution baseline to generate an anomaly score; If the abnormal score exceeds the abnormal threshold, the target domain name is resolved at multiple points in different geographical locations to obtain the resolution result; The hijacking attack type is determined based on the analysis results, and a hijacking alert is triggered. Implement targeted corrective measures based on the type of hijacking attack described.

2. The method according to claim 1, characterized in that, The resolution baseline for the target domain name includes: Obtain at least one of the following: the set of IP addresses, the set of CNAME records, and the set of NS records for the target domain. Autonomous system, organization information and address properties are extracted from the IP address set to generate an IP address baseline; Extract the second-level domain, record type, and provider from the CNAME record set to generate a CNAME record baseline; The second-level domain, record type, and provider are extracted from the NS record set to generate the NS record baseline.

3. The method according to claim 1, characterized in that, The step of comparing the latest resolution behavior data of the target domain name with the resolution baseline to generate an anomaly score includes: When the latest resolution data of the target domain name is received, attribute features are extracted from the IP address, CNAME record and NS record in the latest resolution data to generate the latest resolution behavior data; The latest analytical behavior data is compared item by item with the analytical baseline to obtain the anomaly indication value corresponding to each attribute feature; The anomaly score is obtained by weighted summation of the anomaly indication values ​​corresponding to each attribute feature.

4. The method according to claim 1, characterized in that, The process of performing multi-point resolution on the target domain name at different geographical location resolution points to obtain resolution results includes: Obtain a pre-configured set of resolution points located in different geographical locations; the set of resolution points includes local network resolution points and multiple cross-regional network resolution points; Each of the resolution points in the set of resolution points resolves the target domain name to obtain the latest resolution data for each resolution point; The step of determining the hijacking attack type and triggering a hijacking alarm based on the parsing results includes: For each of the resolution points, attribute features are extracted from the IP address, CNAME record, and NS record in the latest resolution data of the resolution point to generate the latest resolution behavior data of the resolution point; The latest parsing behavior data of each parsing point is compared with the parsing baseline to obtain the comparison results; Based on the comparison results of each of the aforementioned analysis points, the type of hijacking attack is determined and a hijacking alarm is triggered.

5. The method according to claim 4, characterized in that, The step of determining the hijacking attack type and triggering a hijacking alarm based on the comparison results of each of the aforementioned parsing points includes: If the comparison results of the local network resolution point and the comparison results of each cross-regional network resolution point are consistent with the resolution baseline, then the hijacking attack type is determined to be the first type and the first type alarm is triggered; If the comparison result of the local network resolution point is consistent with the latest resolution behavior data of the target domain name, and the comparison result of each cross-regional network resolution point is consistent with the resolution baseline, then the hijacking attack type is determined to be the second type and a second type alarm is triggered. If the comparison results of the local network resolution point and the comparison results of each cross-regional network resolution point are consistent with the latest resolution behavior data of the target domain name, then the hijacking attack type is determined to be the third type and a third type alarm is triggered.

6. The method according to claim 1, characterized in that, The targeted corrective measures based on the type of hijacking attack include: If the hijacking attack type is the first type, then identify the recursive server that was poisoned and reset the cache; If the hijacking attack type is the second type, then the communication path outside the network is checked to determine the location where the tampering occurred and repair it; If the hijacking attack type is the third type, then determine whether the domain name resolution behavior belongs to a legitimate change of owner or a hijacking by attacker, and update the resolution baseline according to the determination result; Updating the analytical baseline based on the determined result includes: If the domain name resolution behavior is due to a legitimate change of owner, then based on the difference between the latest resolution behavior data of the target domain name and the resolution baseline, a replacement strategy or an addition strategy is adopted to update the resolution baseline; If the domain name resolution behavior is due to hijacking by an attacker, then determine the location where the tampering occurred and fix it.

7. A domain name hijacking detection device, characterized in that, include: The building module is used to build the resolution baseline of the target domain name, wherein the resolution baseline includes at least one of the attribute characteristics of Internet Protocol IP address, canonical name CNAME record, and name server NS record; The comparison module is used to compare the latest resolution behavior data of the target domain name with the resolution baseline and generate an anomaly score; The resolution module is used to perform multi-point resolution on the target domain name at different geographical location resolution points when the abnormal score exceeds the abnormal threshold, so as to obtain the resolution result; The alarm module is used to determine the hijacking attack type based on the parsing results and trigger a hijacking alarm; The correction module is used to perform targeted correction measures based on the type of hijacking attack.

8. An electronic device, characterized in that, include: A processor and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-6.

Images