DDoS attack processing method and device, electronic equipment and storage medium

Abstract

The invention discloses a DDoS attack processing method and device, electronic equipment and a storage medium, and belongs to the technical field of network security. In the method, after a DDoS attack occurs in a top-level DNS, a control end receives a link switching request, then a link between a recursive DNS and the top-level DNS can be inquired from a first agent, and if it is determined that the link used by the recursive DNS is a conventional link, the link switching request is sent to the first agent; if yes, a link switching instruction is sent to the first agent, so that a conventional link used by the recursive DNS is switched to a standby link between the top-level DNS, and service resources of the top-level DNS corresponding to the standby link and the conventional link are different. Therefore, when the top-level DNS encounters the DDoS attack, only the service resource corresponding to the conventional link is consumed, and the service resource corresponding to the standby link is not influenced, so that after the link used by the recursive DNS is switched from the conventional link to the standby link, the top-level DNS still can normally provide service for the recursive DNS.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, electronic device and storage medium for processing DDoS attacks. Background Art

[0002] In recent years, the scale and intensity of attacks on top-level domains have been increasing. Taking the top-level domain ".cn" as an example, its export bandwidth is usually within 1Gbps, which means that the upper limit of data traffic that the top-level domain name system (Domain Name System, DNS) can handle is about 1Gbps.

[0003] In the related technologies, the network security measures taken for the domain name resolution system are mainly based on edge anti-DDoS attack means, such as firewalls and intrusion detection systems (IDS). Such methods often rely on preset rules to prevent unauthorized access, but cannot effectively distinguish between legitimate network traffic and malicious network traffic. Once the rules are improperly set, legitimate access may be mistakenly intercepted, which is not enough to defend against large-scale DDoS attacks. At the same time, its performance limitations make it vulnerable to high-traffic attacks. Summary of the invention

[0004] The embodiments of the present application provide a method, device, electronic device and storage medium for processing a DDoS attack, so as to solve the problem in the related art that a DDoS attack may cause a top-level DNS to be unable to provide services normally.

[0005] In a first aspect, an embodiment of the present application provides a method for processing a DDoS attack, including:

[0006] The control end receives a link switching request, where the link switching request is triggered after a DDoS attack occurs on a top-level DNS;

[0007] Sending a first link query request to a first agent, where the first link query request is used to query a link between a recursive DNS and the top-level DNS, and the first agent is deployed on the recursive DNS;

[0008] receiving first link information sent by the first agent;

[0009] If it is determined based on the first link information that the recursive DNS uses a regular link, a link switching instruction is sent to the first agent to switch the regular link used by the recursive DNS to a backup link to the top-level DNS, and the service resources of the top-level DNS corresponding to the backup link and the regular link are different.

[0010] In a second aspect, an embodiment of the present application provides a method for processing a DDoS attack, including:

[0011] The first agent receives a first link query request, where the first link query request is used to query a link between the recursive DNS and the top-level DNS, where the first link query request is sent by the control end after receiving a link switching request, where the link switching request is triggered after a DDoS attack occurs on the top-level DNS, and the first agent is deployed on the recursive DNS;

[0012] Sending first link information to the control end;

[0013] receiving a link switching request sent by the control end, wherein the link switching request is sent by the control end after determining that the recursive DNS uses a regular link based on the first link information;

[0014] The regular link used by the recursive DNS is switched to a backup link to the top-level DNS, and the service resources of the top-level DNS corresponding to the backup link and the regular link are different.

[0015] In a third aspect, an embodiment of the present application provides a DDoS attack processing device, including:

[0016] A first receiving module is used to receive a link switching request, where the link switching request is triggered after a DDoS attack occurs in a top-level DNS;

[0017] A first sending module, configured to send a first link query request to a first agent, wherein the first link query request is used to query a link between a recursive DNS and the top-level DNS, and the first agent is deployed on the recursive DNS;

[0018] A second receiving module, configured to receive the first link information sent by the first agent;

[0019] The second sending module is used to send a link switching instruction to the first agent if it is determined based on the first link information that the recursive DNS uses a regular link, so as to switch the regular link used by the recursive DNS to a backup link to the top-level DNS, and the service resources of the top-level DNS corresponding to the backup link and the regular link are different.

[0020] In a fourth aspect, an embodiment of the present application provides a DDoS attack processing device, including:

[0021] a first receiving module, configured to receive a first link query request, wherein the first link query request is used to query a link between the recursive DNS and the top-level DNS, wherein the first link query request is sent by the control end after receiving a link switching request, wherein the link switching request is triggered after a DDoS attack occurs in the top-level DNS, and wherein the first agent is deployed on the recursive DNS;

[0022] A first sending module, used for sending first link information to the control end;

[0023] A second receiving module, configured to receive a link switching request sent by the control end, wherein the link switching request is sent by the control end after determining that the recursive DNS uses a regular link based on the first link information;

[0024] The second sending module is used to switch the regular link used by the recursive DNS to a backup link to the top-level DNS, and the service resources of the top-level DNS corresponding to the backup link and the regular link are different.

[0025] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein:

[0026] The memory stores a computer program executable by at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute any of the above-mentioned methods for processing DDoS attacks.

[0027] In a sixth aspect, an embodiment of the present application provides a storage medium. When a computer program in the storage medium is executed by a processor of an electronic device, the electronic device can execute any of the above-mentioned methods for processing DDoS attacks.

[0028] In a seventh aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned methods for processing DDoS attacks.

[0029] In the embodiment of the present application, after a DDoS attack occurs to the top-level DNS, the control end will receive a link switching request, and then the first agent may be queried for the link between the recursive DNS and the top-level DNS. If it is determined that the link used by the recursive DNS is a regular link, a link switching instruction may be sent to the first agent to switch the regular link used by the recursive DNS to a backup link between the top-level DNS, wherein the service resources of the top-level DNS corresponding to the backup link and the regular link are different. In this way, the service resources of the top-level DNS are divided into two parts, one corresponding to the regular link and the other corresponding to the backup link. When the top-level DNS encounters a DDoS attack, only the service resources corresponding to the regular link will be consumed, and the service resources corresponding to the backup link will not be affected. Therefore, after the link used by the recursive DNS is switched from the regular link to the backup link, the top-level DNS can still provide normal services for the recursive DNS. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0031] Figure 1 A schematic diagram of a DDoS attack scenario provided in an embodiment of the present application;

[0032] Figure 2 A flowchart of a method for processing a DDoS attack provided in an embodiment of the present application;

[0033] Figure 3 A flowchart of another method for processing a DDoS attack provided in an embodiment of the present application;

[0034] Figure 4 A schematic diagram of a scenario of a method for processing a DDoS attack provided in an embodiment of the present application;

[0035] Figure 5 A schematic diagram of the structure of a DDoS attack processing device provided in an embodiment of the present application;

[0036] Figure 6 A schematic diagram of the structure of another DDoS attack processing device provided in an embodiment of the present application;

[0037] Figure 7 A schematic diagram of the hardware structure of an electronic device for implementing a method for processing DDoS attacks provided in an embodiment of the present application. DETAILED DESCRIPTION

[0038] In order to solve the problem in the related art that DDoS attacks may cause the top-level DNS to be unable to provide services normally, the embodiments of the present application provide a method, device, electronic device and storage medium for processing DDoS attacks.

[0039] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0040] In order to facilitate the understanding of this application, the technical terms involved in this application are:

[0041] Backbone network: refers to the high-speed, high-capacity network connecting the main nodes of the Internet, usually built and maintained by operators. The backbone network is the main transmission channel of the Internet and is responsible for carrying a large amount of data exchange on the Internet.

[0042] Intrusion Detection System (IDS): A network security system that monitors network transmissions and issues alarms or takes proactive countermeasures when suspicious transmissions are detected.

[0043] Domain Name System (DNS): A distributed database system used to manage the mapping relationship between domain names and IP addresses. The DNS server is a host that provides domain name resolution services to users.

[0044] Top-Level DNS: refers to the DNS server responsible for managing the Internet top-level domain (TLD), such as .com, .org, .net, etc. Each TLD has one or more authoritative DNS servers responsible for responding to domain name query requests under the TLD.

[0045] Authoritative DNS: The final authoritative source of domain names, used to store DNS records for specific domain names, including the IP address corresponding to the domain name, and other types of DNS records that may be needed. When a recursive DNS server finds the authoritative DNS server responsible for a specific domain name through the TLD server, it will query the authoritative DNS server for specific information about the required domain name.

[0046] Recursive DNS: acts as a proxy between the client and other DNS servers to help resolve domain name requests. When a client sends a query request to a recursive DNS server, the recursive server will begin to recursively query and resolve the query upwards, querying the upper authoritative or top-level DNS until it gets the answer and returns it to the client.

[0047] Distributed Denial of Service (DDoS): is a type of network attack where attackers use a large number of controlled "zombie hosts" to send a large number of requests to target systems such as top-level DNS, causing the target system resources to be exhausted and unable to provide services to normal users. This type of attack is distributed, highly concealed, and difficult to track.

[0048] With the rapid development of the Internet, DNS has become an important part of network infrastructure services, but DNS faces multiple security threats such as DDoS attacks. DDoS attacks can be easily spread across different networks around the world, making it difficult to quickly identify the source of the attack and block it. In addition, attack requests not only occupy the processing power of the server, but may also fill up the bandwidth of the entire network, making it impossible for legitimate DNS query requests to be responded to, resulting in service interruption.

[0049] In recent years, the scale and intensity of attacks on top-level domains have been increasing. Taking the top-level domain ".cn" as an example, its export bandwidth is usually within 1Gbps, which means that the upper limit of data traffic that the top-level domain name system (Domain Name System, DNS) can handle is about 1Gbps.

[0050] In the related technologies, the network security measures taken for the domain name resolution system are mainly based on edge anti-DDoS attack means, such as firewalls and intrusion detection systems (IDS). Such methods often rely on preset rules to prevent unauthorized access, but cannot effectively distinguish between legitimate network traffic and malicious network traffic. Once the rules are improperly set, legitimate access may be mistakenly intercepted, which is not enough to defend against large-scale DDoS attacks. At the same time, its performance limitations make it vulnerable to high-traffic attacks.

[0051] See also Figure 1 , Figure 1 A scenario diagram of a DDoS attack provided for an embodiment of the present application includes a recursive DNS, a backbone network and a top-level DNS, wherein the backbone network is used to provide network transmission services for multiple user terminals, each user terminal can send a domain name resolution request to the recursive DNS, the recursive DNS interacts with the top-level DNS through the backbone network to obtain a domain name resolution result, and sends the domain name resolution result to the user terminal, and then, the user terminal accesses the top-level DNS through the backbone network based on the domain name resolution result.

[0052] When a top-level DNS is attacked by DDoS, a large number of messages will reach the top-level DNS, thereby exhausting the service resources of the top-level DNS such as network cards, making it impossible for the top-level DNS to provide services for recursive DNS normally. In addition, there may also be a large number of attack messages on the backbone network.

[0053] To this end, in the embodiment of the present application, a dedicated, hidden backup link with high security and high reliability is constructed between the recursive DNS and the top-level DNS. Since the service resources of the top-level DNS corresponding to the backup link and the regular link are different, the DDoS attack will only consume the service resources corresponding to the regular link, and will not affect the service resources corresponding to the backup link. Therefore, when the top-level domain DNS faces a DDoS attack, the link between the recursive DNS and the top-level DNS is quickly switched to the backup link, and the top-level DNS can still provide normal services for the recursive DNS. This solution is not limited by the scale and volume of the attack, and can fundamentally ensure that the domain name resolution service is not interrupted.

[0054] After introducing the application scenarios of the embodiments of the present application, the processing of the DDoS attack proposed in the present application is described below with a specific embodiment.

[0055] Figure 2 A flowchart of a method for processing a DDoS attack provided in an embodiment of the present application, the method comprising the following steps.

[0056] In step 201, a link switching request is received, where the link switching request is triggered after a DDoS attack occurs in the top-level DNS.

[0057] In specific implementation, detection nodes for detecting DDoS attacks can be deployed on the top-level DNS side and the backbone network side respectively. Among them, the detection node on the top-level DNS side can respond quickly when the link performance fails, and can also avoid the untimely handling caused by the long detection time overhead on the backbone network side in some cases; the detection node on the backbone network side can start detection before the DDoS attack paralyzes the top-level DNS, and can also detect DDoS attacks that do not act on the top-level domain device itself (difficult to detect on the top-level DNS side) but will cause link failures. In this way, the linkage between the two sides can identify DDoS attacks as accurately as possible, and thus provide more accurate link switching decisions.

[0058] Therefore, the link switching request can be sent by the second agent deployed on the top-level DNS after determining that the message processing load of the top-level DNS matches the load characteristics when a DDoS attack occurs, or it can be sent by the third agent deployed on the network device corresponding to the backbone network after determining that the network traffic transmitted on the backbone network matches the traffic characteristics when a DDoS attack occurs on the top-level DNS.

[0059] In step 202, a first link query request is sent to a first proxy, where the first link query request is used to query a link to a top-level DNS used by a recursive DNS, and the first proxy is deployed on the recursive DNS.

[0060] To avoid erroneous switching, you can first query the link between the current recursive DNS and the top-level DNS.

[0061] In step 203, first link information sent by a first agent is received.

[0062] The first link information includes a link identifier, a link number, and the like.

[0063] In step 204, if it is determined based on the first link information that the recursive DNS uses a regular link, a link switching instruction is sent to the first proxy to switch the regular link used by the recursive DNS to a backup link to the top-level DNS. The service resources of the top-level DNS corresponding to the backup link and the regular link are different.

[0064] Among them, the regular link can also be called the first link, the backup link can also be called the second link, and the service resources of the top-level DNS are such as network cards.

[0065] In step 205, a link recovery request is received, where the link recovery request is triggered after the DDoS attack on the top-level DNS is resolved.

[0066] The link recovery request may include a first link recovery request and a second link recovery request. The first link recovery request may be load alarm release information sent by the second agent, and the second link recovery request may be network alarm release information sent by the third agent.

[0067] In other words, link recovery can only be performed when both the top-level DNS end and the backbone network end are sure that the DDoS attack has been lifted. This ensures the rationality of link recovery.

[0068] In step 206, a second link query request is sent to the first proxy, where the second link query request is used to query the link between the recursive DNS and the top-level DNS.

[0069] To avoid false recovery, you can first query the link between the current recursive DNS and the top-level DNS.

[0070] In step 207, second link information sent by the first agent is received.

[0071] The second link information includes a link identifier, a link number, and the like.

[0072] In step 208, if it is determined based on the second link information that the recursive DNS uses a backup link, a link recovery instruction is sent to the first proxy to restore the backup link used by the recursive DNS to a regular link.

[0073] See also Figure 3 , Figure 3 A flowchart of another method for processing a DDoS attack provided in an embodiment of the present application, the method comprising the following steps.

[0074] In step 301, a first link query request is received. The first link query request is used to query the link between the recursive DNS and the top-level DNS. The first link query request is sent by the control end after receiving the link switching request. The link switching request is triggered after a DDoS attack occurs in the top-level DNS. The first agent is deployed on the recursive DNS.

[0075] In step 302, first link information is sent to the control end.

[0076] Here, what is sent to the control end is the first link information of the link to the top-level DNS currently in use.

[0077] In step 303, a link switching request sent by the control end is received. The link switching request is sent by the control end after determining that the recursive DNS uses a regular link based on the first link information.

[0078] In step 304, the regular link used by the recursive DNS is switched to a backup link to the top-level DNS, and the service resources of the top-level DNS corresponding to the backup link and the regular link are different.

[0079] In step 305, a second link query request is received. The second link query request is used to query the link between the recursive DNS and the top-level DNS. The second link query request is sent by the control end after receiving the link recovery request. The link recovery request is triggered after the DDoS attack on the top-level DNS is lifted.

[0080] In step 306, the second link information is sent to the control end.

[0081] Here, what is sent to the control end is the second link information of the currently used link to the top-level DNS.

[0082] In step 307, a link recovery instruction is received. The link recovery instruction is sent by the control end after determining that the recursive DNS uses a regular link based on the second link information.

[0083] In step 308, the backup link used by the recursive DNS is restored to a regular link.

[0084] The embodiment of the present application provides a recursive top-level linkage domain name service guarantee solution for end-to-end collaboration. Specifically, by deploying detection nodes for detecting DDoS attacks on the top-level DNS end and the backbone network end, accurate link switching decisions based on multi-source information are implemented. Because the top-level DNS end can respond quickly when the link performance fails, it can also avoid the untimely handling caused by the long detection time overhead of the backbone network end in some cases; and the backbone network end can start detection before the DDoS attack paralyzes the top-level DNS, and can also detect DDoS attacks that do not act on the top-level DNS itself (difficult to detect on the top-level DNS end) but will cause link failures. At the same time, a backup link is constructed between the recursive DNS and the top-level DNS to build a hidden, secure, and highly reliable emergency guarantee channel for the top-level domain, which serves as a transfer channel when the top-level domain is attacked by DDoS.

[0085] See also Figure 4 , Figure 4 A scenario diagram of a method for handling DDoS attacks provided in an embodiment of the present application, the components in this solution involve recursive DNS, top-level DNS, control terminal (which can be a link control program), backbone network traffic detection program Traffic-Agent, recursive server control program DNS-Agent, recursive server monitoring program Load-Agent, and a regular link and a backup link running between the recursive DNS and the top-level DNS, which need to be initialized and configured respectively. Load-Agent can have various forms as an end-side detection agent, including but not limited to programs running on devices, IDS, etc.

[0086] Combine the following Figure 4 The solution of the embodiment of the present application is introduced.

[0087] Step 1. Environment construction and module initialization.

[0088] Step 1.1: Build a communication link. Build a communication link between the recursive DNS and the top-level DNS to be protected. The communication link includes a regular link and a backup link.

[0089] Among them, the conventional link provides standard DNS query and response services, while the backup link needs to be specially designed with higher security and concealment, such as using Multi-Protocol Label Switching (MPLS), Segment Routing IPv6 (SRv6) based on the IPv6 forwarding plane, GPRS Tunnelling Protocol (GTP) or other Virtual Private Network (VPN) technologies to provide dedicated line services isolated from the network traffic of the conventional link, ensuring that the backup link has sufficient bandwidth and low latency to serve as an alternative link during high-traffic attacks.

[0090] Step 1.2 Initialize Traffic-Agent, configure traffic collection information, and monitor the network traffic of the top-level DNS to detect abnormal traffic in a timely manner.

[0091] Step 1.3: Initialize DNS-Agent and start listening to the link switching control instructions from the control end; initialize the control end and start listening to the link switching request from Load-Agent and run Load-Agent.

[0092] Step 2: When a DDoS attack occurs, a link switching request is generated, including the following two situations.

[0093] Step 2.1 Big network alarm: Traffic alarm from Traffic-Agent. Based on the operator's advantage in network traffic acquisition on the backbone network, the network traffic of the top-level DNS is analyzed from the perspective of the big network. The static baseline method or the dynamic baseline method is combined with the pre-trained anomaly detection model to identify abnormal traffic in the network traffic that matches the traffic characteristics during the DDoS attack. If Traffic-Agent determines that the network traffic is abnormal traffic of the DDoS attack, a traffic alarm is generated and a link switching request is sent to the control end.

[0094] Step 2.2 Load alarm: Load alarm from Load-Agent. Load-Agent runs as a program on the top-level DNS server, and obtains the network card information of the regular link of the top-level DNS in real time, including but not limited to the network card load, the number of active connections, the number of newly added connections, the network card throughput increment, etc. It uses a machine learning model (including but not limited to anomaly detection models based on time series or clustering algorithms) to conduct comprehensive multi-dimensional data analysis. When the machine learning model shows that the current load matches the load characteristics during a DDoS attack, it is determined that the top-level DNS server is under a DDoS attack, and then a load alarm is generated, and a link switching request is sent to the link control program.

[0095] Step 3. Link switching.

[0096] Step 3.1 Status query. The control end first queries the DNS-Agent for the link currently used by the recursive DNS. If it is currently working on the backup link, complete step 3. The control end here can monitor and process link switching and recovery requests from Traffic-Agent and Load-Agent according to the status, and can use the specified protocol (such as OpenFlow, netconf or a custom control protocol) to complete the link status query and session link switching operation instruction issuance with the DNS-Agent session.

[0097] Step 3.2 If the current recursive DNS uses the regular link, notify the DNS-Agent to switch to the backup link.

[0098] Step 3.3 DNS-Agent responds to the switch instruction, updates the enabled link in the recursive DNS configuration file to the standby link, and restarts the DNS service program, thereby switching the link to the standby link to prevent providing services for ongoing legitimate DNS queries.

[0099] Step 4. After switching to the backup link, Traffic-Agent and Load-Agent continue to run to detect whether the regular link has been restored.

[0100] Step 4.1 Since Load-Agent is closer to the top-level DNS, Load-Agent is the first to sense whether the link is restored or not. Therefore, Load-Agent will generally send the first link recovery request to the control end first. After Traffic-Agen detects that the DDoS attack is lifted, it will send the second link recovery request to the control end.

[0101] Step 4.2: After receiving the first link recovery request and the second link recovery request, the control end queries the DNS-Agent for the link currently used by the recursive DNS. If the link has been restored to the normal link, step 4 is completed.

[0102] Step 4.3 If the backup link is still in use, the DNS-Agent is notified to switch the backup link back to the regular link. The DNS-Agent performs the corresponding configuration changes and completes the link recovery after restarting the service.

[0103] This application provides a domain name service guarantee method for end-to-end collaboration and recursive top-level linkage, which can achieve the following beneficial effects:

[0104] 1. By implementing coordinated detection on the top-level domain device side and the backbone network side, a global perspective and multi-point monitoring are achieved when a DDoS attack occurs, ensuring that the top-level domain DNS service can still be quickly switched to the backup link under attack, avoiding service interruption caused by DDoS attacks;

[0105] 2. By linking the recursive DNS and the top-level DNS, a dedicated, hidden backup link with high security and reliability is built. When the top-level domain DNS faces a DDoS attack, it can quickly switch to the preset secure link without being restricted by the scale and volume of the attack, thus fundamentally guaranteeing the domain name resolution service.

[0106] 3. Through accurate link switching decisions based on multi-source information, the efficiency and accuracy of attack detection have been greatly improved, and automated monitoring and rapid response have been achieved in the entire stage from attack occurrence, continuation to release and recovery, significantly enhancing the top-level domain DNS's ability to respond to increasingly complex DDoS attacks.

[0107] Based on the same technical concept, the embodiment of the present application also provides a DDoS attack processing device. The principle of solving the problem by the DDoS attack processing device is similar to the above-mentioned DDoS attack processing method. Therefore, the implementation of the DDoS attack processing device can refer to the implementation of the DDoS attack processing method, and the repeated parts will not be repeated.

[0108] Figure 5 A structural diagram of a DDoS attack processing device provided in an embodiment of the present application includes:

[0109] A first receiving module 501 is used to receive a link switching request, where the link switching request is triggered after a DDoS attack occurs in a top-level DNS;

[0110] A first sending module 502 is used to send a first link query request to a first agent, where the first link query request is used to query a link between a recursive DNS and the top-level DNS, and the first agent is deployed on the recursive DNS;

[0111] A second receiving module 503, configured to receive the first link information sent by the first agent;

[0112] The second sending module 504 is used to send a link switching instruction to the first agent if it is determined based on the first link information that the recursive DNS uses a regular link, so as to switch the regular link used by the recursive DNS to a backup link to the top-level DNS, and the service resources of the top-level DNS corresponding to the backup link and the regular link are different.

[0113] In some embodiments, the link switching request is sent by the second agent after determining the message processing load of the top-level DNS and matching the load characteristics during a DDoS attack, and the second agent is deployed on the top-level DNS, or the link switching request is sent by the third agent after determining the network traffic transmitted on the backbone network and matching the traffic characteristics during a DDoS attack, and the third agent is deployed on a network device corresponding to the backbone network.

[0114] In some embodiments, the first receiving module 501 is further used to receive a link recovery request, where the link recovery request is triggered after the DDoS attack on the top-level DNS is resolved;

[0115] The first sending module 502 is further used to send a second link query request to the first proxy, where the second link query request is used to query the link between the recursive DNS and the top-level DNS;

[0116] The second receiving module 503 is further used to receive the second link information sent by the first agent;

[0117] The second sending module 504 is further configured to send a link recovery instruction to the first proxy to recover the backup link used by the recursive DNS to the regular link if it is determined based on the second link information that the recursive DNS uses the backup link.

[0118] In some embodiments, the link recovery request includes a first link recovery request and a second link recovery request, wherein the first link recovery request is sent by the second agent after determining that the message processing load of the top-level DNS does not match the load characteristics during a DDoS attack, and the second link recovery request is sent by the third agent after determining that the network traffic transmitted on the backbone network does not match the traffic characteristics during a DDoS attack.

[0119] Figure 6 A structural diagram of another DDoS attack processing device provided in an embodiment of the present application includes:

[0120] The first receiving module 601 is used to receive a first link query request, where the first link query request is used to query the link between the recursive DNS and the top-level DNS, where the first link query request is sent by the control end after receiving a link switching request, where the link switching request is triggered after a DDoS attack occurs in the top-level DNS, and the first agent is deployed on the recursive DNS;

[0121] A first sending module 602, configured to send first link information to the control end;

[0122] A second receiving module 603 is used to receive a link switching request sent by the control end, where the link switching request is sent by the control end after determining that the recursive DNS uses a regular link based on the first link information;

[0123] The second sending module 604 is used to switch the regular link used by the recursive DNS to a backup link to the top-level DNS, and the service resources of the top-level DNS corresponding to the backup link and the regular link are different.

[0124] In some embodiments, the first receiving module 601 is further used to receive a second link query request, where the second link query request is used to query the link between the recursive DNS and the top-level DNS, where the second link query request is sent by the control end after receiving a link recovery request, where the link recovery request is triggered after the DDoS attack on the top-level DNS is lifted;

[0125] The first sending module 602 is further used to send the second link information to the control end;

[0126] The second receiving module 603 is further used to receive a link recovery instruction, where the link recovery instruction is sent by the control end after determining that the recursive DNS uses the regular link based on the second link information;

[0127] The second sending module 604 is further configured to restore the backup link used by the recursive DNS to the regular link.

[0128] The division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, the functional modules in the embodiments of the present application may be integrated into a processor, or may exist physically alone, or two or more modules may be integrated into one module. The coupling between the modules may be achieved through some interfaces, which are usually electrical communication interfaces, but it is not excluded that they may be mechanical interfaces or other forms of interfaces. Therefore, the modules described as separate components may or may not be physically separated, and may be located in one place or distributed to different locations of the same or different devices. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0129] After introducing the DDoS attack processing method and device according to the exemplary embodiment of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0130] Refer to the following Figure 7 The electronic device 130 implemented according to this embodiment of the present application is described. Figure 7 The electronic device 130 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0131] like Figure 7 As shown, the electronic device 130 is in the form of a general electronic device. The components of the electronic device 130 may include but are not limited to: the at least one processor 131, the at least one memory 132, and a bus 133 connecting different system components (including the memory 132 and the processor 131).

[0132] Bus 133 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0133] The memory 132 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1321 and / or a cache memory 1322 , and may further include a read-only memory (ROM) 1323 .

[0134] The memory 132 may also include a program / utility 1325 having a set (at least one) of program modules 1324, such program modules 1324 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0135] The electronic device 130 may also communicate with one or more external devices 134 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 130, and / or communicate with any device that enables the electronic device 130 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 135. Furthermore, the electronic device 130 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 136. As shown, the network adapter 136 communicates with other modules for the electronic device 130 via a bus 133. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 130, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0136] In an exemplary embodiment, a storage medium is also provided, and when a computer program in the storage medium is executed by a processor of an electronic device, the electronic device can execute the above-mentioned DDoS attack processing method. Optionally, the storage medium can be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0137] In an exemplary embodiment, the electronic device of the present application may include at least one processor and a memory communicatively connected to the at least one processor, wherein the memory stores a computer program executable by the at least one processor, and when the computer program is executed by the at least one processor, the at least one processor may execute the steps of any DDoS attack processing method provided in the embodiments of the present application.

[0138] In an exemplary embodiment, a computer program product is also provided. When the computer program product is executed by an electronic device, the electronic device can implement any exemplary method provided in the present application.

[0139] Furthermore, the computer program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a RAM, a ROM, an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a compact disk read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0140] The program product for processing DDoS attacks in the embodiment of the present application may adopt a CD-ROM and include program code, and may be run on a computing device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, and the program may be used by or in combination with an instruction execution system, apparatus, or device.

[0141] The readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0142] The program code contained on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, radio frequency (RF), etc., or any suitable combination of the foregoing.

[0143] Program code for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device via any type of network such as a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0144] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0145] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0146] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0147] The present application is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0148] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0149] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0150] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0151] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application also includes these modifications and variations.

Claims

1. A method for handling DDoS attacks. It is characterized in that include: The control end receives a link switching request, where the link switching request is triggered after a DDoS attack occurs on a top-level DNS; Sending a first link query request to a first agent, where the first link query request is used to query a link between a recursive DNS and the top-level DNS, and the first agent is deployed on the recursive DNS; receiving first link information sent by the first agent; If it is determined based on the first link information that the recursive DNS uses a regular link, a link switching instruction is sent to the first agent to switch the regular link used by the recursive DNS to a backup link to the top-level DNS, and the service resources of the top-level DNS corresponding to the backup link and the regular link are different.

2. The method according to claim 1, It is characterized in that The link switching request is sent by the second agent after determining the message processing load of the top-level DNS and matching it with the load characteristics during the DDoS attack, and the second agent is deployed on the top-level DNS, or the link switching request is sent by the third agent after determining the network traffic transmitted on the backbone network and matching it with the traffic characteristics during the DDoS attack, and the third agent is deployed on the network device corresponding to the backbone network.

3. The method according to claim 2, It is characterized in that Also includes: receiving a link recovery request, where the link recovery request is triggered after the DDoS attack on the top-level DNS is resolved; Sending a second link query request to the first proxy, where the second link query request is used to query a link used by the recursive DNS to the top-level DNS; receiving second link information sent by the first agent; If it is determined based on the second link information that the recursive DNS uses the backup link, a link recovery instruction is sent to the first agent to restore the backup link used by the recursive DNS to the regular link.

4. The method according to claim 3, It is characterized in that The link recovery request includes a first link recovery request and a second link recovery request. The first link recovery request is sent by the second agent after determining that the message processing load of the top-level DNS does not match the load characteristics during a DDoS attack. The second link recovery request is sent by the third agent after determining that the network traffic transmitted on the backbone network does not match the traffic characteristics during a DDoS attack.

5. A method for handling DDoS attacks. It is characterized in that include: The first agent receives a first link query request, where the first link query request is used to query a link between the recursive DNS and the top-level DNS, where the first link query request is sent by the control end after receiving a link switching request, where the link switching request is triggered after a DDoS attack occurs on the top-level DNS, and the first agent is deployed on the recursive DNS; Sending first link information to the control end; receiving a link switching request sent by the control end, wherein the link switching request is sent by the control end after determining that the recursive DNS uses a regular link based on the first link information; The regular link used by the recursive DNS is switched to a backup link to the top-level DNS, and the service resources of the top-level DNS corresponding to the backup link and the regular link are different.

6. The method according to claim 5, It is characterized in that Also includes: receiving a second link query request, where the second link query request is used to query a link between the recursive DNS and the top-level DNS, where the second link query request is sent by the control end after receiving a link recovery request, where the link recovery request is triggered after a DDoS attack on the top-level DNS is lifted; Sending second link information to the control end; receiving a link recovery instruction, wherein the link recovery instruction is sent by the control end after determining that the recursive DNS uses the regular link based on the second link information; The backup link used by the recursive DNS is restored to the regular link.

7. A DDoS attack defense device, applied to the control end, It is characterized in that include: A first receiving module is used to receive a link switching request, where the link switching request is triggered after a DDoS attack occurs in a top-level DNS; A first sending module, configured to send a first link query request to a first agent, wherein the first link query request is used to query a link between a recursive DNS and the top-level DNS, and the first agent is deployed on the recursive DNS; A second receiving module, configured to receive the first link information sent by the first agent; The second sending module is used to send a link switching instruction to the first agent if it is determined based on the first link information that the recursive DNS uses a regular link, so as to switch the regular link used by the recursive DNS to a backup link to the top-level DNS, and the service resources of the top-level DNS corresponding to the backup link and the regular link are different.

8. A DDoS attack defense device, applied to a first proxy terminal, It is characterized in that include: a first receiving module, configured to receive a first link query request, wherein the first link query request is used to query a link between the recursive DNS and the top-level DNS, wherein the first link query request is sent by the control end after receiving a link switching request, wherein the link switching request is triggered after a DDoS attack occurs in the top-level DNS, and wherein the first agent is deployed on the recursive DNS; A first sending module, used for sending first link information to the control end; A second receiving module, configured to receive a link switching request sent by the control end, wherein the link switching request is sent by the control end after determining that the recursive DNS uses a regular link based on the first link information; The second sending module is used to switch the regular link used by the recursive DNS to a backup link to the top-level DNS, and the service resources of the top-level DNS corresponding to the backup link and the regular link are different.

9. An electronic device, It is characterized in that include: at least one processor, and a memory communicatively connected to the at least one processor, wherein: The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the method according to any one of claims 1 to 6.

10. A storage medium, It is characterized in that When the computer program in the storage medium is executed by a processor of an electronic device, the electronic device can execute the method according to any one of claims 1 to 6.

11. A computer program product, It is characterized in that The method comprises a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images