Method, device and system for network attack defense

Abstract

The invention provides a method, a device and a system for network attack defense. The method comprises steps that target DNS response messages sent by external network equipment to internal network equipment are received; on the condition that a dynamic white list comprises source addresses of the target DNS response messages, whether the target DNS response messages satisfy preset conditions is determined; if yes, the target DNS response messages are dumped; the preset conditions at least comprise that target domain names of the target DNS response message are not included in historical domain name records, and each historical domain name of the historical domain name records is respectively extracted from historical DNS response messages sent by the external network equipment. The method is advantaged in that actual sources in different modes attacking the DNS response messages of the internal network equipment can be filtered, and impact of DNS response attack on business and the network can be alleviated.

Description

technical field [0001] The present application relates to the field of network technology, and in particular to a method, device and system for defending against network attacks. Background technique [0002] With the continuous advancement of network technology, there are more and more network attacks in the network field. At present, among many network attacks, Distributed Denial of Service (DDoS) has become a relatively serious attack means. In the DDOS attack, the DNS response attack has become a mainstream attack type, and the DNS response attack can also be called a Domain Name System (DNS, Domain Name System) response attack. [0003] In order to prevent DNS response attacks, cleaning devices can be added to the original system to form a defense system. see figure 1 It is a structural schematic diagram of a defense system. It can be seen from the illustration that the cleaning equipment bypass is set on one side of the routing equipment. [0004] In the case of cl...

AI Technical Summary

Problems solved by technology

Since the dynamic whitelist only contains IP addresses of real sources and does not contain IP addresses of fake sources, the source detection method can only clean DNS response attacks initiated by fake sources, but not DNS response attacks initiated by real sources.

Images