High-speed domain name resolution method based on stateless scanning

Abstract

The invention relates to a high-speed domain name resolution method based on stateless scanning. The method comprises: encrypting a UDP protocol header of the DNS query message; periodically sending DNS query messages, analyzing and verifying the recovered reply message; recording a DNS reply message of which the UDP protocol header conforms to the encryption feature and a corresponding IP; and verifying the IP and generating a reliable DNS service IP pool according to a result, when a domain name resolution request exists, selecting the IP as a resolution server to resolve the domain name corresponding to the request, continuously receiving the UDP message, verifying the UDP protocol header and the DNS protocol header, and recording the current UDP message information if the UDP message and the DNS protocol header pass the verification. According to the method, load balancing is carried out among different resolution servers, domain name resolution efficiency is improved, real-time perception of global domain name information change can be realized by a single device, accuracy and real-time performance of a PDNS collection system are greatly improved, and a data basis is providedfor threat intelligence association analysis and global DNS malicious pollution problem analysis.

Description

technical field [0001] The present invention relates to the transmission of digital information, such as the technical field of telegraph communication, in particular to a high-speed domain name resolution method based on stateless scanning. Background technique [0002] With the development of the network, attacks on DNS infrastructure have occurred frequently in the past few years, such as DDoS attacks against domain name servers, using domain name servers as amplification mechanisms for DDoS attacks, replacing registered accounts to modify authorization information, and caching investment information. Virus attacks and domain name server abuse by malware, etc.; Passive DNS is very useful when you need to conduct network incident response investigations, and you can query the passive DNS database to find DNS query records associated with a website , or which domain name servers the website has used since a certain time, or which other domain names are using the same set of...

AI Technical Summary

Problems solved by technology

[0005] The present invention solves the problem of low resolution efficiency in the prior art, and loses the meaning of real-time perception of domain name information changes, while traditional domain name resolution is only performed between several domain name resolution services and the query is based on UDP stateful mode, which is limited by the protocol stack The outbound port limit and the upper limit of concurrent DNS queries per second cannot exceed 65535, providing an optimized high-speed domain name resolution method based on stateless scanning

Images