Methods for cleaning equipment, detecting equipment, routing equipment and preventing dns attacks

Abstract

This paper discloses a method for cleaning equipment, detecting equipment, routing equipment and preventing DNS attacks. message; according to one or more received synchronous messages, create the first session table that contains one or more sessions; Whether the text hits the session in the first session table; when it is judged that the DNS Reply message received hits the session in the first session table, the DNS Reply message is forwarded to the routing device; when it is judged that the DNS Reply message received When the packet does not match the session in the first session table, the DNS Reply packet is discarded. The embodiment of the present invention reduces a large number of missing packets and false killings in the process of defending against DNS response flooding attacks.

Description

technical field [0001] Embodiments of the present invention relate to but are not limited to network security technology, especially a cleaning device, a detection device, a routing device and a method for preventing domain name system (DNS, Domain Name System) attacks. Background technique [0002] DNS response flooding (Reply Flood) attack has become the mainstream distributed denial of service (DDoS, Distributed Denial of service) attack type in the network. The DNS attack directly launched by the botnet is a reflective DNS attack formed by the rebound of many open DNS servers in the Internet (such as figure 1 shown). Among them, due to the characteristics of easy implementation, large traffic, and difficult to track, reflective DNS attacks have become the preferred attack method for launching large-traffic attacks, which has brought great harm to user services and their networks. [0003] Therefore, an effective method is needed to defend and clean DNS Reply Flood atta...

AI Technical Summary

Problems solved by technology

[0005] However, the cleaning device deployed in the bypass above uses the method of determining whether to send the received DNS Reply message to the intranet user. When the domain name in the normal DNS Reply message belongs to the top N domain names or the normal DNS Reply message If the source IP address in the domain name is not in the whitelist, it will lead to false killing of normal DNS Reply packets, and if the attack contains many domain names, since the proportion of attack traffic for each domain name is not high, a large number of domain names will be generated. The problem of packet leakage, so there are a lot of packet leakage and manslaughter problems in the process of defending against DNS reflection attacks. How to solve this problem has become a problem that needs to be solved urgently

Images