Attack protection method and device

Abstract

The invention provides an attack preventing method and a device thereof, in one embodiment of the attack preventing method, comprising: entering a preventing flow when a detecting device detects the DNS flood, first validating the domain name resolution request from a real source aiming at the domain name resolution request transmitted by the client-side, then transmitting the domain name resolution request to the DNS server and responding to the terminal. The embodiment of the invention effectively prevents DNS flood, effectively ensures the normal operation of the DNS server with the advantages of simple implement and wide application.

Description

technical field [0001] The invention relates to the field of network security, in particular to an attack prevention method and device. Background technique [0002] DNS (Domain Name System, Domain Name System) is a distributed database for TCP / IP applications, providing conversion between host names and IP addresses and routing information about e-mail. The DNS server plays an important role in internet applications. Once the DNS server is attacked by DDOS, it will seriously affect people's normal network applications. [0003] DNS flood is a UDP flood based on a specific application protocol. The attacker sends a large number of domain name resolution requests to the DNS server, causing the DNS server to be seriously overloaded and cannot continue to respond to DNS requests from normal users, thereby achieving the purpose of the attack. Generally, the DNS request sent by the attacker is a randomly generated domain name that does not exist in the network. When the DNS serv...

AI Technical Summary

Problems solved by technology

For the case of all discarding, the DNS requests of some normal users are affected, and the attack purpose is indirectly achieved; while only filtering part, it will still have a great impact on the server and cannot protect the server well

It can be seen that these two technologies cannot identify the attack of forged source ip very well, so they cannot effectively prevent DNS flood attacks

[0015] For the second technology, since the establishment of the domain name reputation mechanism requires a long period of learning, and the accuracy of the learning results largely depends on the precondition that there is no attack during the learning period; and the domain name reputation mechanism needs to maintain a large amount of data, The reputation evaluation algorithm is relatively complex, and the evaluation results directly affect the effectiveness of defense

It can be seen that the implementation of this technology is complicated, which is not conducive to the effective implementation of DNS flood attacks

Images