An Online Recognition Method of Recursive Domain Name Server Based on Estimation of Connectivity

Abstract

The invention discloses a recursive domain name server online identification method based on connection degree estimation. The method is as follows: 1) performing protocol analysis on the acquired network traffic within a set time period to obtain a DNS traffic data set; 2) analyzing the DNS traffic in the DNS traffic data set to obtain attribute information of the DNS traffic; 3 ) Calculate the Src-con value and Dom-con value of each source IP according to the attribute information; the Src-con value is the source IP connection degree, that is, the number of different destination IP addresses corresponding to the source IP address in DNS traffic; the Dom-con value is the domain name connection degree, that is, the number of different domain names corresponding to the source IP address; 4) If the Src-con value corresponding to the same source IP is higher than the source IP connection degree threshold, and the Dom-con value is higher than the domain name connection degree threshold; then the The server corresponding to the source IP is used as the recursive domain name server. The invention has high recognition accuracy.

Description

technical field [0001] The invention belongs to the technical field of network measurement, and in particular relates to a recursive domain name server online identification method based on connection degree estimation. Background technique [0002] The Domain Name System (Domain Name System) is the core service of the Internet. It resolves the domain name to an IP address through the domain name server, making it easier for users to access the Internet. The resolution process is as follows: figure 1 shown. At present, domain name servers can be divided according to service types: Root-DNS: root domain name server, the highest-level domain name server in the domain name resolution system, responsible for returning the authoritative domain name server address of the top-level domain name; Authoritative DNS (ADNS): authoritative domain name server, responsible for management For a certain area, the domain name query of this area is directly searched and responded from the loc...

AI Technical Summary

Problems solved by technology

But the active method also has many disadvantages: in the first method, a large number of IP addresses need to be obtained in advance before active detection; in the second method, many recursive domain name servers currently have security settings to prevent any The domain name query of the host, the domain name query request may be filtered by it, resulting in a proactive method that consumes a lot of resources to detect IP addresses that do not respond

Large traffic and limited online resources pose great challenges to online analysis traffic

Images