WO2018113730A1 - 网络安全的检测方法和装置 - Google Patents

网络安全的检测方法和装置 Download PDF

Info

Publication number
WO2018113730A1
WO2018113730A1 PCT/CN2017/117694 CN2017117694W WO2018113730A1 WO 2018113730 A1 WO2018113730 A1 WO 2018113730A1 CN 2017117694 W CN2017117694 W CN 2017117694W WO 2018113730 A1 WO2018113730 A1 WO 2018113730A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
address
domain name
secure
addresses
Prior art date
Application number
PCT/CN2017/117694
Other languages
English (en)
French (fr)
Inventor
高永岗
张建新
刘天
Original Assignee
北京奇虎科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京奇虎科技有限公司 filed Critical 北京奇虎科技有限公司
Publication of WO2018113730A1 publication Critical patent/WO2018113730A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]

Definitions

  • the present disclosure relates to the field of computer technologies, and in particular, to a network security detection method and apparatus.
  • some related technologies are detected by first storing a blacklist library on the local end of the electronic device, and then by comparing the feature vector or URI (Uniform Resource Identifier) of the web page, if the feature vector or If the URI is not in the blacklist, it is judged that there is no danger of phishing.
  • URI Uniform Resource Identifier
  • the above-described related art detection method has a technical problem that the detection accuracy is not high.
  • Embodiments of the present disclosure provide a network security detection method and apparatus for improving network security detection accuracy.
  • the present disclosure provides a method for detecting network security, including:
  • the UE When the first target domain name does not match the multiple second target domain names, it is determined that the UE has a network security risk.
  • the present disclosure provides a network security detecting apparatus, including:
  • a first obtaining module configured to obtain a target internet protocol IP address that is parsed by the user equipment UE to the first target domain name
  • a reverse parsing module configured to reversely resolve the target IP address, and obtain multiple second target domain names corresponding to the target IP address
  • a first determining module configured to determine whether the first target domain name is consistent with one of the second target domain names
  • the first determining module is configured to determine that the UE has a network security risk when the first target domain name does not match the multiple second target domain names.
  • the present disclosure provides a computer program comprising:
  • Computer readable code when the computer readable code is run on a computing device, causes the computing device to perform the network security detection method described above.
  • the present disclosure provides a computer readable medium, comprising:
  • the above computer program for executing the above-described network security detection method is stored.
  • the target IP address that the UE resolves to the first target domain name is obtained, and then the target IP address is reversely parsed, and multiple second target domain names corresponding to the target IP address are obtained, when the first target is obtained.
  • the domain name does not match the multiple second target domain names, it is determined that the UE has a network security risk. Because in the phishing attack, the criminals resolve the first target domain name to an incorrect IP address, but the incorrect IP address may still not be in the blacklist library. Therefore, after obtaining the target IP address, the present application directly reverses the target IP address, and obtains a plurality of second target domain names that legally use the target IP address from a more authoritative DNS server.
  • the target IP is not in the blacklist database, if the first target domain name is inconsistent with all the second target secure domain names, it indicates that the target IP address may point to the dangerous domain name, thereby determining that the UE has network risk. Therefore, through the above technical solution, the technical problem that the network security detection in the prior art is not accurate is solved, and the accuracy of the network security detection is improved.
  • FIG. 1 is a flowchart of a method for detecting network security in an embodiment of the present disclosure
  • FIG. 2 is a schematic structural diagram of a network security detecting apparatus according to an embodiment of the present disclosure
  • FIG. 3 schematically illustrates a block diagram of a computing device for performing a method of detecting network security in accordance with an embodiment of the present disclosure
  • FIG. 4 schematically illustrates a storage unit for maintaining or carrying program code that implements a method of detecting network security in accordance with an embodiment of the present disclosure.
  • Embodiments of the present disclosure provide a network security detection method and apparatus for improving network security detection accuracy.
  • the target IP address that the UE resolves to the first target domain name is obtained, and then the target IP address is reversely parsed, and multiple second target domain names corresponding to the target IP address are obtained, when the first target is obtained.
  • the domain name does not match the multiple second target domain names, it is determined that the UE has a network security risk. Because in the phishing attack, the criminals resolve the first target domain name to an incorrect IP address, but the incorrect IP address may still not be in the blacklist library. Therefore, after obtaining the target IP address, the present application directly reverses the target IP address, and obtains a plurality of second target domain names that legally use the target IP address from a more authoritative DNS server.
  • the target IP is not in the blacklist database, if the first target domain name is inconsistent with all the second target secure domain names, it indicates that the target IP address may point to the dangerous domain name, thereby determining that the UE has network risk. Therefore, through the above technical solution, the technical problem that the network security detection in the prior art is not accurate is solved, and the accuracy of providing network security detection is realized.
  • the first aspect of the disclosure provides a method for detecting network security.
  • FIG. 1 it is a flowchart of a method for detecting network security in an embodiment of the present disclosure. The method includes:
  • S101 Obtain a target internet protocol IP address that is parsed by the user equipment UE to the first target domain name.
  • S102 Reversely resolve the target IP address, and obtain multiple second target domain names corresponding to the target IP address;
  • the method for detecting the network security in the embodiment of the present disclosure may be applied to a UE (User Equipment), such as a smart phone, a laptop computer, or a tablet computer, and may also be applied to a server.
  • UE User Equipment
  • the disclosure is not specifically limited.
  • the method of the present disclosure may be used to detect whether the network is secure after the UE accesses the network, or may be detected irregularly according to the trigger of the user, and the disclosure does not specifically limit the disclosure.
  • the target IP Internet Protocol, Internet Protocol
  • the first target domain name is a domain name that the UE can access through the currently accessed network.
  • the target IP address is an IP address obtained by the UE to perform DNS (Domain Name System) resolution on the first target domain name.
  • DNS Domain Name System
  • the DNS resolution of the first target domain name can also obtain other parameters such as the network protocol used by the first target domain name.
  • the UE can perform DNS resolution on all the domain names that can be accessed, and then detect all domain names.
  • the UE may perform DNS resolution on any domain name that can be accessed, and then detect some of the domain names, and the disclosure does not specifically limit the disclosure.
  • the UE obtains the first target domain name, and after the DNS resolves the corresponding IP address based on the first target domain name, the target IP address is obtained. If the execution subject is a server, the UE parses the target IP address and sends the target IP address to the server, so that the server obtains the target IP address.
  • DNS reverse analysis is performed on the target IP address.
  • the UE or server that obtains the target IP address sends the target IP address to the DNS server, and requests the DNS server to return multiple domain names that can legally use the target address IP. Then, receive the DNS server One or more domain names returned.
  • the domain name obtained by resolving the target IP address in reverse is referred to as a second target domain name.
  • the second target domain name is a relatively authoritative DNS server that is reversely resolved based on the target IP address
  • the second target domain name is a secure domain name that can legally use the target IP address. Therefore, if the first target domain name is inconsistent with all the second target domain names, it means that the first target domain name is not a domain name that legally uses the target IP address. Therefore, in S104, when the first target domain name does not match the multiple second target domain names, it is determined that the first target domain name is hijacked, and the UE has a network security risk.
  • first target domain name is consistent with one of the second target domain names, it indicates that the first target domain name is a domain name that legally uses the target IP address.
  • network security may be determined when the first target domain name is a legal domain name. If multiple first target domain names are detected, network security can be determined when all first target domain names are legitimate domain names. If one or more of the first target domain names are not legal, it will determine that there is a security risk in the current network.
  • the execution subject is the UE
  • the UE may be monitored to send a reverse resolution request to the DNS server, thereby providing the fake second target domain name to the UE. Therefore, it is preferred to perform the method in the embodiment of the present disclosure in a server.
  • the method may further include:
  • S1001 Determine whether the target IP address is consistent with one of the plurality of secure IP addresses recorded by the reference library;
  • the reference library in the embodiment of the present disclosure records a plurality of secure domain names and a secure IP address used by each secure domain name.
  • the base stock is stored in the storage space of the executing entity and is updated periodically or irregularly.
  • the target IP address After obtaining the target IP address, it is first determined whether the target IP address is consistent with one of the plurality of secure IP addresses recorded in the reference library. Since all the secure IP addresses of each domain name may not be recorded in the reference library, if the target IP address is inconsistent with all the secure IP addresses in the reference library, the S102 reversely resolves the target IP address, and then passes. Judging the first item Whether the domain name is secure to determine whether there is a network security risk.
  • the target IP address is consistent with one of the secure IP addresses, it indicates that the UE can currently link to the first target domain name with the secure IP address, so when the target IP address is consistent with one of the secure IP addresses, it can be determined that the first target domain name is not hijack.
  • first target domain name when the target IP address is a secure IP address, or the target IP address is not a secure IP address, but the second reverse target domain name is further reversed.
  • network security can be determined. If multiple first target domain names are detected, all target IP addresses are secure IP addresses, or part of the first target domain name is a secure IP address, and the remaining first target domain names are legal domain names, or all first target domain names. Network security can only be determined when it is a legal domain name. If the target IP address of one or more first target domains is not a secure IP address, and all the second target domain names that are reversely resolved are inconsistent with the first target domain name, it is determined that the current network has a security risk.
  • the server is executed in the embodiment.
  • the method is a better choice.
  • Table 1 shows that the secure IP addresses of the domain name baidu.com are 111.13.101.208, 180.149.132.47, 123.125.114.144 and 220.181.57.217. Among them, 111.13.101.208 is maintained by the mobile node of Beijing Baidu Netcom Technology Co., Ltd. By analogy, the meaning of the rest of the information in the table is not detailed here.
  • the UE accesses a new wireless local area network, and then actively resolves the two domain names baidu.com and so.com, and obtains the IP address 111.13.101.208 corresponding to baidu.com and the IP address 106.120.160.134 of so.com. Comparing the two IP addresses in the reference library, since 106.120.160.134 and the three secure IP addresses of so.com are not the same, 111.13.101.208 is consistent with the first secure IP address 111.13.101.208 of baidu.com, so 106.120.160.134 further performs reverse parsing.
  • the reverse analysis results of 106.120.160.134 are haoso.com, haosou.com, so.com, sou.com, haosou.cn, sou.cn, c-b.360webcache.com, mier.net.cn and 2222888.com.
  • the second target domain name so.com in the reverse analysis result is consistent with the first target domain name so.com, so it is judged that the so.com is not hijacked, and the UE network is secure.
  • the UE obtains the target IP address resolved by the first target domain name, and then determines whether the target IP address is consistent with one of the plurality of secure IP addresses recorded in the reference library, when the target IP address is used.
  • the destination IP address is further reversely analyzed, and multiple second target domain names corresponding to the target IP address are obtained.
  • the first target domain name does not match the multiple second target domain names, Determine that the UE has a network security risk. Therefore, when there is no matching secure IP address in the reference library, a plurality of second target domain names that legally use the target IP address are obtained from the authoritative DNS server by further performing reverse analysis on the target IP address. If there is still no second target domain name consistent with the first target domain name, it is determined that there is a network security risk. Therefore, the present disclosure determines whether the network is safe by two tests, and improves the detection accuracy.
  • the reference library may not record multiple secure domain names and corresponding secure IP addresses, but record multiple dangerous secure domain names and dangerous IP addresses.
  • the target IP address is inconsistent with the plurality of dangerous IP addresses in the reference library, it is determined that the first target domain name is not hijacked. If the target IP address is consistent with one of the dangerous IP addresses, the target IP address is further reversed. If there is a domain name consistent with the first target domain name in the second target domain name, if it exists, it indicates that the first target domain name is not hijacked, and if all the second target domain names are inconsistent with the first target domain name, determining that the first target domain name is Hijacking, the UE has network risks.
  • determining whether the target IP address is consistent with one of the plurality of secure IP addresses recorded by the reference library in S1001 may be specifically implemented by the following process:
  • the target integer indicates that there is a secure IP address in the reference library that matches the target IP address. If the target integer is not found, the target IP address does not match the multiple secure IP addresses.
  • the target IP address is converted into a corresponding target integer.
  • multiple secure IP addresses stored in the reference library also correspond to a secure integer stored with each secure IP address.
  • the method of converting an IP address into an integer is to add the fourth byte of the IP address to the first
  • the number of bytes is multiplied by the product of the cube of 256
  • the second byte is multiplied by the product of the square of 256
  • the sum of the third byte is multiplied by 256.
  • the secure integer corresponding to the secure IP address 106.120.160.134 is recorded, the decimal integer 1786290310, the hexadecimal integer 6A78A086, the octal integer 15236120206, or the binary integer 1101010011110001010000010000110 may be specifically stored, and the disclosure is not specifically limited.
  • searching for the secure IP address matching the target IP address in the reference library is simplified to search for the target integer in the reference library.
  • the target integer If the target integer is found, it indicates that there is a secure IP address in the reference library that matches the target IP address. Otherwise, if the target integer is not found, the target IP address is inconsistent with all secure IP addresses.
  • the amount of operations is smaller than a string of numbers comparing the target IP addresses, thereby improving search efficiency and improving the efficiency of network security detection.
  • the server further includes: before obtaining the target IP address corresponding to the first target domain name sent by the UE, the server further includes:
  • the server sends multiple security domain names to the UE, so that the UE resolves multiple security domain names, and obtains the target IP address corresponding to each security domain name.
  • the base library is stored in the server storage space.
  • Multiple secure domain names are recorded in the base library, as well as the secure IP address used by each secure domain name.
  • DNS hijacking in the phishing danger usually hijacks high-value websites, such as bank login websites, payment websites, third-party login websites and mailboxes. Therefore, the first target domain name in the embodiment of the present disclosure may be specifically the domain name of these high value websites. In other words, it can be determined whether the UE's network is secure by detecting whether the domain name of the high-value website is hijacked.
  • the server can automatically select the secure domain name of the high-value website from the reference library, or the server can also receive the selection operation of the manager, and then determine the secure domain name of the high-value website based on the selection operation of the manager.
  • the server determines the secure domain name of the plurality of high-value websites that need to be detected and sends it to the UE. Further, when the UE needs to detect the network security, the plurality of secure domain names sent by the server are respectively parsed through the currently accessed network, and then the plurality of parsed objects are further analyzed.
  • the standard IP address is sent to the server, so that the server determines whether the network currently accessed by the UE has a security risk.
  • the server sends a plurality of secure domain names that need to perform DNS resolution to the UE, which reduces the number of IP addresses that the UE needs to resolve, and the detection amount of the server.
  • the domain name is a high-value website domain name, and the server can concentrate resources on detecting these high-value websites, which is more conducive to discovering network security risks.
  • the UE may also determine the first target domain name by itself. Specifically, whether the execution subject is a server or a UE, before S101, it may include:
  • the UE obtains a domain name to be detected
  • the to-be-detected domain name meets the preset condition, the to-be-detected domain name is determined as the first target domain name.
  • the UE when accessing the network, the UE first obtains any domain name to be detected. Then, it is determined whether the domain name to be detected satisfies a preset condition.
  • the preset condition indicates that security detection is required.
  • there are multiple ways to determine whether the domain name to be detected satisfies the preset condition and several of them will be introduced below. In the specific implementation process, including but not limited to the following.
  • the UE obtains the website corresponding to the domain to be detected according to the domain name to be detected. Then, feature extraction is performed on the website page to determine whether there are features indicating financial circulation in the page features, such as payment options, bank website links, and entry identifiers for inputting payment accounts.
  • features indicating financial circulation in the page features such as payment options, bank website links, and entry identifiers for inputting payment accounts.
  • the page feature has a feature indicating financial circulation, it indicates that the website involves financial circulation, and the domain name to be detected satisfies the preset condition.
  • the company to which the domain name to be detected is obtained is obtained according to the domain name to be detected. Then, determine if the company is a company involved in finance.
  • the UE is pre-stored with a plurality of companies involved in finance. Therefore, if the company to which the domain name to be detected belongs is consistent with one of the plurality of companies involved in the pre-stored financial, the company to which the domain name to be detected belongs is a company involved in finance.
  • the company to which the domain name to be detected belongs is not consistent with any of the pre-stored companies involved in finance, it means The company that detects the domain name is not a company that involves finance. Since the website maintained by the company involved in finance usually requires the user to input financial related information, it is determined that the domain to be detected satisfies the preset condition.
  • a person skilled in the art to which the present disclosure belongs can determine whether the domain name to be detected satisfies a preset condition according to an actual selection, and the present disclosure does not specifically limit the disclosure.
  • the UE determines the to-be-detected domain name as the first target domain name, and further parses the first target domain name to obtain the target IP address.
  • the UE determines that the to-be-detected domain name that meets the preset condition is the first target domain name, and then detects the first target domain name. On the one hand, it reduces the number of IP addresses that the UE needs to resolve. On the other hand, focusing resources on detecting high-value websites that meet the preset conditions is more conducive to discovering network security risks.
  • the second aspect of the present disclosure further provides a network security detection apparatus, as shown in FIG. 2, including:
  • the first obtaining module 101 is configured to obtain a target internet protocol IP address that is parsed by the user equipment UE to the first target domain name;
  • the reverse parsing module 102 is configured to reversely resolve the target IP address, and obtain a plurality of second target domain names corresponding to the target IP address;
  • the first determining module 103 is configured to determine whether the first target domain name is consistent with one of the second target domain names
  • the first determining module 104 is configured to determine that the UE has a network security risk when the first target domain name does not match the multiple second target domain names.
  • the device in the embodiment of the disclosure further includes:
  • a second determining module configured to determine, after obtaining the target Internet Protocol IP address that is parsed by the user equipment UE to the first target domain name, whether the target IP address is consistent with one of the plurality of secure IP addresses recorded by the reference library ;
  • the reverse resolution module is notified to reversely resolve the target IP address.
  • the device in the embodiment of the present disclosure further includes:
  • a second determining module configured to determine the first target after determining whether the target IP address is consistent with one of the plurality of secure IP addresses recorded by the reference library, and when the target IP address is consistent with one of the secure IP addresses The domain name has not been hijacked.
  • the second determining module is configured to convert the target IP address into a corresponding target integer; and search for the target integer in the secure integer corresponding to the plurality of secure IP addresses recorded by the reference library based on the target integer;
  • the target integer indicates that there is a secure IP address in the reference library that matches the target IP address. If the target integer is not found, the target IP address does not match the multiple secure IP addresses.
  • the reference library also records a plurality of secure domain names corresponding to the plurality of secure IP addresses.
  • the device further includes:
  • the sending module is configured to send multiple secure domain names to the UE, so that the UE resolves multiple secure domain names, and obtains a target IP address corresponding to each secure domain name.
  • the device in the embodiment of the present disclosure further includes:
  • a second obtaining module configured to obtain a to-be-detected domain name before obtaining the target Internet Protocol IP address resolved by the user equipment UE to the first target domain name;
  • a third determining module configured to determine whether the domain name to be detected meets a preset condition indicating that security detection is required
  • the third determining module is configured to determine the domain name to be detected as the first target domain name when the domain name to be detected satisfies the preset condition.
  • FIG. 3 illustrates a computing device that can implement a method of detecting network security in accordance with the present disclosure.
  • the computing device traditionally includes a processor 310 and a computer program product or computer readable medium in the form of a storage device 320.
  • the storage device 320 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM.
  • Storage device 320 has a storage space 330 that stores program code 331 for performing any of the method steps described above.
  • storage space 330 storing program code may include various program code 331 for implementing various steps in the above methods, respectively.
  • the program code can be read from or written to one or more computer program products.
  • These computer program products include program code carriers such as a hard disk, a compact disk (CD), a memory card, or a floppy disk.
  • Such a computer program product Often a portable or fixed storage unit such as that shown in FIG.
  • the storage unit may have storage segments, storage spaces, and the like that are similarly arranged to storage device 320 in the computing device of FIG.
  • the program code can be compressed, for example, in an appropriate form.
  • the storage unit includes computer readable code 331' for performing the method steps in accordance with the present disclosure, ie, code that can be read by a processor, such as 310, which when executed by the computing device causes the computing device Perform the various steps in the method described above.
  • the target IP address that the UE resolves to the first target domain name is obtained, and then the target IP address is reversely parsed, and multiple second target domain names corresponding to the target IP address are obtained, when the first target is obtained.
  • the domain name does not match the multiple second target domain names, it is determined that the UE has a network security risk. Because in the phishing attack, the criminals resolve the first target domain name to an incorrect IP address, but the incorrect IP address may still not be in the blacklist library. Therefore, after obtaining the target IP address, the present application directly reverses the target IP address, and obtains a plurality of second target domain names that legally use the target IP address from a more authoritative DNS server.
  • the target IP is not in the blacklist database, if the first target domain name is inconsistent with all the second target secure domain names, it indicates that the target IP address may point to the dangerous domain name, thereby determining that the UE has network risk. Therefore, through the above technical solution, the technical problem that the network security detection in the prior art is not accurate is solved, and the accuracy of the network security detection is improved.
  • modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment.
  • the modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components.
  • any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined.
  • Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.
  • Various component embodiments of the present disclosure may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof.
  • a microprocessor or digital signal processor may be used in practice to implement some or all of the functionality of a gateway, proxy server, some or all of the components in accordance with embodiments of the present disclosure.
  • the present disclosure may also be implemented as a device or device program (eg, a computer program and a computer program product) for performing some or all of the methods described herein.
  • Such a program implementing the present disclosure may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本公开实施例提供了一种网络安全的检测方法和装置，该方法包括：获得用户设备UE对第一目标域名解析出的目标互联网协议IP地址；反向解析目标IP地址，获得目标IP地址对应的多个第二目标域名；判断第一目标域名是否与其中一个第二目标域名一致；当第一目标域名与多个第二目标域名均不匹配时，确定UE存在网络安全风险。

Description

网络安全的检测方法和装置
相关申请的交叉参考
本申请要求于2016年12月21日提交中国专利局、申请号为201611193269.1、名称为“一种网络安全的检测方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本公开涉及计算机技术领域，尤其涉及一种网络安全的检测方法和装置。
背景技术
随着网络的推广和深度应用，人们日常生活中的各类信息与网络更为紧密地结合在一起。正因如此，对于网络安全的检测就得更加重要。
以钓鱼检测为例，一些相关技术通过如下方法检测：首先在电子设备本地端存储黑名单库，然后通过比对网页的特征向量或者URI(统一资源标识符，Uniform Resource Identifier)，如果特征向量或者URI不在黑名单库中，则判断不存在钓鱼危险。
然而，上述相关技术的检测方法存在检测准确率不高的技术问题。
发明内容
本公开实施例提供了一种网络安全的检测方法和装置，用于提高网络安全检测准确率。
第一方面，本公开提供了一种网络安全的检测方法，包括：
获得用户设备UE对第一目标域名解析出的目标互联网协议IP地址；
反向解析目标IP地址，获得目标IP地址对应的多个第二目标域名；
判断第一目标域名是否与其中一个第二目标域名一致；
当第一目标域名与多个第二目标域名均不匹配时，确定UE存在网络安全风险。
第二方面，本公开提供了一种网络安全的检测装置，包括：
第一获得模块，用于获得用户设备UE对第一目标域名解析出的目标互联网协议IP地址；
反向解析模块，用于反向解析目标IP地址，获得目标IP地址对应的多个第二目标域名；
第一判断模块，用于判断第一目标域名是否与其中一个第二目标域名一致；
第一确定模块，用于当第一目标域名与多个第二目标域名均不匹配时，确定UE存在网络安全风险。
第三方面，本公开提供了一种计算机程序，包括：
计算机可读代码，当计算机可读代码在计算设备上运行时，导致计算设备执行上述网络安全的检测方法。
第四方面，本公开提供了一种计算机可读介质，包括：
存储了上述执行上述网络安全的检测方法的计算机程序。
本公开实施例中的上述一个或多个技术方案，至少具有如下一种或多种技术效果：
在本公开实施例的技术方案中，首先获得UE对第一目标域名解析出的目标IP地址，然后反向解析目标IP地址，获得目标IP地址对应的多个第二目标域名，当第一目标域名与多个第二目标域名均不匹配时，确定UE存在网络安全风险。由于在钓鱼攻击中，不法分子将第一目标域名的解析到不正确的IP地址上，但是该不正确的IP地址可能仍然不在黑名单库中。因此，本申请在获得目标IP地址后直接对目标IP地址进行反向解析，从较为权威的DNS服务器获得合法使用目标IP地址的多个第二目标域名。那么，即使目标IP不在黑名单库中，如果第一目标域名与所有第二目标安全域名均不一致，则表明目标IP地址可能指向危险域名，进而确定UE存在网络风险。所以，通过上述技术方案，解决了现有技术存在的网络安全检测准确不高的技术问题，实现了提高网络安全检测准确率。
附图概述
图1为本公开实施例中网络安全的检测方法的流程图；
图2为本公开实施例中网络安全的检测装置的结构示意图；
图3示意性地示出了用于执行根据本公开实施例的网络安全的检测方法的计算设备的框图；以及
图4示意性地示出了用于保持或者携带实现根据本公开实施例的网络安全的检测方法的程序代码的存储单元。
本发明的较佳实施方式
本公开实施例提供了一种网络安全的检测方法和装置，用于提高网络安全检测准确率。
为了解决上述技术问题，本公开提供的技术方案思路如下：
在本公开实施例的技术方案中，首先获得UE对第一目标域名解析出的目标IP地址，然后反向解析目标IP地址，获得目标IP地址对应的多个第二目标域名，当第一目标域名与多个第二目标域名均不匹配时，确定UE存在网络安全风险。由于在钓鱼攻击中，不法分子将第一目标域名的解析到不正确的IP地址上，但是该不正确的IP地址可能仍然不在黑名单库中。因此，本申请在获得目标IP地址后直接对目标IP地址进行反向解析，从较为权威的DNS服务器获得合法使用目标IP地址的多个第二目标域名。那么，即使目标IP不在黑名单库中，如果第一目标域名与所有第二目标安全域名均不一致，则表明目标IP地址可能指向危险域名，进而确定UE存在网络风险。所以，通过上述技术方案，解决了现有技术存在的网络安全检测准确不高的技术问题，实现了提供网络安全检测准确率。
下面通过附图以及具体实施例对本公开技术方案做详细的说明，应当理解本申请实施例以及实施例中的具体特征是对本申请技术方案的详细的说明，而不是对本申请技术方案的限定，在不冲突的情况下，本申请实施例以及实施例中的技术特征可以相互组合。
本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
本公开第一方面提供了一种网络安全的检测方法，请参考图1，为本公开实施例中网络安全的检测方法的流程图。该方法包括：
S101：获得用户设备UE对第一目标域名解析出的目标互联网协议IP地址；
S102：反向解析目标IP地址，获得目标IP地址对应的多个第二目标域名；
S103：判断第一目标域名是否与其中一个第二目标域名一致；
S104：当第一目标域名与多个第二目标域名均不匹配时，确定UE存在网络安全风险。
本公开实施例中网络安全的检测方法可以应用于UE(用户设备，User Equipment)，例如智能手机、笔记本电脑或平板电脑等，也可以应用于服务器，本公开不做具体限制。
并且，为了能够保障UE网络安全，可以在每次UE接入网络之后均使用本公开的方法检测网络是否安全，也可以根据用户的触发来不定期检测，本公开不做具体限制。
下面对本公开实施例中网络安全的检测方法进行说明。
首先，S101中获得UE对第一目标域名解析出的目标IP(互联网协议，InternetProtocol)地址。
具体来讲，第一目标域名为UE通过当前接入的网络能够访问到的一个域名。目标IP地址则是UE对第一目标域名进行DNS(域名系统，Domain Name System)解析而获得的IP地址。当然，对第一目标域名进行DNS解析，还可以获得第一目标域名所使用的网络协议等其他参数。
UE可以对能够访问到所有域名均进行DNS解析，进而对所有域名进行检测。或者，UE也可以对能够访问到的任意域名进行DNS解析，进而对其中一部分域名进行检测，本公开不做具体限制。
如果本公开实施例中网络安全检测方法的执行主体为UE，则UE获取第一目标域名，且基于第一目标域名进行DNS解析出对应的IP地址之后，就获得了目标IP地址。而如果执行主体为服务器，则UE解析出目标IP地址后将目标IP地址发送给服务器，进而使服务器获得目标IP地址。
接下来，S102中，对目标IP地址进行DNS反向解析。具体来讲，获得目标IP地址的UE或服务器将目标IP地址发送到DNS服务器，并请求DNS服务器返回能够合法使用目标地址IP的多个域名。然后，接收DNS服务器 返回的一个或多个域名。本公开实施例中，将反向解析目标IP地址而获得的域名称为第二目标域名。
然后，S103中，判断第一目标域名是否与多个第二目标域名中的其中一个一致。由于第二目标域名是较为权威的DNS服务器基于目标IP地址反向解析出的，所以第二目标域名是能够合法使用目标IP地址的安全域名。所以，如果第一目标域名与所有第二目标域名均不一致，则表示第一目标域名不是合法使用目标IP地址的域名。因此S104中，第一目标域名与多个第二目标域名均不匹配时，确定第一目标域名被劫持，UE存在网络安全风险。
而如果第一目标域名与其中一个第二目标域名一致，则表示第一目标域名是合法使用目标IP地址的域名。在具体实现过程中，如果仅检测一个第一目标域名的合法性，则在该第一目标域名为合法域名时可以确定网络安全。而如果检测多个第一目标域名，在所有第一目标域名均为合法域名时才能确定网络安全。如果其中有一个或多个第一目标域名不合法，将确定当前网络存在安全风险。
另外，在具体实现过程中，如果执行主体为UE，由于不法分子劫持网络后，可能会监视到UE向DNS服务器发送反向解析请求，进而向UE提供虚假第二目标域名。所以，在服务器中执行本公开实施例中的方法为较佳选择。
作为一种可选的实施例，如图2所示，在S101之后，还可以包括：
S1001：判断目标IP地址是否与基准库记录的多个安全IP地址中的其中一个安全IP地址一致；
S1002：当目标IP地址与多个安全IP地址均不一致时，确定执行反向解析目标IP地址的步骤。
具体来讲，本公开实施例中的基准库记录有多个安全域名，以及每个安全域名所使用的安全IP地址。基准库存储在执行主体的存储空间中，并且定期或不定期更新。
在获得目标IP地址后，首先判断目标IP地址是否与基准库中记录的多个安全IP地址中的一个一致。由于基准库中可能并没有将每个域名的所有安全IP地址全部记录到，所以如果目标IP地址与基准库中的所有安全IP地址均不一致，则进一步执行S102反向解析目标IP地址，进而通过判断第一目 标域名是否安全来判断是否存在网络安全风险。
另外，S1001之后，还包括：
S1003：当目标IP地址与其中一个安全IP地址一致时，确定第一目标域名未被劫持。
如果目标IP地址与其中一个安全IP地址一致，则表示UE当前能够以安全IP地址链接到第一目标域名，所以在目标IP地址与其中一个安全IP地址一致时，可以确定第一目标域名未被劫持。
类似的，如果仅检测一个第一目标域名的合法性，则在目标IP地址为安全IP地址时，或者目标IP地址不为安全IP地址，但是进一步反向解析出的多个第二目标安全域名中存在与第一目标安全域名一致的域名时，则可以确定网络安全。而如果检测多个第一目标域名，在所有目标IP地址为安全IP地址，或者一部分第一目标域名的目标IP地址为安全IP地址，其余第一目标域名为合法域名，或者全部第一目标域名均为合法域名时才能确定网络安全。如果其中有一个或多个第一目标域的目标IP地址不是安全IP地址，并且反向解析出的所有第二目标域名均与第一目标域名不一致时，则确定当前网络存在安全风险。
另外，在具体实现过程中，考虑到存储基准库将占用较多资源，并且大量运算会消耗很多电量，且UE的处理器和内存相对服务器较小，所以，在服务器中执行本公开实施例中的方法为较佳选择。
下面列举几个具体例子来对上述过程进行说明。假设基准库的一部分如表1所示。
表1
Figure PCTCN2017117694-appb-000001
Figure PCTCN2017117694-appb-000002
表1表示，域名baidu.com的安全IP地址为111.13.101.208、180.149.132.47、123.125.114.144和220.181.57.217。其中，111.13.101.208由北京市北京百度网讯科技有限公司移动节点维护。以此类推，表中其余信息的意思此处就不再一一详细赘述了。
假设UE接入一个新的无线局域网，然后主动对baidu.com和so.com两个域名进行解析。得到baidu.com对应的IP地址111.13.101.208，以及so.com对应的IP地址42.236.9.70。将两个IP地址在基准库中进行对比，由于111.13.101.208与baidu.com的第1个安全IP地址111.13.101.208一致，并且42.236.9.70与so.com的第1个安全IP地址42.236.9.70一致，所以确定网络安全。
假设UE接入一个新的无线局域网，然后主动对baidu.com和so.com两个域名进行解析，得到baidu.com对应的IP地址111.13.101.209，以及so.com的IP地址42.236.9.70。将两个IP地址在基准库中进行对比，由于111.13.101.209与baidu.com的4个安全IP地址均不致，42.236.9.70与so.com的第1个安全IP地址42.236.9.70一致，所以对111.13.101.209进一步执行反向解析。111.13.101.209的反向解析结果中的所有第二目标域名中均没有baidu.com，所以判断baidu.com被劫持，UE存在网络安全风险。
再假设UE接入一个新的无线局域网，然后主动对baidu.com和so.com两个域名进行解析，得到baidu.com对应的IP地址111.13.101.208，以及so.com的IP地址106.120.160.134。将两个IP地址在基准库中进行对比，由于106.120.160.134与so.com的3个安全IP地址均不致，111.13.101.208与baidu.com的第1个安全IP地址111.13.101.208一致，所以对106.120.160.134进一步执行反向解析。106.120.160.134的反向解析结果为haoso.com、haosou.com、so.com、sou.com、haosou.cn、sou.cn、c-b.360webcache.com、mier.net.cn和2222888.com。反向解析结果中的第二目标域名so.com与第一目标域名so.com一致，所以判断so.com未被劫持，UE网络安全。
由上述描述可以看出，首先获得UE对第一目标域名解析出的目标IP地址，然后判断目标IP地址是否与基准库记录的多个安全IP地址中的其中一个安全IP地址一致，当目标IP地址与多个安全IP地址均不一致时，进一步反向解析目标IP地址，获得目标IP地址对应的多个第二目标域名，当第一目标域名与多个第二目标域名均不匹配时，才确定UE存在网络安全风险。所以，在基准库中不存在匹配的安全IP地址时，通过进一步对目标IP地址进行反向解析，从权威DNS服务器中获取合法使用目标IP地址的多个第二目标域名。如果仍然没有与第一目标域名一致的第二目标域名，才确定存在网络安全风险。所以，本公开通过两次检测判断网络是否安全，提高了检测准确率。
当然，在具体实现过程中，基准库中也可以不是记录多个安全域名以及对应的安全IP地址，而是记录多个危险安全域名和危险IP地址。进而，如果目标IP地址与基准库中的多个危险IP地址均不一致时，判断第一目标域名未被劫持。而如果目标IP地址与其中一个危险IP地址一致时，则进一步反向解析目标IP地址。如果第二目标域名中存在与第一目标域名一致的域名，如果存在，则表示第一目标域名未被劫持，如果所有第二目标域名均与第一目标域名不一致，则确定第一目标域名被劫持，UE存在网络风险。
进一步，作为一种可选的实施例，S1001中判断目标IP地址是否与基准库记录的多个安全IP地址中的其中一个安全IP地址一致，可以具体通过如下过程实现：
将目标IP地址转换为对应的目标整数；
基于目标整数，在基准库记录的与多个安全IP地址一一对应的安全整数中搜索目标整数；
若搜索到目标整数，表示基准库中存在与目标IP地址一致的安全IP地址；若未搜索到目标整数，表示目标IP地址与多个安全IP地址均不匹配。
具体来讲，由于将目标IP地址在基准库的大量安全IP地址中进行对比，运算量较大，且效率低，因此，在本公开实施例中，将目标IP地址转换为对应的目标整数。当然，基准库中存储的多个安全IP地址，也对应存储有与每个安全IP地址的安全整数。
其中，将IP地址转换为整数的方法为，将IP地址的第四字节加上第一 个字节乘以256的三次方的积、第二个字节乘以256的二次方的积和第三个字节乘以256的积的和。
举例来说，将IP地址106.120.160.134转换为对应的整数具体为106*2563+120*2562+160*256+134＝1786290310(10进制)。在记录安全IP地址106.120.160.134对应的安全整数时，可以具体存储10进制整数1786290310，16进制整数6A78A086、8进制整数15236120206或2进制整数1101010011110001010000010000110，本公开不做具体限制。
进而，在基准库中搜索与目标IP地址一致的安全IP地址，就简化为在基准库中搜索目标整数。
若搜索到目标整数，则表示基准库中存在与目标IP地址一致的安全IP地址，反之，若未搜索到目标整数，表示目标IP地址与所有安全IP地址均不一致。
由于在基准库中搜索一个整数，运算量小于对比目标IP地址的一串数字，因此提高了搜索效率，进而提高了网络安全检测的效率。
作为一种可选的实施例，如果本公开实施例中的执行主体为服务器，那么，服务器在获得UE发送的第一目标域名对应的目标IP地址之前，还进一步包括：
服务器向UE发送多个安全域名，以使UE对多个安全域名进行解析，进而获得每个安全域名对应的目标IP地址。
具体来讲，当执行主体为服务器时，基准库将存储在服务器存储空间中。基准库中记录了多个安全域名，以及每个安全域名所使用安全IP地址。通过大量统计得出，钓鱼危险中DNS劫持通常劫持的是高价值的网站，如银行登录网站、支付网站、第三方登录网址和邮箱等。因此，本公开实施例中的第一目标域名可以具体为这些高价值网站的域名。换言之，可以通过检测高价值网站的域名是否被劫持，从而判断UE的网络是否安全。
服务器可以自动从基准库中选择出高价值网站的安全域名，或者服务器也可以接收管理人员的选择操作，进而基于管理人员的选择操作确定高价值网站的安全域名。然后，服务器将确定出需要检测的多个高价值网站的安全域名发送给UE。进而，当UE需要对网络安全进行检测时，通过当前接入的网络，对服务器发送的多个安全域名分别进行解析，进而将解析出的多个目 标IP地址发送给服务器，使服务器判断UE当前接入的网络是否存在安全风险。
由上述描述可知，通过服务器向UE下发需要进行DNS解析的多个安全域名，一方面减轻了UE需要解析IP地址的数量，以及服务器的检测量，另一方面，服务器下发的多个安全域名为高价值网站域名，进而服务器可以集中资源对这些高价值网站进行检测，更加有利于发现网络安全风险。
或者，在另一种实施例中，UE还可以自行确定第一目标域名。具体来讲，无论执行主体是服务器还是UE，在S101之前，都可以包括：
UE获得一待检测域名；
判断待检测域名是否满足表示需要进行安全检测的预设条件；
当待检测域名满足预设条件时，将待检测域名确定为第一目标域名。
具体来讲，UE在接入网络时，首先获得任意一待检测的域名。然后，判断待检测域名是否满足预设条件。在本公开实施例中，预设条件表示需要进行安全检测。在本申请实施例中，判断待检测域名是否满足预设条件有多种方式，下面将对其中几种进行介绍。在具体实现过程中，包括但不限于以下几种。
第一种：
判断待检测域名对应的网站是否涉及金融流通。
具体来讲，UE根据待检测域名，获得待检测域名对应的网站。然后对网站页面进行特征提取，判断页面特征中是否存在表示金融流通的特征，例如支付选项、银行网站链接以及输入支付账号的入口标识等。
如果页面特征中具有表示金融流通的特征，那么表示该网站涉及金融流通，确定待检测域名满足预设条件。
第二种：
判断待检测域名所属公司是否为涉及金融的公司。
具体来讲，根据待检测域名获得待检测域名的所属公司。然后，判断公司是否为涉及金融的公司。其中，UE中预先存储有多个涉及金融的公司，因此，如果待检测域名所属公司与预先存储的多个涉及金融的公司中的其中一个一致，则表示待检测域名所属公司为涉及金融的公司，反之，如果待检测域名所属公司与预先存储的多个涉及金融的公司中的均不一致，则表示待 检测域名所属公司不为涉及金融的公司。由于涉及金融的公司所维护的网站通常会需要用户输入与金融相关的信息，所以判断待检测域名满足预设条件。
在具体实现过程中，本公开所属领域的普通技术人员可以根据实际选择判断待检测域名是否满足预设条件的方式，本公开不做具体限制。
进一步，当待检测域名满足预设条件时，UE将待检测域名确定为第一目标域名，进而对第一目标域名进行解析，获得目标IP地址。
由上述描述可知，当待检测域名满足预设条件时，UE将确定满足预设条件的待检测域名为第一目标域名，进而对第一目标域名进行检测。一方面减轻了UE需要解析IP地址数量，另一方面，将资源集中于检测满足预设条件的高价值网站，更加有利于发现网络安全风险。
基于与前述实施例中网络安全的检测方法同样的公开构思，本公开第二方面还提供一种网络安全的检测装置，如图2所示，包括：
第一获得模块101，用于获得用户设备UE对第一目标域名解析出的目标互联网协议IP地址；
反向解析模块102，用于反向解析目标IP地址，获得目标IP地址对应的多个第二目标域名；
第一判断模块103，用于判断第一目标域名是否与其中一个第二目标域名一致；
第一确定模块104，用于当第一目标域名与多个第二目标域名均不匹配时，确定UE存在网络安全风险。
可选的，本公开实施例中的装置还包括：
第二判断模块，用于在获得用户设备UE对第一目标域名解析出的目标互联网协议IP地址之后，判断目标IP地址是否与基准库记录的多个安全IP地址中的其中一个安全IP地址一致；
当目标IP地址与多个安全IP地址均不一致时，通知反向解析模块反向解析目标IP地址。
进一步，本公开实施例中的装置还包括：
第二确定模块，用于在判断目标IP地址是否与基准库记录的多个安全IP地址中的其中一个安全IP地址一致之后，当目标IP地址与其中一个安全IP地址一致时，确定第一目标域名未被劫持。
更进一步，第二判断模块用于将目标IP地址转换为对应的目标整数；基于目标整数，在基准库记录的与多个安全IP地址一一对应的安全整数中搜索目标整数；
若搜索到目标整数，表示基准库中存在与目标IP地址一致的安全IP地址；若未搜索到目标整数，表示目标IP地址与多个安全IP地址均不匹配。
更进一步，基准库还记录有多个安全IP地址对应的多个安全域名，当基准库存储于服务器时，该装置还包括：
发送模块，用于向UE发送多个安全域名，以使UE对多个安全域名进行解析，进而获得每个安全域名对应的目标IP地址。
更进一步，本公开实施例中的装置还包括：
第二获得模块，用于在获得用户设备UE对第一目标域名解析出的目标互联网协议IP地址之前，获得一待检测域名；
第三判断模块，用于判断待检测域名是否满足表示需要进行安全检测的预设条件；
第三确定模块，用于当待检测域名满足预设条件时，将待检测域名确定为第一目标域名。
前述图1实施例中的网络安全的检测方法的各种变化方式和具体实例同样适用于本实施例的网络安全的检测装置，通过前述对网络安全的检测方法的详细描述，本领域技术人员可以清楚的知道本实施例中网络安全的检测装置的实施方法，所以为了说明书的简洁，在此不再详述。
本公开第三方面提供了一种计算机程序，图3示出了可以实现根据本公开的网络安全的检测方法的计算设备。该计算设备传统上包括处理器310和以存储设备320形式的计算机程序产品或者计算机可读介质。存储设备320可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。存储设备320具有存储用于执行上述方法中的任何方法步骤的程序代码331的存储空间330。例如，存储程序代码的存储空间330可以包括分别用于实现上面的方法中的各种步骤的各个程序代码331。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。这些计算机程序产品包括诸如硬盘、紧致盘(CD)、存储卡或者软盘之类的程序代码载体。这样的计算机程序产品通 常为例如图4所示的便携式或者固定存储单元。该存储单元可以具有与图3的计算设备中的存储设备320类似布置的存储段、存储空间等。程序代码可以例如以适当形式进行压缩。通常，存储单元包括用于执行根据本公开的方法步骤的计算机可读代码331＇，即可以由诸如310之类的处理器读取的代码，当这些代码由计算设备运行时，导致该计算设备执行上面所描述的方法中的各个步骤。
本公开实施例中的上述一个或多个技术方案，至少具有如下一种或多种技术效果：
在本公开实施例的技术方案中，首先获得UE对第一目标域名解析出的目标IP地址，然后反向解析目标IP地址，获得目标IP地址对应的多个第二目标域名，当第一目标域名与多个第二目标域名均不匹配时，确定UE存在网络安全风险。由于在钓鱼攻击中，不法分子将第一目标域名的解析到不正确的IP地址上，但是该不正确的IP地址可能仍然不再黑名单库中。因此，本申请在获得目标IP地址后直接对目标IP地址进行反向解析，从较为权威的DNS服务器获得合法使用目标IP地址的多个第二目标域名。那么，即使目标IP不在黑名单库中，如果第一目标域名与所有第二目标安全域名均不一致，则表明目标IP地址可能指向危险域名，进而确定UE存在网络风险。所以，通过上述技术方案，解决了现有技术存在的网络安全检测准确不高的技术问题，实现了提高网络安全检测准确率。
在此提供的算法和显示不与任何特定计算机、虚拟系统或者其它设备固有相关。各种通用系统也可以与基于在此的示教一起使用。根据上面的描述，构造这类系统所要求的结构是显而易见的。此外，本公开也不针对任何特定编程语言。应当明白，可以利用各种编程语言实现在此描述的本公开的内容，并且上面对特定语言所做的描述是为了披露本公开的最佳实施方式。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本公开的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
类似地，应当理解，为了精简本公开并帮助理解各个公开方面中的一个或多个，在上面对本公开的示例性实施例的描述中，本公开的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开 的方法解释成反映如下意图：即所要求保护的本公开要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要求书所反映的那样，公开方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本公开的单独实施例。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(包括伴随的权利要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。
此外，本领域的技术人员能够理解，尽管在此的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本公开的范围之内并且形成不同的实施例。例如，在下面的权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。
本公开的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本公开实施例的网关、代理服务器、系统中的一些或者全部部件的一些或者全部功能。本公开还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序产品)。这样的实现本公开的程序可以存储在计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。
应该注意的是上述实施例对本公开进行说明而不是对本公开进行限制，并且本领域技术人员在不脱离所附权利要求的范围的情况下可设计出替换实施例。在权利要求中，不应将位于括号之间的任何参考符号构造成对权利要 求的限制。单词“包含”不排除存在未列在权利要求中的元件或步骤。位于元件之前的单词“一”或“一个”不排除存在多个这样的元件。本公开可以借助于包括有若干不同元件的硬件以及借助于适当编程的计算机来实现。在列举了若干装置的单元权利要求中，这些装置中的若干个可以是通过同一个硬件项来具体体现。单词第一、第二、以及第三等的使用不表示任何顺序。可将这些单词解释为名称。

Claims (14)

  1. 一种网络安全的检测方法，其特征在于，包括：
    获得用户设备UE对第一目标域名解析出的目标互联网协议IP地址；
    反向解析所述目标IP地址，获得所述目标IP地址对应的多个第二目标域名；
    判断所述第一目标域名是否与其中一个第二目标域名一致；
    当所述第一目标域名与所述多个第二目标域名均不匹配时，确定所述UE存在网络安全风险。
  2. 如权利要求1所述的方法，其特征在于，在获得用户设备UE对第一目标域名解析出的目标互联网协议IP地址之后，还包括：
    判断所述目标IP地址是否与基准库记录的多个安全IP地址中的其中一个安全IP地址一致；
    当所述目标IP地址与所述多个安全IP地址均不一致时，确定执行所述反向解析所述目标IP地址的步骤。
  3. 如权利要求2所述的方法，其特征在于，在判断所述目标IP地址是否与基准库记录的多个安全IP地址中的其中一个安全IP地址一致之后，还包括：
    当所述目标IP地址与其中一个所述安全IP地址一致时，确定所述第一目标域名未被劫持。
  4. 如权利要求2所述的方法，其特征在于，判断所述目标IP地址是否与基准库记录的多个安全IP地址中的其中一个安全IP地址一致，包括：
    将所述目标IP地址转换为对应的目标整数；
    基于所述目标整数，在所述基准库记录的与所述多个安全IP地址一一对应的安全整数中搜索所述目标整数；
    若搜索到所述目标整数，表示所述基准库中存在与所述目标IP地址一致的所述安全IP地址；若未搜索到所述目标整数，表示所述目标IP地址与所述多个安全IP地址均不匹配。
  5. 如权利要求2所述的方法，其特征在于，所述基准库还记录有多个安 全IP地址对应的多个安全域名，当所述基准库存储于服务器时，在获得用户设备UE对第一目标域名解析出的目标互联网协议IP地址之前，还包括：
    服务器向所述UE发送所述多个安全域名，以使所述UE对所述多个安全域名进行解析，进而获得每个安全域名对应的所述目标IP地址。
  6. 如权利要求2所述的方法，其特征在于，在获得用户设备UE对第一目标域名解析出的目标互联网协议IP地址之前，还包括：
    所述UE获得一待检测域名；
    判断所述待检测域名是否满足表示需要进行安全检测的预设条件；
    当所述待检测域名满足所述预设条件时，将所述待检测域名确定为所述第一目标域名。
  7. 一种网络安全的检测装置，其特征在于，包括：
    第一获得模块，用于获得用户设备UE对第一目标域名解析出的目标互联网协议IP地址；
    反向解析模块，用于反向解析所述目标IP地址，获得所述目标IP地址对应的多个第二目标域名；
    第一判断模块，用于判断所述第一目标域名是否与其中一个第二目标域名一致；
    第一确定模块，用于当所述第一目标域名与所述多个第二目标域名均不匹配时，确定所述UE存在网络安全风险。
  8. 如权利要求7所述的装置，其特征在于，所述装置还包括：
    第二判断模块，用于在获得用户设备UE对第一目标域名解析出的目标互联网协议IP地址之后，判断所述目标IP地址是否与基准库记录的多个安全IP地址中的其中一个安全IP地址一致；
    当所述目标IP地址与所述多个安全IP地址均不一致时，通知反向解析模块反向解析所述目标IP地址。
  9. 如权利要求8所述的装置，其特征在于，所述装置还包括：
    第二确定模块，用于在判断所述目标IP地址是否与基准库记录的多个安全IP地址中的其中一个安全IP地址一致之后，当所述目标IP地址与其中一个所述安全IP地址一致时，确定所述第一目标域名未被劫持。
  10. 如权利要求8所述的装置，其特征在于，所述第二判断模块用于将 所述目标IP地址转换为对应的目标整数；基于所述目标整数，在所述基准库记录的与所述多个安全IP地址一一对应的安全整数中搜索所述目标整数；
    若搜索到所述目标整数，表示所述基准库中存在与所述目标IP地址一致的所述安全IP地址；若未搜索到所述目标整数，表示所述目标IP地址与所述多个安全IP地址均不匹配。
  11. 如权利要求8所述的装置，其特征在于，所述基准库还记录有多个安全IP地址对应的多个安全域名，当所述基准库存储于服务器时，所述装置还包括：
    发送模块，用于向所述UE发送所述多个安全域名，以使所述UE对所述多个安全域名进行解析，进而获得每个安全域名对应的所述目标IP地址。
  12. 如权利要求8所述的装置，其特征在于，所述装置还包括：
    第二获得模块，用于在获得用户设备UE对第一目标域名解析出的目标互联网协议IP地址之前，获得一待检测域名；
    第三判断模块，用于判断所述待检测域名是否满足表示需要进行安全检测的预设条件；
    第三确定模块，用于当所述待检测域名满足所述预设条件时，将所述待检测域名确定为所述第一目标域名。
  13. 一种计算机程序，包括计算机可读代码，当所述计算机可读代码在计算设备上运行时，导致所述计算设备执行根据权利要求1-6中的任一项所述的网络安全的检测方法。
  14. 一种计算机可读介质，其中存储了如权利要求13所述的计算机程序。
PCT/CN2017/117694 2016-12-21 2017-12-21 网络安全的检测方法和装置 WO2018113730A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611193269.1 2016-12-21
CN201611193269.1A CN106453436B (zh) 2016-12-21 2016-12-21 一种网络安全的检测方法和装置

Publications (1)

Publication Number Publication Date
WO2018113730A1 true WO2018113730A1 (zh) 2018-06-28

Family

ID=58215543

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/117694 WO2018113730A1 (zh) 2016-12-21 2017-12-21 网络安全的检测方法和装置

Country Status (2)

Country Link
CN (1) CN106453436B (zh)
WO (1) WO2018113730A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111953813A (zh) * 2020-08-24 2020-11-17 携程计算机技术（上海）有限公司 Ip地址的识别方法、系统、电子设备及存储介质
CN113055362A (zh) * 2021-03-01 2021-06-29 深信服科技股份有限公司 异常行为的预防方法、装置、设备及存储介质
CN113347139A (zh) * 2020-03-02 2021-09-03 深信服科技股份有限公司 一种识别安全信息的方法、装置、系统和介质

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106453436B (zh) * 2016-12-21 2019-05-31 北京奇虎科技有限公司 一种网络安全的检测方法和装置
CN107547682B (zh) * 2017-07-31 2020-06-05 新华三技术有限公司 Ip地址识别方法及装置
CN107979611B (zh) * 2017-12-18 2020-09-29 北京奇艺世纪科技有限公司 一种文件劫持的判定方法及装置
CN109257373B (zh) * 2018-10-31 2020-12-04 腾讯科技（深圳）有限公司 一种域名劫持识别方法、装置及系统
CN110223051B (zh) * 2019-05-17 2021-07-16 中国银联股份有限公司 支付方法、装置、设备、系统及存储介质
CN111372205A (zh) * 2020-02-28 2020-07-03 维沃移动通信有限公司 信息提示方法及电子设备
CN114844722B (zh) * 2022-06-08 2023-03-24 郑州龙名网络科技有限公司 基于域名的网络安全检测方法

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103491073A (zh) * 2013-09-09 2014-01-01 中国科学院计算机网络信息中心 在c/s网络架构下基于tlsa协议的安全通信方法
CN103561120A (zh) * 2013-10-08 2014-02-05 北京奇虎科技有限公司 检测可疑dns的方法、装置和可疑dns的处理方法、系统
CN103825895A (zh) * 2014-02-24 2014-05-28 联想(北京)有限公司 一种信息处理方法及电子设备
CN103957201A (zh) * 2014-04-18 2014-07-30 上海聚流软件科技有限公司 基于dns的域名信息处理方法、装置及系统
US20160014145A1 (en) * 2009-10-07 2016-01-14 At&T Intellectual Property I, L.P. Website Security
CN105721276A (zh) * 2014-11-17 2016-06-29 纬创资通股份有限公司 垃圾邮件判定方法及其邮件服务器
CN106453436A (zh) * 2016-12-21 2017-02-22 北京奇虎科技有限公司 一种网络安全的检测方法和装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102932375B (zh) * 2012-11-22 2015-10-07 北京奇虎科技有限公司 网络访问行为的防护方法和装置
EP2924941B1 (en) * 2012-12-26 2019-09-11 Huawei Technologies Co., Ltd. Method and device for preventing service illegal access
CN103561121B (zh) * 2013-10-11 2017-04-12 北京奇虎科技有限公司 一种dns的解析方法、装置和浏览器
CN103581363B (zh) * 2013-11-29 2017-12-12 哈尔滨工业大学（威海） 对恶意域名和非法访问的控制方法及装置

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160014145A1 (en) * 2009-10-07 2016-01-14 At&T Intellectual Property I, L.P. Website Security
CN103491073A (zh) * 2013-09-09 2014-01-01 中国科学院计算机网络信息中心 在c/s网络架构下基于tlsa协议的安全通信方法
CN103561120A (zh) * 2013-10-08 2014-02-05 北京奇虎科技有限公司 检测可疑dns的方法、装置和可疑dns的处理方法、系统
CN103825895A (zh) * 2014-02-24 2014-05-28 联想(北京)有限公司 一种信息处理方法及电子设备
CN103957201A (zh) * 2014-04-18 2014-07-30 上海聚流软件科技有限公司 基于dns的域名信息处理方法、装置及系统
CN105721276A (zh) * 2014-11-17 2016-06-29 纬创资通股份有限公司 垃圾邮件判定方法及其邮件服务器
CN106453436A (zh) * 2016-12-21 2017-02-22 北京奇虎科技有限公司 一种网络安全的检测方法和装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113347139A (zh) * 2020-03-02 2021-09-03 深信服科技股份有限公司 一种识别安全信息的方法、装置、系统和介质
CN111953813A (zh) * 2020-08-24 2020-11-17 携程计算机技术（上海）有限公司 Ip地址的识别方法、系统、电子设备及存储介质
CN113055362A (zh) * 2021-03-01 2021-06-29 深信服科技股份有限公司 异常行为的预防方法、装置、设备及存储介质

Also Published As

Publication number Publication date
CN106453436A (zh) 2017-02-22
CN106453436B (zh) 2019-05-31

Similar Documents

Publication Publication Date Title
WO2018113730A1 (zh) 网络安全的检测方法和装置
US11070580B1 (en) Vulnerability scanning method, server and system
WO2015051720A1 (zh) 检测可疑dns的方法、装置和可疑dns的处理方法、系统
EP3170091B1 (en) Method and server of remote information query
US9053320B2 (en) Method of and apparatus for identifying requestors of machine-generated requests to resolve a textual identifier
US20160337378A1 (en) Method and apparatus for detecting security of online shopping environment
US11888879B2 (en) System and method for monitoring security of a computer network
CN110430188B (zh) 一种快速url过滤方法及装置
WO2019109529A1 (zh) 网页识别方法、装置、计算机设备及计算机存储介质
CN106992981B (zh) 一种网站后门检测方法、装置和计算设备
US10122722B2 (en) Resource classification using resource requests
WO2020228038A1 (zh) 域名处理方法、装置、电子设备以及存储介质
US11575707B2 (en) System and method for blocking phishing attempts in computer networks
WO2017167208A1 (zh) 识别恶意网站的方法、装置及计算机存储介质
WO2018113728A1 (zh) 公共WiFi钓鱼风险的检测方法和装置
WO2018113732A1 (zh) Dns全流量劫持风险的检测方法和装置
US11811806B2 (en) System and apparatus for internet traffic inspection via localized DNS caching
WO2024031884A1 (zh) 一种域名同源判定方法、装置、电子设备及存储介质
EP3311555A1 (en) Advanced security for domain names
CN113965392B (zh) 恶意服务器检测方法、系统、可读介质及电子设备
US11444971B2 (en) Method for assessing the quality of network-related indicators of compromise
US10462180B1 (en) System and method for mitigating phishing attacks against a secured computing device
CN103078771A (zh) 基于p2p的僵尸网络分布式协作检测系统和方法
CN109194621B (zh) 流量劫持的检测方法、装置及系统
TWI750252B (zh) 記錄網站存取日誌的方法和裝置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17883455

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17883455

Country of ref document: EP

Kind code of ref document: A1