WO2021109669A1 - 恶意域名访问的检测方法、装置及计算机可读存储介质 - Google Patents

恶意域名访问的检测方法、装置及计算机可读存储介质 Download PDF

Info

Publication number
WO2021109669A1
WO2021109669A1 PCT/CN2020/114561 CN2020114561W WO2021109669A1 WO 2021109669 A1 WO2021109669 A1 WO 2021109669A1 CN 2020114561 W CN2020114561 W CN 2020114561W WO 2021109669 A1 WO2021109669 A1 WO 2021109669A1
Authority
WO
WIPO (PCT)
Prior art keywords
domain name
executable file
target process
hash value
malicious
Prior art date
Application number
PCT/CN2020/114561
Other languages
English (en)
French (fr)
Inventor
吴维朋
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2021109669A1 publication Critical patent/WO2021109669A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions

Definitions

  • This application relates to the field of computer and communication technology, and in particular to a method for detecting malicious domain name access, a device for detecting malicious domain name access, and a computer-readable storage medium.
  • the domain name system is a service of the Internet.
  • the domain name system as a distributed database that maps domain names and Internet Protocol (IP) addresses to each other, can make it easier for people to access the Internet.
  • IP address is a numeric address that identifies a site on the network.
  • a domain name is a set of strings, which is easier to remember by users than an IP address.
  • the resolution of the domain name is done by the DNS server.
  • an application such as a browser
  • the resolution function puts the domain name to be converted in the DNS request, using the user datagram protocol (UDP)
  • UDP user datagram protocol
  • the message is sent to the local domain name server.
  • the local domain name server finds the domain name, it puts the corresponding IP address in the response message and returns it.
  • the domain name server also has information connected to other servers to support forwarding when it cannot be resolved. If the domain name server cannot answer the DNS request, the domain name server will temporarily become another client in the DNS and send a resolution request to the root domain name server.
  • the root domain name server must be able to find the domain name servers of all the second-level domain names below, and so on and so on, until the requested domain name is queried.
  • HIPS host intrusion prevention system
  • C/S server/client
  • the client is installed on the protected host for data collection.
  • the server is installed on a computer connected to the protected host and used to receive and analyze the data collected by the client.
  • the client uses the packet capture function library pcap to capture DNS messages, resolve the domain name contained in the DNS message, and match the domain name contained in the DNS message with the domain name in the blacklist of illegal domain names.
  • the client uploads the matching result to the server, receives the corresponding policy issued by the server, and executes the received policy.
  • the embodiments of the application provide a detection method, device, and computer-readable storage medium for malicious domain name access to solve the problem that the related technology has an unsatisfactory protective effect on malicious domain name access behavior.
  • a method for detecting malicious domain name access is provided.
  • the client host obtains the domain name requested by the target process and the target process when the target process triggers domain name access.
  • the target process identifier is used to identify an application program running on the client host.
  • the client host sends parameter information of the target process to the server host, where the parameter information includes the domain name that the target process requests to access and the process identifier of the target process.
  • the client host receives the security detection result returned by the server host.
  • the security detection result indicates whether the domain name requested by the target process is an illegal domain name; the client host processes the target process according to the security detection result .
  • This method can obtain the domain name resolution behavior and the process to which it belongs in real time, and has a traceability effect on the process of domain name resolution.
  • the server host will combine the malicious process detection function to judge the maliciousness of the domain name.
  • the method further includes: comparing the domain name requested by the target process with the illegal domain name included in the local domain name blacklist, and determining according to the comparison result
  • the local domain name blacklist does not include the domain name requested by the target process.
  • obtaining the domain name requested to be accessed by the target process and the process identification of the target process includes: obtaining the domain name requested to be accessed by the target process and the process identification of the target process through a dynamic library file called by the target process.
  • the parameter information further includes the save path of the executable file of the generated target process on the client host, and before receiving the security detection result returned by the server host, it also includes: receiving the executable file sent by the server host Get the executable file according to the save path of the executable file of the generated target process on the client host, calculate the hash value of the executable file, and compare the calculated hash value with the hash value sent by the server host The desired value is compared; in response to the calculated hash value being consistent with the hash value sent by the server host, the executable file is sent to the server host.
  • the client In view of the situation where the server needs to call a third-party scanning engine to scan executable files, the client provides executable files and only after they pass verification to further ensure security.
  • the target process after determining according to the comparison result that the domain name requested by the target process is not included in the local domain name blacklist, it also includes: receiving the updated domain name blacklist sent by the server host, and updating the local domain name blacklist according to the updated domain name blacklist .
  • the server host combines the malicious process detection function to judge the maliciousness of the domain name. If it is malicious, the server host will add it to the blacklist and synchronize the updated blacklist to the client to improve the client's ability to identify malicious domain names.
  • a method for detecting malicious domain name access includes: a server host receives parameter information of a target process sent by a client host, the parameter information includes the domain name that the target process requests to access and the process identifier of the target process .
  • the server host performs security detection based on the parameter information of the target process. After that, the server host sends the security detection result to the client host, and the security detection result indicates whether the domain name requested by the target process is an illegal domain name.
  • the parameter information also includes the storage path of the executable file of the target process generated on the client host, and the server host performs security detection according to the parameter information of the target process, including: the server host generates the executable file of the target file according to the executable file of the target process.
  • the corresponding relationship between the storage path of the file on the client host and the hash value of the executable file, the hash value of the executable file is obtained, and the executable file is checked for security according to the hash value of the executable file. As a result, it is determined whether the executable file is a malicious file.
  • perform security detection on the executable file according to the hash value of the executable file, and determine whether the executable file is a malicious file according to the detection result including: comparing the hash value of the executable file with the malicious program blacklist The hash value of the malicious program is compared; in response to the hash value of the malicious program that matches the hash value of the executable file in the malicious program blacklist, the hash value of the executable file is sent to the client host, Receive the executable file sent after the client host verifies the hash value of the executable file; use a third-party detection technology to detect the executable file, and determine whether the executable file is malicious according to the detection result.
  • the method further includes: in response to the executable file being a malicious file, adding the hash value of the executable file to the malicious program blacklist.
  • performing security detection on the executable file according to the hash value of the executable file, and judging whether the executable file is a malicious file according to the detection result including: sending the hash value of the executable file to the client host, and receiving the client The executable file sent after the end host verifies the hash value of the executable file;
  • the executable file before obtaining the hash value of the executable file, it also includes: comparing the domain name requested by the target process with the illegal domain name included in the local domain name blacklist, and determining that the local domain name blacklist is not included according to the comparison result The domain name requested by the target process.
  • the method further includes: in response to the executable file being a malicious file, adding the domain name requested by the target process to the local domain name blacklist, thereby obtaining an updated domain name blacklist; Send the updated domain name blacklist to the client host.
  • the server host combines the malicious process detection function to judge the maliciousness of the domain name. If it is malicious, the server host will add it to the blacklist and synchronize the updated blacklist to the client to improve the client's ability to identify malicious domain names.
  • a device for detecting malicious domain name access is provided, which is used to implement the client host described in the first aspect or any one of the possible implementation manners of the first aspect.
  • the device has the function of implementing the method described in the foregoing first aspect or any one of the possible implementation manners of the foregoing first aspect.
  • the function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • a detection device for malicious domain name access is provided, which is used to implement the server host described in the second aspect or any one of the possible implementation manners of the second aspect.
  • the device has the function of implementing the method of the foregoing second aspect or any one of the possible implementation manners of the foregoing second aspect.
  • the function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • a system for detecting malicious domain name access which includes the client host described in the third aspect and the server host described in the fourth aspect.
  • an embodiment of the present application provides a computer storage medium for storing computer software instructions used in the above-mentioned malicious domain name access detection method, which includes instructions for executing the above-mentioned first aspect or any one of the above-mentioned first aspects.
  • Another aspect of the present application provides a computer-readable storage medium having instructions stored in the computer-readable storage medium, which when run on a computer, cause the computer to execute the methods described in the above aspects.
  • Another aspect of the present application provides a computer program product containing instructions, which when run on a computer, causes the computer to execute the methods described in the above aspects.
  • Another aspect of the present application provides a chip including a storage device and a processing device, the storage device is used to store computer instructions, and the processing device is used to call and run the computer instructions from the storage device to execute the first aspect and its The method in any possible implementation manner of the foregoing first aspect, or the method in any possible implementation manner of the foregoing second aspect and the foregoing second aspect is executed.
  • FIG. 1 is a schematic diagram of the system structure of HIPS provided by an embodiment of the application.
  • FIG. 2 is a schematic diagram of an application scenario of a method for detecting malicious domain name access provided by an embodiment of the application
  • FIG. 3 is a flowchart of a method for detecting malicious domain name access provided by an embodiment of the application
  • FIG. 4 is a schematic diagram of the relationship between the Agent on a protected host and the process of initiating domain name resolution according to an embodiment of the application;
  • FIG. 5 is a schematic flowchart of a domain name resolution process on a protected host provided by an embodiment of this application;
  • FIG. 6 is a flowchart of a detection method for Agent malicious domain name access provided by an embodiment of the application
  • FIG. 7 is a flowchart of a method for detecting server malicious domain name access provided by an embodiment of the application.
  • FIG. 8 is a flowchart of a server malicious domain name identification and update mechanism provided by an embodiment of the application.
  • FIG. 9 is a schematic structural diagram of a detection device for malicious domain name access provided by an embodiment of the application.
  • FIG. 10 is a schematic structural diagram of a detection device for malicious domain name access provided by an embodiment of this application.
  • FIG. 11 is a schematic structural diagram of an electronic device provided by an embodiment of this application.
  • FIG. 12 is a schematic structural diagram of an electronic device provided by an embodiment of this application.
  • pcap is an application programming interface (application programming interface, API) used to capture network traffic.
  • the embodiment of the present application provides a method for detecting malicious domain name access.
  • This method can obtain the domain name resolution behavior and the process to which it belongs in real time, and has a traceability effect on the process of domain name resolution.
  • Upload the domain name and the process information that cannot be determined in the client to the server, and the server will combine the malicious process detection function to judge the maliciousness of the domain name. If it is malicious, the server will add it to the blacklist and synchronize the blacklist to the client to improve the client's ability to identify malicious domain names.
  • the organic cooperation between the client and the server can self-operate an efficient domain name blacklist, which reduces the rate of false negatives.
  • HIPS usually adopts a server/client (client-server, C/S) architecture.
  • client client-server
  • C/S server/client
  • the client is installed on the protected host for data collection.
  • the server is installed on a computer connected to the protected host and used to receive and analyze the data collected by the client.
  • Fig. 2 is a schematic diagram of an application scenario of a method for detecting malicious domain name access provided by an embodiment of the present application.
  • Agent is a software module installed and running on a protected host in the internal network, for example, installed and running on a client host.
  • the server runs on a host that can communicate with the protected host, for example, on the server host. Therefore, Agent and Server can run on different hosts, or on the same host. In this embodiment of the application, Agent and Server cooperate to complete the detection of malicious domain name access.
  • the method for detecting malicious domain name access provided by the embodiment of the present application will be described by taking the method for detecting malicious domain name access through cooperation between the client host and the server host as an example. As shown in Figure 3, the method includes the following processes.
  • the client host obtains the domain name requested by the target process and the process identifier of the target process.
  • the process identifier of the target process is used to identify an application running on the client host.
  • the manner in which the client host obtains the domain name requested to be accessed by the target process and the process identification of the target process includes but is not limited to obtaining the domain name requested to be accessed by the target process and the process identification of the target process through the dynamic library file called by the target process.
  • Figure 4 describes the relationship between the Agent and the process of initiating domain name resolution on a protected host.
  • the process of initiating domain name resolution calls the gethostbyname series of functions to initiate domain name resolution.
  • domain name resolution is a process of resolving a domain name to an IP address.
  • Most of the domain name resolution on the operating systems of various computer devices is done by calling the library function gethostbyname.
  • the domain name resolution process is carried out according to the configuration values of the hosts item in /etc/nsswitch.conf. There are more than one configuration values of the hosts item, and each configuration value corresponds to a resolution method.
  • the domain name can be resolved in sequence using the resolution mode corresponding to the configuration value of the hosts item. For example, according to the configuration value from left to right, the resolution method corresponding to the configuration value is used to resolve the domain name. If the domain name is resolved to an IP address, the resolution is successful and the resolution process is exited. If the domain name is not resolved to the IP address, the resolution fails, and the resolution method corresponding to the next configuration item is used to continue to resolve the domain name.
  • common configuration values are files and dns. Files is finally used to resolve the file /etc/hosts with the local domain name.
  • the target process that initiates domain name resolution loads a dynamic library file, that is, the so file, such as the libnss_hw.so file in Figure 4, when it starts.
  • the main logic is to load the so file in the target process that initiates domain name resolution.
  • the libnss_hw.so file obtains the domain name (that is, the domain name to be resolved) and the process identity (process identity, PID) that the target process requests to access.
  • the domain name and PID are resolved and sent to the agent of HIPS, where the agent is the agent of HIPS.
  • the client host obtains the parameter information of the target process through the Agent, and the parameter information includes the domain name that the target process requests to access and the process identification PID of the target process.
  • the parameter information may further include, but is not limited to, one or more types of information such as executable file path, command line, process name, executable file hash, and so on.
  • Fig. 5 is a schematic flowchart of a domain name resolution process on a protected host provided by an embodiment of the present application.
  • the process is realized by modifying the existing domain name resolution process.
  • the dynamic library file libnss_hw.so is the key to implementation.
  • the dynamic library file libnss_hw.so is written.
  • This libnss_hw.so obtains the domain name to be resolved and the PID of the current target process, and then sends it to the HIPS Agent process to trigger the Agent to detect malicious domain names.
  • the domain name resolution detection described in FIG. 5 means that this detection is triggered when there is a domain name resolution.
  • the process shown in Figure 5 mainly includes the following steps.
  • hosts filesdnsmyhostname.
  • hosts hw files dnsmyhostname.
  • the created soft link is: ln-s libnss_hw.so libnss_hw.so.2
  • Program A initiates domain name resolution.
  • libnss_hw.so will receive the domain name of program A, and use getpid to obtain the PID of program A, send the domain name and process PID to be resolved to the Agent, and return the resolution failure.
  • the client host sends parameter information of the target process to the server host, where the parameter information includes the domain name that the target process requests to access and the process identifier of the target process.
  • the Agent on the protected host will perform malicious domain name detection after receiving the notification of domain name resolution in real time. Therefore, in an exemplary embodiment, before the client host sends the parameter information of the target process to the server host, the method further includes: comparing the domain name requested by the target process with the illegal domain name contained in the local domain name blacklist, According to the comparison result, it is determined that the local domain name blacklist does not include the domain name requested by the target process. Among them, according to the comparison result, it is determined that the local domain name blacklist does not include the domain name requested by the target process, indicating that it cannot be determined whether the domain name is an illegal domain name. Therefore, the parameter information of the target process can be reported to the server host, and the server host can further Check whether the domain name is a malicious domain name, that is, an illegal domain name.
  • the client host may not have a blacklist of domain names but a whitelist of domain names.
  • the method further includes: requesting access to the domain name of the target process It is compared with the legal domain names contained in the local domain name whitelist, and according to the comparison result, it is determined that the local domain name whitelist does not include the domain name that the target process requests to access.
  • the local domain name whitelist does not include the domain name requested by the target process, indicating that it cannot be determined whether the domain name is an illegal domain name. Therefore, the parameter information of the target process can be reported to the server host, and the server host can further check whether the domain name is Malicious domain names are illegal domain names.
  • the client host may also have both a domain name whitelist and a domain name blacklist.
  • the client host compares the domain name requested by the target process with the domain name whitelist. If the domain name whitelist is not included The domain name requested by the target process is not matched successfully, indicating that the domain name requested by the target process is not sure whether it is a legal domain name.
  • the domain name requested by the target process is further compared with the domain name blacklist. If the domain name blacklist includes The domain name requested by the target process is matched successfully, indicating that the domain name requested by the target process is an illegal domain name.
  • the domain name requested by the target process cannot be matched with the domain name blacklist, it further indicates that the domain name requested by the target process is not sure whether it is a legal domain name, and the next step is performed.
  • Fig. 6 the detection process of domain name access for the Agent is shown in Fig. 6 as an example.
  • the workflow of the Agent shown in Fig. 6 mainly includes the following steps.
  • the target process performs domain name resolution, that is, when the target process requests to access a certain domain name, the logic of the dynamic library file is triggered and the agent is notified.
  • the Agent receives a notification from libnss_hw.so, and the notification includes the request of the target process The domain name accessed and the process ID of the target process.
  • the Agent first matches the domain name requested by the target process with the domain name blacklist.
  • the domain name blacklist contains malicious domain names, that is, illegal domain names. If the domain name blacklist includes the domain name requested by the target process, the domain name requested by the target process matches the malicious domain name in the domain name blacklist successfully, that is, the domain name requested by the target process hits the domain name blacklist, and 603 is executed; if the domain name is black If the domain name requested by the target process is not included in the list, the domain name requested by the target process does not match the malicious domain name in the domain name blacklist, that is, the domain name requested by the target process does not match the domain name blacklist, and step 604 is executed.
  • the client may also adopt a domain name whitelist method, and the domain name whitelist contains legal domain names.
  • the client judges whether the domain name whitelist of the client includes the domain name requested by the target process. If the domain name whitelist of the client includes the domain name requested by the target process, the domain name requested by the target process is the legal domain name in the whitelist of the domain name. If the match is successful, that is, the domain name requested by the target process hits the domain name whitelist, indicating that the domain name requested by the target process is a legal domain name, the whole process ends, otherwise the next detection process is executed, such as reporting to the server, and the server performs Detection.
  • the client may also have both a domain name whitelist and a domain name blacklist.
  • the client compares the domain name accessed by the target process with the domain name whitelist. If the domain name whitelist does not include the domain name requested by the target process , The domain name requested by the target process does not match the legal domain name in the domain name whitelist, indicating that the domain name requested by the target process is not sure whether it is a legal domain name, and the domain name is further compared with the domain name blacklist. If the domain name is blacklisted If the domain name requested by the target process is included, the domain name requested by the target process matches the malicious domain name in the domain name blacklist successfully, indicating that the domain name requested by the target process is an illegal domain name.
  • the domain name requested by the target process cannot be matched with the domain name blacklist, it further indicates that the domain name requested by the target process is not sure whether it is a legal domain name, and the next step is performed, such as reporting to the server, which will be checked by the server.
  • the domain name blacklist includes the domain name requested by the target process, and the domain name requested by the target process matches the malicious domain name in the domain name blacklist successfully, that is, the domain name requested by the target process hits the domain name blacklist, indicating that this is a malicious domain name Analyze the behavior, then report this event. It can also be displayed.
  • the domain name blacklist does not include the domain name requested by the target process, and the domain name requested by the target process does not match the malicious domain name in the domain name blacklist. That is, the domain name requested by the target process does not match the domain name blacklist, and the target is obtained.
  • the PID of the process, the PID of the target process, the domain name that the target process requests to access, and other parameter information are reported to the server.
  • the server host receives the parameter information of the target process sent by the client host.
  • the parameter information of the target process sent by the client host and received by the server host includes, but is not limited to, the domain name that the target process requests to access and the process identifier of the target process.
  • the parameter information may also include the path of the executable file corresponding to the process identifier of the target process, that is, the path where the executable file for generating the target process is saved on the client host.
  • the parameter information may also include the hash value of the executable file that generated the target process.
  • the server host performs security detection according to the parameter information of the target process.
  • the parameter information of the target process includes the domain name that the target process requests to access and the process identifier of the target process. Since the server host can be connected to multiple client hosts, the server host can summarize the domain name blacklist of the server based on the detection of the domain names of each client host. The local domain name blacklist of the server is better than sent The current domain name blacklist of the client host for the parameter information of the target process is more comprehensive. Therefore, in an exemplary embodiment, after the server host receives the parameter information of the target process, the server host may first request access to the domain name and service of the target process when performing security checks based on the parameter information of the target process.
  • the illegal domain name included in the local domain name blacklist of the end host is compared, and the local domain name blacklist is determined according to the comparison result whether the domain name requested by the target process is included in the local domain name blacklist. For example, if it is determined according to the comparison result that the local domain name blacklist includes the domain name requested by the target process, a secure detection result can be directly obtained, and the secure detection result indicates that the domain name requested by the target process is a legal domain name. If it is determined according to the comparison result that the local domain name blacklist does not include the domain name that the target process requests to access, other methods can be used to continue the detection.
  • the server host can also store the domain name whitelist locally, and use the domain name whitelist for security detection.
  • the server host may store both the domain name whitelist and the domain name blacklist locally, and the server host uses the domain name blacklist and the domain name whitelist for detection, which is not limited in the embodiment of the application.
  • the parameter information also includes the save path of the executable file of the target process on the client host;
  • the security check according to the parameter information of the target process includes: Generate the corresponding relationship between the save path of the executable file of the target process on the client host and the hash value of the executable file, obtain the hash value of the executable file, and secure the executable file according to the hash value of the executable file Detecting, judging whether the executable file is malicious according to the detection result.
  • the corresponding relationship between the storage path of the executable file of the target process on the client host and the hash value of the executable file is stored by the server host in advance before the detection of malicious domain name access is performed this time of.
  • the client host can collect information about the target process to obtain the PID of the target process, the save path of the executable file that generates the target process on the client host, and the executable file can also be calculated The hash value and so on.
  • the client host reports the target process information to the server host.
  • the server host can determine and store the save path and save path of the executable file that generates the target process on the client host according to the target process information reported by the client host.
  • Correspondence of the hash value of the executable file includes, but is not limited to, the storage path of the executable file of the target process generated on the client host and the hash value of the executable file, and may also include information such as the identification of the target process.
  • the embodiment of the present application does not have this correspondence.
  • the content of is limited, and the hash value of the executable file of the target process can be determined according to the corresponding relationship.
  • the client host saves the domain name requested by the target process, the process identifier of the target process, and the executable file that generated the target process on the client host.
  • the server host receives the parameter information of the target process sent by the client host, and obtains the executable file that generates the target process again through the parameter information of the target process.
  • the storage path on the client host is used to determine the hash value of the executable file of the target process by querying the corresponding relationship. After that, the executable file can be tested for security according to the hash value of the executable file, and whether the executable file is a malicious file can be determined according to the detection result.
  • security detection is performed on the executable file according to the hash value of the executable file, and whether the executable file is a malicious file is determined according to the detection result, including but not limited to the following situations.
  • Case 1 The hash value of the executable file is compared with the hash value of the illegal program included in the malicious program blacklist; in response to the existence of a malicious program in the malicious program blacklist that matches the hash value of the executable file The hash value of the executable file is determined to be malicious.
  • the server host has a malicious program blacklist, and the malicious program blacklist contains the hash value of the malicious program. Therefore, the server host compares the hash value of the executable file with the hash value of the malicious program included in the malicious program blacklist. If the hash value of the malicious program that matches the hash value of the executable file exists in the malicious program blacklist, it is determined that the executable file is a malicious file.
  • Case 2 The hash value of the executable file is compared with the hash value of the malicious program contained in the malicious program blacklist; in response to the malicious program blacklist, there is no malicious program that matches the hash value of the executable file.
  • the hash value of the program the hash value of the executable file is sent to the client host, and the executable file sent after the client host verifies the hash value of the executable file.
  • Use third-party detection technology to detect the executable file, and determine whether the executable file is a malicious file according to the detection result.
  • the third-party detection technology in this embodiment refers to the detection technology provided by other software and hardware providers except the provider of the client host and the server host.
  • Third-party detection technology includes static behavior detection technology and dynamic behavior detection technology.
  • Feature scanning engine is an example of static behavior detection technology.
  • the scanning engine scans executable files to identify whether the executable file contains known signatures related to malicious programs, and determines whether the executable file is based on the scanning results. It is a malicious file.
  • Dynamic behavior detection technology includes sandbox, which provides a virtual operating environment. The sandbox collects the behavior sequence generated when the executable file runs in the virtual operating environment, and analyzes the similarity between the collected behavior sequence and the malicious behavior model constructed based on the behavior sequence of the known malicious program to determine the executable Whether the file is malicious.
  • the server host also needs to have a malicious program blacklist, and the malicious program blacklist has the hash value of the malicious program. Therefore, the server host compares the hash value of the executable file with the hash value of the malicious program included in the malicious program blacklist. If the hash value of the malicious program that matches the hash value of the executable file does not exist in the malicious program blacklist, it is uncertain whether the executable file is a malicious file. In order to further determine whether the executable file is a malicious file, this embodiment of the application calls a third-party scanning engine to scan the executable file.
  • the server host may only send the hash value of the executable file of the target process to the client host, and the client host After the host receives the hash value of the executable file, it obtains the executable file according to the save path of the executable file of the target process on the client host, and then calculates the hash value of the executable file. If the client host The calculated hash value is consistent with the hash value sent by the server host, and the verification is passed, and the executable file is sent to the server host.
  • the server may also be detecting other processes on the client host. Therefore, in order to enable the client host to Determine which process executable file is returned to the server host.
  • the server host can also send the executable file that generated the target process to the client host. The save path above enables the client host pair to obtain the corresponding executable file according to the save path sent by the server host, and send the executable file to the server host after verification.
  • the executable file after determining whether the executable file is a malicious file according to the scanning result, it also includes: in response to the executable file being a malicious file, adding the hash value of the executable file to the malicious program blacklist.
  • the hash value of the executable file is added to the malicious program blacklist, so that the malicious process recorded in the malicious program blacklist becomes more and more comprehensive, which is convenient for subsequent rapid detection.
  • the server host may not have a malicious program blacklist but a program whitelist, and the program whitelist includes the hash value of the legitimate program.
  • the server compares the hash value of the executable file with the hash value of the legal program contained in the program whitelist; in response to the hash value of the legal program in the program whitelist that matches the hash value of the executable file hopefully, it is determined that the executable file is a legal file. If the hash value of a legitimate program that matches the hash value of the executable file does not exist in the program whitelist, the executable file is obtained according to the path and hash value of the executable file; third-party detection technology is used to check the executable file. Detection, based on the detection result to determine whether the executable file is a malicious file.
  • the server-side host may also have both a program whitelist and a malicious program blacklist.
  • the server-side host compares the hash value of the executable file with the program whitelist. If there is no match, it means that The executable file is not sure whether it is a legitimate file, and the hash value of the executable file is further compared with the malicious program blacklist. If the match is successful, there is a malicious program in the malicious program blacklist that matches the hash value of the executable file. The hash value of the program indicates that the executable file is malicious.
  • the hash value of the executable file cannot be matched with the malicious program blacklist, it further indicates that the executable file is not sure whether it is a legitimate file, and the process of scanning with a third-party engine is performed.
  • the server host has both a whitelist of programs and a blacklist of malicious programs
  • the hash value of is compared with the whitelist of the program. Regarding which list should be compared first when there are both a malicious program blacklist and a program whitelist, this embodiment of the application does not limit this.
  • Case 3 Send the hash value of the executable file to the client host, receive the executable file sent after the client host verifies the hash value of the executable file; use third-party detection technology to detect the executable file, according to The detection result determines whether the executable file is malicious.
  • the third situation can be considered to be the processing method adopted when the server host does not have a malicious program blacklist and a program whitelist.
  • This method directly uses third-party detection technology to detect executable files, and determines the executable file based on the detection results. Whether the file is malicious.
  • the server host in addition to sending the hash value of the executable file to the client host, can also send to the client host the save path of the executable file that generates the target process on the client host, so that the client The end host pair obtains the corresponding executable file according to the save path sent by the server host, and sends the executable file to the server host after verification.
  • the process for the Server to determine whether the process is malicious by means such as executable file hashing and file scanning can be shown in FIG. 7, where the Server is a software module, as shown in the Server in FIG. 2.
  • Server's workflow mainly includes the following steps.
  • the Agent starts real-time monitoring of the target process and reports the start information of the target process in real time.
  • the server After receiving the startup information of the target process, the server will perform a malicious check on the target process, for example, use the executable file hash to perform malicious program blacklist matching.
  • the server judges whether the hash value of the executable file is included in the malicious program blacklist, that is, whether the hash of the executable file of the target process is generated hits the malicious program blacklist, and if the hash of the executable file of the target process is generated If the malicious program blacklist is hit, it indicates that the target process is malicious.
  • the detection result is stored, and the detection process is executed 705, and the detection process is ended. If the hash of the executable file of the target process does not hit the malicious program blacklist, the next step 704 is executed.
  • the server side stores the detection result.
  • the method further includes: in response to the executable file being a malicious file, adding the domain name requested by the target process to the local domain name blacklist to obtain the updated domain name blacklist. List; send the updated domain name blacklist to the client host.
  • Server's workflow mainly includes the following steps.
  • the server receives the suspicious domain name and process information reported by the agent.
  • the suspicious domain name is the domain name that the target process requests to access.
  • the process information includes the PID of the target process.
  • the server compares the suspicious domain name with the domain name whitelist to determine whether the domain name matches the domain name whitelist. If the domain name whitelist includes the suspicious domain name reported by the agent, the suspicious domain name matches the legal domain name in the domain name whitelist successfully, that is, the suspicious domain name matches the domain name whitelist, and the whole process ends; otherwise, the next step 803 is executed.
  • the server may also adopt a domain name blacklist method, and the domain name blacklist includes illegal domain names. For example, the server judges whether the domain name reported by the agent belongs to the domain name blacklist of the server. If the domain name blacklist includes the domain name reported by the agent, the domain name reported by the agent is an illegal domain name. The entire process ends, otherwise the next process is executed.
  • the server may also have both a domain name whitelist and a domain name blacklist. The server compares the domain name reported by the agent with the domain name whitelist. The domain name whitelist does not include the domain name, that is, the domain name is not associated with the domain name.
  • the legal domain name in the whitelist matches, it means that the domain name is uncertain whether it is a legal domain name.
  • the domain name is further compared with the domain name blacklist, and if the domain name is included in the domain name blacklist, the domain name is successfully matched with the illegal domain name in the domain name blacklist, indicating that the domain name is an illegal domain name. If the domain name cannot be matched with the domain name blacklist, it is further explained that the domain name is not sure whether it is a legal domain name, and the next step is performed.
  • the server queries whether the target process is a malicious process in the malicious process detection result. If it is not a malicious process, the entire process ends; otherwise, the next step 804 is executed.
  • the information reported by the agent also includes the save path of the executable file of the target process on the client host.
  • the detection result of the malicious process may include the hash value of the malicious program, and the server generates the executable file of the target process according to The corresponding relationship between the save path on the client host and the hash value of the executable file obtains the hash value of the executable file of the target process.
  • the hash value of the executable file is compared with the hash value of the malicious program in the malicious process detection result to query whether the target process is a malicious process. For example, if the detection result of the malicious process includes the hash value of the executable file, the target process is a malicious process.
  • the domain name can be considered as a malicious domain name, and then it is added to the local domain name blacklist of the server to obtain an updated domain name blacklist.
  • the server side synchronizes the updated domain name blacklist to the agent, and the agent updates the agent's local domain name blacklist.
  • the server host sends a security check result to the client host, and the security check result indicates whether the domain name that the target process requests to access is an illegal domain name.
  • the server host sends the security detection result to the client host, so that the client host can process the target process.
  • the Server notifies the Agent of the judgment result so that the Agent can take further control measures on the target program that initiates the domain name resolution process, such as the browser.
  • the client host receives the security detection result returned by the server host.
  • the method before the client host receives the security detection result returned by the server host, the method further includes: receiving the hash value of the executable file sent by the server host; and obtaining the executable file according to the path of the executable file Calculate the hash value of the executable file, and compare the calculated hash value with the hash value sent by the server host; in response to the calculated hash value being consistent with the hash value sent by the server host, Send executable files to the server host.
  • the client host can store multiple executable files. If the client host and the server host only detect malicious domain name access for one target process, the client host receives the executable file sent by the server host. After the hash value, the executable file that generates the target process currently being detected can be obtained from the stored executable files, and the hash value of the executable file is calculated, and the calculated hash value is compared with the server host The sent hash values are compared. When the comparison result is that the calculated hash value is consistent with the hash value sent by the server host, the executable file is sent to the server host.
  • the server host can also send the save path of the executable file of the target process on the client host when sending the hash value of the executable file.
  • the client host receives the target process generated by the server host After the save path and hash value of the executable file on the client host, the executable file is first obtained according to the save path, and the client host performs the hash value calculation on the executable file by itself, and the calculated hash value is compared with The hash value sent by the server host is compared.
  • the comparison result is that the calculated hash value is consistent with the hash value sent by the server host, the executable file is sent to the server host, thereby further ensuring the security of the executable file.
  • the client host processes the target process according to the result of the security detection.
  • the manner in which the client host processes the target process according to the security detection result is not limited in the embodiment of the present application. Exemplarily, if the result of the security detection indicates that the domain name accessed by the target process is a legal domain name, the client host allows the target process to access the domain name. If the result of the security check indicates that the domain name accessed by the target process is an illegal domain name, that is, a malicious domain name, the client prevents the target process from accessing the domain name.
  • the client host determines the local domain name blacklist according to the comparison result. After the domain name requested by the target process is not included in the list, it also includes: receiving the updated domain name blacklist sent by the server host, and updating the local domain name blacklist according to the updated domain name blacklist.
  • the embodiment of this application does not limit the manner in which the client updates the local domain name blacklist according to the updated domain name blacklist.
  • the updated domain name blacklist can be directly replaced with the local domain name blacklist, or incremental updating can be adopted. Method, the newly-added illegal domain names in the domain name blacklist to be updated will be added to the local domain name blacklist.
  • This method can obtain the domain name resolution behavior and the process to which it belongs in real time, and has a traceability effect on the process of domain name resolution.
  • the organic cooperation between the client and the server can self-operate an efficient domain name blacklist, which reduces the rate of false negatives.
  • the method provided by the embodiments of this application can self-update the malicious domain name blacklist.
  • the server can also combine domain name resolution data and process information data to learn to obtain new malicious domain names and update the policy to The client makes the new malicious domain name effective, forming a closed-loop mechanism, which can further improve the accuracy of subsequent malicious domain detection.
  • an embodiment of the present application also provides a detection device for malicious domain name access, which is used to implement the function of the agent in the embodiments of FIGS. 2-8.
  • the apparatus for detecting malicious domain name access provided in the embodiment of the apparatus may be integrated in a host device, for example, applied to a client host.
  • the detection device for malicious domain name access includes:
  • the processing unit 901 is configured to obtain the domain name requested by the target process and the process identifier of the target process when the target process triggers domain name access, and the process identifier of the target process is used to identify an application program running on a client host;
  • the communication unit 902 is configured to send parameter information of the target process to the server host, and the parameter information includes the domain name that the target process requests to access and the process identifier of the target process;
  • the communication unit 902 is also configured to receive a security detection result returned by the server host, and the security detection result indicates whether the domain name requested by the target process is an illegal domain name;
  • the processing unit 901 is further configured to process the target process according to the result of the safety detection.
  • the processing unit 901 is further configured to compare the domain name requested to be accessed by the target process with the illegal domain name contained in the local blacklist, and determine according to the comparison result that the local domain name blacklist does not include the target process requesting access Domain name.
  • the processing unit 901 is configured to obtain the domain name requested to be accessed by the target process and the process identifier of the target process through the dynamic library file called by the target process.
  • the communication unit 902 is further configured to receive the updated domain name blacklist sent by the server host;
  • the processing unit is also used to update the local domain name blacklist according to the updated domain name blacklist.
  • the parameter information further includes the storage path of the executable file of the target process generated on the client host, and the communication unit 902 is further configured to receive the hash value of the executable file sent by the server host;
  • the processing unit 901 is also configured to obtain the executable file according to the save path of the executable file of the target process generated on the client host, calculate the hash value of the executable file, and send the calculated hash value to the server host Compare the hash value of;
  • the communication unit 902 is further configured to send an executable file to the server host in response to the calculated hash value being consistent with the hash value sent by the server host.
  • the device provided by the embodiment of the present application obtains the domain name resolution behavior and the belonging process in real time, and uploads the uncertain domain name and the belonging process information to the server host, thereby combining the malicious process detection function of the server host to perform malicious actions on this domain name. judgment.
  • an efficient domain name blacklist can be self-operated, which reduces the false positive rate.
  • the embodiment of the present application also provides a detection device for malicious domain name access, which is used to implement the function of the server in the embodiment of FIG. 2 to FIG. 8.
  • the apparatus for detecting malicious domain name access provided in the embodiment of the apparatus may be integrated in a host device, for example, applied to a server host.
  • the detection device for malicious domain name access includes:
  • the communication unit 1001 is configured to receive parameter information of the target process sent by the client host, and the parameter information includes the domain name that the target process requests to access and the process identifier of the target process;
  • the processing unit 1002 is configured to perform safety detection according to the parameter information of the target process
  • the communication unit 1001 is also configured to send a security detection result to the client host, and the security detection result indicates whether the domain name that the target process requests to access is an illegal domain name.
  • the parameter information further includes the saving path of the executable file of the target process generated on the client host;
  • the processing unit 1002 is configured to generate the target process executable file according to the saving path of the executable file on the client host and Correspondence of the hash value of the executable file, obtain the hash value of the executable file, perform a security check on the executable file according to the hash value of the executable file, and judge whether the executable file is a malicious file according to the detection result.
  • the processing unit 1002 is configured to compare the hash value of the executable file with the hash value of the malicious program contained in the malicious program blacklist; The hash value of the file matches the hash value of the malicious program, and the executable file is determined to be a malicious file.
  • the processing unit 1002 is configured to compare the hash value of the executable file with the hash value of the malicious program contained in the malicious program blacklist;
  • the communication unit 1001 is configured to send the hash value of the executable file to the client host in response to the absence of the hash value of the malicious program matching the hash value of the executable file in the malicious program blacklist, and receive the client host The executable file sent after verifying the hash value of the executable file;
  • the processing unit 1002 is configured to detect the executable file using a third-party detection technology, and determine whether the executable file is a malicious file according to the detection result.
  • the processing unit 1002 is further configured to add the hash value of the executable file to the malicious program blacklist in response to the executable file being a malicious file.
  • the communication unit 1001 is configured to send the hash value of the executable file to the client host, and receive the executable file sent after the client host verifies the hash value of the executable file;
  • the processing unit 1002 is configured to detect the executable file using a third-party detection technology, and determine whether the executable file is a malicious file according to the detection result.
  • the processing unit 1002 is further configured to compare the domain name requested by the target process with the illegal domain name included in the local domain name blacklist, and determine that the local domain name blacklist does not include the target process request according to the comparison result The domain name to visit.
  • the processing unit 1002 is further configured to, in response to the executable file being a malicious file, add the domain name requested by the target process to the local domain name blacklist to obtain an updated domain name blacklist;
  • the communication unit 1001 is also used to send the updated domain name blacklist to the client host.
  • the device provided by the embodiment of the present application obtains the domain name resolution behavior and the belonging process through the client host in real time, and uploads the uncertain domain name and the belonging process information in the client, thereby combining the malicious process detection function to judge the maliciousness of the domain name.
  • an efficient domain name blacklist can be self-operated, which reduces the false positive rate.
  • the embodiment of the present application also provides a system for detecting malicious domain name access, including the agent and server in FIG. 2.
  • a system for detecting malicious domain name access including the agent and server in FIG. 2.
  • the embodiment of the present application also provides an electronic device.
  • the electronic device is the server host or the client host in the foregoing embodiment.
  • the hardware structure of the electronic device may include, but is not limited to, the structure shown in FIG. 11:
  • the electronic device 1100 includes a transceiver 1103, a processor 1102, and a memory 1101.
  • the transceiver 1103 is used to receive messages or data information
  • the processor 1102 is used to execute related steps of the server host or the client host in the embodiment shown in FIG. 3.
  • any of the device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physically separate.
  • the physical unit can be located in one place or distributed across multiple network units. Some or all of the modules can be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the connection relationship between the modules indicates that they have a communication connection, which can be specifically implemented as one or more communication buses or signal lines.
  • FIG. 12 is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the application.
  • the electronic device 1200 shown in FIG. 12 can execute the corresponding steps performed by the client host or the server host in the method of the foregoing embodiment.
  • the electronic device 1200 includes a processor 1201, a memory 1202, an interface 1203, and a bus 1204.
  • the interface 1203 may be implemented in a wireless or wired manner, and specifically may be a network card.
  • the aforementioned processor 1201, memory 1202, and interface 1203 are connected through a bus 1204.
  • the processor 1201 is configured to execute the processing performed by the client host or the server host in the foregoing embodiment.
  • the interface 1203 is used to receive and send data.
  • the processor 1201 is configured to support obtaining the domain name requested by the target process and the process identifier of the target process when the target process triggers domain name access.
  • the process identifier of the target process is used to identify an application program running on the client host. Refer to the content described in step 301 in FIG. 3.
  • the interface 1203 is used to support sending parameter information of the target process to the server host.
  • the parameter information includes the domain name that the target process requests to access and the process identifier of the target process.
  • the interface 1203 is also used to receive the security detection result returned by the server host.
  • the processor 1201 is also configured to process the target process according to the result of the security detection, which may refer to the content described in step 307 in FIG. 3.
  • the interface 1203 is used to receive the parameter information of the target process sent by the client host, and the parameter information includes the domain name and target that the target process requests to access.
  • the process identifier of the process refer to the content described in step 303 in FIG. 3.
  • the processor 1201 is configured to perform security detection according to the parameter information of the target process, and the content described in step 304 in FIG. 3 may be referred to.
  • the interface 1203 is also used to send the result of the security check to the client host. The result of the security check indicates whether the domain name requested by the target process is an illegal domain name. Refer to the content described in step 305 in FIG. 3.
  • the memory 1202 includes an operating system 12021 and an application program 12022 for storing programs, codes, or instructions.
  • the processor 1201 or a hardware device executes these programs, codes, or instructions, the processing process involving the network device in the method embodiment can be completed.
  • the memory 1202 may include a read-only memory (English: Read-only Memory, abbreviation: ROM) and a random access memory (English: Random Access Memory, abbreviation: RAM).
  • ROM includes a basic input/output system (English: Basic Input/Output System, abbreviation: BIOS) or an embedded system
  • the RAM includes an application program and an operating system.
  • the system is booted by the BIOS solidified in the ROM or the bootloader in the embedded system to guide the electronic device 1200 into a normal operating state.
  • the application program and the operating system run in the RAM, thereby completing the processing process involving the client host or the server host in the method embodiment.
  • FIG. 12 only shows a simplified design of the electronic device 1200.
  • the electronic device 1200 may include any number of interfaces, processors or memories.
  • processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processing (DSP), and application specific integrated circuits. ASIC), field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc.
  • the general-purpose processor may be a microprocessor or any conventional processor. It is worth noting that the processor may be a processor that supports an advanced reduced instruction set machine (advanced RISC machines, ARM) architecture.
  • the foregoing memory may include a read-only memory and a random access memory, and provide instructions and data to the processor.
  • the memory may also include non-volatile random access memory.
  • the memory can also store device type information.
  • the memory may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory can be read-only memory (ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), and electrically available Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be random access memory (RAM), which is used as an external cache. By way of exemplary but not limiting illustration, many forms of RAM are available.
  • static random access memory static random access memory
  • dynamic random access memory dynamic random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • double data rate synchronous dynamic random access Memory double data date SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • serial link DRAM SLDRAM
  • direct memory bus random access memory direct rambus RAM
  • a computer-readable storage medium is also provided, and at least one instruction is stored in the storage medium, and the instruction is loaded and executed by a processor to implement the method for detecting malicious domain name access as described above.
  • This application provides a computer program.
  • the computer program When the computer program is executed by a computer, it can cause a processor or computer to execute the corresponding steps and/or processes in the foregoing method embodiments.
  • the embodiment of the present application also provides a chip, including a storage device and a processing device.
  • the storage device is used to store computer instructions
  • the processing device is used to call and run the computer instructions from the storage device to execute the client in the foregoing method embodiment. The steps performed by the host or server host.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer And Data Communications (AREA)

Abstract

一种恶意域名访问的检测方法、装置及计算机可读存储介质，以该方法应用于客户端主机为例，包括：客户端主机在目标进程触发域名访问时，获取目标进程请求访问的域名及目标进程的进程标识，目标进程的进程标识用于标识一个该客户端主机上运行的应用程序(301)；客户端向服务端主机发送目标进程的参数信息(302)；客户端主机接收服务端主机对应返回的安全检测的结果(306)；客户端主机根据安全检测的结果对目标进程进行处理(307)。该方法能够获取域名解析行为及所属进程，对做域名解析的进程会有一个溯源的作用。通过客户端和服务端主机的配合，降低了恶意域名访问的检测漏报误报率。

Description

恶意域名访问的检测方法、装置及计算机可读存储介质
本申请要求于2019年12月05日提交的申请号为201911236811.0、发明名称为“恶意域名访问的检测方法和装置”的中国专利申请的优先权，本申请要求于2020年02月28日提交的申请号为202010131066.X、发明名称为“恶意域名访问的检测方法、装置及计算机可读存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机及通信技术领域，尤其涉及一种恶意域名访问的检测方法、一种恶意域名访问的检测装置及计算机可读存储介质。
背景技术
域名系统(domain name system，DNS)是互联网的一项服务。域名系统作为将域名和网际协议(internet protocol，IP)地址相互映射的一个分布式数据库，能够使人更方便地访问互联网。IP地址是网络上标识站点的数字地址。域名是一组字符串，与IP地址相比，更容易被用户记忆。
域名的解析工作由DNS服务器完成。当应用程序(例如浏览器)需要将一个主机域名映射为IP地址时,就调用域名解析函数,解析函数将待转换的域名放在DNS请求中,以用户数据报协议(user datagram protocol，UDP)报文方式发给本地域名服务器。本地的域名服务器查到域名后,将对应的IP地址放在应答报文中返回。同时域名服务器还具有连向其他服务器的信息以支持不能解析时的转发。若域名服务器不能应答DNS请求请求,则此域名服务器就暂成为DNS中的另一个客户,向根域名服务器发出解析请求。根域名服务器一定能找到下面的所有二级域名的域名服务器,这样以此类推,一直向下解析,直到查询到所请求的域名。
为了防范内部网络中的用户访问非法域名，企业通常会部署主机入侵防护系统(host intrusion prevention system，HIPS)对包含非法域名的DNS请求进行检测和过滤。HIPS通常采用服务器/客户机(client-server，C/S)架构。其中，客户端被安装在被保护主机上，用于数据采集。服务端被安装在与被保护主机存在网络连接的一个计算机上，用于接收分析客户端采集的数据。客户端使用抓包功能函数库pcap捕获DNS报文，解析出DNS报文包含的域名，将DNS报文包含的域名与非法域名黑名单中的域名进行匹配，如果DNS报文包含的域名与非法域名黑名单中的域名相同，则认为发送上述DNS报文的行为是恶意域名访问行为，否则认为正常域名访问行为。客户端将匹配结果上传给服务器，接收服务器对应下发的策略，并执行接收到的策略。
然而上述相关技术的防护效果不理想。在发现恶意域名访问行为时，无法及时采取保护措施。
发明内容
本申请实施例提供一种恶意域名访问的检测方法、装置及计算机可读存储介质，用以解 决相关技术对恶意域名访问行为防护效果不理想的问题。
第一方面，提供了一种恶意域名访问的检测方法，以该方法应用于客户端主机为例，该客户端主机在目标进程触发域名访问时，获取该目标进程请求访问的域名以及该目标进程的进程标识，示例性地，该目标进程标识用于标识一个该客户端主机上运行的应用程序。客户端主机向服务端主机发送该目标进程的参数信息，其中，该参数信息包括目标进程请求访问的域名及目标进程的进程标识。之后，该客户端主机接收服务端主机对应返回的安全检测的结果，该安全检测的结果指示目标进程请求访问的域名是否为非法域名；该客户端主机根据该安全检测的结果对目标进程进行处理。
该方法能够实时获取域名解析行为及所属进程，对于做域名解析的进程会有一个溯源的作用。将客户端中不能确定的域名及所属进程信息上传到服务端主机，服务端主机会结合恶意进程检测功能，对于此域名的恶意进行判断。通过客户端和服务端有机的配合，降低了恶意域名访问的检测漏报误报率。
可选地，客户端主机向服务端主机发送目标进程的参数信息之前，该方法还包括：将目标进程请求访问的域名与本地域名黑名单中包含的非法域名进行比对，根据比对结果确定本地域名黑名单中不包括该目标进程请求访问的域名。
可选地，获取目标进程请求访问的域名以及目标进程的进程标识，包括：通过目标进程调用的动态库文件获取目标进程请求访问的域名以及目标进程的进程标识。
可选地，参数信息还包括生成目标进程的可执行文件在客户端主机上的保存路径，则接收服务端主机对应返回的安全检测的结果之前，还包括：接收服务端主机发送的可执行文件的哈希值；根据生成目标进程的可执行文件在客户端主机上的保存路径获取可执行文件，对可执行文件进行哈希值计算，将计算得到的哈希值与服务端主机发送的哈希值进行比对；响应于计算得到的哈希值与服务端主机发送的哈希值一致，向服务端主机发送该可执行文件。
针对服务端需要调用第三方扫描引擎对可执行文件进行扫描的情况，客户端提供可执行文件，且通过验证之后才提供，进一步保证安全性。
可选地，根据比对结果确定本地域名黑名单中不包括目标进程请求访问的域名之后，还包括：接收服务端主机发送的更新的域名黑名单，根据更新的域名黑名单更新本地域名黑名单。
服务端主机结合恶意进程检测功能，对于域名的恶意进行判断。如果是恶意的，那么服务端主机会将其加入黑名单，将更新的黑名单同步给客户端，提高客户端识别恶意域名的能力。
第二方面，提供了一种恶意域名访问的检测方法，该方法包括：服务端主机接收客户端主机发送的目标进程的参数信息，该参数信息包括目标进程请求访问的域名及目标进程的进程标识。该服务端主机根据目标进程的参数信息进行安全检测。之后，该服务端主机向客户端主机发送安全检测的结果，该安全检测的结果指示目标进程请求访问的域名是否为非法域名。
可选地，参数信息还包括生成目标进程的可执行文件在客户端主机上的保存路径，该服务端主机根据目标进程的参数信息进行安全检测，包括：服务端主机根据生成目标文件的可执行文件在客户端主机上的保存路径与可执行文件的哈希值的对应关系，获取可执行文件的 哈希值，根据该可执行文件的哈希值对该可执行文件进行安全检测，根据检测结果判断该可执行文件是否为恶意文件。
可选地，根据可执行文件的哈希值对可执行文件进行安全检测，根据检测结果判断可执行文件是否为恶意文件，包括：将可执行文件的哈希值与恶意程序黑名单中包含的恶意程序的哈希值进行比对；响应于恶意程序黑名单中存在与可执行文件的哈希值相匹配的恶意程序的哈希值，确定可执行文件为恶意文件。
可选地，根据可执行文件的哈希值对可执行文件进行安全检测，根据检测结果判断可执行文件是否为恶意文件，包括：将可执行文件的哈希值与恶意程序黑名单中包含的恶意程序的哈希值进行比对；响应于恶意程序黑名单中不存在与可执行文件的哈希值相匹配的恶意程序的哈希值，向客户端主机发送可执行文件的哈希值，接收客户端主机对可执行文件的哈希值进行验证之后发送的可执行文件；使用第三方检测技术对可执行文件进行检测，根据检测结果确定可执行文件是否为恶意文件。
可选地，根据检测结果确定可执行文件是否为恶意文件之后，还包括：响应于可执行文件为恶意文件，将可执行文件的哈希值加入恶意程序黑名单中。
可选地，根据可执行文件的哈希值对可执行文件进行安全检测，根据检测结果判断可执行文件是否为恶意文件，包括：向客户端主机发送该可执行文件的哈希值，接收客户端主机对该可执行文件的哈希值进行验证之后发送的所述可执行文件；
使用第三方检测技术对可执行文件进行检测，根据检测结果确定可执行文件是否为恶意文件。
可选地，获取可执行文件的哈希值之前，还包括：将目标进程请求访问的域名与本地域名黑名单中包含的非法域名进行比对，根据比对结果确定本地域名黑名单中不包括目标进程请求访问的域名。
可选地，根据检测结果判断可执行文件是否为恶意文件之后，还包括：响应于可执行文件为恶意文件，将目标进程请求访问的域名加入本地域名黑名单，从而得到更新的域名黑名单；向客户端主机发送更新的域名黑名单。
服务端主机结合恶意进程检测功能，对于域名的恶意进行判断。如果是恶意的，那么服务端主机会将其加入黑名单，将更新的黑名单同步给客户端，提高客户端识别恶意域名的能力。
第三方面，提供了一种恶意域名访问的检测装置，用于实现第一方面或第一方面的任意一种可能的实现方式所述的客户端主机。该装置具有实现上述第一方面所述方法或上述第一方面的任意一种可能的实现方式的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
第四方面，提供了一种恶意域名访问的检测装置，用于实现第二方面或第二方面的任意一种可能的实现方式所述的服务端主机。该装置具有实现上述第二方面所述方法或上述第二方面的任意一种可能的实现方式的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
第五方面，提供了一种恶意域名访问的检测系统，包括第三方面所述的客户端主机和第四方面所述的服务端主机。
第六方面，本申请实施例提供了一种计算机存储介质，用于储存为上述恶意域名访问的检测方法所用的计算机软件指令，其包含用于执行上述第一方面或上述第一方面的任意一种可能的实现方式所设计的程序，或者包含用于执行上述第二方面或上述第二方面的任意一种可能的实现方式所设计的程序。
本申请的又一方面提了供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
本申请的又一方面提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
本申请的又一方面提供了一种芯片，包括存储器件和处理器件，存储器件用于存储计算机指令，处理器件用于从存储器件中调用并运行该计算机指令，以执行上述第一方面及其上述第一方面任意可能的实现方式中的方法，或者执行上述第二方面及其上述第二方面任意可能的实现方式中的方法。
附图说明
图1为本申请实施例提供的HIPS的系统结构示意图；
图2为本申请实施例提供的一种恶意域名访问的检测方法的应用场景示意图；
图3为本申请实施例提供的一种恶意域名访问的检测方法流程图；
图4为本申请实施例提供的一个被保护主机上Agent与发起域名解析的进程的关系示意图；
图5为本申请实施例提供的被保护主机上的域名解析过程的流程示意图；
图6为本申请实施例提供的Agent恶意域名访问的检测方法的流程图；
图7为本申请实施例提供的Server恶意域名访问的检测方法的流程图；
图8为本申请实施例提供的Server恶意域名识别及更新机制流程；
图9为本申请实施例提供的一种恶意域名访问的检测装置的结构示意图；
图10为本申请实施例提供的一种恶意域名访问的检测装置的结构示意图；
图11为本申请实施例提供的一种电子设备的结构示意图；
图12为本申请实施例提供的一种电子设备的结构示意图。
具体实施方式
相关技术对恶意域名访问行为防护效果不理想，具体表现在以下方面。第一，在发现恶意域名访问行为时，无法定位到特定进程，导致无法及时采取保护措施。第二，客户端采用pcap抓到包非常消耗主机的处理器资源和内存资源，影响被保护主机的性能。其中，pcap是一个用于捕获网络流量的应用编程接口(application programming interface，API)。
本申请实施例提供了一种恶意域名访问的检测方法。该方法能够实时获取域名解析行为及所属进程，对于做域名解析的进程会有一个溯源的作用。将客户端中不能确定的域名及所属进程信息上传到服务端，服务端会结合恶意进程检测功能，对于此域名的恶意进行判断。如果是恶意的，那么服务端会将其加入黑名单，将黑名单同步给客户端，提高客户端识别恶意域名的能力。此方案中客户端和服务端有机的配合，能够自运营出一个高效的域名黑名单，降低了漏报误报率。
下面结合各个附图对本申请实施例技术方案的主要实现原理、具体实施方式及其对应能够达到的有益效果进行详细的阐述。以该方法应用于HIPS系统为例，该HIPS系统的结构可如图1所示。HIPS通常采用服务器/客户机(client-server，C/S)架构。其中，客户端被安装在被保护主机上，用于数据采集。服务端被安装在与被保护主机存在网络连接的一个计算机上，用于接收分析客户端采集的数据。
图2是本申请实施例提供的一种恶意域名访问的检测方法的应用场景示意图。代理(Agent)是一个软件模块，安装运行在内部网络被保护的主机上，例如安装运行在客户端主机上。服务端(Server)运行在与被保护的主机能够进行网络通信的一个主机上，例如运行在服务端主机上。因此，Agent和Server可以分别运行在不同主机上，也可以运行在同一主机上。在本申请实施例中Agent和Server配合完成恶意域名访问的检测。
接下来，结合图2所示的应用场景，以客户端主机和服务端主机相互配合实现恶意域名访问的检测方法为例，对本申请实施例提供的恶意域名访问的检测方法进行说明。如图3所示，该方法包括如下几个过程。
301，客户端主机在目标进程触发域名访问时，获取目标进程请求访问的域名以及目标进程的进程标识，目标进程的进程标识用于标识一个该客户端主机上运行的应用程序。
示例性地，客户端主机获取目标进程请求访问的域名以及目标进程的进程标识的方式，包括但不限于通过目标进程调用的动态库文件获取目标进程请求访问的域名以及目标进程的进程标识。
例如，客户端主机上的Agent与发起域名解析的进程之间的关系可如图4所示。图4描述了在一个被保护主机上Agent与发起域名解析的进程的关系。发起域名解析的进程调用了gethostbyname系列函数，发起域名解析。其中，域名解析是一个将域名解析到IP地址的过程，各种计算机设备的操作系统上大多的域名解析都是调用库函数gethostbyname完成的。域名解析过程是按照/etc/nsswitch.conf中的hosts项的配置值进行的，hosts项的配置值有一个以上，每个配置值对应一种解析方式。可以按照顺序依次采用hosts项的配置值所对应的解析方式对域名进行解析。例如按照配置值从左至右的顺序依次使用配置值对应的解析方式对域名进行解析。如果将域名解析到IP地址，则解析成功，退出解析过程。如果未将域名解析到IP地址，则解析失败，使用下一个配置项对应的解析方式继续对域名进行解析。示例性地，常见配置值有files,dns。files最终是用的本地域名解析文件/etc/hosts进行的。可选地，在lib目录下有着与配置值files对应的动态库文件，例如so文件。dns是使用发送DNS数据包,向服务器请求的。
此外，发起域名解析的目标进程启动时加载动态库文件，即so文件，如图4中的libnss_hw.so文件。主要逻辑是通过发起域名解析的目标进程中加载的该so文件，在这个过程中libnss_hw.so文件获取目标进程请求访问的域名(即待解析域名)和进程标识(process identity，PID)，将待解析域名和PID发送给HIPS的Agent，这里的Agent是HIPS中的Agent。
在示例性实施例中，客户端主机通过Agent获取目标进程的参数信息，该参数信息包括目标进程请求访问的域名及目标进程的进程标识PID。在示例性实施例中，该参数信息还可以包括但不限于可执行文件路径、命令行、进程名、可执行文件hash等一种或多种信息。客 户端主机通过Agent获取目标进程的参数信息后，将该目标进程的参数信息上报给服务端主机。
图5是本申请实施例提供的被保护主机上的域名解析过程的流程示意图。可选地，该流程是由通过修改现有的域名解析过程实现。动态库文件libnss_hw.so是实现的关键，编写动态库文件libnss_hw.so，由该libnss_hw.so获取待解析域名和当前目标进程的PID,然后发送给HIPS Agent进程，触发Agent进行恶意域名检测。可选地，以该发起域名解析的目标进程为程序A，例如是浏览器程序为例，图5所描述的域名解析检测，是指当有域名解析时，就会触发此检测。如果Agent判断该检测结果命中域名黑名单，则认为是恶意域名，将此事件上报Server。如果没有命中黑名单，Agent则将域名及对应PID等信息上报给服务端Server。图5所示的流程主要包括以下步骤。
501，配置/etc/nsswitch.conf中的hosts项，将hw写到第一个配置上，也即在/etc/nsswitch.conf中的hosts项，将hw作为第一配置值。
例如，配置前，hosts:filesdnsmyhostname。配置后，hosts:hw files dnsmyhostname。
502，将libnss_hw.so放到/lib64目录下，并创建相应软链接。
例如，创建的软链接为：ln-s libnss_hw.so libnss_hw.so.2
503，调用gethostbyname，在程序A启动时，会根据/etc/nsswitch.conf找到所依赖的so并加载到内存，分别为配置值hw依赖的libnss_hw.so、配置值files依赖的libnss_files.so、配置值dns依赖的libnss_dns.so、配置值myhostname依赖的libnss_myhostname.so。
504，程序A发起域名解析。
505，按照/etc/nsswitch.conf中hosts的配置顺序依次调用相应so，所以首先调用libnss_hw.so执行其逻辑。
506，libnss_hw.so会收到程序A的域名，且使用getpid获得程序A的PID，将待解析域名和进程PID发送给Agent,并返回解析失败。
507，libnss_hw.so返回失败则会使用下一个so进行解析，也即按照/etc/nsswitch.conf中的配置顺序，使用下一个so进行域名解析，直到解析成功或者所有so都解析失败为止。此时的逻辑与不加hw配置时是一样的，暂不赘述。
302，客户端主机向服务端主机发送目标进程的参数信息，参数信息包括目标进程请求访问的域名及目标进程的进程标识。
基于上述过程，被保护主机上的Agent实时收到域名解析的通知后，进行恶意域名检测。因此，在示例性实施例中，客户端主机向服务端主机发送目标进程的参数信息之前，该方法还包括：将目标进程请求访问的域名与本地域名黑名单中包含的非法域名进行比对，根据比对结果确定本地域名黑名单中不包括目标进程请求访问的域名。其中，根据比对结果确定本地域名黑名单中不包括目标进程请求访问的域名，说明不能确定该域名是否为非法域名，因而可以将目标进程的参数信息上报给服务端主机，由服务端主机进一步检测该域名是否为恶意域名，即非法域名。
可选地，客户端主机本地还可以不具有域名黑名单，而具有域名白名单，则客户端主机向服务端主机发送目标进程的参数信息之前，该方法还包括：将目标进程请求访问的域名与本地域名白名单中包含的合法域名进行比对，根据比对结果确定本地域名白名单中不包括目标进程请求访问的域名。其中，本地域名白名单中不包括目标进程请求访问的域名，说明不 能确定该域名是否为非法域名，因而可以将目标进程的参数信息上报给服务端主机，由服务端主机进一步检测该域名是否为恶意域名，即非法域名。
可选地，在示例性实施例中，客户端主机还可以同时具有域名白名单和域名黑名单，客户端主机将目标进程请求访问的域名与域名白名单比对，如果域名白名单中不包括该目标进程请求访问的域名，则未匹配成功，说明该目标进程请求访问的域名不确定是否为合法域名，进一步将该目标进程请求访问的域名与域名黑名单比对，如果域名黑名单中包括该目标进程请求访问的域名，则匹配成功，说明该目标进程请求访问的域名为非法域名。如果该目标进程请求访问的域名与域名黑名单也无法匹配，则进一步说明该目标进程请求访问的域名不确定是否为合法域名，执行下一步流程。当然，针对客户端主机同时具有域名白名单和域名黑名单的情况，也可以先将该目标进程请求访问的域名与域名黑名单比对，如果未匹配成功，再将该目标进程请求访问的域名与域名白名单进行比对。关于同时具备域名黑名单和域名白名单的情况下，先比对哪个名单，本申请实施例对此不进行限定。
综上，针对Agent进行域名访问的检测过程以图6为例，图6所示的Agent的工作流程主要包括以下步骤。
601，目标进程进行域名解析，即目标进程请求访问某个域名时，触发动态库文件的逻辑，通知了代理Agent，例如，Agent端收到libnss_hw.so发来的通知，通知中包括目标进程请求访问的域名和目标进程的进程标识。
602，Agent首先将目标进程请求访问的域名与域名黑名单匹配，域名黑名单中含有恶意域名，即非法域名。如果域名黑名单中包括目标进程请求访问的域名，则目标进程请求访问的域名与域名黑名单中的恶意域名匹配成功，也即目标进程请求访问的域名命中域名黑名单，执行603；如果域名黑名单中不包括目标进程请求访问的域名，则目标进程请求访问的域名与域名黑名单中的恶意域名匹配未成功，也即目标进程请求访问的域名未命中域名黑名单，执行604。
可选地，客户端除了具有域名黑名单之外，还可以采用域名白名单的方式，域名白名单中含有合法域名。例如，客户端判断客户端的域名白名单中是否包括目标进程请求访问的域名，如果客户端的域名白名单中包括目标进程请求访问的域名，则目标进程请求访问的域名与域名白名单中的合法域名匹配成功，也即目标进程请求访问的域名命中域名白名单，说明目标进程请求访问的域名是合法域名，则整个流程结束，否则执行下一步的检测流程，如上报给服务端，由服务端进行检测。
在示例性实施例中，客户端还可以同时具有域名白名单和域名黑名单，客户端将目标进程访问的域名与域名白名单比对，如果域名白名单中不包括该目标进程请求访问的域名，则目标进程请求访问的域名与域名白名单中的合法域名匹配未成功，说明该目标进程请求访问的域名不确定是否为合法域名，进一步将该域名与域名黑名单比对，如果域名黑名单中包括该目标进程请求访问的域名，则目标进程请求访问的域名与域名黑名单中的恶意域名匹配成功，说明该目标进程请求访问的域名为非法域名。如果该目标进程请求访问的域名与域名黑名单也无法匹配，则进一步说明该目标进程请求访问的域名不确定是否为合法域名，执行下一步流程，如上报给服务端，由服务端进行检测。当然，针对客户端同时具有域名白名单和域名黑名单的情况，也可以先将该目标进程请求访问的域名与域名黑名单比对，如果目标进程请求访问的域名与域名黑名单中的恶意域名未匹配成功，再将该目标进程请求访问的域名 与域名白名单进行比对。
603，域名黑名单中包括目标进程请求访问的域名，则目标进程请求访问的域名与域名黑名单中的恶意域名匹配成功，即目标进程请求访问的域名命中域名黑名单，说明这是一个恶意域名解析行为，那么将此事件上报。还可以进行展示。
604，域名黑名单中不包括目标进程请求访问的域名，则目标进程请求访问的域名与域名黑名单中的恶意域名匹配未成功，即目标进程请求访问的域名未命中域名黑名单，则获取目标进程的PID，将目标进程的PID、目标进程请求访问的域名等参数信息上报给服务端(server)。
接下来回到附图3所示的流程中。
303，服务端主机接收客户端主机发送的目标进程的参数信息。
示例性地，服务端主机接收到的客户端主机发送的目标进程的参数信息包括但不限于目标进程请求访问的域名及目标进程的进程标识。可选地，该参数信息还可以包括目标进程的进程标识对应的可执行文件路径，即生成目标进程的可执行文件在客户端主机上的保存路径。在示例性实施例中，该参数信息中还可以包括生成目标进程的可执行文件的哈希值。
304，服务端主机根据目标进程的参数信息进行安全检测。
在示例性实施例中，目标进程的参数信息包括目标进程请求访问的域名及目标进程的进程标识。由于服务端主机可以连接有多个客户端主机，因而服务端主机可以根据各个客户端主机对域名的检测情况来汇总得到服务端本地的一个域名黑名单，该服务端本地的域名黑名单比发送目标进程的参数信息的客户端主机当前的域名黑名单更为全面。因此，在示例性实施例中，当服务端主机接收到目标进程的参数信息后，服务端主机在根据该目标进程的参数信息进行安全检测时，可先将该目标进程请求访问的域名与服务端主机本地域名黑名单中包含的非法域名进行比对，根据比对结果确定该本地域名黑名单中是否包括该目标进程请求访问的域名。例如，如果根据比对结果确定该本地域名黑名单中包括该目标进程请求访问的域名，则可以直接得到安全的检测结果，通过该安全的检测结果指示该目标进程请求访问的域名是合法域名。如果根据比对结果确定该本地域名黑名单中不包括该目标进程请求访问的域名，则可以采用其他方式继续进行检测。
需要说明的是，以上仅以服务端主机采用本地域名黑名单为例进行说明，除此之外，服务端主机本地还可以存储域名白名单，采用域名白名单进行安全检测。又或者，服务端主机本地可以既存储了域名白名单，也存储了域名黑名单，则服务端主机采用域名黑名单和域名白名单的方式进行检测，本申请实施例对此不进行限定。
针对采用本地域名黑名单及域名白名单均未得到检测结果的情况，可根据该目标进程的参数信息对目标进程是否恶意来进行进一步的检测。本申请实施例对此不进行限定，在示例性实施例中，该参数信息还包括目标进程的可执行文件在客户端主机上的保存路径；根据目标进程的参数信息进行安全检测，包括：根据生成目标进程的可执行文件在客户端主机上的保存路径与可执行文件的哈希值的对应关系，获取可执行文件的哈希值，根据可执行文件的哈希值对可执行文件进行安全检测，根据检测结果判断可执行文件是否为恶意文件。
其中，可选地，生成目标进程的可执行文件在客户端主机上的保存路径与可执行文件的哈希值的对应关系是在本次进行恶意域名访问的检测之前，由服务端主机提前存储的。例如，主机在目标进程启动阶段，客户端主机可对目标进程的信息进行采集，得到目标进程的PID、生成目标进程的可执行文件在客户端主机上的保存路径，还可以计算得到可执行文件的哈希 值等。之后，客户端主机将该目标进程的信息上报给服务端主机，服务端主机可根据客户端主机上报的目标进程的信息确定并存储生成目标进程的可执行文件在客户端主机上的保存路径与可执行文件的哈希值的对应关系。该对应关系中包括但不限于生成目标进程的可执行文件在客户端主机上的保存路径及可执行文件的哈希值，还可以包括目标进程的标识等信息，本申请实施例不对该对应关系的内容进行限定，能够根据该对应关系确定该目标进程的可执行文件的哈希值即可。
进一步地，当目标进程触发域名访问时，为了实现恶意域名访问的检测，客户端主机将目标进程请求访问的域名、目标进程的进程标识及生成目标进程的可执行文件在客户端主机上的保存路径等作为目标进程的参数信息上报给服务端主机后，服务端主机接收到客户端主机发送的该目标进程的参数信息，通过该目标进程的参数信息再次获取到生成目标进程的可执行文件在客户端主机上的保存路径，从而通过查询对应关系确定该目标进程的可执行文件的哈希值。之后便可以根据可执行文件的哈希值对可执行文件进行安全检测，根据检测结果判断可执行文件是否为恶意文件。
在示例性实施例中，根据可执行文件的哈希值对可执行文件进行安全检测，根据检测结果判断可执行文件是否为恶意文件，包括但不限于如下几种情况。
情况一：将可执行文件的哈希值与恶意程序黑名单中包含的非法程序的哈希值进行比对；响应于恶意程序黑名单中存在与可执行文件的哈希值相匹配的恶意程序的哈希值，确定可执行文件为恶意文件。
该种情况一，服务端主机具有恶意程序黑名单，该恶意程序黑名单中具有恶意程序的哈希值。因此，服务端主机将可执行文件的哈希值与恶意程序黑名单中包含的恶意程序的哈希值进行比对。如果恶意程序黑名单中存在与可执行文件的哈希值相匹配的恶意程序的哈希值，确定可执行文件为恶意文件。
情况二：将可执行文件的哈希值与恶意程序黑名单中包含的恶意程序的哈希值进行比对；响应于恶意程序黑名单中不存在与可执行文件的哈希值相匹配的恶意程序的哈希值，向客户端主机发送可执行文件的哈希值，接收客户端主机对可执行文件的哈希值进行验证之后发送的可执行文件。使用第三方检测技术对所述可执行文件进行检测，根据检测结果确定可执行文件是否为恶意文件。本实施例中的第三方检测技术是指除客户端主机和服务端主机的提供商之外的其他软硬件提供商提供的检测技术。第三方检测技术包括静态行为检测技术和动态行为检测技术。特征扫描引擎是静态行为检测技术的一个例子，扫描引擎对可执行文件进行文件扫描，以识别可执行文件中是否包含已知的与恶意程序相关的特征码，并根据扫描结果确定可执行文件是否为恶意文件。动态行为检测技术包括沙箱，沙箱提供了一种虚拟运行环境。沙箱通过收集可执行文件在虚拟运行环境中运行时产生的行为序列，并通过分析收集到的行为序列与基于已知恶意程序的行为序列构建的恶意行为模型之间的相似性，确定可执行文件是否为恶意文件。
该种情况二，服务端主机也需要具有恶意程序黑名单，该恶意程序黑名单中具有恶意程序的哈希值。因此，服务端主机将可执行文件的哈希值与恶意程序黑名单中包含的恶意程序的哈希值进行比对。如果恶意程序黑名单中不存在与可执行文件的哈希值相匹配的恶意程序的哈希值，则不确定可执行文件是否为恶意文件。为了进一步确定可执行文件是否为恶意文件，本申请实施例调用第三方扫描引擎对可执行文件进行扫描。
也就是说，该情况二是在通过恶意程序黑名单无法确定可执行文件是否为恶意文件的情况下采用的。可选地，如果客户端主机和服务端主机当前仅针对一个目标进程进行恶意域名访问的检测，则服务端主机可以仅向客户端主机发送该目标进程的可执行文件的哈希值，客户端主机接收到该可执行文件的哈希值之后，按照该目标进程的可执行文件在客户端主机上的保存路径去获取可执行文件，之后计算该可执行文件的哈希值，如果客户端主机计算的哈希值与服务端主机发送的哈希值一致，则验证通过，将该可执行文件发送给服务端主机。
可选地，由于客户端主机和服务端主机之间可能不止检测一个进程，除了当前的目标进程，服务端可能也在对客户端主机上的其他进程在检测，所以，为了使得客户端主机能够确定向服务端主机返回哪个进程的可执行文件，该服务端主机除了向客户端主机发送可执行文件的哈希值，还可以向客户端主机发送生成该目标进程的可执行文件在客户端主机上的保存路径，使得客户端主机对根据服务端主机发送的保存路径去获取对应的可执行文件，并在验证之后将可执行文件发送给服务端主机。
此外，针对该情况二，根据扫描结果确定可执行文件是否为恶意文件之后，还包括：响应于可执行文件为恶意文件，将可执行文件的哈希值加入恶意程序黑名单中。通过在确定可执行文件为恶意文件的情况下，将可执行文件的哈希值加入恶意程序黑名单中，使得恶意程序黑名单中记录的恶意进程越来越全面，便于后续快速检测。
需要说明的是，针对上述情况一和情况二，服务端主机还可以不具有恶意程序黑名单，而具有程序白名单，该程序白名单中包括合法程序的哈希值。则服务端将可执行文件的哈希值与程序白名单中包含的合法程序的哈希值进行比对；响应于程序白名单中存在与可执行文件的哈希值相匹配的合法程序的哈希值，确定该可执行文件为合法文件。如果程序白名单中不存在与可执行文件的哈希值相匹配的合法程序的哈希值，根据可执行文件的路径及哈希值获取可执行文件；使用第三方检测技术对可执行文件进行检测，根据检测结果确定可执行文件是否为恶意文件。
可选地，在示例性实施例中，服务端主机还可以同时具有程序白名单和恶意程序黑名单，服务端主机将可执行文件的哈希值与程序白名单比对，未匹配则说明该可执行文件不确定是否为合法文件，进一步将该可执行文件的哈希值与恶意程序黑名单比对，如果匹配成功，即恶意程序黑名单中存在与可执行文件的哈希值匹配的恶意程序的哈希值，则说明该可执行文件为恶意文件。如果该可执行文件的哈希值与恶意程序黑名单也无法匹配，则进一步说明该可执行文件不确定是否为合法文件，执行使用第三方引擎扫描的流程。当然，针对服务端主机同时具有程序白名单和恶意程序黑名单的情况，也可以先将该可执行文件的哈希值与恶意程序黑名单比对，如果未匹配成功，再将该可执行文件的哈希值与程序白名单进行比对。关于同时具备恶意程序黑名单和程序白名单的情况下，先比对哪个名单，本申请实施例对此不进行限定。
情况三：向客户端主机发送可执行文件的哈希值，接收客户端主机对可执行文件的哈希值进行验证之后发送的可执行文件；使用第三方检测技术对可执行文件进行检测，根据检测结果确定可执行文件是否为恶意文件。
该情况三可以认为是服务端主机未具有恶意程序黑名单和程序白名单的情况下采取的处理方式，该方式直接采用第三方检测技术来对可执行文件进行检测，根据检测结果确定出可执行文件是否为恶意文件。
需要说明的是，无论是上述哪种情况，本申请实施例均不对使用的第三方检测技术进行限定，详见上述情况二中的相关内容。此外，该情况三中，服务端主机除了向客户端主机发送可执行文件的哈希值，也可以向客户端主机发送生成该目标进程的可执行文件在客户端主机上的保存路径，使得客户端主机对根据服务端主机发送的保存路径去获取对应的可执行文件，并在验证之后将可执行文件发送给服务端主机。关于向客户端主机发送可执行文件的哈希值，接收客户端主机对可执行文件的哈希值进行验证之后发送的可执行文件的过程，可参见上述情况二的相关内容，此处不再赘述。
在示例性实施例中，Server通过可执行文件hash及文件扫描等手段，判断进程是否恶意的过程可如图7所示，其中，该Server是软件模块，如图2中的Server所示。如图7所示，Server的工作流程主要包括以下步骤。
701，Agent端对目标进程启动实时监控，并实时上报目标进程的启动信息。
702，Server端收到该目标进程的启动信息后，会对目标进程进行恶意检查，例如，使用可执行文件hash进行恶意程序黑名单匹配。
703，Server端判断恶意程序黑名单中是否包括该可执行文件的哈希值，即确定生成目标进程的可执行文件的hash是否命中恶意程序黑名单，如果该生成目标进程的可执行文件的hash命中恶意程序黑名单，则说明此目标进程是恶意的，将其检测结果存储起来，执行705，并结束检测流程。如果该生成目标进程的可执行文件的hash没有命中恶意程序黑名单则执行下一步704。
704，使用第三方检测技术对可执行文件进行检测，如果是恶意的，则Server端将结果进行存储，也即执行705。
705，Server端存储检测结果。
在示例性实施例中，根据检测结果判断可执行文件是否为恶意文件之后，还包括：响应于可执行文件为恶意文件，将目标进程请求访问的域名加入本地域名黑名单，得到更新的域名黑名单；向客户端主机发送更新的域名黑名单。
可选地，以图8所示的Server进行恶意域名识别及更新机制流程为例。如图8所示，Server的工作流程主要包括以下步骤。
801，server端收到agent上报的可疑域名及进程信息。该可疑域名为目标进程请求访问的域名，示例性地，该进程信息包括目标进程的PID。
802，server端将可疑域名与域名白名单进行比对，以确定域名是否匹配域名白名单。如果域名白名单中包括agent上报的可疑域名，则该可疑域名与域名白名单中的合法域名匹配成功，也即该可疑域名命中域名白名单，则整个流程结束；否则执行下一步803。
可选地，服务端除了具有域名白名单之外，还可以采用域名黑名单的方式，该域名黑名单包括非法域名。例如，服务端判断agent上报的域名是否属于服务端的域名黑名单，如果该域名黑名单中包括该agent上报的域名，则该agent上报的域名为非法域名，整个流程结束，否则执行下一步流程。在示例性实施例中，服务端还可以同时具有域名白名单和域名黑名单，服务端将agent上报的域名与域名白名单比对，域名白名单中不包括该域名，即该域名未与域名白名单中的合法域名匹配，则说明该域名不确定是否为合法域名。进一步将该域名与域名黑名单比对，如果域名黑名单中包括该域名，则该域名与域名黑名单中的非法域名匹配成功，则说明该域名为非法域名。如果该域名与域名黑名单也无法匹配，则进一步说明该域名 不确定是否为合法域名，执行下一步流程。当然，针对服务端同时具有域名白名单和域名黑名单的情况，也可以先将该域名与域名黑名单比对，如果未匹配成功，再将该域名与域名白名单进行比对。
803，server端在恶意进程检测结果里查询此目标进程是否为恶意进程，如果不是恶意进程，则整个流程结束；否则执行下一步804。
示例性地，agent上报的信息还包括目标进程的可执行文件在客户端主机上的保存路径，该恶意进程检测结果里可以包括恶意程序的哈希值，server端根据生成目标进程的可执行文件在客户端主机上的保存路径与可执行文件的哈希值的对应关系，获取到目标进程的可执行文件的哈希值。之后，将该可执行文件的哈希值与恶意进程检测结果里的恶意程序的哈希值进行比对，从而查询此目标进程是否为恶意进程。例如，如果恶意进程检测结果里包括该可执行文件的哈希值，则该目标进程为恶意进程。
804，如果该目标进程是恶意进程，那么此域名可以被认为是恶意域名，然后将其加入到服务端本地的域名黑名单，得到更新的域名黑名单。
805，server端将更新的域名黑名单同步给agent，由agent更新agent本地域名黑名单。
接下来，回到附图3所示的流程中。
305，服务端主机向客户端主机发送安全检测的结果，该安全检测的结果指示目标进程请求访问的域名是否为非法域名。
无论通过上述304得到何种安全检测的结果，服务端主机将安全检测的结果发送给客户端主机，使客户端主机对目标进程进行处理。示例性地，Server将判断结果通知Agent，以便于Agent对发起域名解析过程的目标程序，如浏览器采取进一步控制措施。
306，客户端主机接收服务端主机对应返回的安全检测的结果。
在示例性实施例中，客户端主机接收服务端主机对应返回的安全检测的结果之前，还包括：接收服务端主机发送的可执行文件的哈希值；根据可执行文件的路径获取可执行文件，对可执行文件进行哈希值计算，将计算得到的哈希值与服务端主机发送的哈希值进行比对；响应于计算得到的哈希值与服务端主机发送的哈希值一致，向服务端主机发送可执行文件。
示例性地，客户端主机可存储多个可执行文件，如果客户端主机与服务端主机仅针对一个目标进程进行恶意域名访问的检测，则客户端主机接收到服务端主机发送的可执行文件的哈希值之后，可从存储的多个可执行文件中获取生成当前正在进行检测的目标进程的可执行文件，对可执行文件进行哈希值计算，将计算得到的哈希值与服务端主机发送的哈希值进行比对。在比对结果为计算得到的哈希值与服务端主机发送的哈希值一致的情况下，再向服务端主机发送可执行文件。
此外，服务端主机还可以在发送可执行文件的哈希值时发送该生成目标进程的可执行文件在客户端主机上的保存路径，当客户端主机接收到服务端主机发送的生成目标进程的可执行文件在客户端主机上的保存路径及哈希值之后，先根据该保存路径获取可执行文件，通过客户端主机自行对可执行文件进行哈希值计算，将计算得到的哈希值与服务端主机发送的哈希值进行比对。在比对结果为计算得到的哈希值与服务端主机发送的哈希值一致的情况下，再向服务端主机发送可执行文件，从而可以进一步保证可执行文件的安全性。
307，客户端主机根据安全检测的结果对目标进程进行处理。
客户端主机根据安全检测的结果对目标进程进行处理的方式，本申请实施例不进行限定。 示例性地，如果安全检测的结果指示该目标进程访问的域名为合法域名，则客户端主机允许该目标进程访问该域名。如果安全检测的结果指示该目标进程访问的域名为非法域名，即恶意域名，则客户端阻止该目标进程访问该域名。
在示例性实施例中，服务端主机在确定有新的非法域名，将该新的非法域名加入到域名黑名单，得到更新的域名黑名单的情况，客户端主机根据比对结果确定本地域名黑名单中不包括目标进程请求访问的域名之后，还包括：接收服务端主机发送的更新的域名黑名单，根据更新的域名黑名单更新本地域名黑名单。示例性地，本申请实施例不对客户端根据更新的域名黑名单更新本地域名黑名单的方式进行限定，例如，可以直接将更新的域名黑名单替换本地域名黑名单，也可以采取增量更新的方式，即将更新的域名黑名单中新增的非法域名添加到本地域名黑名单中。
该方法能够实时获取域名解析行为及所属进程，对于做域名解析的进程会有一个溯源的作用。将客户端中不能确定的域名及所属进程信息上传到服务端，服务端会结合恶意进程检测功能，对于此域名的恶意进行判断。如果是恶意的，那么服务端会将其加入黑名单，并把黑名单同步给客户端，提高客户端识别恶意域名的能力。此方案中客户端和服务端有机的配合，能够自运营出一个高效的域名黑名单，降低了漏报误报率。
此外，本申请实施例提供的方法能够自更新恶意域名黑名单，除了单纯的使用恶意域名黑名单，服务端还可以结合域名解析数据和进程信息数据，学习获得新的恶意域名，并更新策略到客户端，使新的恶意域名生效，形成了一个闭环的机制，可以进一步提高后续的恶意域名检测的准确性。
相应地，本申请实施例还提供了一种恶意域名访问的检测装置，该装置用于实现图2-图8实施例中agent的功能。本装置实施例中提供的恶意域名访问的检测装置，可以集成在主机设备中，例如应用于客户端主机。恶意域名访问的检测装置可以实现的其他附加功能、以及与其他网元设备的交互过程，请参照方法实施例中对agent的描述，在这里不再赘述。示例性地，参见图9，该恶意域名访问的检测装置包括：
处理单元901，用于在目标进程触发域名访问时，获取目标进程请求访问的域名以及目标进程的进程标识，目标进程的进程标识用于标识一个客户端主机上运行的应用程序；
通信单元902，用于向服务端主机发送目标进程的参数信息，参数信息包括目标进程请求访问的域名及目标进程的进程标识；
通信单元902，还用于接收服务端主机对应返回的安全检测的结果，安全检测的结果指示目标进程请求访问的域名是否为非法域名；
处理单元901，还用于根据安全检测的结果对目标进程进行处理。
在示例性实施例中，处理单元901，还用于将目标进程请求访问的域名与本地黑名单中包含的非法域名进行比对，根据比对结果确定本地域名黑名单中不包括目标进程请求访问的域名。
在示例性实施例中，处理单元901，用于通过目标进程调用的动态库文件获取目标进程请求访问的域名以及目标进程的进程标识。
在示例性实施例中，通信单元902，还用于接收服务端主机发送的更新的域名黑名单；
处理单元，还用于根据更新的域名黑名单更新本地域名黑名单。
在示例性实施例中，参数信息还包括生成目标进程的可执行文件在客户端主机上的保存路径，通信单元902，还用于接收服务端主机发送的可执行文件的哈希值；
处理单元901，还用于根据生成目标进程的可执行文件在客户端主机上的保存路径获取可执行文件，对可执行文件进行哈希值计算，将计算得到的哈希值与服务端主机发送的哈希值进行比对；
通信单元902，还用于响应于计算得到的哈希值与服务端主机发送的哈希值一致，向服务端主机发送可执行文件。
本申请实施例提供的装置，通过实时获取域名解析行为及所属进程，将不能确定的域名及所属进程信息上传到服务端主机，从而结合服务端主机的恶意进程检测功能，对于此域名的恶意进行判断。通过与服务端主机有机的配合，能够自运营出一个高效的域名黑名单，降低了漏报误报率。
本申请实施例还提供了一种恶意域名访问的检测装置，用于实现图2-图8实施例中server的功能。本装置实施例中提供的恶意域名访问的检测装置，可以集成在主机设备中，例如应用于服务端主机上。恶意域名访问的检测装置可以实现的其他附加功能、以及与其他网元设备的交互过程，请参照方法实施例中对server的描述，在这里不再赘述。示例性地，参见图10，该恶意域名访问的检测装置包括：
通信单元1001，用于接收客户端主机发送的目标进程的参数信息，参数信息包括目标进程请求访问的域名及目标进程的进程标识；
处理单元1002，用于根据目标进程的参数信息进行安全检测；
通信单元1001，还用于向客户端主机发送安全检测的结果，安全检测的结果指示目标进程请求访问的域名是否为非法域名。
在示例性实施例中，参数信息还包括生成目标进程的可执行文件在客户端主机上的保存路径；处理单元1002，用于根据生成目标进程的可执行文件在客户端主机上的保存路径与可执行文件的哈希值的对应关系，获取可执行文件的哈希值，根据可执行文件的哈希值对可执行文件进行安全检测，根据检测结果判断可执行文件是否为恶意文件。
在示例性实施例中，处理单元1002，用于将可执行文件的哈希值与恶意程序黑名单中包含的恶意程序的哈希值进行比对；响应于恶意程序黑名单中存在与可执行文件的哈希值相匹配的恶意程序的哈希值，确定可执行文件为恶意文件。
在示例性实施例中，处理单元1002，用于将可执行文件的哈希值与恶意程序黑名单中包含的恶意程序的哈希值进行比对；
通信单元1001，用于响应于恶意程序黑名单中不存在与可执行文件的哈希值相匹配的恶意程序的哈希值，向客户端主机发送可执行文件的哈希值，接收客户端主机对可执行文件的哈希值进行验证之后发送的可执行文件；
处理单元1002，用于使用第三方检测技术对可执行文件进行检测，根据检测结果确定可执行文件是否为恶意文件。
在示例性实施例中，处理单元1002，还用于响应于可执行文件为恶意文件，将可执行文件的哈希值加入恶意程序黑名单中。
在示例性实施例中，通信单元1001，用于向客户端主机发送可执行文件的哈希值，接收 客户端主机对可执行文件的哈希值进行验证之后发送的可执行文件；
处理单元1002，用于使用第三方检测技术对可执行文件进行检测，根据检测结果确定可执行文件是否为恶意文件。
在示例性实施例中，处理单元1002，还用于将目标进程请求访问的域名与本地域名黑名单中包含的非法域名进行比对，根据比对结果确定本地域名黑名单中不包括目标进程请求访问的域名。
在示例性实施例中，处理单元1002，还用于响应于可执行文件为恶意文件，将目标进程请求访问的域名加入本地域名黑名单，得到更新的域名黑名单；
通信单元1001，还用于向客户端主机发送更新的域名黑名单。
本申请实施例提供的装置，通过客户端主机实时获取域名解析行为及所属进程，将客户端中不能确定的域名及所属进程信息上传，从而结合恶意进程检测功能，对于此域名的恶意进行判断。通过与客户端主机有机的配合，能够自运营出一个高效的域名黑名单，降低了漏报误报率。
应理解的是，上述图9或图10提供的装置在实现其功能时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将设备的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的装置与方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
相应地，本申请实施例还提供了一种恶意域名访问的检测系统，包括图2中的agent和server。agent和server的更多实现细节和交互过程，请参照前面图3所示实施例中的描述，在这里不再赘述。
本申请实施例还提供了一种电子设备，该电子设备为上述实施例中服务端主机或客户端主机，该电子设备的硬件结构可以包括但不限于如图11所示结构：
如图11所示，该电子设备1100包括收发器1103、处理器1102和存储器1101。其中，收发器1103用于接收报文或数据信息等，处理器1102用于执行上述图3所示实施例中服务端主机或客户端主机处理的相关步骤。
需说明的是，以上描述的任意装置实施例都仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。另外，本申请提供的第一网络节点或控制器实施例附图中，模块之间的连接关系表示它们之间具有通信连接，具体可以实现为一条或多条通信总线或信号线。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
图12为本申请实施例提供的电子设备的硬件结构示意图。图12所示的电子设备1200可以执行上述实施例的方法中客户端主机或服务端主机执行的相应步骤。
如图12所示，电子设备1200包括处理器1201、存储器1202、接口1203和总线1204。 其中接口1203可以通过无线或有线的方式实现，具体来讲可以是网卡。上述处理器1201、存储器1202和接口1203通过总线1204连接。
所述处理器1201用于执行上述实施例中客户端主机或服务端主机进行的处理。所述接口1203用于接收和发送数据。
例如，当所述电子设备1200为上述方法实施例中的客户端主机时，作为举例，处理器1201用于支持在目标进程触发域名访问时，获取目标进程请求访问的域名以及目标进程的进程标识，目标进程的进程标识用于标识一个该客户端主机上运行的应用程序，可参考图3中步骤301所述的内容。所述接口1203用于支持向服务端主机发送目标进程的参数信息，该参数信息包括目标进程请求访问的域名及目标进程的进程标识，可参考图3中步骤302所述的内容。接口1203，还用于接收服务端主机对应返回的安全检测的结果，可参见图3中步骤306所述的内容。处理器1201还用于根据安全检测的结果对目标进程进行处理，可参见图3中步骤307所述的内容。
例如，当所述电子设备1200为上述方法实施例中的服务端主机时，所述接口1203用于接收客户端主机发送的目标进程的参数信息，该参数信息包括目标进程请求访问的域名及目标进程的进程标识，可参见图3中步骤303所述的内容。处理器1201，用于根据目标进程的参数信息进行安全检测，可参见图3中步骤304所述的内容。接口1203，还用于向客户端主机发送安全检测的结果，该安全检测的结果指示目标进程请求访问的域名是否为非法域名，可参见图3中步骤305所述的内容。
存储器1202包括操作系统12021和应用程序12022，用于存储程序、代码或指令，当处理器1201或硬件设备执行这些程序、代码或指令时可以完成方法实施例中涉及网络设备的处理过程。可选的，所述存储器1202可以包括只读存储器(英文：Read-only Memory，缩写：ROM)和随机存取存储器(英文：Random Access Memory，缩写：RAM)。其中，所述ROM包括基本输入/输出系统(英文：Basic Input/Output System，缩写：BIOS)或嵌入式系统；所述RAM包括应用程序和操作系统。当需要运行电子设备1200时，通过固化在ROM中的BIOS或者嵌入式系统中的bootloader引导系统进行启动，引导电子设备1200进入正常运行状态。在电子设备1200进入正常运行状态后，运行在RAM中的应用程序和操作系统，从而，完成方法实施例中涉及客户端主机或服务端主机的处理过程。
可以理解的是，图12仅仅示出了电子设备1200的简化设计。在实际应用中，电子设备1200可以包含任意数量的接口，处理器或者存储器。
应理解的是，上述处理器可以是中央处理器(Central Processing Unit，CPU)，还可以是其他通用处理器、数字信号处理器(digital signal processing，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现场可编程门阵列(field－programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者是任何常规的处理器等。值得说明的是，处理器可以是支持进阶精简指令集机器(advanced RISC machines，ARM)架构的处理器。
进一步地，在一种可选的实施例中，上述存储器可以包括只读存储器和随机存取存储器，并向处理器提供指令和数据。存储器还可以包括非易失性随机存取存储器。例如，存储器还可以存储设备类型的信息。
该存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两 者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用。例如，静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic random access memory，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data date SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
还提供了一种计算机可读存储介质，存储介质中存储有至少一条指令，指令由处理器加载并执行以实现如上任一所述的恶意域名访问的检测方法。
本申请提供了一种计算机程序，当计算机程序被计算机执行时，可以使得处理器或计算机执行上述方法实施例中对应的各个步骤和/或流程。
本申请实施例还提供了一种芯片，包括存储器件和处理器件，存储器件用于存储计算机指令，处理器件用于从存储器件中调用并运行该计算机指令，以执行上述方法实施例中客户端主机或者服务端主机执行的步骤。
本申请说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的范围。这样，倘若本申请的这些修改和变型属于本申请权利要求的范围之内，则本申请也意图包括这些改动和变型在内。

Claims (30)

  1. 一种恶意域名访问的检测方法，其特征在于，包括：
    客户端主机在目标进程触发域名访问时，获取所述目标进程请求访问的域名以及所述目标进程的进程标识，所述目标进程的进程标识用于标识一个所述客户端主机上运行的应用程序；
    所述客户端主机向服务端主机发送所述目标进程的参数信息，所述参数信息包括所述目标进程请求访问的域名及所述目标进程的进程标识；
    所述客户端主机接收所述服务端主机对应返回的安全检测的结果，所述安全检测的结果指示所述目标进程请求访问的域名是否为非法域名；
    所述客户端主机根据所述安全检测的结果对所述目标进程进行处理。
  2. 根据权利要求1所述的方法，其特征在于，所述向服务端主机发送所述目标进程的参数信息之前，所述方法还包括：
    将所述目标进程请求访问的域名与本地域名黑名单中包含的非法域名进行比对，根据比对结果确定所述本地域名黑名单中不包括所述目标进程请求访问的域名。
  3. 根据权利要求1或2所述的方法，其特征在于，所述获取目标进程请求访问的域名以及所述目标进程的进程标识，包括：
    通过所述目标进程调用的动态库文件获取所述目标进程请求访问的域名以及所述目标进程的进程标识。
  4. 根据权利要求2所述的方法，其特征在于，所述根据比对结果确定所述本地域名黑名单中不包括所述目标进程请求访问的域名之后，还包括：
    接收所述服务端主机发送的更新的域名黑名单，根据所述更新的域名黑名单更新所述本地域名黑名单。
  5. 根据权利要求1-4任一所述的方法，其特征在于，所述参数信息还包括生成所述目标进程的可执行文件在所述客户端主机上的保存路径，所述接收所述服务端主机对应返回的安全检测的结果之前，还包括：
    接收所述服务端主机发送的所述可执行文件的哈希值；
    根据生成所述目标进程的可执行文件在所述客户端主机上的保存路径获取所述可执行文件，对所述可执行文件进行哈希值计算，将计算得到的哈希值与所述服务端主机发送的哈希值进行比对；
    响应于所述计算得到的哈希值与所述服务端主机发送的哈希值一致，向所述服务端主机发送所述可执行文件。
  6. 一种恶意域名访问的检测方法，其特征在于，包括：
    服务端主机接收客户端主机发送的目标进程的参数信息，所述参数信息包括所述目标进程请求访问的域名及所述目标进程的进程标识；
    所述服务端主机根据所述目标进程的参数信息进行安全检测；
    所述服务端主机向所述客户端主机发送安全检测的结果，所述安全检测的结果指示所述目标进程请求访问的域名是否为非法域名。
  7. 根据权利要求6所述的方法，其特征在于，所述参数信息还包括生成所述目标进程的可执行文件在所述客户端主机上的保存路径，所述根据所述目标进程的参数信息进行安全检测，包括：
    根据生成所述目标进程的可执行文件在所述客户端主机上的保存路径与所述可执行文件的哈希值的对应关系，获取所述可执行文件的哈希值，根据所述可执行文件的哈希值对所述可执行文件进行安全检测，根据检测结果判断所述可执行文件是否为恶意文件。
  8. 根据权利要求7所述的方法，其特征在于，所述根据所述可执行文件的哈希值对所述可执行文件进行安全检测，根据检测结果判断所述可执行文件是否为恶意文件，包括：
    将所述可执行文件的哈希值与恶意程序黑名单中包含的恶意程序的哈希值进行比对；
    响应于所述恶意程序黑名单中存在与所述可执行文件的哈希值相匹配的恶意程序的哈希值，确定所述可执行文件为恶意文件。
  9. 根据权利要求7所述的方法，其特征在于，所述根据所述可执行文件的哈希值对所述可执行文件进行安全检测，根据检测结果判断所述可执行文件是否为恶意文件，包括：
    将所述可执行文件的哈希值与恶意程序黑名单中包含的恶意程序的哈希值进行比对；
    响应于所述恶意程序黑名单中不存在与所述可执行文件的哈希值相匹配的恶意程序的哈希值，向所述客户端主机发送所述可执行文件的哈希值，接收所述客户端主机对所述可执行文件的哈希值进行验证之后发送的所述可执行文件；
    使用第三方检测技术对所述可执行文件进行检测，根据检测结果确定所述可执行文件是否为恶意文件。
  10. 根据权利要求9所述的方法，其特征在于，所述根据检测结果确定所述可执行文件是否为恶意文件之后，还包括：
    响应于所述可执行文件为恶意文件，将所述可执行文件的哈希值加入所述恶意程序黑名单中。
  11. 根据权利要求7所述的方法，其特征在于，所述根据所述可执行文件的哈希值对所述可执行文件进行安全检测，根据检测结果判断所述可执行文件是否为恶意文件，包括：
    向所述客户端主机发送所述可执行文件的哈希值，接收所述客户端主机对所述可执行文件的哈希值进行验证之后发送的所述可执行文件；
    使用第三方检测技术对所述可执行文件进行检测，根据检测结果确定所述可执行文件是否为恶意文件。
  12. 根据权利要求7-11任一所述的方法，其特征在于，所述获取所述可执行文件的哈希值之前，还包括：
    将所述目标进程请求访问的域名与本地域名黑名单中包含的非法域名进行比对，根据比对结果确定所述本地域名黑名单中不包括所述目标进程请求访问的域名。
  13. 根据权利要求12所述的方法，其特征在于，所述根据检测结果判断所述可执行文件是否为恶意文件之后，还包括：
    响应于所述可执行文件为恶意文件，将所述目标进程请求访问的域名加入所述本地域名黑名单，从而得到更新的域名黑名单；
    向所述客户端主机发送所述更新的域名黑名单。
  14. 一种恶意域名访问的检测装置，其特征在于，所述装置应用于客户端主机，包括：
    处理单元，用于在目标进程触发域名访问时，获取所述目标进程请求访问的域名以及所述目标进程的进程标识，所述目标进程的进程标识用于标识一个所述客户端主机上运行的应用程序；
    通信单元，用于向服务端主机发送所述目标进程的参数信息，所述参数信息包括所述目标进程请求访问的域名及所述目标进程的进程标识；
    所述通信单元，还用于接收所述服务端主机对应返回的安全检测的结果，所述安全检测的结果指示所述目标进程请求访问的域名是否为非法域名；
    所述处理单元，还用于根据所述安全检测的结果对所述目标进程进行处理。
  15. 根据权利要求14所述的装置，其特征在于，所述处理单元，还用于将所述目标进程请求访问的域名与本地黑名单中包含的非法域名进行比对，根据比对结果确定所述本地域名黑名单中不包括所述目标进程请求访问的域名。
  16. 根据权利要求14或15所述的装置，其特征在于，所述处理单元，用于通过所述目标进程调用的动态库文件获取所述目标进程请求访问的域名以及所述目标进程的进程标识。
  17. 根据权利要求15所述的装置，其特征在于，所述通信单元，还用于接收所述服务端主机发送的更新的域名黑名单；
    所述处理单元，还用于根据所述更新的域名黑名单更新所述本地域名黑名单。
  18. 根据权利要求14-17任一所述的装置，其特征在于，所述参数信息还包括生成所述目标进程的可执行文件在所述客户端主机上的保存路径，所述通信单元，还用于接收所述服务端主机发送的所述可执行文件的哈希值；
    所述处理单元，还用于根据生成所述目标进程的可执行文件在所述客户端主机上的保存路径获取所述可执行文件，对所述可执行文件进行哈希值计算，将计算得到的哈希值与所述服务端主机发送的哈希值进行比对；
    所述通信单元，还用于响应于所述计算得到的哈希值与所述服务端主机发送的哈希值一致，向所述服务端主机发送所述可执行文件。
  19. 一种恶意域名访问的检测装置，其特征在于，所述装置应用于服务端主机，包括：
    通信单元，用于接收客户端主机发送的目标进程的参数信息，所述参数信息包括所述目标进程请求访问的域名及所述目标进程的进程标识；
    处理单元，用于根据所述目标进程的参数信息进行安全检测；
    所述通信单元，还用于向所述客户端主机发送安全检测的结果，所述安全检测的结果指示所述目标进程请求访问的域名是否为非法域名。
  20. 根据权利要求19所述的装置，其特征在于，所述参数信息还包括生成所述目标进程的可执行文件在所述客户端主机上的保存路径，所述处理单元，用于根据生成所述目标进程的可执行文件在所述客户端主机上的保存路径与所述可执行文件的哈希值的对应关系，获取所述可执行文件的哈希值，根据所述可执行文件的哈希值对所述可执行文件进行安全检测，根据检测结果判断所述可执行文件是否为恶意文件。
  21. 根据权利要求20所述的装置，其特征在于，所述处理单元，用于将所述可执行文件的哈希值与恶意程序黑名单中包含的恶意程序的哈希值进行比对；响应于所述恶意程序黑名单中存在与所述可执行文件的哈希值相匹配的恶意程序的哈希值，确定所述可执行文件为恶意文件。
  22. 根据权利要求20所述的装置，其特征在于，所述处理单元，用于将所述可执行文件的哈希值与恶意程序黑名单中包含的恶意程序的哈希值进行比对；
    所述通信单元，用于响应于所述恶意程序黑名单中不存在与所述可执行文件的哈希值相匹配的恶意程序的哈希值，向所述客户端主机发送所述可执行文件的哈希值，接收所述客户端主机对所述可执行文件的哈希值进行验证之后发送的所述可执行文件；
    所述处理单元，用于使用第三方检测技术对所述可执行文件进行检测，根据检测结果确定所述可执行文件是否为恶意文件。
  23. 根据权利要求22所述的装置，其特征在于，所述处理单元，还用于响应于所述可执行文件为恶意文件，将所述可执行文件的哈希值加入所述恶意程序黑名单中。
  24. 根据权利要求20所述的装置，其特征在于，所述通信单元，用于向所述客户端主机发送所述可执行文件的哈希值；接收所述客户端主机对所述可执行文件的哈希值进行验证之后发送的所述可执行文件；
    所述处理单元，用于使用第三方检测技术对所述可执行文件进行检测，根据检测结果确定所述可执行文件是否为恶意文件。
  25. 根据权利要求20-24任一所述的装置，其特征在于，所述处理单元，还用于将所述 目标进程请求访问的域名与本地域名黑名单中包含的非法域名进行比对，根据比对结果确定所述本地域名黑名单中不包括所述目标进程请求访问的域名。
  26. 根据权利要求25所述的装置，其特征在于，所述处理单元，还用于响应于所述可执行文件为恶意文件，将所述目标进程请求访问的域名加入所述本地域名黑名单，从而得到更新的域名黑名单；
    所述通信单元，还用于向所述客户端主机发送所述更新的域名黑名单。
  27. 一种客户端主机，其特征在于，包括存储器和处理器，所述存储器用于存储指令，所述处理器读取所述存储器中保存的指令后，使得所述客户端主机执行权利要求1-5任一所述的方法。
  28. 一种服务端主机，其特征在于，包括存储器和处理器，所述存储器用于存储指令，所述处理器读取所述存储器中保存的指令后，使得所述服务端主机执行权利要求6-13任一所述的方法。
  29. 一种恶意域名访问的检测系统，其特征在于，包括如权利要求27所述的客户端主机和如权利要求28所述的服务端主机。
  30. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有至少一条指令，所述指令由处理器加载并执行以实现如权利要求1-13中任一所述的方法。
PCT/CN2020/114561 2019-12-05 2020-09-10 恶意域名访问的检测方法、装置及计算机可读存储介质 WO2021109669A1 (zh)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201911236811 2019-12-05
CN201911236811.0 2019-12-05
CN202010131066.X 2020-02-28
CN202010131066.XA CN112929326B (zh) 2019-12-05 2020-02-28 恶意域名访问的检测方法、装置及计算机可读存储介质

Publications (1)

Publication Number Publication Date
WO2021109669A1 true WO2021109669A1 (zh) 2021-06-10

Family

ID=76162491

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/114561 WO2021109669A1 (zh) 2019-12-05 2020-09-10 恶意域名访问的检测方法、装置及计算机可读存储介质

Country Status (2)

Country Link
CN (1) CN112929326B (zh)
WO (1) WO2021109669A1 (zh)

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113572774A (zh) * 2021-07-27 2021-10-29 杭州迪普科技股份有限公司 一种网络设备中的报文转发方法及装置
CN113676549A (zh) * 2021-09-02 2021-11-19 京东科技信息技术有限公司 应用请求的分流方法及应用网关、电子设备、存储介质
CN113938463A (zh) * 2021-08-27 2022-01-14 中国互联网络信息中心 一种域名滥用阻断方法及装置
CN114301696A (zh) * 2021-12-30 2022-04-08 北京天融信网络安全技术有限公司 恶意域名检测方法、装置、计算机设备及存储介质
CN114401140A (zh) * 2022-01-13 2022-04-26 腾讯科技（深圳）有限公司 访问处理方法、相关设备、存储介质及程序产品
CN114546508A (zh) * 2022-02-28 2022-05-27 广联达科技股份有限公司 工具型应用软件的云端访问方法及装置
CN114844678A (zh) * 2022-04-07 2022-08-02 南京邮电大学 基于隐私保护的浏览器安全查询方法
CN114844704A (zh) * 2022-05-05 2022-08-02 鹏城实验室 基于可编程交换机的实时dns隧道检测方法及相关设备
CN115174197A (zh) * 2022-07-01 2022-10-11 阿里云计算有限公司 webshell文件的检测方法、系统、电子设备及计算机存储介质
CN115842685A (zh) * 2023-02-21 2023-03-24 北京微步在线科技有限公司 一种威胁情报的生成方法、装置、电子设备及存储介质
CN116723051A (zh) * 2023-08-07 2023-09-08 北京安天网络安全技术有限公司 一种域名情报信息生成方法、装置及介质

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113810510A (zh) * 2021-07-30 2021-12-17 绿盟科技集团股份有限公司 一种域名访问方法、装置及电子设备
CN113676473B (zh) * 2021-08-19 2023-05-02 中国电信股份有限公司 网络业务安全防护装置、方法以及存储介质
CN114244612A (zh) * 2021-12-17 2022-03-25 成都星云智联科技有限公司 一种恶意进程阻断方法及相关组件
CN116455620A (zh) * 2023-03-31 2023-07-18 华能信息技术有限公司 一种恶意域名访问分析及确定方法
CN117439824B (zh) * 2023-12-21 2024-03-12 山东科技大学 基于ai的智慧城市评价方法、系统、设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102761458A (zh) * 2011-12-20 2012-10-31 北京安天电子设备有限公司 一种反弹式木马的检测方法和系统
CN102932375A (zh) * 2012-11-22 2013-02-13 北京奇虎科技有限公司 网络访问行为的防护方法和装置
US20160006766A1 (en) * 2014-07-07 2016-01-07 Wins Co., Ltd. Method and apparatus for providing analysis service based on behavior in mobile network environment
CN109413042A (zh) * 2018-09-25 2019-03-01 郑州云海信息技术有限公司 基于集中管理平台管理黑名单规则的方法及系统
CN109889511A (zh) * 2019-01-31 2019-06-14 中国人民解放军61660部队 进程dns活动监控方法、设备及介质

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105635126B (zh) * 2015-12-24 2018-10-09 北京奇虎科技有限公司 恶意网址访问防护方法、客户端、安全服务器及系统
US20180248896A1 (en) * 2017-02-24 2018-08-30 Zitovault Software, Inc. System and method to prevent, detect, thwart, and recover automatically from ransomware cyber attacks, using behavioral analysis and machine learning

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102761458A (zh) * 2011-12-20 2012-10-31 北京安天电子设备有限公司 一种反弹式木马的检测方法和系统
CN102932375A (zh) * 2012-11-22 2013-02-13 北京奇虎科技有限公司 网络访问行为的防护方法和装置
US20160006766A1 (en) * 2014-07-07 2016-01-07 Wins Co., Ltd. Method and apparatus for providing analysis service based on behavior in mobile network environment
CN109413042A (zh) * 2018-09-25 2019-03-01 郑州云海信息技术有限公司 基于集中管理平台管理黑名单规则的方法及系统
CN109889511A (zh) * 2019-01-31 2019-06-14 中国人民解放军61660部队 进程dns活动监控方法、设备及介质

Cited By (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113572774A (zh) * 2021-07-27 2021-10-29 杭州迪普科技股份有限公司 一种网络设备中的报文转发方法及装置
CN113938463A (zh) * 2021-08-27 2022-01-14 中国互联网络信息中心 一种域名滥用阻断方法及装置
CN113938463B (zh) * 2021-08-27 2023-07-11 中国互联网络信息中心 一种域名滥用阻断方法及装置
CN113676549A (zh) * 2021-09-02 2021-11-19 京东科技信息技术有限公司 应用请求的分流方法及应用网关、电子设备、存储介质
CN114301696A (zh) * 2021-12-30 2022-04-08 北京天融信网络安全技术有限公司 恶意域名检测方法、装置、计算机设备及存储介质
CN114301696B (zh) * 2021-12-30 2023-12-01 北京天融信网络安全技术有限公司 恶意域名检测方法、装置、计算机设备及存储介质
CN114401140A (zh) * 2022-01-13 2022-04-26 腾讯科技（深圳）有限公司 访问处理方法、相关设备、存储介质及程序产品
CN114401140B (zh) * 2022-01-13 2022-11-11 腾讯科技（深圳）有限公司 访问处理方法、相关设备及存储介质
CN114546508A (zh) * 2022-02-28 2022-05-27 广联达科技股份有限公司 工具型应用软件的云端访问方法及装置
CN114546508B (zh) * 2022-02-28 2024-04-12 广联达科技股份有限公司 工具型应用软件的云端访问方法及装置
CN114844678A (zh) * 2022-04-07 2022-08-02 南京邮电大学 基于隐私保护的浏览器安全查询方法
CN114844704B (zh) * 2022-05-05 2023-06-06 鹏城实验室 基于可编程交换机的实时dns隧道检测方法及相关设备
CN114844704A (zh) * 2022-05-05 2022-08-02 鹏城实验室 基于可编程交换机的实时dns隧道检测方法及相关设备
CN115174197A (zh) * 2022-07-01 2022-10-11 阿里云计算有限公司 webshell文件的检测方法、系统、电子设备及计算机存储介质
CN115174197B (zh) * 2022-07-01 2024-03-29 阿里云计算有限公司 webshell文件的检测方法、系统、电子设备及计算机存储介质
CN115842685B (zh) * 2023-02-21 2023-05-05 北京微步在线科技有限公司 一种威胁情报的生成方法、装置、电子设备及存储介质
CN115842685A (zh) * 2023-02-21 2023-03-24 北京微步在线科技有限公司 一种威胁情报的生成方法、装置、电子设备及存储介质
CN116723051A (zh) * 2023-08-07 2023-09-08 北京安天网络安全技术有限公司 一种域名情报信息生成方法、装置及介质
CN116723051B (zh) * 2023-08-07 2023-10-27 北京安天网络安全技术有限公司 一种域名情报信息生成方法、装置及介质

Also Published As

Publication number Publication date
CN112929326B (zh) 2022-05-24
CN112929326A (zh) 2021-06-08

Similar Documents

Publication Publication Date Title
WO2021109669A1 (zh) 恶意域名访问的检测方法、装置及计算机可读存储介质
US11997139B2 (en) Deceiving attackers accessing network data
US11102220B2 (en) Detection of botnets in containerized environments
US9294505B2 (en) System, method, and computer program product for preventing a modification to a domain name system setting
Parampalli et al. A practical mimicry attack against powerful system-call monitors
US8806629B1 (en) Automatic generation of policy-driven anti-malware signatures and mitigation of DoS (denial-of-service) attacks
CN111868689A (zh) 区块链账本的运行时自校正
US11086983B2 (en) System and method for authenticating safe software
CN109768992B (zh) 网页恶意扫描处理方法及装置、终端设备、可读存储介质
US20070005992A1 (en) Signed manifest for run-time verification of software program identity and integrity
US20090172814A1 (en) Dynamic generation of integrity manifest for run-time verification of software program
JP4934860B2 (ja) 情報システム構成要素解析から算出したトラストスコアに基づいて複数のネットワークエンドポイント間のアクセスを制御する方法
WO2019127890A1 (zh) 漏洞扫描方法、装置、计算机设备和存储介质
JP2010182019A (ja) 異常検知装置およびプログラム
US11949651B2 (en) Domain name service (DNS) server cache table validation
CN109361574B (zh) 基于JavaScript脚本的NAT检测方法、系统、介质和设备
US20230222226A1 (en) Memory scan-based process monitoring
CN107623693B (zh) 域名解析防护方法及装置、系统、计算设备、存储介质
US11251976B2 (en) Data security processing method and terminal thereof, and server
JP2006146600A (ja) 動作監視サーバ、端末装置及び動作監視システム
US11645390B2 (en) Cloud-based method to increase integrity of a next generation antivirus (NGAV) security solution in a virtualized computing environment
KR102393913B1 (ko) 이상행위 탐지 장치, 방법 및 이를 포함하는 시스템
WO2023165257A1 (zh) 一种代码段动态度量方法、装置及电子设备
CN109951527B (zh) 面向虚拟化系统的hypervisor完整性检测方法
US20070136812A1 (en) Computer Virus Preventive System

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20896483

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20896483

Country of ref document: EP

Kind code of ref document: A1