Hijack recognition method, hijack recognition device for domain name system, electronic equipment and storage medium

Abstract

Embodiments of the invention provide a hijack recognition method and a hijack recognition device for a domain name system, electronic equipment and a storage medium, relating to the field of network security and capable of timely discovering DNS hijack threats not in the threat detection base and increasing the threat detection capability. The recognition method is applied to bypass detection equipment and comprises the following steps: recording the used received first domain name system response information corresponding to the domain name system access of the user; accessing a domain name the same as the domain name of the domain name system access of the user, receiving the second domain name system response information corresponding to the access; and determining whether the domain name system access of the user is hijacked according to the first domain name system response information and the second domain name system response information. The invention is suitable for protectionof computer network security.

Description

Technical field [0001] The present invention relates to the technical field of network security, in particular to a method, device, electronic equipment and storage medium for identifying hijacking of a domain name system. Background technique [0002] DNS (Domain Name System, DNS) hijacking, also known as domain name hijacking, refers to intercepting domain name resolution requests within the hijacked network, analyzing the requested domain name, and returning a fake IP address. The effect is that the hijacked user visits the fake website . [0003] In the process of implementing the present invention, the inventor found that when the bypass detection device performs DNS hijacking threat detection on traffic, it only records the user's DNS access, and performs detection according to the rules in the threat rule database, and detects some that are not in the rule database. The threat of DNS hijacking cannot be discovered in time. As a result, it will inevitably affect network secu...

AI Technical Summary

Problems solved by technology

[0003] In the process of realizing the present invention, the inventor found that when the bypass detection device detects the threat of DNS hijacking on the traffic, it only records the DNS access of the user, detects according to the rules in the threat rule base, and detects some traffic that is not in the rule base. The threat of DNS hijacking cannot be detected in time, which will inevitably affect the security of the network

Images