政府教育域名权威资源记录异常变更测量研究  

Measurement study on abnormal changes in authoritative resource records of government and educational domains

作　　者：孙俊哲 陆超逸 刘保君 段海新[1] 孙东红[1] SUN Junzhe;LU Chaoyi;LIU Baojun;DUAN Haixin;SUN Donghong(Institute for Network Sciences and Cyberspace,Tsinghua University,Beijing 100084,China)

机构地区：[1]清华大学网络科学与网络空间研究院,北京100084

出　　处：《通信学报》2024年第S2期16-26,共11页Journal on Communications

摘　　要：权威侧域名劫持伴随资源记录异常变更。为实现权威侧域名劫持事件的及时预警,针对各国政府、教育等重要行业域名和高访问量的流行域名,构建权威侧资源记录监测系统,实现对全球750万个重要域名的主动抓取和长期监测。提出资源记录异常变更筛选算法并应用于监测数据,在一个月的分析周期内识别896个重要域名的资源记录存在异常变更。经人工验证,导致资源记录异常变更的原因包括域名管理者的不当配置、钓鱼攻击和非法内容展示等行为。Authoritative-side domain hijacking is characterized by abnormal changes in resource records.To enable timely warnings for authoritative-side domain hijacking incidents,a monitoring system for authoritative-side resource records was established,targeting significant domains in key sectors such as government and education,as well as hightraffic popular domains.The system actively captured and continuously monitored 7.5 million important domains globally.An algorithm was developed to filter abnormal changes in resource records,identifying abnormal changes in 896 significant domains within a one-month analysis period.Manual verification results indicate that the causes included misconfigurations by domain administrators,phishing attacks,and the display of illegal content.

关 键 词：域名系统 资源记录 权威服务 劫持攻击 

分 类 号：TN915.08[电子电信—通信与信息系统]