Cache optimization method and system for resisting continuous variable-domain name prefix attack

Abstract

The invention relates to a cache optimization method and system for resisting continuous variable-domain name prefix attack. The method includes that regularly counting domain name absence records according to a set time period through a domain name cache server, when the domain name absence records surpass a set threshold, beginning to automatically gather the domain names; dividing the domain names into a plurality of aggregate classes according to the complete matching between second-level domain names and third-level domain names, if the element number of the aggregate class surpasses a set threshold, aggregating all the domain names in the aggregate class into an aggregate domain name with prefix *; for a new domain name query request, if there is no corresponding concrete record in the domain name cache server, matching with the aggregate domain name, if the matching is successful, returning a domain name absence response, otherwise, performing domain name query in an authorization domain name server. The cache optimization method for resisting the continuous variable-domain name prefix attack has advantages of strong cache stability, high timeliness, cache space saving and the like.

Description

Technical field [0001] The invention belongs to the technical field of network protection, and in particular relates to a cache optimization method and system for caching domain name servers to resist persistent variable domain name prefix attacks. Background technique [0002] A domain name is the name of a computer or computer group on the Internet composed of a series of names separated by dots. It is used to identify the electronic location of the computer during data transmission (sometimes also refer to the geographic location. The geographical domain name refers to A local area of ​​administrative autonomy) is the "mask" of IP addresses. Domain names can be divided into multiple levels. The right part of the last "." is called the top-level domain name, such as .com, .net, .org, etc. The left part of the last "." is called the second-level domain name, such as abc.com, trueland.net, etc. The left part of the second-level domain name is called the third-level domain name,...

AI Technical Summary

Problems solved by technology

If the total number of times or the change frequency of the destination IP exceeds the set threshold, it is considered that a domain name prefix change attack has occurred, and the strategy of discarding packets or sending false response packets is adopted. The disadvantages are: (1) High overhead: a bypass traffic analysis system needs to be established in real time Capture and store domain name query data packets, statistically analyze the number of destination IPs of all data packets, the calculation overhead and storage overhead are large

(2) Poor stability: The threshold setting of the total number of times or change frequency of the target IP is not unique, and has certain variability, which has a greater impact on the overall

At the same time, there is also the possibility of forging data packets, which will interfere with the method of analyzing the destination IP, resulting in poor stability

[0013] These two types of defense strategies do not directly optimize the caching domain name server itself, but notify the caching domain name server to take specific measures to deal with the attack after analyzing it through an external auxiliary device

Images