Security gateway system for resisting DDoS attack for DNS service

Abstract

The invention discloses a high-efficiency anti-DDoS security gateway system, which can effectively detect and defend a DNS denial-of-service attack. The system comprises two core components, namely a detector and a filter. The system supports two deploying ways, namely serial connection and bypass. A detecting method is based on the self-learning network flow state statistic and characteristic disinterment, achieves the detection and positioning of the network abnormal flow by setting network performance parameter thresholds, and can effectively identify the suspected attack flow. A defending method carries out a thought of deep defense, and the system is deployed with two defense steps of attack characteristic defense and baseline defense so as to ensure the attack defending effect of thesystem under normal network condition and the basic defense capacity of the system in the individual and severe attack environment. The methods can effectively improve the security and attack resista nce of a DNS server and can ensure the normal operation of the DNS service.

Description

Technical field [0001] The invention relates to computer network security. Specifically, it relates to a method and device for detecting and defending a denial of service (DDoS: Distributed Denial of Service) attack of the DNS service. Background technique [0002] DNS (Domain Name System) is a distributed database system used to manage the mapping of host name and address information. It links names that are easy to remember and understand with boring IP addresses. The entire distributed system is organized in a tree structure. There are 13 root server nodes in the world, which are used to resolve top-level domain domain names, such as com, net, cn, etc., and there are sub-DNS servers at various levels to resolve domain names in their respective jurisdictions such as edu, org, etc., forming a tree structure. When a domain name request occurs, the request first arrives at the preferred DNS server. When there is no corresponding domain name cache information locally, the request i...

AI Technical Summary

Problems solved by technology

Existing DDoS defense methods cannot meet the requirements of DNS service protection. For example, a DDoS detection and defense method based on data mining, which performs data mining on a large number of data packets, extracts features, and deploys the DDoS attack according to the characteristics of the DDoS attack. Filtering, this method can effectively avoid the situation where the server is paralyzed due to attacks, but this method has a big problem in the actual implementation process: it is easy to make some characteristics of normal traffic match the detected characteristics, so as to kill normal traffic by mistake; , this method cannot be based on the characteristics of the DNS service, such as network traffic characteristics, domain name request packet characteristics, etc., but only detects and defends according to the characteristics of the traffic, so it cannot meet the security requirements of the DNS service

Images