Network attack determination method, secure network data transmission method, and corresponding apparatus

1. A secure network data transmission method, wherein the secure network data transmission method comprises:

determining conforming attack rules based on format analysis on attack rules transmitted by a rule configuration server;

comparing domain name resolution information with the conforming attack rules, wherein the domain name resolution information is returned by a network in response to a webpage browsing request;

determining, according to the comparing the domain name resolution information with the conforming attack rules, whether the webpage browsing request encounters a network attack; and

in response to determining that the webpage browsing request encounters the network attack:

discarding the domain name resolution information;

sending the webpage browsing request to a proxy server;

obtaining correct webpage data corresponding to the webpage browsing request by performing a network data transmission in a secure manner using the proxy server; and

accessing a correct website based on the correct webpage data.

2. The method according to claim 1 , wherein determining, according to the comparing the domain name resolution information with the conforming attack rules, whether the webpage browsing request encounters a network attack comprises:

determining, according to the conforming attack rules and the domain name resolution information, legality of an IP address comprised in the domain name resolution information; and

determining, according to the legality of the IP address comprised in the domain name resolution information, whether the webpage browsing request encounters a network attack, and if the IP address is legal, determining that the webpage browsing request encounters no network attack, or if the IP address is illegal, determining that the webpage browsing request encounters a network attack.

3. The method according to claim 2 , wherein the determining, according to the conforming attack rules and the domain name resolution information, legality of an IP address comprised in the domain name resolution information comprises:

obtaining a target attack rule in the conforming attack rules by using the webpage browsing request, wherein the conforming attack rules comprise a domain name, an IP address, and a rule type identifier, and wherein a domain name comprised in the target attack rule is the same as a to-be-accessed domain name in the webpage browsing request;

traversing the target attack rule, to determine whether the IP address comprised in the domain name resolution information is comprised in the target attack rule; and

if the IP address comprised in the domain name resolution information is not comprised in the target attack rule, determining that the IP address comprised in the domain name resolution information is legal; or

if the IP address comprised in the domain name resolution information is comprised in the target attack rule, determining, according to the target attack rule, whether the IP address comprised in the domain name resolution information is legal, and if a rule type identifier, in the target attack rule, corresponding to the IP address comprised in the domain name resolution information is a legal identifier, determining that the IP address is legal, or if a rule type identifier, in the target attack rule, corresponding to the IP address comprised in the domain name resolution information is an illegal identifier, determining that the IP address is illegal.

4. The method according to claim 1 , wherein determining, according to the comparing the domain name resolution information with the conforming attack rules, whether the webpage browsing request encounters a network attack comprises:

obtaining a target attack rule in the conforming attack rules by using the webpage browsing request, wherein the conforming attack rules comprise a tempering keyword, a non-tempered information expression, and a tempered information expression, and the non-tempered information expression comprised in the target attack rule corresponds to the webpage browsing request;

obtaining response information returned by the network according to the webpage browsing request;

traversing the target attack rule, to determine whether a response header keyword in the response information matches a tempering keyword in the target attack rule;

if the response header keyword in the response information matches the tempering keyword in the target attack rule, determining whether response header content in the response information matches a tempered information expression in the target attack rule; and

if the response header content matches the tempered information expression in the target attack rule, determining that the webpage browsing request encounters a network attack.

5. The method according to claim 1 , further comprising:

analyzing the conforming attack rules according to domain names included in the conforming attack rules to obtain a two-dimensional data structure of each conforming attack rule.

6. The method according to claim 1 , wherein obtaining the correct webpage data comprises:

encrypting the webpage browsing request;

sending the encrypted webpage browsing request to the proxy server for the proxy server to decrypt the encrypted webpage browsing request to obtain the webpage browsing request, perform domain name resolution on the webpage browsing request, access a target server corresponding to a domain name resolution result, to obtain network data corresponding to the webpage browsing request, and encrypt the network data to obtain encrypted network data; and

receiving the encrypted network data from the proxy server.

7. A network attack determining system, comprising one or more processors and one or more non-transitory computer-readable memories coupled to the one or more processors and configured with instructions executable by the one or more processors to cause the system to perform operations comprising:

determining conforming attack rules based on format analysis on attack rules transmitted by a rule configuration server;

comparing domain name resolution information with the conforming attack rules, wherein the domain name resolution information is returned by a network in response to a webpage browsing request;

determining, according to the comparing the domain name resolution information with the conforming attack rules, whether the webpage browsing request encounters a network attack; and

in response to determining that the webpage browsing request encounters the network attack:

discarding the domain name resolution information;

sending the webpage browsing request to a proxy server;

obtaining correct webpage data corresponding to the webpage browsing request by performing a network data transmission in a secure manner using the proxy server; and

accessing a correct website based on the correct webpage data.

8. The system according to claim 7 , wherein determining, according to the comparing the domain name resolution information with the conforming attack rules, whether the webpage browsing request encounters a network attack comprises:

determining, according to the conforming attack rules and the domain name resolution information, legality of an IP address comprised in the domain name resolution information; and

determining, according to the legality of the IP address comprised in the domain name resolution information, whether the webpage browsing request encounters a network attack, and if the IP address is legal, determining that the webpage browsing request encounters no network attack, or if the IP address is illegal, determining that the webpage browsing request encounters a network attack.

9. The system according to claim 8 , wherein the determining, according to the conforming attack rules and the domain name resolution information, legality of an IP address comprised in the domain name resolution information comprises:

obtaining a target attack rule in the conforming attack rules by using the webpage browsing request, wherein the conforming attack rules comprise a domain name, an IP address, and a rule type identifier, and wherein a domain name comprised in the target attack rule is the same as a to-be-accessed domain name in the webpage browsing request;

traversing the target attack rule, to determine whether the IP address comprised in the domain name resolution information is comprised in the target attack rule; and

if the IP address comprised in the domain name resolution information is not comprised in the target attack rule, determining that the IP address comprised in the domain name resolution information is legal; or

if the IP address comprised in the domain name resolution information is comprised in the target attack rule, determining, according to the target attack rule, whether the IP address comprised in the domain name resolution information is legal, and if a rule type identifier, in the target attack rule, corresponding to the IP address comprised in the domain name resolution information is a legal identifier, determining that the IP address is legal, or if a rule type identifier, in the target attack rule, corresponding to the IP address comprised in the domain name resolution information is an illegal identifier, determining that the IP address is illegal.

10. The system according to claim 7 , wherein determining, according to the comparing the domain name resolution information with the conforming attack rules, whether the webpage browsing request encounters a network attack comprises:

obtaining a target attack rule in the conforming attack rules by using the webpage browsing request, wherein the conforming attack rules comprise a tempering keyword, a non-tempered information expression, and a tempered information expression, and the non-tempered information expression comprised in the target attack rule corresponds to the webpage browsing request;

obtaining response information returned by the network according to the webpage browsing request;

traversing the target attack rule, to determine whether a response header keyword in the response information matches a tempering keyword in the target attack rule;

if the response header keyword in the response information matches the tempering keyword in the target attack rule, determining whether response header content in the response information matches a tempered information expression in the target attack rule; and

if the response header content matches the tempered information expression in the target attack rule, determining that the webpage browsing request encounters a network attack.

11. The system according to claim 7 , further comprising:

analyzing the conforming attack rules according to domain names included in the conforming attack rules to obtain a two-dimensional data structure of each conforming attack rule.

12. The system according to claim 7 , wherein obtaining the correct webpage data comprises:

encrypting the webpage browsing request;

sending the encrypted webpage browsing request to the proxy server for the proxy server to decrypt the encrypted webpage browsing request to obtain the webpage browsing request, perform domain name resolution on the webpage browsing request, access a target server corresponding to a domain name resolution result, to obtain network data corresponding to the webpage browsing request, and encrypt the network data to obtain encrypted network data; and

receiving the encrypted network data returned by the proxy server.

13. A non-transitory computer-readable storage medium configured with instructions executable by one or more processors to cause the one or more processors to perform operations comprising:

determining conforming attack rules based on format analysis on attack rules transmitted by a rule configuration server;

comparing domain name resolution information with the conforming attack rules, wherein the domain name resolution information is returned by a network in response to a webpage browsing request;

determining, according to the comparing the domain name resolution information with the conforming attack rules, whether the webpage browsing request encounters a network attack; and

in response to determining that the webpage browsing request encounters the network attack:

discarding the domain name resolution information;

sending the webpage browsing request to a proxy server;

obtaining correct webpage data corresponding to the webpage browsing request by performing a network data transmission in a secure manner using the proxy server; and

accessing a correct website based on the correct webpage data.

14. The non-transitory computer-readable storage medium according to claim 13 , wherein determining, according to the comparing the domain name resolution information with the conforming attack rules, whether the webpage browsing request encounters a network attack comprises:

determining, according to the conforming attack rules and the domain name resolution information, legality of an IP address comprised in the domain name resolution information; and

determining, according to the legality of the IP address comprised in the domain name resolution information, whether the webpage browsing request encounters a network attack, and if the IP address is legal, determining that the webpage browsing request encounters no network attack, or if the IP address is illegal, determining that the webpage browsing request encounters a network attack.

15. The non-transitory computer-readable storage medium according to claim 14 , wherein the determining, according to the conforming attack rules and the domain name resolution information, legality of an IP address comprised in the domain name resolution information comprises:

obtaining a target attack rule in the conforming attack rules by using the webpage browsing request, wherein the conforming attack rules comprise a domain name, an IP address, and a rule type identifier, and wherein a domain name comprised in the target attack rule is the same as a to-be-accessed domain name in the webpage browsing request;

traversing the target attack rule, to determine whether the IP address comprised in the domain name resolution information is comprised in the target attack rule; and

if the IP address comprised in the domain name resolution information is not comprised in the target attack rule, determining that the IP address comprised in the domain name resolution information is legal; or

if the IP address comprised in the domain name resolution information is comprised in the target attack rule, determining, according to the target attack rule, whether the IP address comprised in the domain name resolution information is legal, and if a rule type identifier, in the target attack rule, corresponding to the IP address comprised in the domain name resolution information is a legal identifier, determining that the IP address is legal, or if a rule type identifier, in the target attack rule, corresponding to the IP address comprised in the domain name resolution information is an illegal identifier, determining that the IP address is illegal.

16. The non-transitory computer-readable storage medium according to claim 13 , wherein determining, according to the comparing the domain name resolution information with the conforming attack rules, whether the webpage browsing request encounters a network attack comprises:

obtaining a target attack rule in the conforming attack rules by using the webpage browsing request, wherein the conforming attack rules comprise a tempering keyword, a non-tempered information expression, and a tempered information expression, and the non-tempered information expression comprised in the target attack rule corresponds to the webpage browsing request;

obtaining response information returned by the network according to the webpage browsing request;

traversing the target attack rule, to determine whether a response header keyword in the response information matches a tempering keyword in the target attack rule;

if the response header keyword in the response information matches the tempering keyword in the target attack rule, determining whether response header content in the response information matches a tempered information expression in the target attack rule; and

if the response header content matches the tempered information expression in the target attack rule, determining that the webpage browsing request encounters a network attack.

17. The non-transitory computer-readable storage medium according to claim 13 , further comprising:

analyzing the conforming attack rules according to domain names included in the conforming attack rules to obtain a two-dimensional data structure of each conforming attack rule.

18. The non-transitory computer-readable storage medium according to claim 13 , wherein obtaining the correct webpage data comprises:

encrypting the webpage browsing request;

sending the encrypted webpage browsing request to the proxy server for the proxy server to decrypt the encrypted webpage browsing request to obtain the webpage browsing request, perform domain name resolution on the webpage browsing request, access a target server corresponding to a domain name resolution result, to obtain network data corresponding to the webpage browsing request, and encrypt the network data to obtain encrypted network data; and

receiving the encrypted network data from the proxy server.