Web通信中可疑域名监控技术的研究

Research on Suspicious Domain Name Monitoring in Web Communciation

现有Web服务存在着很多的仿冒、欺骗等安全威胁,而Web通信基本先通过DNS获取IP地址,因此对网络中DNS域名信息的分析有助于加强对可疑非法Web通信的监控。传统的域名分析技术只能进行简单的协议分析,而且耗费资源严重,不能实现安全控制。文中提出了一种针对可疑域名的监控技术,给出了设计方案和具体的编程实现方法,并搭建了校园网环境进行验证,表明该系统有很小的丢包率和及时的安全控制响应,能很好实现对网络域名信息的监控。

There are a lot of security threats such as counterfeit and cheat on the Web services,many Web services need to firstly get IP address through DNS analyzing,so monitoring the domain name information can help to promote the level of the monitoring of the suspicious or illegal communication.Traditional domain analysis technology can only carry on the simple analysis of protocol,seriously costing resources,and can＇t achieve safety control.It puts forward a domain name monitoring technology.It gives design,implementation and experiment.Experimental result and the implementations efficiency analysis show that it succeeds in implementing analysis and monitoring on the domain name information of the network.