Method, apparatus and system for detecting abnormality of DNS (domain name system) query flow

Abstract

The invention relates to a method, an apparatus and a system for detecting the abnormality of DNS query flow, which belong to the technical field of Internet. The detection method comprises the following steps of: respectively counting DNS query flows of regions according to the pre-divided region units; respectively determining the covariance matrixes corresponding to a plurality of time slices according to DNS query flows of regions; respectively calculating the matrix relevance variation value between the covariance matrixes corresponding to the plurality of time slices and the average covariance matrix; and outputting the instantaneous alarm information when the matrix relevance variation value between the covariance matrixes corresponding to any time slices and the average covariance matrix is greater than the first predetermined value for indicating that the DNS query flow of any time slices is abnormal. The invention is beneficial to reducing the loss of abnormality of DNS query flow.

Description

technical field [0001] The invention relates to the technical field of the Internet, in particular to a method, device and system for detecting abnormality of DNS query traffic. Background technique [0002] The Domain Name System (DNS) is mainly used to complete the mapping from domain names to IP addresses and the resolution of other Internet resources. It is one of the important infrastructures in today's Internet. Due to the rapid growth of network traffic year by year and the complexity of network topology, it is becoming more and more difficult to directly monitor Internet traffic at a macro level; DNS query traffic, as an important reflection of the entire Internet traffic, is easier to implement and more feasible to monitor . [0003] In the process of DNS query traffic anomaly detection, it is necessary to be able to describe the normal behavior of the network system where the DNS server is located in order to establish the distribution of normal behavior, and to b...

AI Technical Summary

Problems solved by technology

[0011] In the process of realizing the embodiment of the present invention, the inventor found that the existing technology mainly detects the abnormality of the total traffic characteristics of each area, but in the actual occurrence of abnormalities or attacks , the change of the total flow characteristics is often not obvious, so the probability of missed detection is relatively high

Images