A DNS access speed limiting method and device based on DPDK

Abstract

Embodiments of the present invention provide a method, apparatus, electronic device, and readable storage medium for DNS access rate limiting based on DPDK. The method includes: receiving a DNS request through the DPDK suite; parsing the received DNS request to determine the type of DNS request; if the DNS request is of the target type, rate limiting the DNS request; and if the DNS request is released after rate limiting, forwarding the released DNS request to a local DNS processing module for processing. This method addresses the problem of related technologies that only perform rate limiting protection during the DNS recursion phase, resulting in additional system and network resource consumption.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to a DNS access speed limiting method, device, electronic device and readable storage medium based on DPDK. Background Art

[0002] DNS is a core Internet service that helps users resolve domain names to IP addresses and serves as the gateway to the Internet. As a fundamental network service, DNS security is crucial.

[0003] Related technologies protect DNS security by implementing rate limiting during the recursion phase. This prevents excessive requests or distributed denial of service attacks from initiating a large number of recursions, ultimately leading to a denial of service (DoS).

[0004] However, before the data message is rate-limited in the recursive phase, it has already undergone complete protocol parsing, complete parsing of user-layer DNS packets, and cache query, wasting a lot of system resources. In addition, access rate limiting in the recursive phase requires returning a SERVFAIL response message to the client, which consumes a lot of network bandwidth resources. Summary of the Invention

[0005] The present invention provides a DNS access speed limiting method, device, electronic device and readable storage medium based on DPDK to solve the technical problem that the related art only performs speed limiting protection in the recursive stage of DNS, resulting in additional system resource consumption and network resource occupation.

[0006] In a first aspect, the present invention provides a DNS access rate limiting method based on DPDK, the method comprising:

[0007] Receive DNS requests through the DPDK suite;

[0008] Parsing the received DNS request to determine the type of the DNS request;

[0009] If the DNS request is of the target type, rate limiting the DNS request;

[0010] When the DNS request is processed by speed limiting and is released, the released DNS request is forwarded to the local DNS processing module for processing.

[0011] In a second aspect, the present invention provides a DNS access rate limiting device based on DPDK, the device comprising:

[0012] DNS request receiving module, used to receive DNS requests through the DPDK suite;

[0013] A request distinguishing module is used to perform target protocol layer analysis on the received DNS request to determine the type of the DNS request;

[0014] A rate limiting module, configured to perform rate limiting processing on the DNS request when the DNS request is of a target type;

[0015] The forwarding module is used to forward the released DNS request to the local DNS processing module for processing after the DNS request is processed by speed limit and released.

[0016] In a third aspect, the present invention provides a DNS access rate limiting system based on DPDK, the system comprising: a DPDK receiving module, a DPDK sending module, and a local DNS processing module; the local DNS processing module comprises: a local DNS cache module and a local DNS recursive module;

[0017] The DPDK receiving module is used to receive a DNS request through the DPDK suite; parse the received DNS request to determine the type of the DNS request; if the DNS request is of the target type, rate limit the DNS request; if the DNS request is rate-limited and released, forward the released DNS request to the local DNS cache module;

[0018] The local DNS cache module is used to search for locally cached DNS data after receiving a DNS request sent by the DPDK rate limit module; after finding the DNS data corresponding to the DNS request, return the DNS data to the DPDK sending module; and if no DNS data corresponding to the DNS request is found, forward the DNS request to the local DNS recursive module;

[0019] The local DNS recursive module is used to perform recursive lookup based on the DNS request, obtain DNS data and send it to the DPDK sending module through the local DNS cache module;

[0020] The DPDK sending module is used to return the DNS data corresponding to the DNS request.

[0021] In a fourth aspect, the present invention provides an electronic device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned DPDK-based DNS access speed limiting method when executing the program.

[0022] In a fifth aspect, the present invention provides a readable storage medium. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the above-mentioned DPDK-based DNS access speed limiting method.

[0023] In an embodiment of the present invention, the method can receive a DNS request through the DPDK suite; parse the received DNS request to determine the type of DNS request; if the DNS request is of the target type, rate limit the DNS request; after the DNS request is rate-limited and released, forward the released DNS request to the local DNS processing module for processing. This method adds a rate limit method related to the specified domain name and total number of visits to the original network message processing flow of DPDK. Without changing the original logic of the local DNS, it can solve the problem that the related technology only performs rate limit protection in the recursive stage of DNS, resulting in additional system resource consumption and network resource occupation. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0025] Figure 1 This is a flowchart of a method for limiting DNS access speed based on DPDK provided in an embodiment of the present application;

[0026] Figure 2 It is a DNS workflow diagram in related technology;

[0027] Figure 3 This embodiment of the present application provides a schematic diagram of achieving and canceling speed limit conditions in a time window;

[0028] Figure 4 This is a block diagram of a DNS access rate limiting device based on DPDK provided in an embodiment of the present application;

[0029] Figure 5 This is a schematic diagram of a DNS access rate limiting system based on DPDK provided in an embodiment of the present application;

[0030] Figure 6 This is a structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0032] The terms "first," "second," and the like in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of this application can be implemented in an order other than that illustrated or described herein, and that the objects distinguished by "first," "second," and the like are generally of the same type, and do not limit the number of objects; for example, the first object can be one or at least two. In addition, the term "and / or" in the specification and claims indicates at least one of the connected objects, and the character " / " generally indicates that the objects connected are in an "or" relationship.

[0033] The following describes in detail a method for limiting DNS access speed based on DPDK provided by an embodiment of the present application through specific embodiments and application scenarios in conjunction with the accompanying drawings.

[0034] The following is an introduction to the terms involved in the embodiments of the present disclosure:

[0035] DNS (Domain Name System): The Domain Name System (DNS) is an internet service. As a distributed database that maps domain names to IP addresses, it facilitates internet access. A domain name associates an IP address with a meaningful set of characters. When a user accesses a website, they can enter either the IP address or the domain name; both are equivalent.

[0036] DPDK (Data Plane Development Kit): DPDK is a data plane development tool set that focuses on technologies for network applications to achieve high-performance processing of network packets. It can greatly improve data processing performance and throughput, and improve the efficiency of data plane applications.

[0037] CDN (Content Delivery Network): A CDN is an intelligent virtual network built on top of the existing Internet by placing node servers throughout the network. The CDN system redirects user requests to the nearest service node in real time based on comprehensive information such as network traffic, node connectivity, load status, distance to the user, and response time. This allows users to obtain the content they need locally, alleviates Internet congestion, and improves website response speeds.

[0038] Reference Figure 1 , Figure 1 This is a flowchart of a DNS access speed limiting method based on DPDK provided by an embodiment of the present invention. Figure 1 As shown, the method may include:

[0039] Step 101: Receive a DNS request through the DPDK suite.

[0040] Figure 2 This is the DNS workflow diagram in the related technology, refer to Figure 2 As can be seen, the typical DNS workflow is as follows: First, the user (client) sends a DNS request to the local domain name system (LocalDNS). The local domain name system cache DNS module receives the DNS request, resolves the user's source IP address and the domain name to be queried, and queries the cache database. If the cache database contains the relevant domain name to be queried, the domain name is resolved and the IP address is sent back to the user via a DNS response. If the cache database does not contain the relevant domain name to be queried, the local domain name system cache DNS module sends a DNS recursive request to the local domain name system recursive DNS module. After receiving the DNS recursive request, the local domain name system recursive DNS module initiates DNS requests to authoritative DNS servers at all levels. Authoritative DNS servers at all levels respond to the DNS request and return data to the local domain name system recursive DNS module. Finally, the local domain name system recursive DNS module returns the data to the local domain name system cache DNS module, which returns it to the user via a DNS response and inserts the data into the cache database.

[0041] A DNS request is a query sent by a user (client) to the local domain name system (LocalDNS). It includes a message header, a query question area, a response question area, an authorization response area, and an additional information area. Based on the DNS request's predefined resolution rules, the local domain name system resolves the DNS request and obtains the IP address corresponding to the requested domain name, as well as the server name and address that returns the IP address.

[0042] In an embodiment of the present application, after receiving a DNS request, the DPDK-based local domain name system of this solution first performs rate limit judgment and processing on the DNS request, and then resolves the DNS request that meets the conditions.

[0043] Step 102: parse the received DNS request to determine the type of the DNS request.

[0044] In an embodiment of the present application, after receiving a DNS request, a preliminary simple resolution is first performed, and only specific types of DNS requests are rate-limited, while other types of DNS requests directly enter the normal local DNS processing process.

[0045] Optionally, step 102 includes:

[0046] Sub-step 1021, parse and obtain the network layer protocol, transport layer protocol, and application layer content of the DNS request.

[0047] The data information contained in the DNS request can be used to obtain the network layer protocol, transport layer protocol, and application layer content. The transport layer protocol can be TCP or UDP, usually UDP.

[0048] Sub-step 1022, when the network layer protocol is IPV4 or IPV6, the transport layer protocol is UDP, and the application layer content indicates that the DNS request is legal, determining that the DNS request belongs to the target category.

[0049] The target type is a DNS request whose network layer protocol is IPV4 or IPV6, whose transport layer protocol is UDP, and whose application layer content indicates that the DNS request is legitimate. DNS requests of this target type are filtered, while other types of DNS requests enter the normal localDNS processing flow. Specifically, network packets using the IPv4 / IPv6 protocol are filtered at the IP layer; network packets using UDP are filtered at the transport layer; and network packets using DNS requests are filtered at the user layer. The domain names requested at each level are then obtained.

[0050] Step 103: When the DNS request is of the target type, rate limiting is performed on the DNS request.

[0051] In an embodiment of the present application, for a target type of DNS request, whether to perform speed limiting can be determined by determining whether the number of accesses to a specified domain name within a time window has reached the access limit, and whether the total number of DNS request accesses within the time window has reached the access limit. If the number of accesses to a specified domain name within the time window has reached the access limit, or the total number of DNS request accesses within the time window has reached the access limit, the access speed is limited by releasing a proportion of DNS requests and directly discarding the rest, thereby ensuring the stability and security of the DPDK-based local domain name system of this solution.

[0052] Optionally, step 103 includes:

[0053] Sub-step 1031, parse the DNS request to obtain the DNS request domain name.

[0054] A domain name is a string of names separated by dots, representing the name of a computer or group of computers on the Internet. It is used to locate and identify computers during data transmission. Common domain name suffixes include .com, .net, .cn, .edu, .top, and .xyz. DNS manages domain names by dividing them into groups responsible for the names of various subsystems. Each layer in the system is called a domain, and each domain is separated by a dot.

[0055] The Query Problem area in the DNS request displays any DNS query problems and ongoing query information, including the query name, query type, and query class. The query name contains the domain name being queried, also known as the requested domain name; the query type contains the resource type of the DNS query request, typically type A, indicating that the corresponding IP address is obtained from the domain name; and the query class contains the address type. Resolving the DNS request will reveal the DNS request domain name.

[0056] Sub-step 1032: determining the number of DNS requests for each subdomain name in each time unit within a time window of a first preset length.

[0057] The first preset length is a pre-set time length, which can be 5 seconds, 10 seconds, 15 seconds, and so on. It can be set or modified based on specific circumstances or requirements. A time window is a time interval of the first preset length. For example, if the first preset length is 5 seconds, the time window is a five-second time interval. The time unit is the unit time used to divide the time window, which can be per second. A time window with the first preset length of 5 seconds has 5 time units, also known as unit time.

[0058] In an embodiment of the present application, after parsing the DNS request, the number of times the DNS request is received is updated, and the DNS request domain name is extracted. If the DNS request domain name belongs to the target category, the number of requests for subdomains at each level is changed, and the access value of the corresponding domain is updated. For each request, the value is increased by 1, and finally the number of each time unit within the time window of the first preset length is obtained.

[0059] Sub-step 1033: When the number of times of each time unit of any subdomain is greater than or equal to a first preset number threshold, the DNS request is released according to a preset ratio and the remaining DNS requests are discarded.

[0060] The first preset threshold is the upper limit of the number of accesses per time unit. It can be flexibly configured based on different domain names and determined by maintenance personnel based on actual conditions and combined with big data statistics of related domain requests. This first threshold can be configured in advance through a configuration file or other means. When the number of times per time unit for any subdomain is greater than or equal to the first threshold, the rate limit condition is met, indicating that rate limit is required.

[0061] See also Figure 3 , Figure 3 This embodiment of the present application provides a schematic diagram of the achievement and cancellation of the speed limit condition for a time window. As can be seen, assuming that the first preset length is 5 seconds and the time unit (unit time) is 1 second, then when the number of visits for 5 consecutive time units is greater than or equal to the first preset number threshold, that is, the number of visits for each time unit in the time window is greater than or equal to the first preset number threshold, it means that the speed limit condition is met and speed limit is required.

[0062] The preset ratio is a pre-set ratio of allowed DNS requests to all DNS requests, and can be 10%, 20%, or other ratios. This ratio can be determined based on different domain names and specific circumstances, and is not specifically limited in this application. For example, in an embodiment of this application, a random number V can be taken from a request and modulo 10 is calculated. If the modulo value is less than 2, the request is allowed; otherwise, the request is discarded. Alternatively, the first two requests can be allowed in sequence, while the last eight requests are discarded. This application does not specify specific implementation methods.

[0063] Sub-step 1034: When the number of times in each time unit for each subdomain name is less than a first preset number threshold, determine the total number of times the DNS request is received within a time window of a first preset length.

[0064] The total number of receptions is the total number of DNS requests received within the time window. Even if the number of times for each time unit for each subdomain is less than the first preset threshold, the overall number of receptions may be high, and rate limiting may still be required. Therefore, when the number of times for each time unit for each subdomain is less than the first preset threshold, the total number of receptions is obtained.

[0065] Sub-step 1035: When the total number of receptions is greater than or equal to a second preset number threshold, the DNS requests are released according to a preset ratio and the remaining DNS requests are discarded.

[0066] The second preset threshold is the upper limit of the total number of accesses within the time window. It can be modified based on different actual situations and combined with big data statistics. When the total number of receptions is greater than or equal to the second preset threshold, the rate limit condition is met, indicating that rate limit is required. The specific release and discard methods are similar to those in sub-step 1033 and are not further described here.

[0067] Sub-step 1036: When the total number of receptions is less than a second preset number threshold, directly release the DNS request.

[0068] The number of times in each time unit of each subdomain is less than the first preset number threshold, and the total number of receptions is less than the second preset number threshold, indicating that the number of requests does not exceed the limit, no speed limit is required, and the DNS request domain name is directly released.

[0069] Optionally, sub-step 1032 includes:

[0070] Sub-step 10321: performing a hash operation on the DNS request of each subdomain, and updating the number of times each subdomain at each level has occurred in each time unit within a time window of a first preset length.

[0071] In this embodiment of the application, the number of DNS requests is managed by creating a hash table that corresponds to domain names and speed limit conditions. After resolving the DNS request, the total number of DNS requests received is updated and incremented by 1. The DNS request domain name is extracted, and a hash operation is performed on the subdomains of the request at each level to check whether they belong to the specified speed limit domain. If so, the access value of the corresponding domain in the hash table is updated, and the value is incremented by 1 for each request.

[0072] Optionally, after sub-step 1035, the following steps may be further included:

[0073] Sub-step 1037, when the number of times of each time unit of each subdomain name is less than the first preset number threshold and the total number of receptions is less than the second preset number threshold, stop executing the process of releasing the DNS requests according to the preset ratio and discarding the remaining DNS requests, and proceed to the step of resolving the DNS requests to obtain the DNS request domain name.

[0074] See also Figure 3 , Figure 3 This is a schematic diagram of achieving and canceling the speed limit condition of a time window provided by an embodiment of the present application. It can be seen that, assuming that the first preset length is 5 seconds and the time unit (unit time) is 1 second, when the number of times in each time unit of each subdomain is less than the first preset number threshold and the total number of receptions is less than the second preset number threshold, the conditions for canceling the speed limit are met, the speed limit is canceled, the process of releasing DNS requests according to the preset ratio and discarding the remaining DNS requests is stopped, and the process of resolving the DNS request and obtaining the DNS request domain name is started.

[0075] Step 104: After the DNS request is processed by speed limit and is released, the released DNS request is forwarded to the local DNS processing module for processing.

[0076] DNS requests that have been speed-limited and released will perform normal DNS services, and the local DNS processing module will respond to the DNS requests. The local DNS processing module usually includes a local DNS cache module and a local DNS recursive module. The DNS request is parsed to obtain the user's source IP, the domain name to be queried, and the cache database is queried. If there is a relevant domain name to be queried in the cache database, the domain name is resolved and the IP address is sent back to the user through the DNS response. If there is no relevant domain name to be queried in the cache database, the local DNS cache module will send a DNS recursive request to the local DNS recursive module. After receiving the DNS recursive request, the local DNS recursive module will initiate a DNS request to authoritative DNS servers at all levels. Authoritative DNS servers at all levels respond to the DNS request and return data to the local DNS recursive module, and finally return the address data to the user.

[0077] Optionally, the method further includes:

[0078] Step 105: If the DNS request is not of the target type, forward the DNS request to a local DNS processing module for processing.

[0079] Optionally, when at least one of the following conditions is met: the network layer protocol is not IPV4 or IPV6, the transport layer protocol is not UDP, and the application layer content indicates that the DNS request is illegal, it is determined that the DNS request does not belong to the target category.

[0080] If the DNS request is not of the target type, no rate limiting is required and the request is sent directly to the local DNS processing module, which returns the corresponding IP address. The specific process is similar to step 104.

[0081] In summary, the embodiment of the present application provides a method for limiting DNS access speed based on DPDK, including receiving a DNS request through the DPDK suite; parsing the received DNS request to determine the type of DNS request; if the DNS request is of the target type, performing speed limiting on the DNS request; after the DNS request is speed limited and released, forwarding the released DNS request to the local DNS processing module for processing. This method adds a speed limiting method related to the specified domain name and total number of visits to the original network message processing flow of DPDK. Without changing the original logic of the local DNS, it can solve the problem that the related technology only performs speed limiting protection in the recursive stage of DNS, thereby resulting in additional system resource consumption and network resource occupation.

[0082] The DPDK-based DNS access rate limiting method provided in the embodiments of the present application can be executed by a DPDK-based DNS access rate limiting device. In the embodiments of the present application, the DPDK-based DNS access rate limiting device executing the DPDK-based DNS access rate limiting method is used as an example to illustrate the DPDK-based DNS access rate limiting device provided in the embodiments of the present application.

[0083] Reference Figure 4 , Figure 4 This is a block diagram of a DNS access speed limiting device based on DPDK provided in an embodiment of the present application. Figure 4 As shown, the DPDK-based DNS access rate limiting device includes:

[0084] The DNS request receiving module 201 is configured to receive a DNS request.

[0085] The request distinguishing module 202 is configured to perform target protocol layer analysis on the received DNS request to determine the type of the DNS request.

[0086] The rate limiting module 203 is configured to perform rate limiting processing on the DNS request when the DNS request is of the target type.

[0087] The forwarding module 204 is configured to forward the DNS request to the local DNS processing module for processing when the DNS request is released after being processed with a speed limit.

[0088] Optionally, the request distinguishing module 202 includes:

[0089] The parsing submodule 2021 is used to parse and obtain the network layer protocol, transport layer protocol, and application layer content of the DNS request.

[0090] The determination submodule 2022 is configured to determine that the DNS request belongs to a target category when the network layer protocol is IPV4 or IPV6, the transport layer protocol is UDP, and the application layer content indicates that the DNS request is legal.

[0091] Optionally, the device further includes:

[0092] The second forwarding module 205 is configured to forward the DNS request to a local DNS processing module for processing if the DNS request is not of the target type.

[0093] Optionally, the rate limiting module 203 includes:

[0094] The acquisition submodule 2031 is used to parse the DNS request and obtain the DNS request domain name.

[0095] The first number determination submodule 2032 is configured to determine the number of DNS requests for each subdomain name in each time unit within a time window of a first preset length.

[0096] The first rate limiting submodule 2033 is configured to, when the number of times of each time unit of any subdomain is greater than or equal to a first preset number threshold, release the DNS requests according to a preset ratio and discard the remaining DNS requests.

[0097] The second number determination submodule 2034 is configured to determine the total number of times the DNS requests are received within a time window of a first preset length when the number of times of each time unit of each subdomain name is less than a first preset number threshold.

[0098] The second rate limiting submodule 2035 is configured to, when the total number of receptions is greater than or equal to a second preset number threshold, release the DNS requests according to a preset ratio and discard the remaining DNS requests.

[0099] The release submodule 2036 is configured to directly release the DNS request if the total number of receptions is less than a second preset number threshold.

[0100] Optionally, after the second speed limiting submodule 2035, the following further steps are included:

[0101] The stop submodule 2036 is used to stop the process of releasing the DNS requests according to a preset ratio and discarding the remaining DNS requests when the number of times of each time unit of each subdomain name is less than the first preset number threshold and the total number of received times is less than the second preset number threshold, and proceed to the step of resolving the DNS request and obtaining the DNS request domain name.

[0102] In summary, the embodiment of the present application provides a DNS access speed limiting device based on DPDK, including a DNS request receiving module for receiving DNS requests through the DPDK suite; a request distinguishing module for parsing the received DNS requests and determining the type of DNS requests; a speed limiting module for speed limiting the DNS requests when the DNS requests are of the target type; and a forwarding module for forwarding the released DNS requests to the local DNS processing module for processing after the DNS requests are speed limited and released. This method adds a speed limiting method related to the specified domain name and the total number of visits to the original network message processing flow of DPDK. Without changing the original logic of the local DNS, it can solve the problem that the related technology only performs speed limiting protection in the recursive stage of DNS, thereby causing additional system resource consumption and network resource occupation.

[0103] See also Figure 5 , Figure 5 This is a schematic diagram of a DNS access rate limiting system based on DPDK provided in an embodiment of the present application. The present invention also provides a DNS access rate limiting system based on DPDK, which includes: a DPDK receiving module, a DPDK sending module, and a local DNS processing module; the local DNS processing module includes: a local DNS cache module and a local DNS recursive module.

[0104] It can be seen that the DPDK receiving module is used to receive DNS requests through the DPDK suite; parse the received DNS requests to determine the type of the DNS requests; if the DNS requests are of the target type, rate limit the DNS requests; after the DNS requests are rate-limited and released, the released DNS requests are forwarded to the local DNS cache module.

[0105] The local DNS cache module is used to search for locally cached DNS data after receiving a DNS request sent by the DPDK rate limit module; after finding the DNS data corresponding to the DNS request, return the DNS data to the DPDK sending module; and if the DNS data corresponding to the DNS request is not found, forward the DNS request to the local DNS recursive module.

[0106] The local DNS recursive module is used to perform a recursive search based on the DNS request, obtain DNS data, and send the DNS data to the DPDK sending module through the local DNS cache module.

[0107] The DPDK sending module is used to return the DNS data corresponding to the DNS request.

[0108] The present invention also provides an electronic device, see Figure 6 , including: a processor 601, a memory 602, and a computer program 6021 stored in the memory and executable on the processor, wherein when the processor executes the program, the DPDK-based DNS access rate limiting method of the aforementioned embodiment is implemented.

[0109] The present invention also provides a readable storage medium. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the DPDK-based DNS access speed limiting method of the aforementioned embodiment.

[0110] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0111] It should be noted that the various information and data obtained in the embodiments of the present invention are all obtained with the authorization of the information / data holder.

[0112] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general-purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing this type of system. In addition, the present invention is not directed to any specific programming language. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of the present invention.

[0113] In the description provided herein, numerous specific details are described. However, it is understood that embodiments of the present invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0114] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Accordingly, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of the present invention.

[0115] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition may be divided into multiple submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed herein may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0116] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It will be appreciated by those skilled in the art that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components of the sorting device according to the present invention. The present invention may also be implemented as an apparatus or device program for performing a portion or all of the methods described herein. Such a program for implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0117] It should be noted that the above embodiments illustrate rather than limit the invention, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between brackets should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising several different elements and by means of appropriately programmed computers. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.

[0118] The user information (including but not limited to the user's device information, user personal information, etc.) and related data involved in the present invention are all information authorized by the user or authorized by all parties.

[0119] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0120] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

[0121] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A DNS access speed limiting method based on DPDK, characterized in that: The method comprises: Receive DNS requests through the DPDK suite; Parsing the received DNS request to determine the type of the DNS request; If the DNS request is of the target type, rate limiting the DNS request; After the DNS request is rate-limited and released, forward the released DNS request to the local DNS processing module for processing; The DNS request is rate-limited, including: Parse the DNS request to obtain the DNS request domain name; Determine the number of DNS requests for each subdomain in each time unit within a time window of a first preset length; If the number of times in each time unit of any subdomain is greater than or equal to a first preset number threshold, allow the DNS request according to a preset ratio and discard the remaining DNS requests; When the number of times in each time unit for each subdomain name is less than a first preset number threshold, determining a total number of times the DNS request is received within a time window of a first preset length; When the total number of received requests is greater than or equal to a second preset number threshold, allowing the DNS request to pass according to a preset ratio and discarding the remaining DNS requests; When the total number of receptions is less than a second preset number threshold, the DNS request is directly released.

2. The method according to claim 1, characterized in that The step of parsing the received DNS request to determine the type of the DNS request includes: Parse and obtain the network layer protocol, transport layer protocol, and application layer content of the DNS request; When the network layer protocol is IPV4 or IPV6, the transport layer protocol is UDP, and the application layer content indicates that the DNS request is legal, it is determined that the DNS request belongs to the target category.

3. The method according to claim 2, characterized in that Also includes: If the DNS request is not of the target type, the DNS request is forwarded to a local DNS processing module for processing.

4. The method according to claim 3, characterized in that When at least one of the following conditions is met: the network layer protocol is not IPV4 or IPV6, the transport layer protocol is not UDP, and the application layer content indicates that the DNS request is illegal, it is determined that the DNS request does not belong to the target category.

5. The method according to claim 1, characterized in that Determining the number of DNS requests for each subdomain in each time unit within a time window of a first preset length includes: A hash operation is performed on the DNS request of each subdomain, and the number of times each subdomain at each level is requested in each time unit within a time window of a first preset length is updated.

6. The method according to claim 1, characterized in that After allowing the DNS requests according to a preset ratio and discarding the remaining DNS requests when the total number of receptions is greater than or equal to a second preset number threshold, the method further includes: When the number of times in each time unit of each subdomain name is less than the first preset number threshold and the total number of receptions is less than the second preset number threshold, the process of releasing the DNS requests according to the preset ratio and discarding the remaining DNS requests is stopped, and the process of resolving the DNS requests and obtaining the DNS request domain name is started.

7. A DNS access speed limiting device based on DPDK, characterized in that: The device comprises: DNS request receiving module, used to receive DNS requests through the DPDK suite; A request distinguishing module is used to perform target protocol layer analysis on the received DNS request to determine the type of the DNS request; A rate limiting module, configured to perform rate limiting processing on the DNS request when the DNS request is of a target type; a forwarding module, configured to forward the DNS request that has been released after the DNS request has been rate-limited to a local DNS processing module for processing; The speed limiting module includes: The acquisition submodule is used to parse the DNS request and obtain the DNS request domain name; a first number determination submodule, configured to determine the number of DNS requests for each subdomain in each time unit within a time window of a first preset length; A first rate limiting submodule is configured to, when the number of times of each time unit of any subdomain is greater than or equal to a first preset number threshold, release the DNS request according to a preset ratio and discard the remaining DNS requests; A second number determination submodule is configured to determine a total number of receptions of the DNS requests received within a time window of a first preset length when the number of times of each time unit of each subdomain name is less than a first preset number threshold; A second rate limiting submodule is configured to, when the total number of receptions is greater than or equal to a second preset number threshold, release the DNS requests according to a preset ratio and discard the remaining DNS requests; The release submodule is used to directly release the DNS request when the total number of reception times is less than a second preset number threshold.

8. The device according to claim 7, characterized in that The request distinguishing module includes: A parsing submodule, configured to parse and obtain the network layer protocol, transport layer protocol, and application layer content of the DNS request; The determination submodule is used to determine that the DNS request belongs to the target category when the network layer protocol is IPV4 or IPV6, the transport layer protocol is UDP, and the application layer content indicates that the DNS request is legal.

9. The device according to claim 7, characterized in that The device further comprises: The second forwarding module is used to forward the DNS request to the local DNS processing module for processing when the DNS request is not of the target type.

10. The device according to claim 7, characterized in that After the second speed limiting submodule, the device further includes: The stop submodule is used to stop the process of releasing the DNS requests according to a preset ratio and discarding the remaining DNS requests when the number of times of each time unit of each subdomain name is less than a first preset number threshold and the total number of receptions is less than a second preset number threshold, and to proceed to the step of parsing the DNS request to obtain the DNS request domain name.

11. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 6 when executing the program.

12. A readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any one of the methods of claims 1-6.

Images