WO2018113732A1 - Method and apparatus for detecting dns full traffic hijack risk - Google Patents

Abstract

Embodiments of the present disclosure provide a method and apparatus for detecting a DNS full traffic hijack risk. The method comprises: obtaining one or more target domain names for detecting a domain name system DNS full traffic hijack risk, the one or more target domain names being wide area network domain names; performing DNS analysis on the one or more target domain names, and obtaining a target Internet protocol (IP) address corresponding to each target domain name, so as to further obtain one or more target IP addresses; determining whether a local area network address exists among the one or more target IP addresses; and when the local area network addresses exists among the one or more target IP addresses, determining that the UE has a DNS full traffic hijack risk.

Description

Method and device for detecting DNS full traffic hijacking risk

Cross-reference to related applications

This application claims priority to Chinese Patent Application No. 201611195637.6, entitled "A Method and Apparatus for Detecting the Risk of DNS Full Traffic Hijacking", filed on December 21, 2016, the entire contents of which are incorporated by reference. In this application.

Technical field

The present disclosure relates to the field of computer technologies, and in particular, to a method and apparatus for detecting a full traffic hijacking risk of a DNS.

Background technique

With the promotion and in-depth application of the network, various types of information in people's daily lives are more closely integrated with the network. For this reason, the detection of network security is even more important.

Take the DNS (Domain Name System) full traffic hijacking detection as an example. Some related technologies are detected by the following methods: First, the electronic device or server stores the blacklist library, and the blacklist library records multiple DNS full traffic hijacking risks. IP (Internet Protocol, Internet Protocol) address. The target domain name is parsed out to the corresponding IP address, and then the parsed IP address is compared in the blacklist library. If the resolved IP address is not in the IP address blacklist, it is determined that there is no DNS full traffic hijacking risk.

However, criminals usually control multiple IP addresses and even hijack new IP addresses, causing the blacklist to fail to record all risky IP addresses. Therefore, the above method is used to detect the risk of DNS full traffic hijacking, and there is a technical problem that the detection accuracy is low.

Summary of the invention

The embodiments of the present disclosure provide a method and a device for detecting a full traffic hijacking risk of a DNS, which are used to improve the detection accuracy of the full traffic hijacking risk of the DNS.

In a first aspect, the present disclosure provides a method for detecting a full traffic hijacking risk of a DNS, including:

Obtain one or more target domain names for detecting the risk of DNS full traffic hijacking in the domain name system; One or more target domain names are specifically WAN domain names;

Performing DNS resolution on one or more target domain names to obtain a target Internet Protocol IP address corresponding to each target domain name, thereby obtaining one or more target IP addresses;

Determining whether a local area network address exists in one or more target IP addresses;

When a local area network address exists in one or more target IP addresses, it is determined that the user equipment UE has a risk of DNS full traffic hijacking.

In a second aspect, the present disclosure provides a method for detecting a full traffic hijacking risk of a DNS, including:

Obtaining one or more target domain names for detecting the risk of DNS full traffic hijacking of the domain name system; wherein the known IP addresses corresponding to one or more target domain names are different;

Performing DNS resolution on one or more target domain names to obtain a target Internet Protocol IP address corresponding to each target domain name, thereby obtaining one or more target IP addresses;

Determining whether the same address exists in one or more target IP addresses;

When the same address exists in one or more target IP addresses, it is determined that the UE has a risk of DNS full traffic hijacking.

In a third aspect, the present disclosure provides a method for detecting a full traffic hijacking risk of a DNS, including:

Obtaining one or more target domain names for detecting the risk of DNS full traffic hijacking of the domain name system; wherein one or more target domain names are specifically WAN domain names, and the known Internet Protocol IP addresses corresponding to one or more target domain names are not the same;

Performing DNS resolution on one or more target domain names to obtain a target IP address corresponding to each target domain name, thereby obtaining one or more target IP addresses;

Determining whether a local area network address exists in one or more target IP addresses, and whether the same address exists in one or more target IP addresses;

When there is a local area network address in one or more target IP addresses, or the same address exists in one or more target IP addresses, it is determined that the user equipment UE has a risk of DNS full traffic hijacking.

In a fourth aspect, the disclosure provides a detecting device for a DNS full traffic hijacking risk, including:

Obtaining a module, configured to obtain one or more target domain names for detecting a risk of DNS full traffic hijacking of the domain name system; wherein, one or more target domain names are specifically a wide area network domain name;

The parsing module is configured to perform DNS resolution on one or more target domain names, obtain a target Internet Protocol IP address corresponding to each target domain name, and obtain one or more target IP addresses;

a first determining module, configured to determine whether a local area network exists in one or more target IP addresses site;

The first determining module is configured to determine that the user equipment UE has a risk of DNS full traffic hijacking when a local area network address exists in one or more target IP addresses.

In a fifth aspect, the disclosure provides a detecting device for a DNS full traffic hijacking risk, including:

Obtaining a module, configured to obtain one or more target domain names for detecting a full traffic hijacking risk of the domain name system; wherein, the known IP addresses corresponding to the one or more target domain names are different;

The parsing module is configured to perform DNS resolution on one or more target domain names, obtain a target Internet Protocol IP address corresponding to each target domain name, and obtain one or more target IP addresses;

a first determining module, configured to determine whether the same address exists in one or more target IP addresses;

The first determining module is configured to determine that the UE has a full traffic hijacking risk when the same address exists in one or more target IP addresses.

In a sixth aspect, the disclosure provides a device for detecting a full traffic hijacking risk of a DNS, including:

Obtaining a module, configured to obtain one or more target domain names for detecting a risk of DNS full traffic hijacking of the domain name system; wherein the one or more target domain names are specifically a WAN domain name, and the known Internet corresponding to the one or more target domain names Protocol IP addresses are not the same;

The parsing module is configured to perform DNS resolution on one or more target domain names, obtain a target IP address corresponding to each target domain name, and obtain one or more target IP addresses;

a determining module, configured to determine whether a local area network address exists in one or more target IP addresses, and whether the same address exists in one or more target IP addresses;

The determining module is configured to determine that the user equipment UE has a risk of DNS full traffic hijacking when a local area network address exists in one or more target IP addresses, or when the same address exists in one or more target IP addresses.

In a seventh aspect, the present disclosure provides a computer program comprising:

Computer readable code, when the computer readable code is run on a computing device, causes the computing device to perform the aforementioned method of detecting the risk of full DNS traffic hijacking.

In an eighth aspect, the present disclosure provides a computer readable medium, comprising:

A computer program for performing the above-described detection method for performing the above-mentioned DNS full traffic hijacking risk is stored.

The above one or more technical solutions in the embodiments of the present disclosure have at least one or more of the following technical effects:

In the technical solution of the embodiment of the present disclosure, one is obtained for detecting the risk of DNS full traffic hijacking One or more target domain names, wherein one or more target domain names in the embodiment of the present disclosure are specifically a wide area network domain name, and then perform DNS resolution on one or more target domain names to obtain a target IP address corresponding to each target domain name, and further Obtain one or more target IP addresses, and then determine whether a local area network address exists in the one or more target IP addresses. Since the IP address corresponding to the target domain name is a wide area network address, when a local area network address exists in one or more target IP addresses, it is determined that the UE has a full traffic hijacking risk of the DNS. Therefore, even if the target IP address resolved by the target domain name is not in the blacklist database, if the target IP address is a local area network address, it indicates that the network currently accessed by the UE may be hijacked by full traffic, and thus the risk of DNS full traffic hijacking of the UE may be determined. Therefore, through the above technical solutions, the detection accuracy of improving the risk of DNS full traffic hijacking is realized.

Further, the technical solution of the embodiment of the present disclosure does not need to be compared with a huge blacklist database, and thus does not need to store a blacklist database, thereby saving the device resources occupied by the storage blacklist database.

Further, since the technical solution in the embodiment of the present disclosure can be executed by the UE without the participation of the server, it is possible to prevent the illegal agent from hijacking the DNS and monitor the interaction between the UE and the server, thereby detecting the interference and even transmitting the representation to the UE. False information about network security.

BRIEF abstract

Various other advantages and benefits will become apparent to those skilled in the art from a The drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the drawing:

1 is a flow chart of a method for detecting a full DNS traffic hijacking risk in the first embodiment of the present disclosure;

2 is a flow chart of a method for detecting a full DNS traffic hijacking risk according to an embodiment of the present disclosure;

3 is a flowchart of a method for detecting a third DNS full traffic hijacking risk according to an embodiment of the present disclosure;

4 is a schematic structural diagram of a first DNS full traffic hijacking risk detecting apparatus according to an embodiment of the present disclosure;

FIG. 5 is a schematic structural diagram of a second DNS full traffic hijacking risk detecting apparatus according to an embodiment of the present disclosure;

6 is a schematic structural diagram of a third DNS full traffic hijacking risk detecting apparatus according to an embodiment of the present disclosure;

FIG. 7 schematically illustrates a block diagram of a computing device for performing a DNS full traffic hijacking detection method in accordance with an embodiment of the present disclosure;

FIG. 8 schematically illustrates a storage unit for maintaining or carrying program code that implements a DNS full traffic hijacking detection method in accordance with an embodiment of the present disclosure.

Preferred embodiment of the invention

The embodiments of the present disclosure provide a method and a device for detecting a full traffic hijacking risk of a DNS, which are used to improve the detection accuracy of the full traffic hijacking risk of the DNS.

In order to solve the above technical problem, the general idea of the technical solution provided by the present disclosure is as follows:

In the technical solution of the embodiment of the present disclosure, one or more target domain names for detecting a risk of DNS full traffic hijacking are obtained, and then one or more target domain names are subjected to DNS resolution to obtain a target IP address corresponding to each target domain name. Obtaining one or more target IP addresses, and then, if one or more target domain names are WAN domain names, determining whether there is a local area network address in the one or more target IP addresses, and if there is a local area network address, determining that the UE has a full DNS address Traffic hijacking risk; or, if one or more target domain names are domain names with different known IP addresses, it is determined whether the same address exists in the one or more target IP addresses, and if the same address exists, it is determined that the UE has a full DNS Traffic hijacking risk; or, if one or more target domain names are WAN domain names, and the known IP addresses of the one or more target domain names are different, determining whether a local area network address exists in the one or more target IP addresses, and Whether the same address exists, if there is a LAN address in one or more destination IP addresses or Same address, it is determined that there is full flow DNS hijacking risk UE.

The technical solutions of the present disclosure are described in detail below with reference to the accompanying drawings and specific embodiments. It is understood that the specific features of the embodiments and the embodiments of the present disclosure are the detailed description of the technical solutions of the present disclosure, and In the case of no conflict, the technical features of the embodiments of the present disclosure and the embodiments may be combined with each other.

The term "and/or" in this context is merely an association describing the associated object, indicating that there may be three relationships, for example, A and / or B, which may indicate that A exists separately, and both A and B exist, respectively. B these three situations. In addition, the character "/" in this article generally indicates that the contextual object is an "or" relationship.

The first aspect of the disclosure provides a method for detecting the risk of DNS full traffic hijacking, please refer to the figure. 1. A flowchart of a method for detecting a full DNS traffic hijacking risk in the embodiment of the present disclosure. The method includes:

S101: Obtain one or more target domain names for detecting a risk of DNS full traffic hijacking of the domain name system; wherein, one or more target domain names are specifically WAN domain names;

S102: Perform DNS resolution on one or more target domain names, obtain a target Internet Protocol IP address corresponding to each target domain name, and obtain one or more target IP addresses.

S103: Determine whether a local area network address exists in one or more target IP addresses;

S104: When a local area network address exists in one or more target IP addresses, determine that the user equipment UE has a risk of DNS full traffic hijacking.

One or more target domain names in the embodiments of the present disclosure are one or a group of test domain names for detecting DNS full traffic hijacking. In order to be able to detect the risk of DNS full traffic hijacking through the one or a group of target domain names, in the embodiment of the present disclosure, each target domain name is specifically a wide area network domain name. In a specific implementation process, the UE may obtain one or more target domain names when it is required to detect the risk of DNS full traffic hijacking, or may obtain one or more target domain names in advance when there is no need to detect the risk of DNS full traffic hijacking. Make specific restrictions.

The time of detecting the full traffic hijacking of the DNS in S102 to S104 may be any time when the UE is powered on, or may be started every preset interval, for example, every hour, or may be used for each time accessing the network. . Or, before S102, it also includes:

Determining whether the UE accesses a new wireless access point AP;

When the UE accesses the new AP, the step of performing DNS resolution on one or more target domain names is performed.

Specifically, in the embodiment of the present disclosure, there are two specific types of APs (Access Points). The second AP is the new AP, and the second AP is the new AP. The second AP is the new AP. The second AP is the new AP. The UE does not access any AP before T1, and accesses the third AP at time T1, and the third AP is a new AP.

For the first case, when the UE switches the AP or the AC (Access Control), the SSID (Service Set Identifier) of the AP or AC accessed after the handover is obtained, and the access is performed before the handover. SSID of the AP or AC. Then, it is determined whether the SSID of the AP or AC accessed after the handover is the same as the SSID of the AP or AC accessed before the handover. If switching If the SSID of the AP or AC that is accessed later is different from the SSID of the AP or AC that is accessed before the handover, the UE accesses the new AP. At this time, the UE cannot confirm the currently accessed network, that is, whether the network where the new AP is located has the risk of full DNS traffic hijacking. Therefore, S102 is executed at this time, and then the DNS full traffic hijacking risk detection is started. In other words, when the UE switches the new network, the risk of the full network DNS full traffic hijacking is detected in S102 to S104.

For the second case, when the UE is not switched to the access AP, the UE cannot confirm whether the currently accessed network has the risk of full DNS traffic hijacking. Therefore, S102 is executed at this time, and then the DNS full traffic hijacking is started. Risk detection. In other words, when the UE initially accesses the network, the network DNS full traffic hijacking risk is detected in S102 to S104.

There are various methods for obtaining the target domain name in S101, and two of them are described below. Specifically, S101 of the embodiment of the present disclosure may be implemented by the following process:

Reading one or more target domain names that are received by the server corresponding to the UE and stored in the storage space of the UE; or

From among the plurality of alternative domain names, one or more domain names satisfying the preset condition are determined to be one or more target domain names.

Specifically, the one or more target domain names obtained by the UE in the embodiment of the present disclosure may be delivered by the server, or may be configured and selected by the UE, and may be delivered by part of the target domain name receiving server, and at the same time, part of the target is configured. domain name. In the specific implementation process, those skilled in the art to which the present disclosure belongs may make selection according to actual conditions, and the disclosure does not specifically limit.

Specifically, if the target domain name is delivered by the server, the target domain name in the embodiment of the present disclosure is the WAN domain name. After the server selects one or more WAN domain names as the target domain name, the server delivers the target domain name to the UE at any time. After receiving the one or more target domain names sent by the server, the UE stores one or more target domain names in its own storage space, and then reads the one or more storage spaces from the storage space when the target domain name needs to be obtained. The target domain name is OK.

For example, the server sends the following JSON structure data to the UE.

{

"domains":["baifubao.com","mail.163.com","jd.com","suning.com","alipay.com","95516.com","so.cn"," Ccb.com","icbc.com.cn","www.cmbc.com.cn"]

}

After receiving the data of the above JSON structure, the UE parses baifubao.com, mail.163.com, jd.com, suning.com, alipay.com, 95516.com, so.cn, ccb.com, icbc.com.cn and Www.cmbc.com.cn ten target domain names, and then store the ten target domain names in the storage space of the UE. When the target domain name needs to be obtained, the target domain name baifubao.com, mail.163.com, jd.com, suning.com, alipay.com, 95516.com, so.cn, ccb.com, are read from the storage space. Icbc.com.cn and www.cmbc.com.cn.

If the target domain name is configured by the UE, the UE determines one or more domain names that meet the preset condition from the multiple candidate domain names as the target domain name. Specifically, the alternate domain name is a domain name visited by the UE, or a domain name that can be accessed currently, and the disclosure does not specifically limit the disclosure. In the public embodiment, since the target domain name is a WAN domain name, the preset condition is specifically a WAN domain name, and the UE selects one or more WAN domain names from the plurality of candidate domain names as the target domain name.

In the specific implementation process, one of ordinary skill in the art to which the present disclosure belongs may select any one of the above two methods for obtaining the target domain name, or may combine the two methods, and the present disclosure does not specifically limit the disclosure.

After obtaining one or more target domain names in S101, the UE performs DNS resolution on each domain name in S102, and obtains an IP address corresponding to each target domain name. In the embodiment of the present disclosure, the IP address resolved by the target domain name through the DNS is referred to as a target IP address.

Next, in S103, it is judged whether or not the local area network address exists in all the target IP addresses. Specifically, the method for determining whether a target IP address is a local area network IP address is to determine whether the target IP address is in any one of ClassA, ClassB, or ClassC. The address range of the ClassA interval is 10.0.0.0~10.255.255.255, the address range of the ClassB interval is 172.16.0.0-172.31.255.255, and the address range of the ClassC interval is 192.168.0.0-192.168.255.255. If the destination IP address is in any of the ClassA, ClassB, or ClassC intervals, the destination IP address is the LAN address. Otherwise, if the destination IP address is not in the ClassA, ClassB, and ClassC intervals, the destination IP address is not the LAN address. .

Since the target domain name in the embodiment of the present disclosure is a WAN domain name, and in a security situation, the IP address corresponding to the WAN domain name is a WAN address, so if a local area network address exists in one or more target IP addresses, this indicates The AP or AC accessed by the UE may be hijacked. Therefore, when a local area network address exists in one or more target IP addresses, the UE is determined in S104. There is a risk of DNS full traffic hijacking.

As can be seen from the above description, since the IP address corresponding to the target domain name is a wide area network address, when a local area network address exists in one or more target IP addresses, it is determined that the UE has a DNS full traffic hijacking risk. Therefore, even if the target IP address resolved by the target domain name is not in the blacklist library, it can be determined that the UE has a full traffic hijacking risk. Therefore, the technical solution in the embodiment of the present disclosure improves the detection accuracy of the DNS full traffic hijacking risk.

Further, the technical solution of the embodiment of the present disclosure does not need to be compared with the huge blacklist database, and thus the blacklist database is not stored in the electronic device or the server, thereby saving the device resources occupied by the blacklist database. .

In the specific implementation process, the foregoing S101 to S104 may be performed by the UE, or the S101 to S102 are performed by the UE, and then the S101 to S104 are executed by the server, that is, the UE parses the target IP address and reports it to the server for detection and determination. For the UE to perform S101 to S104 separately, since the UE does not need the participation of the server when detecting the risk of DNS full traffic hijacking, the present disclosure can further prevent the illegal agent from hijacking the DNS and monitor the interaction between the UE and the server, thereby interfering with detection and even The UE sends false information indicating network security.

Further, as an optional embodiment, in order to further detect the risk of DNS full traffic hijacking, when there is no LAN address in one or more target IP addresses, the method further includes:

Determining whether the same address exists in one or more target IP addresses; wherein the known IP addresses corresponding to the one or more target domain names are different;

When the same address exists in one or more target IP addresses, it is determined that the UE has a risk of DNS full traffic hijacking.

Specifically, in the embodiment of the present disclosure, the target domain name is not only a wide area network domain name, but the known IP address of the target domain name is different. In other words, the target domain name is specifically a WAN domain name corresponding to a different IP address.

Therefore, if the target domain name is delivered by the server, the server selects one or more WAN domain names with different IP addresses and sends them to the UE as the target domain name, so that the UE stores the target domain name. The UE reads out one or more wide area network domain names whose known IP addresses are different from the storage space.

For example, through parsing and verification, the server determines that there are baifubao.com, mail.163.com, jd.com, suning.com, alipay.com, 95516.com, so.cn, ccb.com, icbc.com.cn The IP addresses corresponding to the ten WAN domain names of www.cmbc.com.cn are different. The ten domain names and the IP addresses corresponding to each domain name are shown in Table 1.

Table 1

1. Domain name	2, the corresponding IP address
3, baifubao.com	4, 123.125.112.202
5, mail.163.com	6, 220.181.12.208
7, jd.com	8, 111.206.227.118
9, suning.com	10, 175.25.168.40
11, alipay.com	12, 110.76.19.33
13, 95516.com	14, 119.90.19.44
15, so.com	16, 106.120.160.134
17, ccb.com	18, 124.127.108.106
19, icbc.com.cn	20, 60.247.99.1
21, www.cmbc.com.cn	22, 175.25.171.17

Therefore, the server sends the following JSON structure data to the UE.

{

"domains":["baifubao.com","mail.163.com","jd.com","suning.com","alipay.com","95516.com","so.cn"," Ccb.com","icbc.com.cn","www.cmbc.com.cn"]

}

After receiving the data of the above JSON structure, the UE parses baifubao.com, mail.163.com, jd.com, suning.com, alipay.com, 95516.com, so.cn, ccb.com, icbc.com.cn and Www.cmbc.com.cn ten target domain names, and then store the ten target domain names in the storage space of the UE. When the target domain name needs to be obtained, the target domain name baifubao.com, mail.163.com, jd.com, suning.com, alipay.com, 95516.com is read from the storage space. So.cn, ccb.com, icbc.com.cn and www.cmbc.com.cn.

If the target domain name is determined by the UE, the preset condition is specifically a WAN domain name corresponding to the different IP addresses, and then multiple DNS domain names are parsed, and one or more IP addresses corresponding to each candidate domain name are parsed, and then Select the same IP address as the empty set, and the alternate domain name of the WAN domain name as the target domain name.

In a specific implementation process, the IP address returned by the criminal to the UE may also be a wide area network address. Therefore, in the embodiment of the present disclosure, when there is no local area network address in one or more target IP addresses, one or more further determinations are made. Whether the same address exists in the target IP address to detect the risk of DNS full traffic hijacking.

When a DNS full traffic hijacking occurs, accessing all domain names will return the same IP address of the UE. At the same time, sometimes the criminals randomly return an IP address from a set of IP addresses to the UE in order to avoid being discovered, and this set of IP addresses is the IP address of the server controlled by the criminal. Therefore, if the same address exists in one or more target IP addresses, it indicates that the AP or AC accessed by the UE may be hijacked at this time. Therefore, when there is no local area network address in one or more target IP addresses, but the same address exists, it is determined that the UE has a risk of DNS full traffic hijacking.

For example, suppose the target IP address specifically includes 123.125.112.202, 220.181.12.208, 111.206.227.118, 110.76.19.33, and 123.125.112.202. There is no local area network address among the five target IP addresses, but the first target IP address and The fifth destination IP address is the same, so it is determined that the same address exists in the target IP address, thereby determining that the UE has a full traffic hijacking risk.

Or, for example, assume that the target IP address specifically includes 123.125.112.202, 110.76.19.33, 111.206.227.118, 110.76.19.33, and 123.125.112.202. There is no local area network address among the five target IP addresses, but the first target The IP address is the same as the fifth destination IP address, and the second destination IP address is the same as the fourth destination IP address. Therefore, it is determined that the same address exists in the target IP address, thereby determining that the UE has a full DNS traffic hijacking risk.

It can be seen from the above description that when there is no local area network address in the target IP address parsed by the UE, it is further determined whether the target IP address has the same address, and if the same address exists, it is determined that the UE has a DNS full traffic hijacking risk. Therefore, the detection accuracy of the embodiment of the present disclosure is further improved by determining whether a local area network address exists in the target IP address, and further determining whether the same address exists in the target IP address when there is no local area network address to detect the risk of DNS full traffic hijacking. .

Further, in combination with the foregoing embodiments, the method in the embodiment of the present disclosure further includes:

When the same address does not exist in one or more target IP addresses, it is determined that the UE does not have a DNS full traffic hijacking risk.

Specifically, when the same address does not exist in one or more target IP addresses, it indicates that each target domain name can be accurately resolved to a different WAN IP address, so that the possibility of DNS full traffic hijacking occurs at this time. Low, so if there is no LAN address in one or more target IP addresses, and there is no further same address, it is determined that the UE does not have the risk of DNS full traffic hijacking.

The second aspect of the present disclosure provides another method for detecting a DNS full traffic hijacking risk. Referring to FIG. 2, a flow chart of a method for detecting a full DNS traffic hijacking risk in the second embodiment of the present disclosure is provided. The method includes:

S201: Obtain one or more target domain names for detecting a full traffic hijacking risk of the domain name system; wherein, the known IP addresses corresponding to the one or more target domain names are different;

S202: Perform DNS resolution on one or more target domain names, obtain a target Internet Protocol IP address corresponding to each target domain name, and obtain one or more target IP addresses.

S203: Determine whether the same address exists in one or more target IP addresses.

S204: When there is the same address in one or more target IP addresses, determine that the UE has a risk of DNS full traffic hijacking.

In the specific implementation process, the detection method of detecting the second DNS full traffic hijacking risk to detect the network security is the same as the detection method of the first DNS full traffic hijacking risk detection method, and will not be repeated here. In the above steps, S201 is similar to S101, and S202 is similar to S102. Since S101 and S102 have been described in detail above, the description of the embodiments of the present disclosure will not be repeated.

S201 is different from S101 in that the target domain name in the embodiment of the present disclosure is specifically a domain name with a different IP address. Therefore, if the target domain name is delivered by the server, the server selects one or more corresponding ones by parsing and verifying. A domain name with a different IP address is delivered to the UE as the target domain name, so that the UE stores, and when the target domain name is obtained, the UE reads one or more target domain names with different known IP addresses from the storage space.

For example, through parsing and verification, the server determines that there are baifubao.com, mail.163.com, jd.com, suning.com, alipay.com, 95516.com, so.cn, ccb.com, icbc.com.cn The IP addresses corresponding to the ten domain names of www.cmbc.com.cn are different, as shown in Table 1.

Therefore, the server sends the following JSON structure data to the UE.

{

"domains":["baifubao.com","mail.163.com","jd.com","suning.com","alipay.com","95516.com","so.cn"," Ccb.com","icbc.com.cn","www.cmbc.com.cn"]

}

After receiving the data of the above JSON structure, the UE parses baifubao.com, mail.163.com, jd.com, suning.com, alipay.com, 95516.com, so.cn, ccb.com, icbc.com.cn and Www.cmbc.com.cn ten target domain names, and then store the ten target domain names in the storage space of the UE. When the target domain name needs to be obtained, the target domain name baifubao.com, mail.163.com, jd.com, suning.com, alipay.com, 95516.com, so.cn, ccb.com, are read from the storage space. Icbc.com.cn and www.cmbc.com.cn.

In addition, S201 is different from S101 in that the target domain name in the embodiment of the present disclosure is specifically a domain name with a different IP address. Therefore, if the target domain name is determined by the UE, the preset condition is specifically that the IP address corresponding to the domain name is different. Then, the DNS is parsed for multiple alternate domain names, and one or more IP addresses corresponding to each alternate domain name are parsed, and then the alternate domain name with the same IP address as the empty set is selected as the target domain name.

Next, in S203, it is determined whether one or more target IP addresses have the same address. Specifically, when a hijacking of the entire DNS process occurs, accessing all domain names will return the same IP address of the UE. At the same time, sometimes the criminals randomly return an IP address from a set of IP addresses to the UE in order to avoid being discovered. This set of IP addresses is actually the IP address of the server controlled by the criminal. Therefore, if the same address exists in one or more target IP addresses, it indicates that the AP or AC accessed by the UE may be hijacked at this time. Therefore, when the same address exists in one or more target IP addresses, it is determined in S204 that the UE has a DNS full traffic hijacking risk.

For example, suppose the target IP address specifically includes 123.125.112.202, 220.181.12.208, 111.206.227.118, 110.76.19.33, and 123.125.112.202, and the first target IP address and the fifth target IP address are the same, so the target IP address is determined. The same address exists in the middle, thereby determining that the UE has a full traffic hijacking risk.

Or, for example, assume that the target IP address specifically includes 123.125.112.202, 110.76.19.33, 111.206.227.118, 110.76.19.33, and 123.125.112.202, the first target. The IP address is the same as the fifth destination IP address, and the second destination IP address is the same as the fourth destination IP address. Therefore, it is determined that the same address exists in the target IP address, thereby determining that the UE has a full DNS traffic hijacking risk.

As can be seen from the above description, since the IP addresses corresponding to the known target domain names are different, when there is the same address in one or more target IP addresses, it is determined that the UE has a DNS full traffic hijacking risk. Therefore, even if the target IP address resolved by the target domain name is not in the blacklist library, it can be determined that the UE has a full traffic hijacking risk. Therefore, the technical solution in the embodiment of the present disclosure improves the detection accuracy of the DNS full traffic hijacking risk.

Further, the technical solution of the embodiment of the present disclosure does not need to be compared with the huge blacklist database, and thus the blacklist database is not stored in the electronic device or the server, thereby saving the device resources occupied by the blacklist database. .

In the specific implementation process, the foregoing S201 to S204 may be performed by the UE, or the S201 to S202 are performed by the UE, and then the S201 to S204 are performed by the server, that is, the UE parses the target IP address and reports it to the server for detection and determination. For the UE to perform S201 to S204 separately, since the UE does not need the participation of the server when detecting the risk of DNS full traffic hijacking, the present disclosure can further prevent the illegal agent from hijacking the DNS and monitor the interaction between the UE and the server, thereby interfering with detection and even The UE sends false information indicating network security.

Further, as an optional embodiment, in order to further detect the risk of DNS full traffic hijacking, when the same address does not exist in one or more target IP addresses, the method further includes:

Determining whether a local area network address exists in one or more target IP addresses; wherein the one or more target domain names are specifically a wide area network domain name;

When there is a local area network address in one or more target IP addresses, it is determined that the UE has a risk of DNS full traffic hijacking.

Specifically, in the embodiment of the present disclosure, the target domain name is not only a domain name with a known IP address, but the target domain name is also a WAN domain name. In other words, the target domain name is specifically a WAN domain name corresponding to a different IP address.

Therefore, if the target domain name is delivered by the server, the server selects one or more WAN domain names with different IP addresses and sends them to the UE as the target domain name, so that the UE stores the target domain name. The UE reads out from the storage space that one or more known IP addresses are different, and is the target domain name of the WAN domain name.

If the target domain name is determined by the UE, the preset condition is specifically a WAN domain name with a different IP address, and then multiple DNS domain names are parsed, and one or more IP addresses corresponding to each candidate domain name are parsed. Then select the same IP address as an empty set, and the alternate domain name of the WAN domain name as the target domain name.

In a specific implementation process, the criminals may return different target IP addresses to the UE, but the local area network addresses in the target IP addresses may also expose the hijacking. Therefore, in the embodiment of the present disclosure, when one or more targets are When the same address does not exist in the IP address, it is further determined whether a local area network address exists in one or more target IP addresses to detect the risk of DNS full traffic hijacking.

The method of judging whether one or more target IP addresses are LAN IP addresses has been described in detail above, and therefore will not be repeated here.

Since the target domain name in the embodiment of the present disclosure is a WAN domain name, and in a security situation, the IP address corresponding to the WAN domain name is a WAN address, so if a local area network address exists in one or more target IP addresses, this indicates The AP or AC accessed by the UE may be hijacked. Therefore, when there is no same address in one or more target IP addresses, but there is a local area network address, it is determined that the UE has a risk of DNS full traffic hijacking.

It can be seen from the above description that when the same address does not exist in the target IP address parsed by the UE, it is further determined whether the local IP address is in the target IP address, and if there is a local area network address, it is determined that the UE has a full traffic hijacking risk. Therefore, the detection accuracy of the embodiment of the present disclosure is further improved by determining whether the same address exists in the target IP address, and further determining whether the local area network address exists in the target IP address when the same address does not exist to detect the risk of DNS full traffic hijacking. .

Further, in combination with the foregoing embodiments, the method in the embodiment of the present disclosure further includes:

When there is no local area network address in one or more target IP addresses, it is determined that the UE does not have a DNS full traffic hijacking risk.

Specifically, when there is no LAN address in one or more target IP addresses, it indicates that each target domain name can be accurately resolved to different WAN IP addresses, so the possibility of DNS full traffic hijacking occurs at this time. Low, so when there is no same address in one or more target IP addresses, and there is no further LAN address, it is determined that the UE does not have the risk of DNS full traffic hijacking.

The third aspect of the present disclosure provides another method for detecting the risk of DNS full traffic hijacking. Referring to FIG. 3, it is a flowchart of a method for detecting a third DNS full traffic hijacking risk according to an embodiment of the present disclosure. The Methods include:

S301: Obtain one or more target domain names for detecting a full traffic hijacking risk of the domain name system. The one or more target domain names are specifically WAN domain names, and the known Internet Protocol IP addresses corresponding to the one or more target domain names. Are not the same;

S302: Perform DNS resolution on one or more target domain names, obtain a target IP address corresponding to each target domain name, and obtain one or more target IP addresses.

S303: Determine whether a local area network address exists in one or more target IP addresses, and whether the same address exists in one or more target IP addresses;

S304: When there is a local area network address in one or more target IP addresses, or the same address exists in one or more target IP addresses, it is determined that the user equipment UE has a risk of DNS full traffic hijacking.

The detection method of the third DNS full traffic hijacking risk is detected in the specific implementation process to detect the network security at the same time as the detection method of the first and second DNS full traffic hijacking risks, and the description will not be repeated here. It is. In the above steps, S301 is similar to S101 and S201, and S302 is similar to S102 and S202. Since S101 and S102 have been described in detail above, the description of the embodiments of the present disclosure will not be repeated.

S301 is different from S101 in that the target domain name in the embodiment of the present disclosure is specifically a WAN domain name, and the known IP addresses are different. Therefore, if the target domain name is delivered by the server, the server selects one or more by parsing and verifying. The WAN domain name with the corresponding IP address is delivered to the UE as the target domain name, so that the UE stores, and when the target domain name is obtained, the UE reads one or more known IP addresses from the storage space, and is The target domain name of the WAN domain name.

If the target domain name is determined by the UE, the preset condition is specifically a WAN with a different IP address, and then multiple DNS domains are parsed, and one or more IP addresses corresponding to each alternate domain name are parsed, and then Select the same IP address as the empty set, and the alternate domain name of the WAN domain name as the target domain name.

Next, in S303, it is determined whether one or more target IP addresses have a local area network address and whether the same address exists. If a local area network address exists in one or more target IP addresses, or the same address exists, it indicates that the AP or AC accessed by the UE may be hijacked at this time. Therefore, when there is a local area network address in one or more target IP addresses, or if the same address exists, it is determined in S304 that the UE has a DNS full traffic hijacking risk.

For example, suppose the target IP address specifically includes 123.125.112.202, 220.181.12.208, 111.206.227.118, 110.76.19.33 and 123.125.112.202. The five target IP addresses are all WAN addresses, and the first target IP address and the fifth target IP address are the same, and it is determined that the UE has a full DNS traffic hijacking risk.

Or, for example, assume that the target IP address specifically includes 123.125.112.202, 220.181.12.208, 111.206.227.118, 175.25.168.40, and 192.168.1.1. The five target IP addresses are different, and the fifth target IP address is the local area network. The address, in turn, determines the risk of DNS full traffic hijacking in the UE.

Or, for example, assume that the target IP address specifically includes 123.125.112.202, 123.125.112.202, 111.206.227.118, 175.25.168.40, and 192.168.1.1, the fifth destination IP address is the local area network address, the first destination IP address, and The second target IP address is the same, thereby determining that the UE has a full DNS traffic hijacking risk.

As can be seen from the above description, since the target domain name is known to correspond to different known IP addresses, and each known IP address is known to be a wide area network address, a local area network address exists in one or more target IP addresses, or exists. When the same target IP address is used, it is determined that the UE has a DNS full traffic hijacking risk. Therefore, even if the target IP address resolved by the target domain name is not in the blacklist library, it can be determined that the UE has a full traffic hijacking risk. Therefore, the technical solution in the embodiment of the present disclosure improves the detection accuracy of the DNS full traffic hijacking risk.

Further, the technical solution of the embodiment of the present disclosure does not need to be compared with the huge blacklist database, and thus the blacklist database is not stored in the electronic device or the server, thereby saving the device resources occupied by the blacklist database. .

In the specific implementation process, the foregoing S301 to S304 may be performed by the UE, or the S1 to S302 are performed by the UE, and then the S303 to S304 are performed by the server, that is, the UE parses the target IP address and reports it to the server for detection and determination. For the UE to perform S301 to S304 separately, since the UE does not need the participation of the server when detecting the risk of DNS full traffic hijacking, the present disclosure can further prevent the illegal agent from hijacking the DNS and monitor the interaction between the UE and the server, thereby interfering with detection and even The UE sends false information indicating network security.

Further, in combination with the foregoing embodiments, the method in the embodiment of the present disclosure further includes:

When there is no local area network address in one or more target IP addresses, and the same address does not exist in one or more target IP addresses, it is determined that the UE does not have a DNS full traffic hijacking risk.

Specifically, when there is no local area network address in one or more target IP addresses, and there is no phase The same address indicates that each target domain name can be accurately resolved to different WAN IP addresses. Therefore, the possibility of DNS full traffic hijacking is low at this time, so there is no LAN in one or more destination IP addresses. If the address does not exist, it is determined that the UE does not have a full DNS traffic hijacking risk.

Based on the same disclosure concept as the detection method of the DNS full traffic hijacking risk in the first aspect, the fourth aspect of the present disclosure provides the first DNS full traffic hijacking risk detecting device, as shown in FIG. 4, including:

The obtaining module 101 is configured to obtain one or more target domain names for detecting a full traffic hijacking risk of the domain name system DNS; wherein, the one or more target domain names are specifically a wide area network domain name;

The parsing module 102 is configured to perform DNS resolution on one or more target domain names, obtain a target Internet Protocol IP address corresponding to each target domain name, and obtain one or more target IP addresses;

The first determining module 103 is configured to determine whether a local area network address exists in one or more target IP addresses;

The first determining module 104 is configured to determine that the user equipment UE has a DNS full traffic hijacking risk when a local area network address exists in one or more target IP addresses.

Further, when there is no local area network address in the one or more target IP addresses, the device in the embodiment of the present disclosure further includes:

a second determining module, configured to determine whether the same address exists in one or more target IP addresses; wherein the known IP addresses corresponding to the one or more target domain names are different;

The second determining module is configured to determine that the UE has a full traffic hijacking risk when the same address exists in one or more target IP addresses.

Further, the device in the embodiment of the present disclosure further includes:

The third determining module is configured to determine that the UE does not have a DNS full traffic hijacking risk when the same address does not exist in the one or more target IP addresses.

Specifically, the obtaining module 101 is configured to read one or more target domain names that are sent by the server corresponding to the UE and stored in the storage space of the UE, or determine that the preset is satisfied from the multiple candidate domain names. One or more domain names of the condition are one or more target domain names.

Further, the device in the embodiment of the present disclosure further includes:

a third determining module, configured to determine whether the UE accesses the new wireless access point AP before performing DNS resolution on the one or more target domain names;

When the UE accesses the new AP, the notification parsing module performs DNS resolution on one or more target domain names.

The foregoing various manners and specific examples of the method for detecting the full-rate DNS traffic hijacking risk in the foregoing embodiment of FIG. 1 are also applicable to the detecting device for the full traffic hijacking risk of the DNS in this embodiment, and the risk of full traffic hijacking of the DNS is adopted. For a detailed description of the detection method, those skilled in the art can clearly understand the implementation method of the detection device for the DNS full traffic hijacking risk in this embodiment, so for the sake of brevity of the description, it will not be described in detail herein.

Based on the same disclosure concept as the detection method of the DNS full traffic hijacking risk in the second aspect, the fifth aspect of the present disclosure provides a second DNS full traffic hijacking risk detecting apparatus, as shown in FIG. 5, including:

The obtaining module 201 is configured to obtain one or more target domain names for detecting a full traffic hijacking risk of the domain name system; wherein the known IP addresses corresponding to the one or more target domain names are different;

The parsing module 202 is configured to perform DNS resolution on one or more target domain names, obtain a target Internet Protocol IP address corresponding to each target domain name, and obtain one or more target IP addresses.

The first determining module 203 is configured to determine whether the same address exists in one or more target IP addresses;

The first determining module 204 is configured to determine that the UE has a full DNS traffic hijacking risk when the same address exists in one or more target IP addresses.

Further, when the same address does not exist in the one or more target IP addresses, the apparatus in the embodiment of the present disclosure further includes:

a second determining module, configured to determine whether a local area network address exists in one or more target IP addresses; wherein the one or more target domain names are specifically a wide area network domain name;

The second determining module is configured to determine that the UE has a full traffic hijacking risk when a local area network address exists in one or more target IP addresses.

Further, the device in the embodiment of the present disclosure further includes:

The third determining module is configured to determine that the UE does not have a DNS full traffic hijacking risk when the local area network address does not exist in the one or more target IP addresses.

Specifically, the obtaining module 201 is configured to read one or more target domain names that are sent by the server corresponding to the UE and stored in the storage space of the UE, or determine that the preset condition is met from the multiple candidate domain names. One or more domain names are one or more target domain names.

Further, the device in the embodiment of the present disclosure further includes:

a third determining module, configured to determine whether the UE accesses the new wireless access point AP before performing DNS resolution on the one or more target domain names;

When the UE accesses the new AP, the notification parsing module performs DNS resolution on one or more target domain names.

The foregoing various variants and specific examples of the method for detecting the full-risk traffic risk of the DNS in the foregoing embodiment of FIG. 2 are also applicable to the detecting device for the full traffic hijacking risk of the DNS in this embodiment, and the risk of full traffic hijacking of the DNS is adopted. For a detailed description of the detection method, those skilled in the art can clearly understand the implementation method of the detection device for the DNS full traffic hijacking risk in this embodiment, so for the sake of brevity of the description, it will not be described in detail herein.

Based on the same disclosure concept as the detection method of the DNS full traffic hijacking risk in the third aspect, the sixth aspect of the present disclosure provides a third DNS full traffic hijacking risk detecting apparatus, as shown in FIG. 6, including:

The obtaining module 301 is configured to obtain one or more target domain names for detecting a full traffic hijacking risk of the domain name system DNS; wherein, one or more target domain names are specifically WAN domain names, and one or more target domain names are correspondingly known Internet protocol IP addresses are not the same;

The parsing module 302 is configured to perform DNS resolution on one or more target domain names, obtain a target IP address corresponding to each target domain name, and obtain one or more target IP addresses.

The determining module 303 is configured to determine whether a local area network address exists in one or more target IP addresses, and whether the same address exists in one or more target IP addresses;

The determining module 304 is configured to determine that the user equipment UE has a DNS full traffic hijacking risk when a local area network address exists in one or more target IP addresses, or when the same address exists in one or more target IP addresses.

The various changes and specific examples of the method for detecting the third DNS full traffic hijacking risk in the foregoing embodiment of FIG. 3 are also applicable to the detecting device for the full traffic hijacking risk of the DNS in the foregoing embodiment. For a detailed description of the detection method, those skilled in the art can clearly understand the implementation method of the detection device for the DNS full traffic hijacking risk in this embodiment, so for the sake of brevity of the description, it will not be described in detail herein.

A seventh aspect of the present disclosure provides a computer program, and FIG. 7 illustrates a computing device that can implement a method of detecting a DNS full traffic hijacking risk in accordance with the present disclosure. The computing device has traditionally been included The processor 710 and a computer program product or computer readable medium in the form of a storage device 720. Storage device 720 can be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk, or ROM. Storage device 720 has a storage space 730 that stores program code 731 for performing any of the method steps described above. For example, storage space 730 storing program code may include various program code 731 for implementing various steps in the above methods, respectively. The program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as a hard disk, a compact disk (CD), a memory card, or a floppy disk. Such a computer program product is typically a portable or fixed storage unit such as that shown in FIG. The storage unit may have storage segments, storage spaces, and the like that are similarly arranged to storage device 720 in the computing device of FIG. The program code can be compressed, for example, in an appropriate form. Generally, a storage unit includes computer readable code 731' for performing the steps of the method in accordance with the present disclosure, ie, code that can be read by a processor, such as 710, that when executed by a computing device causes the computing device Perform the various steps in the method described above.

The above one or more technical solutions in the embodiments of the present disclosure have at least one or more of the following technical effects:

In the technical solution of the embodiment of the present disclosure, one or more target domain names for detecting a risk of DNS full traffic hijacking are obtained, where one or more target domain names in the embodiment of the present disclosure are specifically a wide area network domain name, and then one or The plurality of target domain names are subjected to DNS resolution, obtaining a target IP address corresponding to each target domain name, thereby obtaining one or more target IP addresses, and then determining whether a local area network address exists in the one or more target IP addresses. Since the IP address corresponding to the target domain name is a wide area network address, when a local area network address exists in one or more target IP addresses, it is determined that the UE has a full traffic hijacking risk of the DNS. Therefore, even if the target IP address resolved by the target domain name is not in the blacklist database, if the target IP address is a local area network address, it indicates that the network currently accessed by the UE may be hijacked by full traffic, and thus the risk of DNS full traffic hijacking of the UE may be determined. Therefore, through the above technical solutions, the detection accuracy of improving the risk of DNS full traffic hijacking is realized.

Further, the technical solution of the embodiment of the present disclosure does not need to be compared with a huge blacklist database, and thus does not need to store a blacklist database, thereby saving the device resources occupied by the storage blacklist database.

Further, since the technical solutions in the embodiments of the present disclosure may be performed by the UE, The participation of the server can prevent the illegal elements from hijacking the DNS and monitor the interaction between the UE and the server, thereby interfering with the detection and even sending false information indicating network security to the UE.

The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general purpose systems can also be used with the teaching based on the teachings herein. The structure required to construct such a system is apparent from the above description. Moreover, the present disclosure is not directed to any particular programming language. It is to be understood that the subject matter of the present disclosure, which is described herein, may be described in a particular language.

In the description provided herein, numerous specific details are set forth. However, it is understood that the embodiments of the present disclosure may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of the description.

In the description of the exemplary embodiments of the present disclosure, the various features of the present disclosure are sometimes grouped together into a single embodiment, Figure, or a description of it. However, the method disclosed is not to be interpreted as reflecting the intention that the claimed invention requires more features than those recited in the claims. Rather, as disclosed in the following claims, the disclosed aspects are less than all features of the single embodiments disclosed herein. Therefore, the claims following the specific embodiments are hereby explicitly incorporated into the specific embodiments, and each of the claims as a separate embodiment of the present disclosure.

Those skilled in the art will appreciate that the modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components. In addition to such features and/or at least some of the processes or units being mutually exclusive, any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined. Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.

In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features that are included in other embodiments and not in other features, combinations of features of different embodiments are intended to be within the scope of the present disclosure. And different embodiments are formed. For example, in the following rights Any one of the claimed embodiments may be used in any combination.

Various component embodiments of the present disclosure may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functionality of a gateway, proxy server, some or all of the components in accordance with embodiments of the present disclosure. The present disclosure may also be implemented as a device or device program (eg, a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the present disclosure may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

It should be noted that the above-described embodiments are illustrative of the present disclosure and are not intended to limit the scope of the disclosure, and those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or steps that are not recited in the claims. The word "a" or "an" The present disclosure can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means can be embodied by the same hardware item. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.

Claims (16)

1. A method for detecting a full traffic hijacking risk of a DNS, characterized in that it comprises:

   Obtaining one or more target domain names for detecting the risk of DNS full traffic hijacking of the domain name system; wherein the one or more target domain names are specifically WAN domain names;

   Performing DNS resolution on the one or more target domain names to obtain a target Internet Protocol IP address corresponding to each of the target domain names, thereby obtaining one or more target IP addresses;

   Determining whether a local area network address exists in the one or more target IP addresses;

   When a local area network address exists in the one or more target IP addresses, it is determined that the user equipment UE has a DNS full traffic hijacking risk.
2. The method of claim 1, wherein when there is no local area network address in the one or more target IP addresses, the method further comprises:

   Determining whether the same address exists in the one or more target IP addresses; wherein the known IP addresses corresponding to the one or more target domain names are different;

   When the same address exists in the one or more target IP addresses, it is determined that the UE has a DNS full traffic hijacking risk.
3. The method of claim 2, wherein the method further comprises:

   When the same address does not exist in the one or more target IP addresses, it is determined that the UE does not have a DNS full traffic hijacking risk.
4. The method according to any one of claims 1 to 3, characterized in that one or more target domain names for detecting the risk of DNS full traffic hijacking of the domain name system are obtained, including:

   Reading the one or more target domain names that are sent by the server corresponding to the UE and stored in a storage space of the UE; or

   From among the plurality of alternative domain names, determining one or more domain names satisfying the preset condition is the one or more target domain names.
5. The method according to any one of claims 1-3, further comprising: before performing DNS resolution on the one or more target domain names,

   Determining whether the UE accesses a new wireless access point AP;

   When the UE accesses a new AP, performing the step of performing DNS resolution on the one or more target domain names.
6. A method for detecting a full traffic hijacking risk of a DNS, characterized in that it comprises:

   Obtaining one or more target domain names for detecting the risk of DNS full traffic hijacking of the domain name system; wherein the one or more target domain names are specifically a wide area network domain name, and the known Internet protocol corresponding to the one or more target domain names IP addresses are not the same;

   Performing DNS resolution on the one or more target domain names to obtain a target IP address corresponding to each of the target domain names, thereby obtaining one or more target IP addresses;

   Determining whether a local area network address exists in the one or more target IP addresses, and whether the same address exists in the one or more target IP addresses;

   When the local area network address exists in the one or more target IP addresses, or the same address exists in the one or more target IP addresses, it is determined that the user equipment UE has a DNS full traffic hijacking risk.
7. A device for detecting the risk of DNS full traffic hijacking, comprising:

   An obtaining module, configured to obtain one or more target domain names for detecting a risk of DNS full traffic hijacking of the domain name system; wherein the one or more target domain names are specifically a wide area network domain name;

   a parsing module, configured to perform DNS resolution on the one or more target domain names, obtain a target Internet Protocol IP address corresponding to each of the target domain names, and obtain one or more target IP addresses;

   a first determining module, configured to determine whether a local area network address exists in the one or more target IP addresses;

   The first determining module is configured to determine that the user equipment UE has a DNS full traffic hijacking risk when the local area network address exists in the one or more target IP addresses.
8. The device of claim 7, wherein when the local area network address does not exist in the one or more target IP addresses, the apparatus further comprises:

   a second determining module, configured to determine whether the same address exists in the one or more target IP addresses, where the known IP addresses corresponding to the one or more target domain names are different;

   The second determining module is configured to determine that the UE has a full traffic hijacking risk when the same address exists in the one or more target IP addresses.
9. The device of claim 8 further comprising:

   The third determining module is configured to determine that the UE does not have a DNS full traffic hijacking risk when the same address does not exist in the one or more target IP addresses.
10. The device according to any one of claims 7 to 9, wherein the obtaining module is configured to read and receive the one that is sent by a server corresponding to the UE and stored in a storage space of the UE. Or a plurality of target domain names; or from among the plurality of candidate domain names, determining one or more domain names satisfying the preset condition as the one or more target domain names.
11. The device of any of claims 7-9, wherein the device further comprises:

    a third determining module, configured to determine whether the UE accesses a new wireless access point AP before performing DNS resolution on the one or more target domain names;

    When the UE accesses the new AP, the parsing module is notified to perform DNS resolution on the one or more target domain names.
12. A device for detecting the risk of DNS full traffic hijacking, comprising:

    And an obtaining module, configured to obtain one or more target domain names for detecting a full traffic hijacking risk of the domain name system; wherein the one or more target domain names are specifically a wide area network domain name, and the one or more target domain names correspond to Known Internet Protocol IP addresses are not the same;

    a parsing module, configured to perform DNS resolution on the one or more target domain names, obtain a target IP address corresponding to each of the target domain names, and obtain one or more target IP addresses;

    a determining module, configured to determine whether a local area network address exists in the one or more target IP addresses, and whether the same address exists in the one or more target IP addresses;

    And a determining module, configured to determine that the user equipment UE has a DNS full traffic hijacking risk when a local area network address exists in the one or more target IP addresses, or the same address exists in the one or more target IP addresses.
13. A computer program comprising computer readable code causing the computing device to perform a DNS full traffic hijacking risk according to any one of claims 1-5 when the computer readable code is run on a computing device Detection method.
14. A computer readable medium storing the computer program of claim 13.
15. A computer program comprising computer readable code, when said computer readable code is run on a computing device, causing said computing device to perform a method of detecting a DNS full traffic hijacking risk according to claim 6.
16. A computer readable medium storing the computer program of claim 15.

Images