Web通信中可疑域名监控与反制系统的设计  

A New Design of Suspicious Domain Name Monitoring System for Web Communication

作　　者：赵国锋[1] 赵岩 王新恒[1] 叶飞 

机构地区：[1]重庆邮电大学通信与信息工程学院,重庆400065

出　　处：《信息网络安全》2017年第12期11-16,共6页Netinfo Security

基　　金：国家自然科学基金青年基金[61402065]

摘　　要：Web通信中可疑域名层出不穷,对网络安全构成了严重威胁。为了解决Web通信服务中存在的伪冒、欺骗以及不良域名等带来的安全威胁,文章设计了一种针对Web通信中可疑域名的监控与反制系统。该系统主要通过BGP进程实现目标流量牵引,捕获并解析目标流量中DNS数据报文,并与可疑域名数据库中的可疑域名进行匹配,匹配成功的域名则通过调用安全模块实现安全控制。通过搭建校园网环境进行测试,表明该系统操作简单,易于部署,能够实现对可疑域名的监控和反制。In Web communications, suspicious domain names have emerged frequently, which poses a serious threat to network security. Traditional domain name analysis technology can only carry out simple protocol analysis, and it has complex operation, difficult deployment and heavy resource consumption. In order to solve the false threats, deception and bad domain names in Web services, a monitoring and reverse system for suspicious domain names in Web communication is designed in this paper. This system mainly through the BGP process to achieve the goal of traffic traction, DNS data packet capture and analysis of target flow, and matched with suspicious domain name suspicious domain name database, matching the success of the domain name by calling the security module to realize safety control. The test of building campus network shows that the system is easy to operate and deploy. It can monitor and counter the suspicious domain name.

关 键 词：网络安全 Web通信 监控系统 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]