A high-speed domain name resolution method based on stateless scanning

Abstract

The invention relates to a high-speed domain name resolution method based on stateless scanning, which encrypts the UDP protocol header of the DNS query message, periodically sends the DNS query message, analyzes and verifies the returned reply message, and records that the UDP protocol header conforms to the Encrypted DNS reply message and the corresponding IP, verify the IP and generate a reliable DNS service IP pool according to the result, when there is a domain name resolution request, select the IP as the resolution server to resolve the domain name corresponding to the request, and continue to receive UDP messages , verify the UDP protocol header and DNS protocol header, if passed, record the current UDP packet information. The present invention balances the load among different resolution servers, improves domain name resolution efficiency, and a single device can realize real-time perception of global domain name information changes, greatly improving the accuracy and real-time performance of the PDNS collection system, providing threat information correlation analysis and global DNS malicious pollution analysis provides a data basis.

Description

technical field [0001] The present invention relates to the transmission of digital information, such as the technical field of telegraph communication, in particular to a high-speed domain name resolution method based on stateless scanning. Background technique [0002] With the development of the network, attacks on DNS infrastructure have occurred frequently in the past few years, such as DDoS attacks against domain name servers, using domain name servers as amplification mechanisms for DDoS attacks, replacing registered accounts to modify authorization information, and caching investment information. Virus attacks and domain name server abuse by malware, etc.; Passive DNS is very useful when you need to conduct network incident response investigations, and you can query the passive DNS database to find DNS query records associated with a website , or which domain name servers the website has used since a certain time, or which other domain names are using the same set of...

AI Technical Summary

Problems solved by technology

[0005] The present invention solves the problem of low resolution efficiency in the prior art, and loses the meaning of real-time perception of domain name information changes, while traditional domain name resolution is only performed between several domain name resolution services and the query is based on UDP stateful mode, which is limited by the protocol stack The outbound port limit and the upper limit of concurrent DNS queries per second cannot exceed 65535, providing an optimized high-speed domain name resolution method based on stateless scanning

Images