Access control and virus defense method and system based on dns protocol

Abstract

The present invention provides a method and system for access control and virus attack defense, which analyzes the matching DNS request, discards it if it is abnormal, and continues to operate if it passes; it analyzes the passed DNS request to determine whether there are viruses and illegal attacks , through analysis, block viruses and attacks and locate their IP addresses, return a special IP address, record its domain name, and add it to the malicious domain name resolution library; if the DNS request is suspicious, deliver it to the honeypot system, the honeypot system Through the interaction protocol that has been customized in advance, the honeypot system returns a honeypot IP address, and the honeypot system traces back. If the terminal attacks the honeypot IP address, it is judged that the terminal has been infected with a virus or a Trojan horse, and the system Treat accordingly. The present invention can comprehensively solve the security problem based on the DNS protocol.

Description

Technical field [0001] The present invention relates to network security, and more particularly to a DNS-based access control and a virus defense system. Background technique [0002] DNS is an abbreviation for domainnamesystems, which is used to naming organizations and network services to domain hierarchies. The domain name is made of a string or abbreviation by a circle. Each domain name corresponds to a unique IP address, and between the domain name and IP address, DNS is a server for domain name resolution. DNS named Find Computers and services through the User-friendly names for the TCP / IP network of Internet. DNS is a core service of the Internet, which is a distributed database that can map domain names and IP addresses. From January 12, 2010, from 07:00 to 12, Baidu had encountered a top-level domain name baidu.com and the second-level domain access to an abnormality. All resolved to other addresses for a longer period of time, resulting in multiple users in the world ...

AI Technical Summary

Problems solved by technology

From 07:00 to 12:00 on January 12, 2010, Baidu encountered abnormal access to the top-level domain name baidu.com and its second-level domain names, and all of them were resolved to other addresses for a long time, resulting in many users around the world not using normal Visit Baidu

[0003] Existing technical solutions either transfer illegal traffic, or can only ensure the normal access of the path from the switch or router of the enterprise to the web server during DDOS attacks, and do not fundamentally solve the problem of malicious code and attacks using the DNS protocol. The security prevention and defense of the entire link; the superimposed cost of the two systems is very expensive, and it only solves the DDoS attack, and other defenses may require the use of other security equipment, which will affect professionalism

Images