METHOD AND DEVICE FOR DETECTING SUSPICIOUS DNS, AND METHOD AND SYSTEM FOR PROCESSING SUSPICIOUS DNS

摘要

Provided are a method and device for detecting a suspicious DNS, and a method and system for processing a suspicious DNS. The method for detecting a suspicious DNS comprises: acquiring a correct DNS parsing result set of known domain names, the correct DNS parsing result set being obtained by way of parsing the known domain names by a group of domain name parsing servers; acquiring a DNS parsing result to be detected of the known domain names, the DNS parsing result to be detected being a result of parsing the known domain names by a target DNS; checking whether the DNS parsing result to be detected belongs to the correct DNS parsing result set; and if not, marking the target DNS as a suspicious DNS. By means of the technical solution of the present invention, a suspicious DNS which parses a domain name into an unknown result can be simply and rapidly determined, thereby providing a basis for further analysis and processing, and increasing network security.