KR102582837B1 - Pharming dns analysis method and computing device therefor - Google Patents

Abstract

A pharming DNS analysis method and computing device are disclosed. The pharming DNS analysis method according to an embodiment of the present invention includes receiving a response to one or more domain queries transmitted from a terminal to an Internet network, and determining whether DNS pharming is performed based on the response IP address and response TTL included in the response. It includes the step of deciding. According to the present invention, abnormal DNS can be determined thoroughly and without error.

Description

PHARMING DNS ANALYSIS METHOD AND COMPUTING DEVICE THEREFOR}

The present invention relates to a pharming DNS analysis method and computing device.

Conventionally, in order to communicate with a server or service on the Internet, an IP address corresponding to the domain of the server or service must be obtained, so the terminal queries the IP address of the domain name entered into the DNS server. The DNS server responds to the query with the IP address of the server corresponding to the domain name, and the terminal can access the server through the received IP address to obtain the intended content.

However, in the case of abnormal terminals infected with malicious code or hacked, etc., the DNS server address may be changed to an abnormal DNS server. At this time, the terminal queries the DNS server for a domain name in order to communicate with the Internet, but the abnormal DNS server, or pharming DNS, responds with the IP address of an abnormal server unrelated to the normal domain name. The terminal connects to an abnormal IP and downloads and executes content that is dangerous to security as the attacker intended. As a result, the device may be caught by ransomware that forcibly encrypts the data in the device and extorts money such as Bitcoin, or major data or video information in the device may be exported to the outside, and may also be abused as a means of attacking other devices such as DDoS. .

To date, there is no security equipment and standard technology to detect and respond to pharming DNS, so the detection and response to pharming DNS is mainly handled by telecommunication companies with their own technology. For example, the telecommunications company's own technology compares the results of querying a DNS server with the results of querying a farming DNS server and checks whether the two results are the same to determine whether it is a farming DNS. However, in new services such as cache services or clouds, there is a limitation that errors may occur simply by comparing query results.

The present invention aims to solve the above-described needs and/or problems.

In addition, the present invention analyzes traffic communicating with a fake DNS server to determine in advance the status of the DNS server used in the attack, the number of abnormal terminals communicating with the fake DNS server, and the type of malicious code used in the attack. The purpose is to implement a farming DNS analysis method and computing device.

A DNS analysis method according to an embodiment of the present invention is a pharming DNS analysis method by a computing device included in an Internet network, comprising: receiving a response to one or more domain queries transmitted from a terminal to an Internet network; and determining whether to do DNS farming based on the response IP address and response TTL included in the response.

According to one embodiment, in the determining step, the DNS pharming includes a first process of comparing the response IP address with a normal IP address included in normal DNS cache information, a country in which the response IP address is located, and a country in which the domain is located. A second process that compares, a third process that verifies whether the same response IP address is received in response to two or more different domain queries, a hidden flag response IP to the domain query for inspection sent to the DNS server It may be determined based on at least part of a fourth process that compares an address with an IP address corresponding to the domain query for inspection, and a fifth process that compares response TTLs to at least two domain queries separated by time.

According to one embodiment, the DNS pharming occurs when the normal IP address included in the normal DNS cache information and the response IP address are different from each other, the country where the response IP address is located and the country where the domain is located are different, or two or more different The same response IP address is received in response to the domain query, or the response IP address to the query for the domain for inspection sent to the hidden flag DNS server and the IP address corresponding to the query for the domain for inspection are different, or the IP address corresponding to the domain query for inspection is different, or at least separated by a time interval. If the response TTLs for two or more domain queries do not change, it can be determined that DNS is farmed.

According to one embodiment, the domain query for inspection may be transmitted only to the hidden flag DNS server.

A computing device according to another embodiment of the present invention is a computing device for analyzing pharming DNS, comprising: memory; A transceiver that receives a response to one or more domain queries transmitted from the terminal to the Internet network; and a processor that determines whether to do DNS farming based on the response IP address and response TTL included in the response.

According to one embodiment, the DNS pharming includes a first process of comparing the response IP address with a normal IP address included in normal DNS cache information, and a second process of comparing the country where the response IP address is located and the country where the domain is located. A third process that verifies that the same response IP address is received in response to two or more different domain queries, a hidden flag is sent to the DNS server for checking the response IP address for the domain query and said checking. It may be determined based on at least part of a fourth process that compares IP addresses corresponding to domain queries, or a fifth process that compares response TTLs to at least two domain queries separated by time.

According to one embodiment, the DNS pharming occurs when the normal IP address included in normal DNS cache information is different from the response IP address, the country where the response IP address is located is different from the country where the domain is located, or two or more different domains. The same response IP address is received in response to the query, or the response IP address to the query for the domain for inspection sent to the hidden flag DNS server and the IP address corresponding to the query for the domain for inspection are different, or at least two with a time interval If the response TTLs for the above domain queries do not change, it may be determined that DNS is farmed.

According to one embodiment, DNS queries for inspection may be sent only to hidden flag DNS servers.

The effects of the pharming DNS analysis method and computing device according to an embodiment of the present invention will be described as follows.

The present invention analyzes traffic communicating with a fake DNS server and determines in advance the status of the DNS server used in the attack, the number of abnormal terminals communicating with the fake DNS server, and the type of malicious code used in the attack, thereby It can protect and prevent security incidents in large-scale terminals.

The effects that can be obtained from the present invention are not limited to the effects mentioned above, and other effects not mentioned can be clearly understood by those skilled in the art from the description below. .

The accompanying drawings, which are included as part of the detailed description to aid understanding of the present invention, provide embodiments of the present invention, and together with the detailed description, explain technical features of the present invention.
1 is a block diagram of a computing device according to one embodiment of the present invention.
Figure 2 is a flowchart of a DNS analysis method according to an embodiment of the present invention.

Hereinafter, embodiments disclosed in the present invention will be described in detail with reference to the accompanying drawings. However, identical or similar components will be assigned the same reference numbers regardless of reference numerals, and duplicate descriptions thereof will be omitted. The suffixes “module” and “part” for components used in the following description are given or used interchangeably only for the ease of preparing the specification, and do not have distinct meanings or roles in themselves. Additionally, in describing the embodiments disclosed in the present invention, if it is determined that detailed descriptions of related known technologies may obscure the gist of the embodiments disclosed in the present invention, the detailed descriptions will be omitted. In addition, the attached drawings are only for easy understanding of the embodiments disclosed in the present invention, and the technical idea disclosed in the present invention is not limited by the attached drawings, and all changes included in the spirit and technical scope of the present invention are not limited. , should be understood to include equivalents or substitutes.

Terms containing ordinal numbers, such as first, second, etc., may be used to describe various components, but the components are not limited by the terms. The above terms are used only for the purpose of distinguishing one component from another.

When a component is said to be "connected" or "connected" to another component, it is understood that it may be directly connected to or connected to the other component, but that other components may exist in between. It should be. On the other hand, when it is mentioned that a component is “directly connected” or “directly connected” to another component, it should be understood that there are no other components in between.

Singular expressions include plural expressions unless the context clearly dictates otherwise.

In this application, terms such as “comprise” or “have” are intended to designate the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, but are not intended to indicate the presence of one or more other features. It should be understood that this does not exclude in advance the possibility of the existence or addition of elements, numbers, steps, operations, components, parts, or combinations thereof.

The term "Pharming DNS" refers to an abnormal DNS server designed to direct connections to fake servers prepared for malicious code and hacking purposes. Pharming DNS is used as a means to steal key information from terminals (e.g., PCs, smartphones, routers, IoT, etc.), hack other terminals, or attack services or networks such as DDoS. .

The present invention is intended to solve the above-mentioned technical problems and relates to a DNS analysis method for preventing DNS pharming in an Internet network and a computing device therefor.

1 is a block diagram of a computing device according to one embodiment of the present invention.

Referring to FIG. 1 , computing device 1 includes memory 10, transceiver 20, and processor 30.

The memory 10 may be connected to a processor and may store various types of data, signals, messages, information, programs, codes, or instructions. Memory may consist of ROM, RAM, EPROM, flash memory, hard drives, registers, cache memory, computer readable storage media, and/or combinations thereof. Memory may be located internal and/or external to the processor. Additionally, memory can be connected to the processor through various technologies, such as wired or wireless connections.

The transceiver 20 can transmit or receive user data, control information, wireless signals/channels, etc. to other devices. For example, a transceiver can be connected to a processor and transmit and receive wireless signals. For example, the processor may control the transceiver to transmit user data, control information, or wireless signals to another device. Additionally, the processor may control the transceiver to receive user data, control information, or wireless signals from another device. Additionally, the transceiver may be connected to an antenna, and the transceiver may be set to transmit and receive user data, control information, wireless signals/channels, etc. through the antenna.

Processor 30 may be referred to as a controller, microcontroller, microprocessor, or microcomputer. A processor may be implemented by hardware, firmware, software, or a combination thereof. For example, an Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), or Field Programmable Gate Arrays (FPGA) may be included in the processor. Methods according to various embodiments of the present invention may be implemented using firmware or software, and the firmware or software may be implemented to include modules, procedures, functions, etc. Firmware or software configured to perform methods according to various embodiments of the present invention may be included in the processor or stored in memory and driven by the processor.

The computing device 1 according to an embodiment of the present invention is included in the Internet network and is not limited to a browser terminal or DNS server. The computing device 1 according to an embodiment of the present invention can implement the following method of analyzing pharming DNS using the memory, transceiver, and processor described above, which will be described with reference to FIG. 2.

Figure 2 is a flowchart of a DNS analysis method according to an embodiment of the present invention.

Referring to FIG. 2, a response to one or more domain queries transmitted from the terminal 2 to the Internet network can be received (S110).

Here, a domain query is a request for an IP address transmitted to the DNS server 3a through a gateway in order to determine the actual IP address of the domain name of the service server 4a (eg, web server). Then, the DNS server 3a determines the IP address corresponding to the domain name and delivers it to the terminal 2 that sent the domain query. Afterwards, the terminal 2 can request data transmission using the TCP/IP protocol to the service server 4a through the gateway using the identified IP address. That is, a response to a domain query may include an IP address.

Meanwhile, the response may further include a Time to Live (TTL) value. TTL is a time value registered in the DNS server 3a (for example, caching maintenance time value 1800 sec), and TTL is set for all domain information. For a normal DNS server 3a, the TTL is set to decrease in value each time it is queried by the terminal 2.

The computing device 1 may determine whether to do DNS farming based on the response IP address and response TTL included in the response (S120).

Here, the response IP address includes the IP address included in the response. If the DNS server transmitting the response is a normal DNS server 3a, it will be a normal IP address, and if the DNS server transmitting the response is a normal DNS server 3b, it will be a fake IP address. In other words, the response address can be divided into a normal IP address and a fake IP address depending on whether DNS farming is performed. If the terminal 2 receives a fake IP address and connects to the Internet network, the terminal 2 connects to a fake service server 4b other than the normal service server 4a.

Meanwhile, response TTL can also be divided into normal TTL and fake TTL depending on whether DNS farming is used. In normal cases, the TTL is set to decrease in value depending on the passage of time and receiving queries from the terminal 2. Therefore, the normal TTL refers to a value that decreases with the passage of time and the number of queries received, while the fake TTL has the characteristic that the value remains constant and changes when the hacking target is selected or changed.

The computing device 1 can determine whether to do DNS farming using the IP address and TTL included in the response, and processes for determining whether to do DNS farming are described below. The processes for determining whether to do DNS farming include a first process for comparing the response IP address with a normal IP address included in normal DNS cache information, and a second process for comparing the country where the response IP address is located and the country where the domain is located. , a third process to check whether the same response IP address is received in response to two or more different domain queries, a hidden flag, the response IP address to the domain query for inspection sent to the DNS server 3c and the above It includes a fourth process of comparing IP addresses corresponding to domain queries for inspection, and a fifth process of comparing response TTLs to at least two domain queries spaced apart in time. Computing device 1 may determine whether to do DNS farming according to at least some of the first to fifth processes, preferably at least three of the first to fifth processes, more preferably at least four, especially preferably the first process. Whether to perform DNS farming can be determined based on all of the first to fifth processes.

The first process is to compare the normal IP address recorded in the DNS cache information with the IP address included in the response and, if different, determine that DNS has been farmed. The first processor is the most basic overall condition. However, recently, as cloud services, etc. are provided, it is difficult to determine that DNS has been farmed simply through the first process, and the second to fifth processes below, especially the second to fourth processes, are required.

The second process is to compare the country where the response IP is located and the country where the domain is located, and if they are different, determine that the country is DNS farmed. For example, for the domain name www.naver.com, there is a Korean IP address called 1.1.1.1. Assuming that the responding IP address is 10.10.10.10 and the location of this IP is in China, the IP address is used to determine Since the locations are different, in this case, it can be determined that DNS farming has occurred by comparing the countries determined based on the IP address.

The third process is to determine that DNS is farmed when the same response IP address is received in response to two or more different domain queries. For example, in a normal case, a query to www.naver.com and a query to daum.net would be responded to with different IP addresses, but if pharmed, the fake DNS server (3b) would respond to the same IP address. Therefore, in this case, it can be determined that DNS is farmed.

The fourth process uses a predetermined query that there is no reason for a third party to query, and the IP address in response to the query for the domain for inspection sent to the hidden flag DNS server 3c and the IP address corresponding to the query for the domain for inspection are each other. If it is different, it is determined that DNS has been farmed. For example, the hidden flag DNS server 3c is prepared in advance to determine whether to do DNS farming according to the present invention, and does not query anyone other than the inspector. In order to query the hidden flag DNS server (3c), a predetermined inspection domain query must be transmitted, and at this time, the hidden flag DNS server (3c) is set to respond with a inspection IP address corresponding to the predetermined inspection domain query. It is done. The computing device 1 stores information related to the domain query for inspection and the IP address for inspection, and is a server that does not apply to the cloud or cache and is located inside a specific communication network, so there is no cause for the IP to change, so it is a server for inspection. You can determine whether to do DNS farming by comparing the inspection IP address that should be received in response to the domain query and the IP address actually received. If an IP address other than the preset IP address for inspection is received in response to a domain query for inspection, this case may be determined to be DNS farming.

The fifth process is related to the rules of the DNS protocol, and the TTL value should decrease in response to the passage of time and the reception of queries, but even if the same domain query is sent consecutively at intervals, at least If two or more response TTLs do not change, it is determined that DNS is farmed. For example, when connected to a fake DNS server (3b), the values of the two response TTLs will not change if queried over a certain period of time, but when connected to a normal DNS server (3a), the values of the two response TTLs received will not change. Values will change.

According to the present invention, the computing device 1 included in the Internet network can accurately identify abnormal pharming DNS, and further analyzes the traffic of the terminal 2 communicating with the pharming DNS server 3b to determine whether there is a threat to the communication network and predict attacks. It can be used for.

The above-described present invention can be implemented as computer-readable code on a program-recorded medium. Computer-readable media includes all types of recording devices that store data that can be read by a computer system. Examples of computer-readable media include HDD (Hard Disk Drive), SSD (Solid State Disk), SDD (Silicon Disk Drive), ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc. It also includes those implemented in the form of carrier waves (e.g., transmission via the Internet). Accordingly, the above detailed description should not be construed as restrictive in all respects and should be considered illustrative. The scope of the present invention should be determined by reasonable interpretation of the appended claims, and all changes within the equivalent scope of the present invention are included in the scope of the present invention.

Claims (9)

In the method of pharming DNS analysis by a computing device included in the Internet network,
Receiving a response to one or more domain queries transmitted from a terminal to an Internet network; and
determining whether to do DNS farming based on the response IP address and response TTL included in the response;
Including,
In the decision step, the DNS farming is,
A second process for comparing the country in which the response IP address is located and the country in which the domain is located, a hidden flag: a response IP address to a query for a domain for inspection sent to a DNS server and an IP address corresponding to the query for a domain for inspection is determined based on at least some of the fourth process of comparing,
If the country where the response IP address is located and the country where the domain is located are different, or if the response IP address to the inspection domain query sent to the hidden flag DNS server is different from the IP address corresponding to the inspection domain query, it is determined to be DNS farming. DNS analysis method.
delete delete According to paragraph 1,
A DNS analysis method in which domain queries for inspection are sent only to hidden flag DNS servers.
In a computing device for analyzing pharming DNS,
Memory;
A transceiver that receives a response to one or more domain queries transmitted from the terminal to the Internet network; and
It includes a processor that determines whether to do DNS farming based on the response IP address and response TTL included in the response,
The DNS farming is
A second process for comparing the country in which the response IP address is located and the country in which the domain is located, a hidden flag: a response IP address to a query for a domain for inspection sent to a DNS server and an IP address corresponding to the query for a domain for inspection is determined based on at least some of the fourth process of comparing,
If the country where the response IP address is located and the country where the domain is located are different, or if the response IP address to the inspection domain query sent to the hidden flag DNS server is different from the IP address corresponding to the inspection domain query, it is determined to be DNS farming. A computing device that does something.
delete delete According to clause 5,
A computing device in which DNS queries for inspection are sent only to a hidden flag DNS server.
In the computer-readable recording medium on which a program for executing a DNS analysis method on a computer is recorded,
The DNS analysis method includes receiving a response to one or more domain queries transmitted from a terminal to an Internet network, and determining whether to do DNS farming based on the response IP address and response TTL included in the response,
The DNS farming is
A second process for comparing the country in which the response IP address is located and the country in which the domain is located, a hidden flag: a response IP address to a query for a domain for inspection sent to a DNS server and an IP address corresponding to the query for a domain for inspection is determined based on at least some of the fourth process of comparing,
If the country where the response IP address is located and the country where the domain is located are different, or if the response IP address to the inspection domain query sent to the hidden flag DNS server is different from the IP address corresponding to the inspection domain query, it is determined to be DNS farming. A computer-readable recording medium.