TWI764618B - Cyber security protection system and related proactive suspicious domain alert system - Google Patents

Abstract

A cyber security protection system includes a plurality of threat information updating devices; and a proactive suspicious domain alert system, which including: a domain information monitoring device; a domain information storage device; and a security threat analysis device, arranged to operably communicate data with the plurality of threat information updating devices through a network. If the domain information monitoring device detects that a domain mapping of a suspect domain is changed and the new domain mapping of the suspect domain is mapping to a predetermined local address, the domain information monitoring device would further monitor a domain mapping variation frequency of the suspect domain. If the domain mapping variation frequency of the suspect domain exceeds a predetermined value, the security threat analysis device adds the suspect domain into an alert list to render the plurality of threat information updating devices to block their member devices from accessing the suspect domain.

Description

Network information security threat protection system and related proactive suspicious domain warning system

The invention relates to a network information security protection technology, in particular to a network information security threat protection system and a related proactive suspicious network domain warning system.

As various network applications become more and more popular, network attacks emerge in an endless stream everywhere. The methods of network attacks are very diverse. One of the typical methods of network attacks is that hackers use phishing emails, phishing websites, or phishing text messages to trick users into connecting client devices (such as various computers or mobile phones, etc.) through the Internet. Connect to a malicious domain. Another typical network attack method is that hackers use the Trojan horse program that has been implanted in the client device to secretly connect the client device to a malicious domain through the network without the user's knowledge, in order to download malicious software. The code performs further attacks or steals various data from the client device.

To carry out the aforementioned cyberattacks, hackers need to register new domains or steal access to already registered domains. The industry has developed a number of malicious domain detection technologies or information sharing mechanisms, which can detect malicious domains that have been repeatedly used by hackers to conduct network attacks, and provide information on these malicious domains to relevant websites. Road information security protection tools, so that these network information security protection tools can block client devices from accessing these known malicious domains.

However, the existing malicious domain detection mechanisms often need to wait until a certain domain has been involved in multiple network attacks before there is a way to determine the domain as a malicious domain. Such a judgment mechanism has obvious blind spots and needs to wait for a long time, so it is difficult to effectively suppress the cyber attack behavior of hackers, and it is also difficult to provide more effective proactive information for the network application environment. Security protection.

In view of this, how to prevent hackers from using malicious domains to conduct network attacks, so as to increase the difficulty and cost of hackers to carry out network attacks, is a problem to be solved.

This specification provides an embodiment of a network information security threat protection system, which includes: a plurality of threat information update devices, configured to respectively monitor the network connection behavior of a plurality of client network systems; and a proactive suspicious network domain warning The system includes: a network domain information monitoring device configured to monitor changes corresponding to the network domain of a suspected network domain; a network domain information storage device, coupled to the network domain information monitoring device, configured to store the network domain information monitoring records generated by a domain information monitoring device; and an information security threat analysis device, coupled to the domain information monitoring device and the domain information storage device, and configured to update the devices with the plurality of threat information through a network Carry out data communication; wherein, if the network domain information monitoring device finds that the domain correspondence of the suspected network domain has changed, and a new network domain of the suspected network domain corresponds to a predetermined local address or a plurality of predetermined local computers one of the addresses, the domain information monitoring device will also monitor the frequency of changes corresponding to a domain of the suspect domain; wherein, if the domain information monitoring device determines that the frequency of changes corresponding to the suspect domain exceeds one a predetermined value, the information security threat analysis device will add the suspected network domain to a blocking list, so that the plurality of threat information updating devices block the member devices in the plurality of client network systems from accessing the blocking list domain in .

The present specification further provides an embodiment of a proactive suspicious network domain warning system. The proactive suspicious network domain warning system is used for providing a warning list to a plurality of threat information update devices, and the plurality of threat information update devices are respectively used for monitoring the network connection behavior of a plurality of client network systems. The proactive suspicious network domain warning system includes: a proactive suspicious network domain warning system, which includes: a network domain information monitoring device configured to monitor changes corresponding to a network domain of a suspected network domain; a domain information storage device coupled to the network domain information monitoring device and configured to store monitoring records generated by the network domain information monitoring device; and an information security threat analysis device coupled to the network domain information monitoring device and the network Domain capital information storage device, and is set to perform data communication with the plurality of threat information update devices through the network; wherein, if the domain information monitoring device finds that the domain correspondence of the suspect network domain has changed, and the A new network domain corresponds to a predetermined local address or one of a plurality of predetermined local addresses, the network domain information monitoring device will also monitor the frequency of a corresponding change of a network domain of the suspected network domain; The network domain information monitoring device determines that the corresponding change frequency of the suspected network domain exceeds a predetermined value, and the information security threat analysis device will add the suspected network domain to the blocking list, so that the plurality of threat information is updated The device blocks member devices in the plurality of client network systems from accessing the domains in the blocked list.

One of the advantages of the above-mentioned embodiment is that even if the hacker sometimes intentionally sets the domain correspondence of the suspected domain to point to a predetermined local address, in an attempt to hide the maliciousness of the suspected domain and/or the member's device. However, as long as the corresponding change frequency of the suspected network domain exceeds a predetermined value, the information security threat analysis device will add the suspected network domain to the blocking list. In this way, hackers' attempts to hide suspected domains and/or malicious code can be subverted, and hackers' subsequent cyberattacks using suspect domains can be hindered, thus effectively increasing the number of hackers. The difficulty of carrying out a cyber attack.

Another advantage of the above embodiment is that it can increase the difficulty for hackers to repeatedly use the same suspected network domain for network attacks at different time periods, forcing hackers to register more network domains for use, so it can greatly increase the number of hackers. It reduces the cost of cyberattacks by hackers, thereby reducing the possibility of cyberattacks by hackers.

Other advantages of the present invention will be explained in more detail in conjunction with the following description and drawings.

100: Cyber security protection system

102: domain name system monitoring device

104: Suspicious domain information collection device

106: domain owner information detection device

110: Proactive suspicious domain alert system

112: domain information monitoring device

114: domain information storage device

116: Security threat analysis device

120, 130, 140: threat information updating device

122, 132, 142: communication circuit (communication circuit)

124, 134, 144: processing circuit

126, 136, 146: storage circuit

150, 160, 170: client network system

152, 162, 172: network management device

202~222, 302~322, 402~412, 502~514: Operation process (operation)

FIG. 1 is a simplified functional block diagram of a network information security threat protection system according to an embodiment of the present invention.

2 to 3 are simplified flowcharts of a method for determining whether a newly registered network domain has an information security threat according to an embodiment of the present invention.

Figures 4 to 5 show the present invention to determine whether a domain that has been registered for more than a period of time has information security A simplified flowchart of an embodiment of a method of threat.

The embodiments of the present invention will be described below with reference to the relevant drawings. In the drawings, the same reference numbers refer to the same or similar elements or method flows.

FIG. 1 is a simplified functional block diagram of a network information security threat protection system 100 according to an embodiment of the present invention. The network information security threat protection system 100 includes a proactive suspicious network domain warning system 110 and one or more threat information update devices. The proactive suspicious network domain warning system 110 generates relevant domain threat intelligence (domain threat intelligence) for domains that may have network security threat risks, and provides the generated domain threat intelligence Update the device for each threat information. Each threat information update device can provide relevant warning information to one or more client network systems corresponding to each other according to the network domain threat information generated by the proactive suspicious network domain warning system 110 . Each threat information update device can also be equipped with a suitable network management device to manage the network operation of the corresponding client network system, so as to prevent various network devices in the client network system from accessing the network with information security risks. domain and suffered a network attack.

For example, exemplary threat information update devices 120 , 130 , and 140 are shown in the embodiment of FIG. 1 . The threat information updating device 120 can cooperate with a network management device 152 to manage the network operation of a corresponding client network system 150; the threat information updating device 130 can cooperate with a network management device 162 to manage a corresponding client network The network operation of the network system 160 is controlled; and the threat information update device 140 can cooperate with a network management device 172 to manage the network operation of a corresponding client network system 170 .

Please note that the numbers of threat information update devices, client network systems, and network management devices shown in FIG. 1 are only for illustration, and are not intended to be the same as the aforementioned devices in the network security threat protection system 100 . The number of network systems is limited to a specific number. The number of threat information update devices, client network systems, and network management devices in the network security threat protection system 100 can be flexibly adjusted according to requirements. For example, the threat information update device 120 can be used with a plurality of network management devices 152 to manage the client network The network operation of the network system 150; the threat information update device 130 can be combined with a plurality of network management devices 162 to manage the network operation of the client network system 160; and the threat information update device 140 can also be combined with a plurality of network management devices 172 to manage the networking operation of the client network system 170 .

In practical applications, the aforementioned client network systems 150, 160, and 170 may be intranet systems of enterprises, schools, research institutions, government agencies, or non-profit organizations of various sizes, and each includes a certain number of members device (not shown in Figure 1). The number of member devices in each client network system may range from single digits, dozens, hundreds, or even more than a thousand. In addition, multiple member devices in each client network system may all be located in the same geographic area, or may be scattered in different geographic areas (eg, different cities or countries).

The aforementioned network management devices 152, 162, and 172 can be implemented by various suitable network access control devices, such as routers, network gateways, wireless base stations point) and so on. Alternatively, the aforementioned network management devices 152 , 162 , and 172 can also utilize various suitable remote servers, or computing devices installed on various cloud systems (for example, constructed on various private cloud systems or public cloud platforms) on the virtual machine, computing module, or application module) to achieve.

The term "member device" referred to in the specification and the scope of the patent application refers to a variety of devices that can execute a specific operating system (eg: Windows, Linux, macOS, Android, Chrome OS, HarmonyOS, etc.) and support suitable Electronic devices that use data communication protocols, such as desktop computers, notebook computers, tablet computers, servers, Network Attached Storage (NAS), smart TVs, smart phones, or smart speakers, etc. The aforementioned data communication protocol may be various wired data transmission protocols or wireless data transmission protocols, such as TCP/IP communication protocol, UDP (User Datagram Protocol) communication protocol, IEEE 802.11 series communication protocol and so on.

Individual member devices in each client network system can directly or indirectly communicate with one or more other member devices through an appropriate data transmission mechanism (eg, the intranet or data transmission line of the individual client network system). Carry out various data communications. During operation, some member devices in each client network system may use wired data transmission mode for data communication, and some member devices use wireless data transmission mode for data communication. In other words, the data transmission methods used by different member devices may be different.

In the embodiment of FIG. 1 , the proactive suspicious network domain warning system 110 includes a network domain information monitoring device 112 , a network domain information storage device 114 , and an information security threat analysis device 116 . The domain information monitoring device 112 is configured to intermittently collect and monitor domain registration information of one or more predetermined regions, check domain age of the domain, and/or monitor domain mapping of the domain. changes. The domain information storage device 114 is coupled to the domain information monitoring device 112 and configured to store domain registration information collected by the domain information monitoring device 112 and/or monitoring records generated by the domain information monitoring device 112 . The information security threat analysis device 116 is coupled to the network domain information monitoring device 112 and the network domain information storage device 114 , and is configured to control the operation of the network domain information monitoring device 112 and the network domain information storage device 114 . The information security threat analysis device 116 is further configured to, according to the network domain registration information collected by the network domain information monitoring device 112 and/or the monitoring records generated by the network domain information monitoring device 112, target the network information security threat risk of the network. The domain generates relevant domain threat information, and transmits the generated domain threat information to the aforementioned threat information update devices 120, 130, and 140.

The term "domain age" referred to in the description and the scope of the patent application refers to the length of time that has elapsed since the completion of registration of a domain. In practice, it can be measured in various suitable time units, such as , a number of minutes, a number of hours, a number of days, etc.

In practice, both the aforementioned network domain information monitoring device 112 and information security threat analysis device 116 can be used. Use a variety of single processor modules with networking capabilities, computing capabilities, and data processing capabilities, combinations of multiple processor modules, a single computer system, a combination of multiple computer systems, a single server, a combination of multiple servers, Or cloud computing system to achieve. The domain information storage device 114 can be implemented by various volatile storage devices, non-volatile storage devices, database systems, or cloud storage systems.

As shown in FIG. 1 , the threat information updating device 120 includes a communication circuit 122 , a processing circuit 124 , and a storage circuit 126 . The threat information updating device 130 includes a communication circuit 132 , a processing circuit 134 , and a storage circuit 136 . The threat information updating device 140 includes a communication circuit 142 , a processing circuit 144 , and a storage circuit 146 .

In the threat information updating device 120 , the communication circuit 122 is coupled to the corresponding client network system 150 and the network management device 152 , and is configured to be connected through an appropriate network connection (eg, the internal network or the Internet) for data communication with the information security threat analysis device 116 , the network management device 152 , and a plurality of member devices in the client network system 150 to receive the proactive suspicious network domain alert system 110 The transmitted network domain threat information and the network connection behavior records of multiple member devices in the client network system 150 . The processing circuit 124 is coupled to the communication circuit 122 and configured to control the operation of the communication circuit 122 and process the received network connection behavior records to check the network domain access behavior of the member devices in the client network system 150 . The processing circuit 124 can also directly control (or indirectly control through the network management device 152 ) individual members of the client network system 150 according to the network domain threat information transmitted from the proactive suspicious network domain warning system 110 . The device's domain access behavior to prevent individual member devices from accessing specific domains. The storage circuit 126 is coupled to the processing circuit 124 and configured to store the network domain threat information received by the communication circuit 122 and the network connection behavior records of the member devices in the client network system 150 .

In practical applications, the aforementioned threat information updating device 120 may be installed inside the unit to which the client network system 150 belongs, or may be installed in other geographic locations other than the unit to which the client network system 150 belongs. For example, the aforementioned threat information can be updated to the device 120 is installed in the client network system 150 in the form of a stand-alone hardware device. For another example, in some applications, the aforementioned threat information update device 120 can also be changed to various suitable remote servers, or computing devices installed on various cloud systems (for example, structured in various private cloud systems or Virtual machines, computing modules, or application modules on the public cloud platform) to achieve.

Other threat information update devices (eg, threat information update devices 130 and 140 ) in the network security threat protection system 100 may have a similar main structure and configuration as the threat information update device 120 , and other threat information update devices The connection relationship and operation mode between the main constituent circuits in , can be similar to the corresponding circuits in the threat information updating device 120 .

However, it should be noted that, in practice, it is not limited that all threat information update devices 120, 130, and 140 have the same circuit structure, nor is it limited that the operation of individual circuits in each threat information update device must be the same as that of each threat information update device. The corresponding circuits in other threat information update devices are identical.

In practice, the aforementioned communication circuits 122 , 132 , and 142 can be implemented by various wired transmission circuits, wireless transmission circuits, hybrid circuits integrating the aforementioned two communication mechanisms, or cloud communication systems. The processing circuits 124, 134, 144 can all be implemented by a single processor module, a combination of multiple processor modules, a single computer system, a combination of multiple computer systems, a single server, a combination of multiple servers, or a cloud computing system. accomplish. The storage circuits 126, 136, and 146 can be implemented by various volatile storage devices, non-volatile storage devices, database systems, or cloud storage systems.

2 to 3 to further illustrate the operation of the network security threat protection system 100 for performing network domain threat assessment. 2 to 3 are simplified flowcharts of a method for determining whether a newly registered network domain has an information security threat according to an embodiment of the present invention.

In the flowcharts of FIG. 2 and FIG. 3 , the process in the column to which a specific device belongs represents the process performed by the specific device. For example, the portion marked in the "proactive suspicious domain warning system" field is performed by the proactive suspicious domain warning system 110 ; the part marked in the "Threat Information Update Device" field is the process performed by the individual threat information update devices in the threat information update devices 120 , 130 , and 140 . The aforementioned logic is also applicable to other subsequent flowcharts.

As shown in FIG. 2 , when the network information security threat protection system 100 is in operation, the proactive suspicious network domain warning system 110 will perform the process 202 in FIG. 2 , and the threat information updating devices 120 , 130 , and 140 may Process 204 in FIG. 2 is performed.

In the process 202, the domain information monitoring device 112 of the proactive suspicious domain warning system 110 collects and monitors domain registration information of one or more predetermined regions. For example, the domain information monitoring device 112 can connect to the websites or servers of various types of network registries through the Internet to inquire about newly registered domains ( newly registered domain) related information.

For another example, the domain information monitoring device 112 may be connected to one or more DNS monitoring devices 102 through a suitable private network or the Internet to receive the domain names collected by the DNS monitoring device 102 register information. In practice, the aforementioned domain name system monitoring device 102 can use various single processor modules with networking capability, computing capability, and data checking capability, a combination of multiple processor modules, a single computer system, and multiple computer systems. A combination, a single server, a combination of multiple servers, or a cloud computing system can be implemented.

The aforementioned network domain name system monitoring device 102 may be a device managed and operated by the operator and/or manager of the proactive suspicious network domain warning system 110 . Alternatively, the domain name system monitoring device 102 may also be a device managed and operated by other third-party service providers.

In practical applications, the network domain information monitoring device 112 may perform the operation of the process 202 in real time during the operation of the proactive suspicious network domain warning system 110 , or may perform the operation of the process 202 intermittently or periodically. operate. In general, within 5 to 10 minutes after the registration of a new domain is completed, the domain information monitoring device 112 can obtain the relevant data of the newly registered domain by the above-mentioned method.

In the process 204, the threat information updating devices 120, 130, and 140 may monitor the networking behavior of the corresponding client network systems 150, 160, and 170, respectively. For example, the threat information updating device 120 detects and collects the network connection behavior records of the individual member devices in the corresponding client network system 150 . In practice, the processing circuit 124 of the threat information update device 120 can use the network management device 152 or a predetermined application program installed in each member device of the client network system 150 to read and analyze the specific information in the corresponding member device. The content of non-volatile data, such as system logs, boot auto-start items, execution logs, and/or file meta data for specific types of files, etc. The processing circuit 124 can receive the data returned by the specific application through the communication circuit 122 .

For example, if the operating system of the member device is Windows, the network management device 152 or the aforementioned predetermined application can read and analyze the Windows Event Log stored in the member device, and automatically activate the login. File (Autorun Registry), Schedule Job, Prefetch cache, Application Compatibility Cache (Shimcache and/or Amcache), and/or .exe/.dll/.sys The file metadata of portable executable files (PE files) in the format, etc., are transmitted to the communication circuit 122 of the threat information update device 120 .

For another example, when the operating system of the member device is a Linux system, the network management device 152 or the aforementioned predetermined application can read and analyze the log entries under the folder "/var/log/" in the member device, System and service management tools (Systemd), system initialization scripts (SysV init script), scheduling instructions (crontab), system initialization procedures (Upstart), dynamic web pages in .php or .jsp format, and instruction execution scripts (shell scripts), sensitive files, command histories, syslog, and/or Executable and Linkable Format files in .so/.ko format , ELF files), etc., and communicated to the communication circuit 122 of the threat information update device 120.

For another example, when the operating system of the member device is the macOS system, the network management device 152 or the aforementioned predetermined application can read and analyze the log entries under the folder “/var/log/” in the member device, Records under the folder "/Library/LaunchAgents/", records under the folder "/Library/LaunchDaemons/", shell scripts, command histories, and/or Mach object formats The file metadata of the execution files (Mach object files, Mach-O files), etc., are transmitted to the communication circuit 122 of the threat information update device 120 .

In addition to the aforementioned non-volatile data, the network management device 152 or the aforementioned predetermined application program can also detect and analyze the current memory content and/or network behavior of the member devices and other specific volatile data in the process 204 . The content is transmitted to the communication circuit 122 of the threat information update device 120 . For example, the network management device 152 or the aforementioned predetermined application can use the network connection query command "netstat" to inquire about the connection status of the member device and the external network, and can also use various methods to detect the network that the member device attempts to access. area.

During operation, the network management device 152 or the aforementioned predetermined application program or the processing circuit 124 may utilize various filtering and judgment algorithms to perform preliminary content of the aforementioned specific non-volatile data and/or volatile data related to the member device In the analysis, part of the activity records that may be related to the networking actions are selected from the numerous activity history records of the member devices as the networking behavior records, thereby reducing the amount of data that needs to be processed or analyzed by the processing circuit 124 subsequently.

The threat information updating apparatuses 130 and 140 can monitor the network connection behavior of the corresponding client network systems 160 and 170, respectively, according to the operation mode of the aforementioned threat information updating apparatus 120. For brevity, the description is not repeated here. In practical applications, the threat information update devices 120 , 130 , and 140 can respectively transmit the monitoring records of the networking behaviors of the client network systems 150 , 160 , and 170 to the proactive suspicious network domain warning system 110 for processing. Various analyses and judgments.

When the domain information monitoring device 112 finds a newly registered domain, the newly registered domain can be The relevant information is stored in the domain information storage device 114 and notified to the information security threat analysis device 116 .

For example, the network domain information monitoring device 112 may directly store the relevant information of the newly registered domain in the network domain information storage device 114 and notify the information security threat analysis device 116 each time it discovers a newly registered network domain.

Alternatively, the domain information monitoring device 112 may first check the current domain age of the newly registered domain each time it discovers a newly registered domain, and only if the current domain age of the newly registered domain is less than a first Only when the threshold value is reached, the relevant information of the newly registered domain is stored in the domain information storage device 114 and notified to the information security threat analysis device 116 .

In the process 206 , the information security threat analysis device 116 may regard the newly registered network domain notified by the network domain information monitoring device 112 as a suspect domain and add it to a suspect list.

In the process 208, the information security threat analysis device 116 may transmit the suspect list to the threat information update devices 120, 130, and 140 through the network. In practice, the information security threat analysis device 116 can instantly transmit the latest suspect list to the threat information update devices 120 , 130 , and 140 when the content of the suspect list is changed. Alternatively, the information security threat analysis device 116 may also transmit the current suspect list to the threat information update devices 120 , 130 , and 140 intermittently or periodically.

The network domain information monitoring device 112 and the information security threat analysis device 116 repeat the operations of the aforementioned process 202 to process 208 .

In the process 210 , the threat information updating devices 120 , 130 , and 140 use the communication circuits 122 , 132 , and 142 to receive the suspect list from the information security threat analyzing device 116 , respectively.

In the process 212 , the threat information updating devices 120 , 130 , and 140 check the domain access behaviors of the member devices in the corresponding client network systems 150 , 160 , and 170 , respectively, to determine whether the client network systems Whether any of the member devices 150, 160, and 170 have ever attempted to access the domains listed on the suspect list.

For example, in the process 212, the processing circuit 124 of the threat information updating device 120 may The aforementioned networking behavior records of the individual member devices in the client network system 150 are used to analyze the domain access behavior of the individual member devices in the client network system 150 to determine whether there are any Any member device has attempted to access a domain on the suspect list.

For another example, the network management device 152 may replicate each network packet between an individual member device in the client network system 150 and the external network, and transmit the replicated network packet to the communication of the threat information update device 120 circuit 122. In the process 212, the processing circuit 124 of the threat information updating device 120 may check the contents of the destination address and/or source address fields of the aforementioned network packet to determine whether the member device has attempted to Access domains on the suspect list.

For another example, the network management device 152 may copy the field contents of the destination URL and/or the source URL of each network packet between the individual member devices in the client network system 150 and the external network, and copy The content of the field is sent to the communication circuit 122 of the threat information update device 120 . In the process 212, the processing circuit 124 of the threat information updating device 120 may check the contents of the aforementioned fields to determine whether the member device has ever attempted to access the domain listed in the suspect list.

For another example, the network management device 152 may check the field contents of the destination URL and/or the source URL of each network packet between the individual member devices in the client network system 150 and the external network to determine the Whether the member device has ever attempted to access the domain listed in the suspect list, and transmits the judgment result to the communication circuit 122 of the threat information updating device 120 . In the process 212 , the processing circuit 124 of the threat information updating device 120 can quickly know whether any member device in the client network system 150 has tried to access the suspect list according to the judgment result sent from the network management device 152 domain in .

Similarly, the threat information update device 130 can check the network domains of the member devices in the corresponding client network system 160 by collaborating with the corresponding one or more network management devices 162 according to the operation mode of the aforementioned threat information update device 120 . access behavior, and the threat information update device 140 can also be compared with the operation mode of the aforementioned threat information update device 120, The one or more network management devices 172 of the corresponding client network system 170 check the network domain access behavior of the member devices in the corresponding client network system 170 .

As shown in FIG. 2 , after the information security threat analysis device 116 transmits the suspect list to the threat information update devices 120 , 130 , and 140 , the information security threat analysis device 116 also performs a process 214 to wait for the threat information update devices 120 , 130 , and 140 to check. result.

While the information security threat analysis device 116 is waiting for the threat information update devices 120 , 130 , and 140 to generate domain access notifications, the information security threat analysis device 116 may instruct the network domain information monitoring device 112 to intermittently or periodically Process 216.

In the process 216, the domain information monitoring device 112 may check the current domain age of the individual suspect domains in the suspect list. If the domain information monitoring device 112 checks and finds that the current domain age of the specific suspect domain in the suspect list has not exceeded the aforementioned first threshold, the proactive suspicious domain warning system 110 can repeat the process 214 and the process 216 operation. In this case, the specific suspected network domain will be kept in the suspect list by the information security threat analysis device 116 for continued observation.

On the contrary, if the domain information monitoring device 112 checks and finds that the current domain age of the specific suspect domain in the suspect list has exceeded the aforementioned first threshold, the domain information monitoring device 112 will monitor the current domain age of the specific suspect domain. If the domain age has exceeded the aforementioned first threshold, the information security threat analysis device 116 is notified. In this case, the information security threat analysis device 116 will perform the process 218 .

In the process 218, the information security threat analysis device 116 determines that the specific suspected network domain has no obvious network security threat so far, and removes the specific suspected network domain from the suspect list. Next, the information security threat analysis device 116 will perform the process 208 to transmit the updated suspect list to the threat information update devices 120 , 130 , and 140 .

The length of the aforementioned first threshold value is related to the sensitivity of the information security threat analysis device 116 in evaluating the network domain threat risk of the suspect network domains in the suspect list and the length of observation time. In practice, the aforementioned first threshold value can be set to a time length between 1 hour and 120 hours, for example, 1.5 hours, 2 hours, 3 hours, 5 hours, 10 hours, 12 hours, 15 hours, 18 hours, 24 hours, 36 hours, 48 hours, 50 hours, 60 hours, 72 hours, 80 hours, 96 hours, or 100 hours, etc.

As can be seen from the foregoing description, after the network domain information monitoring device 112 discovers the newly registered network domain, the newly registered network domain will be regarded as a suspected network domain by the information security threat analysis device 116 and added to the suspect list for observation. Before the domain age of the specific suspect network domain in the suspect list has not exceeded the aforementioned first threshold, even if the specific suspect network domain is not accessed by any member device in any client network system, the specific suspect network domain will not be accessed. The domain will still be kept in the suspect list by the information security threat analysis device 116 for continued observation. At this time, the threat information updating devices 120 , 130 , and 140 will not block the access action of the corresponding client network system to the specific suspect network domain.

Please note that if the domain age of the specific suspected domain has exceeded the first threshold but has not been accessed by any member device in any client network system, the specific suspected domain will be analyzed by information security threats Device 116 is removed from the suspect list. Such an approach can reduce the number of suspect domains in the suspect list, which can not only reduce the computational burden, storage space requirements, and/or memory requirements required by the domain information monitoring device 112, but also reduce the threat information update device 120, 130, and 140 check the computational load, storage space requirement, and/or memory requirement when performing the aforementioned process 212. For example, according to the test results, setting the aforementioned first threshold to a time length between 1 hour and 72 hours can effectively reduce the number of problems between the network domain information monitoring device 112 and the threat information updating devices 120 , 130 , and 140 . The required computing burden, storage space requirements, and/or memory requirements will not seriously reduce the information security protection performance of the network information security threat protection system 100, so that the aforementioned devices can achieve higher protection performance and resource utilization efficiency. Balanced settings.

On the other hand, as shown in FIG. 2 , when any threat information update device is performing the process 212, if it finds that there is a member device in the corresponding client network system trying to access the domain in the suspect list, the threat information update The device may perform process 220 to generate and transmit a corresponding domain access notification to the proactive suspicious domain alert system 110 . In this situation, The information security threat analysis device 116 will perform the process 222 to receive the domain access notification generated by the threat information update device.

For the convenience of description, it is assumed that the processing circuit 124 of the threat information updating device 120 finds that one or more member devices in the corresponding client network system 150 try to access a member of the suspect list during the operation of the aforementioned process 212. Suspect domain SD1.

In this case, the processing circuit 124 will perform the process 220 to generate a network domain access notification corresponding to the suspect network domain SD1 , and transmit the network domain access notification to the information security threat analysis device 116 through the communication circuit 122 . On the other hand, the information security threat analysis device 116 will perform the process 222 to receive the domain access notification generated by the threat information update device 120 .

Please note that at this time, the domain age of the suspect domain SD1 has not exceeded the aforementioned first threshold value, which means that the suspect domain SD1 is a newly registered domain that has been registered not long ago. In general, most normal domains are not officially publicly available for a reasonable period of time after registration. Moreover, the vast majority of people other than the administrator or owner of the newly registered domain should logically not know the existence of the newly registered domain, so it is unlikely that they will use their own connection under normal circumstances. network device to try to access the newly registered domain.

However, the suspected network domain SD1 has been attempted to be accessed by the member devices in the client network system 150 before the current domain age has not exceeded the aforementioned first threshold value, which obviously does not seem like a new Typical usage of a registered domain.

Therefore, after receiving the aforementioned network domain access notification corresponding to the suspect network domain SD1, the information security threat analysis device 116 regards the suspect network domain SD1 as a network domain with network information security risks. For example, determine the suspected domain SD1 as a malicious domain that may be used by hackers to conduct network attacks using phishing emails, phishing websites, or phishing text messages; The test domain used when the member device in the client network system 150 is successfully implanted; or the suspect domain SD1 is determined as the malicious domain that the malicious code implanted in the client device wants to connect to.

In this case, the information security threat analysis device 116 will perform the process 302 in FIG. 3 to Suspected domain SD1 is included in an alert list. Meanwhile, the information security threat analysis device 116 can remove the suspect network domain SD1 from the aforementioned suspect list, or keep it in the suspect list for a period of time.

In process 304, the information security threat analysis device 116 may transmit the alert list to the threat information update devices 120, 130, and 140 through the network. In practice, the information security threat analysis device 116 can immediately transmit the latest alert list to the threat information update devices 120 , 130 , and 140 when the content of the alert list is changed. Alternatively, the information security threat analysis device 116 may intermittently or periodically transmit the current alert list to the threat information update devices 120 , 130 , and 140 .

In the process 306 , the threat information updating devices 120 , 130 , and 140 use the communication circuits 122 , 132 , and 142 to receive the alert list from the information security threat analyzing device 116 , respectively.

In process 308, the threat information update devices 120, 130, and 140 block member devices in the corresponding client network systems from accessing the domains in the alert list. For example, the processing circuit 124 of the threat information updating device 120 can directly block the access rights of all member devices in the client network system 150 to the domains in the alert list, or instruct the corresponding network management device 152 to block the client The access rights of all member devices in the network system 150 to the domains in the alert list.

Similarly, the processing circuit 134 of the threat information updating device 130 can directly block the access rights of all member devices in the client network system 160 to the domains in the alert list, or instruct the corresponding network management device 162 to block the client The access rights of all member devices in the end network system 160 to the domains in the alert list. The processing circuit 144 of the threat information updating device 140 can directly block the access rights of all member devices in the client network system 170 to the domains in the alert list, or instruct the corresponding network management device 172 to block the client network The access rights of all member devices in the system 170 to the domains in the alert list.

In this embodiment, even if only a single threat information update device 120 transmits the domain access notification corresponding to the suspected domain SD1 to the information security threat analysis device 116, other threats The threat information update devices 130 and 140 do not transmit the domain access notification corresponding to the suspected network domain SD1 to the information security threat analysis device 116, and the information security threat analysis device 116 will also add the suspected network domain SD1 to the alert list and add The alert list is disseminated to threat information update devices 120, 130, and 140, so that threat information update devices 120, 130, and 140 start blocking all member circuits in client network systems 150, 160, and 170 for suspect domain SD1 access rights.

In other words, although the suspected network domain SD1 is only found to be accessed by one or several member devices of the single-client network system 150, it will still be included in the alert list by the information security threat analysis device 116, thereby causing threats The information updating devices 120, 130, and 140 start to block all member circuits in the client network systems 150, 160, and 170 from accessing the suspect network domain SD1.

Therefore, even if the suspected domain SD1 is really a malicious domain used by hackers to conduct network attacks, a test domain used by hackers to test Trojans, or a malicious program that has been implanted in a client device The malicious domain that the code wants to connect to, but it is also difficult to cause further harm to other member devices in the client network system 150, 160, and 170, because the threat information update devices 120, 130, and 140 have been based on the information security threat. The information security threat information (alert list) provided by the analyzing device 116 starts to block all member circuits in the client network systems 150, 160, and 170 from accessing the suspect network domain SD1.

As can be seen from the above description, even if the suspected domain SD1 has just been registered (its current domain age has not exceeded the first threshold), as long as any threat information update device discovers any member device in any client network system Attempting to access the suspect network domain SD1, the information security threat analysis device 116 will add the suspect network domain SD1 to the alert list, so that the threat information update devices 120, 130, and 140 start blocking the client network systems 150, 160, and 140 in advance. and 170 the time point at which the suspect domain SD1 was accessed.

In this way, it is possible to hinder hackers from using the newly registered suspected domain SD1 to conduct network attacks, thereby effectively increasing the difficulty for hackers to carry out network attacks.

From another perspective, the aforementioned proactive suspicious network domain warning system 110 can The network systems 150 , 160 , and 170 provide proactive network information security protection, thereby enhancing the network information security protection level of the client network systems 150 , 160 , and 170 .

Obviously, the aforementioned information security protection mechanism will force hackers to register more domains for use, so it can greatly increase the cost of hackers to carry out network attacks, thereby reducing the possibility of hackers carrying out network attacks.

As shown in FIG. 3 , after the information security threat analysis device 116 transmits the alert list to the threat information update devices 120 , 130 , and 140 , the process 310 is performed to wait for further information security threat assessment results about the suspected domains in the alert list. or specific instructions.

For the convenience of description, the following takes the aforementioned suspected network domain SD1 included in the alert list as an example for description.

For example, the information security threat analysis device 116 may adopt various suitable algorithms or statistical methods, according to the network domain data recorded in the network domain information storage device 114 or the clients collected by the threat information update devices 120 , 130 , and 140 . The network connection behavior records of the end network systems 150, 160, and 170 are used to further evaluate the information security risk of the suspected network domain SD1.

For another example, the network domain information monitoring device 112 can be connected to one or more suspicious network domain information collection devices 104 through a suitable private network or the Internet, so as to inquire whether the suspected network domain SD1 is affected by other information security threat assessment units Or the information security protection service provider determines that the network domain is suspicious, and reports the query result to the information security threat analysis device 116 to further evaluate the information security risk of the suspected network domain SD1. In practice, the aforementioned suspicious network domain information collection device 104 can use various single processor modules with networking capability, computing capability, and data response capability, a combination of multiple processor modules, a single computer system, or a combination of multiple computer systems. A combination, a single server, a combination of multiple servers, or a cloud computing system can be implemented.

For another example, the domain information monitoring device 112 may be connected to one or more domain owner information detecting devices 106 through a suitable private network or the Internet to check the domain owner of the suspected domain SD1 information, and report the check result to the information security threat analysis device 116 . The information security threat analysis device 116 can make a comprehensive judgment based on the domain owner information of the suspected network domain SD1 and other various network information security information, so as to further evaluate the suspected network domain. The security risk of SD1. In practice, the aforementioned domain owner information detection device 106 can use various types of single processor module, combination of multiple processor modules, single computer system, multiple computers with networking capability, computing capability, and data response capability. A combination of systems, a single server, a combination of multiple servers, or a cloud computing system can be implemented.

The aforementioned suspicious network domain information collection device 104 and/or the network domain owner information detection device 106 may be devices managed and operated by the operator and/or administrator of the proactive suspicious network domain warning system 110 . Alternatively, the suspicious network domain information collection device 104 and/or the network domain owner information detection device 106 may also be devices managed and operated by other third-party service providers.

For another example, the information security threat analysis device 116 can also wait for a specific instruction issued by the information security threat analysis device 116 after professional information security analysts use various tools or methods to assess the information security threat of the suspected network domain SD1, for example, Set command to put the suspected domain SD1 on the danger list with high security risk.

If the information security threat analysis device 116 calculates a specific risk assessment result indicating that the suspected network domain SD1 has a high information security risk, or receives a setting instruction issued by the information security analyst to put the suspected network domain SD1 on the danger list, the information security The security threat analysis device 116 will perform the process 312 .

In the process 312, the information security threat analysis device 116 may add the suspected network domain SD1 to a dangerous list according to the aforementioned specific risk assessment result or setting instruction. In practice, the information security threat analysis device 116 can optionally remove the suspected network domain SD1 from the original alert list after adding the suspected network domain SD1 to the danger list.

In the process 314, the information security threat analysis device 116 may transmit the danger list to the threat information update devices 120, 130, and 140 through the network. In practice, the information security threat analysis device 116 can instantly transmit the latest danger list to the threat information update devices 120 , 130 , and 140 when the content of the danger list is changed. Alternatively, the information security threat analysis device 116 may intermittently or periodically transmit the current danger list to the threat information updater. New devices 120, 130, and 140.

In the process 316 , the threat information updating devices 120 , 130 , and 140 use the communication circuits 122 , 132 , and 142 to receive the danger list from the information security threat analyzing device 116 , respectively.

In process 318, the threat information update devices 120, 130, and 140 block member devices in the corresponding client network systems from accessing the domains in the danger list. For example, the processing circuit 124 of the threat information updating device 120 can directly block the access rights of all member devices in the client network system 150 to the domains in the danger list, or instruct the corresponding network management device 152 to block the client The access rights of all member devices in the network system 150 to the domains in the danger list.

Likewise, the processing circuit 134 of the threat information updating device 130 can directly block the access rights of all member devices in the client network system 160 to the domains in the danger list, or instruct the corresponding network management device 162 to block the client The access rights of all member devices in the end network system 160 to the domains in the danger list. The processing circuit 144 of the threat information updating device 140 can directly block the access rights of all member devices in the client network system 170 to the domains in the danger list, or instruct the corresponding network management device 172 to block the client network The access rights of all member devices in the system 170 to the domains in the danger list.

As shown in FIG. 3 , the information security threat analysis device 116 may instruct the network domain information monitoring device 112 to intermittently instruct the information security threat analysis device 116 to wait for the information security threat assessment result or specific instruction on the suspected network domain in the alert list. Process 320 is performed periodically or periodically.

In the process 320, the domain information monitoring device 112 may check the current domain age of the individual suspect domains in the alert list. If the domain information monitoring device 112 checks and finds that the current domain age of the specific suspect domain in the alert list has not exceeded a second threshold, the proactive suspicious domain alert system 110 may repeat the process 310 and the process 320. operate. In this case, the specific suspected network domain will be kept in the alert list by the information security threat analysis device 116 .

Conversely, if the domain information monitoring device 112 checks and finds a specific suspect in the alert list If the current domain age of the network domain has exceeded the aforementioned second threshold value, the network domain information monitoring device 112 will notify the information security threat analysis that the current network domain age of the specific suspected network domain has exceeded the aforementioned second threshold value device 116 . In this case, the information security threat analysis device 116 will perform the process 322 .

In the process 322, the information security threat analysis device 116 determines that the network information security threat level of the specific suspected network domain is not high, and removes the specific suspected network domain from the alert list. Next, the information security threat analysis device 116 will perform the process 304 to transmit the updated alert list to the threat information update devices 120 , 130 , and 140 .

The length of the aforementioned second threshold value is related to the sensitivity of the information security threat analysis device 116 in evaluating the network domain threat risk of the suspected network domain in the alert list and the length of the blocking time. In practice, the second threshold value can be set to be greater than or equal to the aforementioned first threshold value. In this embodiment, the second critical value can be set to a length of time between 12 hours and 200 hours, for example, 15 hours, 18 hours, 24 hours, 36 hours, 48 hours, 50 hours, 60 hours, 72 hours, 80 hours, 96 hours, 100 hours, 110 hours, 120 hours, 150 hours, 168 hours, 180 hours, 200 hours, etc.

Taking the aforementioned suspect network domain SD1 included in the warning list as an example, before the age of the suspect network domain SD1 has not exceeded the aforementioned second threshold, as long as the information security threat analysis device 116 has not calculated the representative suspect network domain SD1 The specific risk assessment result with high information security risk has not received the setting instruction issued by the information security analyst to put the suspected network domain SD1 in the danger list, then the suspected network domain SD1 will be retained by the information security threat analysis device 116. Continued evaluation on the alert list. At this time, the threat information updating devices 120 , 130 , and 140 will continue to block the access action of the corresponding client network system to the suspect network domain SD1 .

Please note that if the domain age of the suspected domain SD1 has exceeded the second threshold but has not been included in the danger list by the information security threat analysis device 116 , the information security threat analysis device 116 will determine the network of the suspected network domain SD1 The information security threat level is not high, and the suspected domain SD1 is removed from the alert list. Doing so reduces the number of suspect domains on the alert list. Not only can the computing burden, storage space requirements, and/or memory requirements required by the network domain information monitoring device 112 and the information security threat analysis device 116 be reduced, but also the threat information updating devices 120, 130, and 140 can perform the aforementioned process 308. The computational burden, storage space requirements, and/or memory requirements of blocking operations. For example, according to the test results, setting the aforementioned second threshold to a time length between 24 hours and 168 hours can effectively reduce the network domain information monitoring device 112 , the information security threat analysis device 116 , and the threat information update. The computing burden, storage space requirements, and/or memory requirements required by the devices 120, 130, and 140 will not seriously reduce the information security protection performance of the network security threat protection system 100, so that the aforementioned devices can be protected Get a more balanced setting in terms of performance and resource usage efficiency.

From another point of view, the aforementioned method of removing the suspected domain from the alert list when the appropriate conditions are established can also effectively improve the information security threat analysis device 116 and the threat information update devices 120 , 130 , and 140 to perform related tasks. Information security analysis compares the computing efficiency and response speed during computing.

In addition, as can be seen from the foregoing description, the domains listed in the alert list are only temporarily blocked. As mentioned above, if the domain age of a specific domain in the alert list has exceeded the second threshold but has not been included in the danger list, the specific domain will be removed from the alert list by the information security threat analysis device 116 . remove. As such, the threat information update devices 120, 130, and 140 can allow member devices in the corresponding client network systems 150, 160, and 170 to access the specific network domain.

In contrast, the network domains listed in the danger list will be blocked for a long time or permanently because they are judged by the information security threat analysis device 116 or other professional information security analysts to have high network information security threats. state.

Next, with reference to FIG. 4 to FIG. 5 , the operation of the network information security threat protection system 100 for performing network domain threat assessment for network domains with different attributes will be further described. FIG. 4 to FIG. 5 are simplified flowcharts of an embodiment of a method for determining whether a network domain that has been registered for more than a period of time has an information security threat according to an embodiment of the present invention.

As described in the flow operation description of FIG. 2 above, if the domain age of the suspect network domain has exceeded the aforementioned first threshold but has not yet been accessed by any member device in any client network system, the suspect network The domain is removed from the suspect list by the security threat analysis device 116 . From a certain perspective, these suspect domains are domains that have been registered for more than a period of time (eg, domain age exceeds the aforementioned first threshold), but do not currently seem to be domains with obvious security risk concerns.

However, hackers use malicious domains to carry out network attacks in a variety of techniques and styles. It has been found that some hackers sometimes intentionally set the domain mapping of malicious domains to point to the local addresses of member devices that have been implanted with malicious code in an attempt to hide malicious domains and/or Malicious code that has been implanted on member devices. This is because in the above-mentioned situation, the malicious code that has been implanted into the member's device will not temporarily access external malicious domains through the network, and is like being in a dormant or dormant state, which leads to professional network security analysts. It is difficult to detect the existence of malicious domains and malicious codes with existing network information security protection tools.

If the hacker then modifies the domain of the malicious domain to an external network address, the member device is vulnerable to network attacks, and the hacker's attack even spreads to other related devices.

In order to reduce the possible damage to the client network system caused by the aforementioned hacking methods, the network information security threat protection system 100 can execute the methods shown in FIG. 4 to FIG. An threat.

As shown in FIG. 4 , when the network information security threat protection system 100 is in operation, the proactive suspicious network domain warning system 110 may perform the process 402 in FIG. 4 . At the same time, the threat information updating devices 120 , 130 , and 140 can continue to operate according to the methods of the flowcharts of FIGS. 2 to 3 , so as to prevent the member devices in the client network systems 150 , 160 , and 170 from being stored. Take the domains in the aforementioned alert list and the domains in the danger list.

In the process 402, the domain information monitoring device 112 of the proactive suspicious domain warning system 110 monitors that the domain information has been registered for more than a period of time (for example, the domain age exceeds the aforementioned first domain name) Variation of domain mappings of multiple suspect domains (threshold). For example, the domain information monitoring device 112 can connect to the websites or servers of various types of domain registries through the Internet to inquire about a certain region, certain regions, or worldwide registered domain names. Domain corresponding data.

For another example, the domain information monitoring device 112 can be connected to one or more of the aforementioned DNS monitoring devices 102 through a suitable private network or the Internet to receive the information collected by the DNS monitoring device 102 domain corresponding data. In practice, the aforementioned domain name system monitoring device 102 can use various single processor modules with networking capability, computing capability, and data checking capability, a combination of multiple processor modules, a single computer system, and multiple computer systems. A combination, a single server, a combination of multiple servers, or a cloud computing system can be implemented.

In one embodiment, the aforementioned network domain correspondence of the suspect network domain includes an A record (A record) of the suspect network domain, or an AAAA record (AAAA record) of the suspect network domain.

In another embodiment, in addition to the A record or the AAAA record, the aforementioned network domain correspondence of the suspect network domain also includes the name server record (NS record) of the suspect network domain, and/or the name server record of the suspect network domain. Mail exchange record (MX record).

If the network domain correspondence of the suspected network domain has not changed, the network domain information monitoring device 112 may repeat the process 402 to check the network of the suspected network domain for many times intermittently or periodically at different time points thereafter. Domain correspondence information, so as to monitor whether the domain correspondence of the suspected domain has changed.

On the other hand, if the domain information monitoring device 112 finds that the domain correspondence of the suspect network domain has changed, the domain information monitoring device 112 will perform the process 404 to further check the pointing target corresponding to the new network domain of the suspect network domain. (destination address) whether it points to a predetermined local address, or one of a plurality of predetermined local addresses. For example, the domain information monitoring device 112 can check whether the new domain corresponding to the suspected domain refers to a first predetermined local address "127.0.0.1", or whether it points to a second predetermined local address "0.0.0.0" ", or whether it points to either of the two predetermined local addresses.

For the convenience of description, it is assumed that the suspect network domain is the aforementioned suspect network domain SD1.

If the network domain information monitoring device 112 finds that the new domain corresponding to the suspected network domain SD1 is indeed pointing to the aforementioned first predetermined local address or second predetermined local address, the relevant information of the suspected network domain SD1 can be stored in the network. The domain information storage device 114 sends a corresponding notification to the information security threat analysis device 116 . After receiving the notification, the information security threat analysis device 116 will perform the process 406 to add the suspected network domain SD1 to a tracking list.

Conversely, if the network domain information monitoring device 112 finds that the new domain corresponding to the suspect network domain SD1 does not point to any predetermined local address, it can transmit the relevant information of the suspect network domain SD1 to the information security threat analysis device 116 . After receiving the relevant information of the suspect network domain SD1, the information security threat analysis device 116 will further determine whether the suspect network domain SD1 has been included in the tracking list.

If the suspected network domain SD1 is not included in the tracking list, the information security threat analysis device 116 determines that the suspected network domain SD1 has no information security threat, or the information security threat is very low. In this case, the information security threat analysis device 116 will perform the process 408 to discard the suspect network domain SD1.

On the contrary, if the suspect network domain SD1 already exists in the tracking list, the information security threat analysis device 116 will perform the process 410 to keep the suspect network domain SD1 in the tracking list.

The information security threat analysis device 116 instructs the domain information monitoring device 112 to monitor a domain mapping variation frequency of each suspect domain listed or retained in the tracking list, so as to determine each suspect network Whether the change frequency of the domain corresponding to the domain exceeds a predetermined value.

Therefore, the network domain information monitoring device 112 will perform the process 412 for the individual suspected network domains in the tracking list, so as to monitor the corresponding change frequency of the network domain of the suspect network domain.

Taking the suspect network domain SD1 as an example, the network domain information monitoring device 112 can record the change history corresponding to the network domain of the suspect network domain SD1, and calculate the number of changes corresponding to the network domain of the suspect network domain SD1 within a predetermined period of time to generate Correspondence to a domain corresponding to the suspected domain SD1 and compare the corresponding change frequency of the network domain with the aforementioned predetermined value.

If the frequency of corresponding changes to the network domain of the suspect network domain SD1 does not exceed the aforementioned predetermined value, the network domain information monitoring device 112 will intermittently or periodically repeat the process 412 to continuously monitor the corresponding changes of the network domain of the suspect network domain SD1. Whether the frequency will exceed the aforementioned predetermined value until the suspect network domain SD1 is removed from the tracking list by the information security threat analysis device 116 .

On the contrary, if the corresponding change frequency of the network domain of the suspected network domain SD1 exceeds the aforementioned predetermined value, the network domain information monitoring device 112 will send a corresponding notification to the information security threat analysis device 116 .

Generally speaking, after the domain age of most normal domains exceeds a certain level (for example, exceeds the aforementioned second threshold), the administrator or owner of the domain usually does not modify its domain correspondence to point to a specific local domain. It makes no sense to change the domain correspondence frequently after changing the domain correspondence to point to a specific local address for a while.

However, the network domain correspondence of the suspected network domain SD1 was first changed to point to the aforementioned first predetermined local address or second predetermined local address, and then the frequency of changes in the corresponding network domain exceeded the aforementioned predetermined value. Too much like the typical usage of normal normal domains.

Therefore, after the information security threat analysis device 116 receives the notification from the network domain information monitoring device 112 that the corresponding change frequency of the network domain of the suspected network domain SD1 exceeds the aforementioned predetermined value, it will regard the suspected network domain SD1 as having network information security. Risky domain. For example, the suspected domain SD1 can be determined to be a malicious domain that has been deliberately concealed by hackers.

In this case, the information security threat analysis device 116 will perform the process 502 in FIG. 5 to add the suspected network domain SD1 to a block list.

In process 504, the information security threat analysis device 116 may transmit the blocking list to the threat information update devices 120, 130, and 140 through the network. In practice, the information security threat analysis device 116 can instantly transmit the latest block list to the threat information update devices 120 , 130 , and 140 when the content of the block list is changed. Alternatively, the information security threat analysis device 116 may intermittently or periodically transmit the current blocking list to the threat information updater. New devices 120, 130, and 140.

In the process 506 , the threat information updating devices 120 , 130 , and 140 use the communication circuits 122 , 132 , and 142 to receive the blocking list from the information security threat analyzing device 116 , respectively.

In process 508, the threat information update devices 120, 130, and 140 block member devices in the corresponding client network systems from accessing the domains in the blocked list. For example, the processing circuit 124 of the threat information updating device 120 can directly block the access rights of all member devices in the client network system 150 to the domains in the blocking list, or instruct the corresponding network management device 152 to block the client The access rights of all member devices in the network system 150 to the domains in the block list.

Likewise, the processing circuit 134 of the threat information updating device 130 can directly block the access rights of all member devices in the client network system 160 to the domains in the blocked list, or instruct the corresponding network management device 162 to block the client The access rights of all member devices in the end network system 160 to the domains in the block list. The processing circuit 144 of the threat information updating device 140 can directly block the access rights of all member devices in the client network system 170 to the domains in the blocking list, or instruct the corresponding network management device 172 to block the client network The access rights of all member devices in the system 170 to the domains in the block list.

In this embodiment, even if the aforementioned threat information updating devices 120 , 130 , and 140 do not transmit the domain access notification related to the suspected domain SD1 or other information security threat reference information to the information security threat analyzing device 116 , As long as the monitoring results of the changes and the frequency of changes corresponding to the network domain of the suspected network domain SD1 by the network domain information monitoring device 112 meet the aforementioned conditions, the information security threat analysis device 116 will list the suspected network domain SD1 into the blocking list, and will The blocking list is propagated to threat information update devices 120, 130, and 140, so that threat information update devices 120, 130, and 140 start blocking all member circuits in client network systems 150, 160, and 170 for suspect domain SD1 access rights.

In other words, even if hackers sometimes deliberately set the domain correspondence of the suspected domain SD1 to point to a predetermined local address, in an attempt to hide the suspected domain SD1 and/or the implanted members However, as long as the corresponding change frequency of the network domain of the suspect network domain SD1 exceeds a predetermined value, the suspect network domain SD1 will still be included in the blocking list by the information security threat analysis device 116 .

In this way, the hacker's attempt to hide the suspected domain SD1 and/or malicious code can be subverted, and the hacker's subsequent network attacks using the suspected domain SD1 can be hindered, so it can effectively increase the How difficult it is for hackers to carry out cyber attacks.

In addition, since the aforementioned information security protection mechanism can increase the difficulty for hackers to repeatedly use the same suspected domain SD1 to conduct network attacks at different times, forcing hackers to register more domains for use, it can greatly increase the The cost of a hacker's cyberattack, thereby reducing the likelihood of a hacker's cyberattack.

From another perspective, the aforementioned proactive suspicious network domain warning system 110 can provide proactive network information security protection for the client network systems 150 , 160 , and 170 , thereby improving the security of the client network system 150 , 160, and 170 network security protection level.

As shown in FIG. 5 , after the information security threat analysis device 116 adds the suspected network domain SD1 to the blocking list, it also instructs the network domain information monitoring device 112 to perform the process 510 to continue to monitor the changes corresponding to the network domain of the suspected network domain SD1 Happening.

The manner in which the network domain information monitoring device 112 monitors the changes corresponding to the network domain of the suspected network domain SD1 in the process 510 is substantially the same as the aforementioned process 402 , and for the sake of brevity, the description is not repeated here.

Similarly, if the network domain information monitoring device 112 finds that the network domain correspondence of the suspected network domain SD1 changes again, the network domain information monitoring device 112 will perform the process 512 to further check the new network domain correspondence of the suspected network domain SD1 at this time. Whether the pointing target points to the aforementioned first predetermined local address, or whether it points to the aforementioned second predetermined local address, or whether it points to any one of the aforementioned two predetermined local addresses.

If the network domain information monitoring device 112 finds that the new network domain corresponding to the suspect network domain SD1 does not point to any predetermined local address, the process 510 will be repeated to continue monitoring the changes of the network domain correspondence of the suspect network domain SD1. In this case, the suspect domain SD1 It will still be kept in the block list by the security threat analysis device 116 . Therefore, the threat information updating devices 120, 130, and 140 will continue to block all member circuits in the client network systems 150, 160, and 170 from accessing the suspect network domain SD1.

On the contrary, if the network domain information monitoring device 112 finds that the new network domain of the suspected network domain SD1 corresponds and points to the aforementioned first predetermined local address or second predetermined local address again, a corresponding notification will be sent to the information security threat. Analysis device 116 . The information security threat analysis device 116 will perform the process 514 after receiving the notification.

In the process 514 , the information security threat analysis device 116 determines that the information security threat previously caused by the suspected network domain SD1 will be temporarily removed. This is because the new domain correspondence of the suspected domain SD1 has been changed to point to the aforementioned first predetermined local address or second predetermined local address again, so even if the member device has been implanted with malicious code, the malicious The code will not access external malicious domains for the time being, so it will not pose a substantial network security threat for the time being.

Therefore, the information security threat analysis device 116 removes the suspect network domain SD1 from the blocking list in the process 514, but still retains the suspect network domain SD1 in the tracking list. In this case, the network domain information monitoring device 112 will repeat the aforementioned process 412 to continuously monitor the corresponding change frequency of the network domain of the suspected network domain SD1.

It can be seen from the above description that after the suspect network domain SD1 is included in the blocking list, if the network domain correspondence of the suspect network domain SD1 is changed to point to the aforementioned first predetermined local address or second predetermined local address again, the information security The threat analysis device 116 determines that the network information security threat of the suspected network domain SD1 will be temporarily removed, and thus removes the suspected network domain SD1 from the blocking list. Such an approach can reduce the number of suspected domains in the blocking list, which can not only reduce the computational burden, storage space requirements, and/or memory requirements required by the domain information monitoring device 112 and the information security threat analysis device 116, but also The computing load, storage space requirement, and/or memory requirement of the threat information updating apparatuses 120 , 130 , and 140 during the blocking operation of the aforementioned process 508 are reduced.

From another perspective, the aforementioned method of removing the suspected domain from the blocking list when the appropriate conditions are established can also effectively improve the information security threat analysis device 116 and the threat information update. Computational efficiency and response speed of the new devices 120 , 130 , and 140 when performing relevant information security analysis and comparison operations.

In addition, as can be seen from the flow charts in FIGS. 4 to 5 , if the network domain information monitoring device 112 finds again that the frequency of changes corresponding to the network domain of the suspected network domain SD1 exceeds the aforementioned predetermined value, the information security threat analysis device 116 will The process 502 in FIG. 5 is performed again, and the suspect network domain SD1 is added to the blocking list again in time. In this case, the threat information updating devices 120 , 130 , and 140 start to block the access rights of all member circuits in the client network systems 150 , 160 , and 170 to the suspect network domain SD1 again.

Therefore, even if the suspected domain SD1 is really a malicious domain used by hackers to conduct network attacks, a test domain used by hackers to test Trojans, or a malicious program that has been implanted in a client device It is difficult to cause further harm to other member devices in the client network system 150, 160, and 170, because the information security threat analysis device 116 will update the threat information update device in time. 120, 130, and 140 information security threat information (blocking list), so the damage caused by the suspected network domain SD1 to the client network systems 150, 160, and 170 will be effectively controlled within a fairly limited range.

By adopting the aforementioned methods of FIGS. 4-5 , the proactive suspicious domain alert system 110 has the opportunity to enable the threat information update devices 120 , 130 , and 140 to start blocking the suspicious domain SD1 before substantial damage is caused. All member circuits in the client network systems 150, 160, and 170 access the suspect network domain SD1. As a result, the cyber attack actions that hackers attempt to use the suspected network domain SD1 may even be completely suppressed by the aforementioned information security protection mechanism adopted by the network information security threat protection system 100 .

From another point of view, using the aforementioned methods in Figures 4 to 5 to evaluate whether a suspected domain that has been registered for a period of time has potential network security threats can prevent hackers from using the old domain to conduct network attacks. Action creates obstacles, which effectively increases the difficulty for hackers to carry out cyber attacks.

Obviously, the aforementioned information security protection mechanism will force hackers to register more domains to Therefore, it can greatly increase the cost of hackers to carry out network attacks, thereby reducing the possibility of hackers carrying out network attacks.

Therefore, the aforementioned proactive suspicious network domain warning system 110 can provide proactive network information security protection for the client network systems 150 , 160 , and 170 , thereby improving the protection against the client network systems 150 , 160 , and 170 The level of network security protection.

Please note that the aforementioned structure of the network information security threat protection system 100 is only an exemplary embodiment, and is not intended to limit the actual implementation of the present invention. For example, the aforementioned functions of the domain name system monitoring device 102 , the suspicious domain information collecting device 104 , and/or the domain owner information detecting device 106 may be integrated into the domain information monitoring device 112 . In this case, the functional blocks of the domain name system monitoring device 102 , the suspicious domain information collecting device 104 , and/or the domain owner information detecting device 106 in FIG. 1 can be omitted.

For another example, the functions of the network management devices 152, 162, and 172 can also be integrated into the corresponding threat information update devices 120, 130, and 140, respectively. In this case, the functional blocks of the network management devices 152, 162, and 172 in FIG. 1 can be omitted.

In addition, in the aforementioned embodiment, the operation flow of FIG. 4 to FIG. 5 is performed after the operation flow of the aforementioned FIG. 2 , but this is only an exemplary embodiment and is not intended to limit the actual implementation of the present invention. For example, the network information security threat protection system 100 may directly regard all the domains that have been registered for more than a period of time (for example, the domain age exceeds the aforementioned first threshold) as suspect domains, and use the aforementioned FIG. 4 to FIG. 5 to evaluate the information security threats of these suspected network domains, without first performing the aforementioned operation process of FIG. 2 or FIG. 3 on the suspect network domains.

In some applications, the aforementioned process 204 in FIG. 2 can also be omitted to reduce the computational burden of the threat information updating apparatuses 120 , 130 , and 140 . As such, the threat information update devices 120, 130, and 140 can be implemented with a more streamlined hardware architecture, software modules, or cloud modules.

Certain terms are used in the specification and in the claims to refer to specific elements, and Those skilled in the art may refer to the same element by different nouns. This specification and the scope of the patent application do not use the difference in name as a way to distinguish elements, but use the difference in function of the elements as a criterion for distinguishing. The "comprising" mentioned in the description and the scope of the patent application is an open-ended term, and should be interpreted as "including but not limited to". In addition, the term "coupled" herein includes any direct and indirect means of connection. Therefore, if it is described in the text that the first element is coupled to the second element, it means that the first element can be directly connected to the second element through electrical connection or signal connection such as wireless transmission or optical transmission, or through other elements or connections. The means is indirectly electrically or signally connected to the second element.

The descriptions of "and/or" used in the specification include any combination of one or more of the listed items. In addition, unless otherwise specified in the specification, any term in the singular also includes the meaning in the plural.

The above are only preferred embodiments of the present invention, and all equivalent changes and modifications made according to the claims of the present invention shall fall within the scope of the present invention.

100: Network Information Security Threat Protection System

102: Domain Name System Monitoring Device

104:Suspicious domain information collection device

106: Domain owner information detection device

110: Proactive suspicious domain warning system

112: Network domain information monitoring device

114: Domain Information Storage Device

116: Information Security Threat Analysis Device

120, 130, 140: Threat information update device

122, 132, 142: Communication circuits

124, 134, 144: Processing circuits

126, 136, 146: Storage circuit

150, 160, 170: Client network system

152, 162, 172: Network management device

Claims (6)

A network information security threat protection system (100), comprising: a plurality of threat information update devices (120, 130, 140), configured to monitor the connection of a plurality of client network systems (150, 160, 170) respectively network behavior; and a proactive suspicious network domain warning system (110), comprising: a network domain information monitoring device (112) configured to monitor a network domain corresponding to a suspected network domain whose network domain age is greater than 72 hours Changes; a network domain information storage device (114), coupled to the network domain information monitoring device (112), configured to store monitoring records generated by the network domain information monitoring device (112); and an information security threat analysis A device (116), coupled to the network domain information monitoring device (112) and the network domain information storage device (114), and configured to update the devices (120, 130, 140) with the plurality of threat information through a network Carry out data communication; wherein, if the network domain information monitoring device (112) finds that the network domain correspondence of the suspected network domain has changed, and a new network domain of the suspected network domain corresponds to a predetermined local address or a plurality of predetermined addresses one of the local addresses of the host, the network domain information monitoring device (112) will also monitor the frequency of changes corresponding to a network domain of the suspect network domain; wherein, if the network domain information monitoring device (112) determines that the suspect network If the corresponding change frequency of the domain of the domain exceeds a predetermined value, the information security threat analysis device (116) will add the suspected domain to a blocking list, so that the plurality of threat information update devices (120, 130, 140) ) blocks member devices in the plurality of client network systems (150, 160, 170) from accessing the domains in the blocked list. The network information security threat protection system (100) according to claim 1, wherein the network domain information monitoring device (112) is further configured to continue monitoring the suspected network domain after the suspect network domain is included in the blocking list changes to the domain's domain mapping, if the domain information The monitoring device (112) finds that the network domain correspondence of the suspect network domain has changed, and a new network domain of the suspect network domain corresponds to a predetermined local address or one of a plurality of predetermined local addresses, then the The information security threat analysis device (116) removes the suspect domain from the blocking list to reduce the network domain information monitoring device (112), the information security threat analysis device (116), and the plurality of threat information updates The computational burden and storage space requirements of the devices (120, 130, 140). The network information security threat protection system (100) according to claim 2, wherein, before the suspect network domain is included in the blocking list, if the network domain information monitoring device (112) finds the network of the suspect network domain The domain correspondence has changed, a new domain correspondence of the suspected domain does not point to a predetermined local address nor one of a plurality of predetermined local addresses, and the suspected domain is not threatened by the information security When the analyzing device (116) is included in a tracking list, the network domain information monitoring device (112) will discard the suspect network domain. A proactive suspicious network domain warning system (110) for providing a blocking list to a plurality of threat information update devices (120, 130, 140), the plurality of threat information update devices (120, 130, 140) using For monitoring the networking behavior of a plurality of client network systems (150, 160, 170), the proactive suspicious network domain warning system (110) includes: a network domain information monitoring device (112) configured to monitor the network Changes in the domain corresponding to a suspected domain whose domain age is greater than 72 hours; a domain information storage device (114), coupled to the domain information monitoring device (112), configured to store the domain information monitoring device (112) monitoring records generated; and an information security threat analysis device (116), coupled to the network domain information monitoring device (112) and the network domain information storage device (114), and configured to be accessible through the network Perform data communication with the plurality of threat information update devices (120, 130, 140); wherein, if the network domain information monitoring device (112) finds a network domain pair of the suspected network domain should be changed, and a new domain of the suspect domain corresponds to a predetermined local address or one of a plurality of predetermined local addresses, the domain information monitoring device (112) will also monitor the suspect The frequency of change corresponding to a network domain of the network domain; wherein, if the network domain information monitoring device (112) determines that the frequency of change corresponding to the network domain of the suspected network domain exceeds a predetermined value, the information security threat analysis device (116) will The suspect network domain is included in the blocking list, so that the plurality of threat information update devices (120, 130, 140) block member devices in the plurality of client network systems (150, 160, 170) from accessing the Block list domains. The proactive suspicious network domain warning system (110) according to claim 4, wherein the network domain information monitoring device (112) is further configured to continue monitoring the suspect network after the suspect network domain is included in the blocking list Changes in the network domain correspondence of the network domain, if the network domain information monitoring device (112) finds that the network domain correspondence of the suspect network domain has changed, and a new network domain correspondence of the suspect network domain points to a predetermined local address or one of a plurality of predetermined local addresses, the information security threat analysis device (116) will remove the suspected network domain from the blocking list, so as to reduce the network domain information monitoring device (112), the information The computing load and storage space requirements of the security threat analysis device (116) and the plurality of threat information update devices (120, 130, 140). The proactive suspicious network domain warning system (110) according to claim 5, wherein, before the suspected network domain is included in the blocking list, if the network domain information monitoring device (112) finds the suspected network domain The domain correspondence has changed, a new domain correspondence of the suspect network domain does not point to a predetermined local address nor one of a plurality of predetermined local addresses, and the suspect network domain is not registered by the information security When the threat analysis device (116) is included in a tracking list, the network domain information monitoring device (112) will discard the suspect network domain.

Images