Method and device for detecting data message

Abstract

The invention discloses a detection method and a device for a data message. The method comprises a detection method of the data message. The method comprises the following steps: reading the domain name parameter of a received first data message; performing a random degree calculation to the domain name parameter of the first data message and a preset domain name parameter to obtain a random degree score of the domain name parameter of the first data message, wherein the preset domain name parameter is a domain name parameter of a preset valid data message; judging if the random degree score is more than a blocking threshold; and determining the first data message to be an invalid data message when the random degree score is more than the blocking threshold. According to the detection method, accurately identifying the invalid data message is achieved, so that the invalid data message can be processed from a flow of all DNS (Domain Name Server) random requests, the invalid data message of the DNS random requests can be effectively and efficiently cleaned, and a DNS random request attack loses a DDOS (Distributed Denial of Service) effect.

Description

technical field [0001] The invention relates to the field of network security, in particular to a method and device for detecting data packets. Background technique [0002] A bot is a computer that has been breached by hackers and planted with a Trojan horse virus. Hackers can manipulate it at will and use it to do anything, just like a puppet. [0003] Normally, if the DNS request packet is less than 512 bytes, the UDP protocol is used, and only the request packet larger than 512 bytes will be transmitted using the TCP protocol. UDP itself is connectionless, and DNS requests are also connectionless. When using UDP protocol to make DNS requests, it is usually a one-response method. The client sends a Query packet to the server, and the server responds with a Request packet. [0004] With the rapid development of the Internet, and due to the need for investment in domain name resources, the number of legal domain names on the Internet continues to increase. The character co...

AI Technical Summary

Problems solved by technology

[0014] Aiming at the problem that the related technology firewall cannot accurately identify the attack traffic, causing a large amount of attack traffic to flow to the server, thus causing legitimate users to be unable to access the DNS server normally, no effective solution has been proposed so far. Therefore, the main purpose of the present invention is to provide a Data message detection method and device to solve the above problems

Images