Method, device and system for monitoring messages in domain name resolution service DNS system

Abstract

The invention discloses a method, device and system for monitoring messages in a domain name resolution service DNS system. The method, the device and the system can provide comprehensive monitoring and protecting abilities for existing special attacks for a DNS, and improve the monitoring accuracy. The method comprises the steps that a first preset length of time is used as a sampling period, and the messages transmitted between the domain name resolution service DNS and any user terminal are obtained; for any obtained messages in the current sampling period, the message types of the messages are determined; according to the determined message types, the message length values and the number of access times of the messages and at least two parameters in a life period are determined; according to the determined message length values, the number of the access times and the two parameters in the life period, monitoring assessment values corresponding to the messages in the current sampling period are determined; according to the determined monitoring assessment values, the messages transmitted between the DNS and any user terminal are monitored.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method, device and system for monitoring messages in a domain name resolution service DNS system. Background technique [0002] As an early Internet protocol, considering the distribution of hosts at that time, the DNS system based on the Domain Name Service (DNS, Domain Name Service) protocol at the beginning of the design was based on mutual trust and was a completely open collaboration system. Various types of data transmitted in the system are not encrypted, proper information protection and authentication mechanisms are not provided, and various queries are not accurately identified. At the same time, the protection of network infrastructure and core backbone equipment is not paid enough attention, resulting in In the later stage, the DNS system is vulnerable to attacks and has poor security. [0003] Among them, the attack methods on the DNS system mainly includ...

AI Technical Summary

Problems solved by technology

[0005] The second attack method is abnormal request access attack

[0006] The third attack method is DNS hijacking attack

[0007] The fourth attack method is that the attacker uses DNS to attack

The disadvantage of this protection method is that some attacks, such as DDoS attacks and man-in-the-middle attacks, can be prevented by setting DNS service rules on the firewall, but it is helpless for most special attacks against DNS

The disadvantage of this method is that the traffic cleaning system can better distinguish DoS / DDoS traffic and normal business traffic to ensure normal service of DNS, but it cannot distinguish special attacks on DNS, such as DNS cache poisoning attacks

The disadvantage of this method is that it can only detect certain specific attacks and has limited protection capabilities.

[0013] To sum up, the implementation method of DNS security monitoring proposed above cannot provide comprehensive monitoring and protection capabilities for existing special attacks against DNS, and has strong limitations and low accuracy.

Images