Detection method and device of DNS tunnel

Abstract

The embodiment of the invention discloses a detection method and device of a DNS tunnel. The method includes: obtaining domain name system (DNS) request data, wherein fields of each piece of DNS request data include request time, client IP, a domain name, a primary domain name and a request packet size; using a white-list, a black-list, a gray-list and threat intelligence information of the primary domain name in the DNS request data to detect the DNS request data, generating black-list alarming information when the DNS request data are determined as of the DNS tunnel, and generating gray-listalarming information when the DNS request data are determined as of a suspected DNS tunnel; and receiving a confirmation instruction of a user on whether the generated gray-list alarming informationis of misjudgment, and adding the generated gray-list alarming information to the black-list if according to the confirmation instruction, it is determined that the generated gray-list alarming information is not of misjudgment. The embodiment of the invention can realize detection of the DNS tunnel, detection speed is high, and detection result accuracy is high.

Description

technical field [0001] The embodiment of the present invention relates to the technical field of the Internet, and in particular to a DNS tunnel detection method and device. Background technique [0002] In an enterprise intranet environment, the DNS (Domain Name System, Domain Name System) protocol is one of the essential network communication protocols. In order to access Internet and intranet resources, DNS provides domain name resolution services, which link domain names and IP Even protocol) address conversion. Most firewalls and intrusion detection devices basically do not filter, analyze or shield DNS, so hiding data or instructions in the DNS protocol for transmission is a concealed and effective means. In actual scenarios, when an attacker takes over the authority of a certain server, or the server is infected by malware, worms, Trojan horses, etc., through the establishment of DNS tunnels, sensitive information theft, file transfer, return control commands, and re...

AI Technical Summary

Problems solved by technology

However, this method can only detect and block the domain names that have been discovered, and there is nothing that can be done for unknown new domain names, and it needs to invest a lot of manpower and financial resources to maintain the blacklist, which is very low cost performance;

Images