Attack identification method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of network security, in particular to an attack identification method and device, electronic equipment and a storage medium, which are used for timely and effectively discovering attacks destroying DNS load balance. The method comprises the steps that a detection routine analyzes a DNS event message, generates a detection DNS request and sends the detection DNS request to an NS server, the DNS event message is generated when a DNS analyzer determines that the NS server does not respond to an original DNS request, the original DNS request comprises a request domain name, and the DNS event message comprises the request domain name and an NS request type; based on the response state of the NS server to the detection DNS request, a detection result is determined, and the detection result represents whether the analysis service of the NS server fails or not and whether the request domain name has attack characteristics or not.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an attack identification method, device, electronic device and storage medium. Background Art

[0002] Domain Name System (DNS) load balancing is to use the network addresses of multiple name servers (NS) in DNS resource records to intelligently distribute network load. At present, the mainstream DNS load balancing technology uses the round-trip time (RTT) optimization algorithm, which randomly initializes the RTT of all NS servers and selects the NS server with the smallest RTT for priority use. If this NS server times out, it will be punished (it will not be selected again for a period of time), and another NS server will be selected as the forwarding address. A new round of RTT calculation will be performed after 1800 seconds.

[0003] In DNS load balancing, if an attacker takes advantage of the fact that some domain names under certain DNS authoritative servers cannot be resolved and have no response, and maliciously requests these domain names, then the NS servers that did not respond will be punished, and most of the NS servers will lose their preferred position. In extreme cases, only one NS server can provide services for 1800 seconds, which will cause the DNS load balancing to fail, increase the resolution pressure on the link and the corresponding DNS authoritative server, and greatly increase network latency.

[0004] The above-mentioned attacks that damage DNS load balancing are generally not discovered until the attack has occurred and has already affected the business, which means they are not discovered in a timely manner. Summary of the invention

[0005] The embodiments of the present application provide an attack identification method, device, electronic device and storage medium for timely and effectively discovering attacks that destroy DNS load balancing.

[0006] The specific technical solutions provided by the embodiments of this application are as follows:

[0007] In a first aspect, an attack identification method is provided, the method comprising:

[0008] The detection routine parses the DNS event message, generates a detection DNS request, and sends the detection DNS request to the NS server, wherein the DNS event message is generated by the DNS resolver when it determines that the NS server has no response to the original DNS request, and the original DNS request includes: a requested domain name, and the DNS event message includes: a requested domain name and a NS request type;

[0009] The detection result is determined based on the response status of the NS server to the detection DNS request. The detection result indicates whether the resolution service of the NS server is faulty and whether the requested domain name has attack characteristics.

[0010] In a possible embodiment, determining the detection result based on the response status of the NS server to the detection DNS request includes:

[0011] When no response is received from the NS server to the DNS probe request under the preset first response condition, it is determined that the resolution service of the NS server is faulty and the requested domain name has no attack characteristics;

[0012] When a response from the NS server to the detection DNS request is received under the first response condition, it is determined that the resolution service of the NS server is normal, and the original DNS request is sent to the NS server. Based on the response status of the NS server to the original DNS request, it is determined whether the requested domain name has attack characteristics.

[0013] Through the above method, the NS server with resolution service failure can be accurately detected.

[0014] In a possible embodiment, determining whether the requested domain name has attack characteristics based on the response status of the NS server to the original DNS request includes:

[0015] When no response is received from the NS server to the original DNS request under the preset second response condition, it is determined that the requested domain name has an attack feature;

[0016] When, under the second response condition, a response to the original DNS request from the NS server is received, it is determined that the requested domain name has no attack features.

[0017] By using the above method, the original request packet is sent and the NS server is re-detected, so that it can be accurately determined whether the requested domain name has attack characteristics when the resolution service of the NS server is normal.

[0018] In a possible embodiment, after determining the detection result based on the response status of the NS server to the detection DNS request, the method further includes:

[0019] Sending the detection result to the DNS resolver, so that when the detection result indicates that the resolution service of the NS server fails, the DNS resolver replaces the value of the first round-trip time RTT contained in the address data with the value of the second RTT, and sets the value of the second RTT to 0; and when the detection result indicates that the resolution service of the NS server is normal and the requested domain name has attack characteristics, the DNS resolver does not change the value of the first RTT contained in the address data, and sets the value of the second RTT to 0;

[0020] The first RTT is the RTT that is preferably used, and the second RTT is the newly calculated RTT.

[0021] Through the above method, the effectiveness of DNS load balancing is guaranteed.

[0022] In a possible embodiment, after determining the detection result based on the response status of the NS server to the detection DNS request, the method further includes:

[0023] When the detection result indicates that the requested domain name has attack characteristics, a DNS response packet is constructed and sent to the client, wherein the DNS response packet uses the User Datagram Protocol UDP, and the TC flag bit of the DNS response packet is 1;

[0024] If a target DNS request returned by the client is received, it is determined that the client is a normal user, wherein the target DNS request uses the transmission control protocol TCP;

[0025] If the target DNS request returned by the client is not received, it is determined that the client has the characteristics of a botnet.

[0026] Through the above method, it is possible to accurately identify whether the client has the characteristics of a botnet.

[0027] In a possible embodiment, the method further includes:

[0028] Send alarm information to the DNS management platform so that the DNS management platform issues an alarm, and based on the alarm information, generates a domain name list and an IP address list, and sends them in batches to the DNS cache server, so that the DNS cache server generates a domain name blacklist and an IP address blacklist based on the domain name list and the IP address list;

[0029] The alarm information includes the requesting domain name, or the alarm information includes the requesting domain name and the IP address of the client.

[0030] Through the above method, attacks can be intercepted and blocked on the DNS cache server, and interception or speed limiting can be performed at the network entrance to ensure the stable operation of the upstream DNS service.

[0031] In a second aspect, an attack identification device is provided, the device comprising:

[0032] The first processing module is used for the detection routine to parse the DNS event message, generate a detection DNS request, and send the detection DNS request to the NS server, wherein the DNS event message is generated by the DNS resolver when it is determined that the NS server has no response to the original DNS request, the original DNS request includes: a requested domain name, and the DNS event message includes: a requested domain name and a NS request type;

[0033] The detection module is used to determine the detection result based on the response status of the NS server to the detection DNS request. The detection result represents: whether the resolution service of the NS server is faulty and whether the requested domain name has attack characteristics.

[0034] In a possible embodiment, when determining the detection result based on the response status of the NS server to the detection DNS request, the detection module is further used to:

[0035] When no response is received from the NS server to the DNS probe request under the preset first response condition, it is determined that the resolution service of the NS server is faulty and the requested domain name has no attack characteristics;

[0036] When a response from the NS server to the detection DNS request is received under the first response condition, it is determined that the resolution service of the NS server is normal, and the original DNS request is sent to the NS server. Based on the response status of the NS server to the original DNS request, it is determined whether the requested domain name has attack characteristics.

[0037] In a possible embodiment, when determining whether the requested domain name has attack characteristics based on the response status of the NS server to the original DNS request, the detection module is further used to:

[0038] When no response is received from the NS server to the original DNS request under the preset second response condition, it is determined that the requested domain name has an attack feature;

[0039] When, under the second response condition, a response to the original DNS request from the NS server is received, it is determined that the requested domain name has no attack features.

[0040] In a possible embodiment, after determining the detection result based on the response status of the NS server to the detection DNS request, a second processing module is further included, and the second processing module is used to:

[0041] Sending the detection result to the DNS resolver, so that when the detection result indicates that the resolution service of the NS server fails, the DNS resolver replaces the value of the first round-trip time RTT contained in the address data with the value of the second RTT, and sets the value of the second RTT to 0; and when the detection result indicates that the resolution service of the NS server is normal and the requested domain name has attack characteristics, the DNS resolver does not change the value of the first RTT contained in the address data, and sets the value of the second RTT to 0;

[0042] The first RTT is the RTT that is preferably used, and the second RTT is the newly calculated RTT.

[0043] In a possible embodiment, based on the response status of the NS server to the DNS detection request, after determining the detection result, a tracing module is further included, and the tracing module is used to:

[0044] When the detection result indicates that the requested domain name has attack characteristics, a DNS response packet is constructed and sent to the client, wherein the DNS response packet uses the User Datagram Protocol UDP, and the TC flag bit of the DNS response packet is 1;

[0045] If a target DNS request returned by the client is received, it is determined that the client is a normal user, wherein the target DNS request uses the transmission control protocol TCP;

[0046] If the target DNS request returned by the client is not received, it is determined that the client has the characteristics of a botnet.

[0047] In a possible embodiment, the device further includes a third processing module, and the third processing module is used to:

[0048] Send alarm information to the DNS management platform so that the DNS management platform issues an alarm, and based on the alarm information, generates a domain name list and an IP address list, and sends them in batches to the DNS cache server, so that the DNS cache server generates a domain name blacklist and an IP address blacklist based on the domain name list and the IP address list;

[0049] The alarm information includes the requesting domain name, or the alarm information includes the requesting domain name and the IP address of the client.

[0050] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any one of the methods described in the first aspect are implemented.

[0051] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any one of the methods described in the first aspect above.

[0052] In a fifth aspect, the present application provides a computer program product, comprising: a computer program code, when the computer program code is run on a computer, the computer executes any one of the methods described in the first aspect.

[0053] In the embodiment of the present application, the detection routine parses the DNS event message, generates a detection DNS request with a request type of NS request type, and sends the detection DNS request to the NS server, wherein the DNS event message is generated by the DNS resolver when it is determined that the NS server has no response to the original DNS request, and the original DNS request contains: the requested domain name, and then based on the response status of the NS server to the detection DNS request, it is determined whether the resolution service of the NS server is faulty and whether the requested domain name has attack characteristics. In this way, through the technology of re-detection of the NS request type, it is possible to determine whether the NS server is faulty and whether the requested domain name has attack characteristics, and under the premise of not affecting normal business, further discover the hidden attack behaviors existing in the DNS resolution process, and timely and effectively discover the attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 A schematic diagram of possible application scenarios in the embodiments of the present application;

[0055] Figure 2 This is a flowchart of an attack identification method provided in an embodiment of the present application;

[0056] Figure 3 This is a schematic diagram of the structure of the attack identification device in the embodiment of the present application;

[0057] Figure 4 Schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0059] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0060] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0061] To facilitate understanding of the technical solutions provided in the embodiments of the present application, some key terms used in the embodiments of the present application are explained here:

[0062] Round Trip Time (RTT): It is an important performance indicator in computer networks, indicating the total delay from the time the sender sends data to the time the sender receives confirmation from the receiver (the receiver sends confirmation immediately after receiving the data).

[0063] SRTT: A measurement indicator used to calculate the DNS resolution delay in DNS resolution. SRTT is calculated using a certain algorithm.

[0064] NS record: It is a domain name server record, which is used to specify which DNS server will resolve the domain name.

[0065] DNS TC flag: This flag is carried in the response message to indicate whether the response data is oversized. If this flag is set, the client should initiate a TCP DNS continue request.

[0066] The following is a brief introduction to the design concept of the embodiment of the present application:

[0067] DNS load balancing uses the network addresses of multiple NS records in DNS resource records to intelligently distribute network loads, which can reduce network congestion and ensure the availability of key enterprise applications. At present, the mainstream DNS load balancing technology uses the RTT optimization algorithm, which randomly initializes the RTT of all NS servers and selects the NS server with the smallest RTT for priority use. If this NS server times out, it will be punished (it will not be selected again for a period of time), and another NS server will be selected as the forwarding address. A new round of RTT calculation will be performed after 1800 seconds.

[0068] In DNS load balancing, if an attacker takes advantage of the fact that some domain names under certain DNS authoritative servers cannot be resolved and have no response, and maliciously requests these domain names, then the NS servers that did not respond will be punished, and most of the NS servers will lose their preferred position. In extreme cases, only one NS server can provide services for 1800 seconds, which will cause the DNS load balancing to fail, increase the resolution pressure on the link and the corresponding DNS authoritative server, and greatly increase network latency.

[0069] However, since the above-mentioned attacks that damage DNS load balancing generally occur during the DNS iterative resolution process, they are difficult to detect and are generally only discovered when DNS load balancing fails and the business is affected. Therefore, the existing technology only detects the attack after it has occurred and has had a certain impact. After the attack is discovered, it is protected and blocked through human intervention, which is not timely and inefficient. How to automatically, timely and effectively detect such attacks and effectively protect against them has become an urgent problem to be solved.

[0070] In view of this, in the embodiments of the present application, an attack identification method, device, electronic device and storage medium are provided. The detection routine parses the DNS event message, generates a detection DNS request, and sends the detection DNS request to the NS server, wherein the DNS event message is generated by the DNS resolver when it is determined that the NS server has no response to the original DNS request. The original DNS request contains: the requested domain name, and then based on the response status of the NS server to the detection DNS request, the detection result is determined. The detection result represents: whether the resolution service of the NS server is faulty, and whether the requested domain name has attack characteristics. In this way, through the technology of re-detecting the NS request type, it can be determined whether the NS server is faulty and whether the requested domain name has attack characteristics. Under the premise of not affecting normal business, the hidden attack behavior existing in the DNS resolution process is further discovered, and the attack is discovered and effectively protected in a timely and effective manner, which can ensure the effectiveness of load balancing. It has the characteristics of discovering attacks, identifying attack characteristics, providing alarms, and automatically generating protection rules, and realizes the linkage protection of DNS resolvers, DNS management platforms, and DNS cache servers.

[0071] See also Figure 1 , which is a schematic diagram of possible application scenarios in the embodiment of the present application, includes a client 110, a DNS management platform 120, a DNS cache server 130, a DNS resolution server 140, a detection routine 150, and a NS server 160.

[0072] The client 110 is used to send a DNS request.

[0073] The DNS management platform 120 is used to issue an alarm, and based on the alarm information, generate a domain name list and an IP address list, and send them in batches to the DNS cache server.

[0074] The DNS cache server 130 is used to store domain names and IP addresses in a domain name blacklist and an IP address blacklist respectively using a non-encrypted hash algorithm. When a user makes a request, the request data is parsed, and attacks are intercepted and blocked on the DNS cache server to ensure the stable operation of the upstream DNS service.

[0075] The DNS resolution server 140 is used to resolve the DNS request sent by the client. When the cache does not hit, it obtains the NS server address for iterative query. It is also used to apply for a DNS event message from the event database when it is determined that the NS server has no response to the original DNS request, fill in the corresponding message content, and call the detection routine corresponding to the identifier of the DNS event message. The detection routine is placed in a waiting queue and scheduled for execution by the central processing unit (CPU). It is also used to manage the address data of the NS server.

[0076] The detection routine 150 is used to detect whether the resolution service of the NS server fails, whether the requested domain name has attack characteristics, and whether the client has the characteristics of a botnet.

[0077] NS server 160 resolves the requested domain name into an IP address.

[0078] The following describes the attack identification method provided by the exemplary embodiment of the present application in combination with the application scenario described above and with reference to the accompanying drawings. It should be noted that the above application scenario is only shown to facilitate understanding of the spirit and principle of the present application, and the implementation of the present application is not limited in this respect.

[0079] See also Figure 2 As shown, it is an implementation flow chart of an attack identification method provided in an embodiment of the present application. The specific implementation process of the method is as follows:

[0080] Step 20: The detection routine parses the DNS event message, generates a detection DNS request, and sends the detection DNS request to the NS server.

[0081] Among them, the DNS event message is generated by the DNS resolver when it determines that the NS server has no response to the original DNS request. The original DNS request includes: the requested domain name, the DNS event message includes: the requested domain name and the NS request type, and the NS server provides services for the NS request type.

[0082] In the embodiment of the present application, the DNS system pre-creates a data resource pool. The data resource pool includes a DNS event database and a detection routine library. The DNS event database is used to store DNS event messages, and the event message contains a unique event ID. The detection routine library is a set of routines for re-detecting and pushing alarms for DNS events when the DNS resolution times out.

[0083] Among them, the detection routines and event messages correspond one to one.

[0084] In the embodiment of the present application, when the DNS resolver receives a resolution request, if the local cache does not record the requested domain name carried in the resolution request, it is necessary to obtain the NS server address for iterative query. During the iterative query process, the DNS resolver randomly initializes the first RTT (SRTT) of all NS addresses, and then initiates an original DNS request to the NS server of the selected NS address.

[0085] The range of the random value of random initialization is 1-32us, which is much smaller than the normal network RTT, and can ensure that each NS address has a chance to be selected.

[0086] In an embodiment of the present application, if the NS server of the selected NS address does not respond, at this time, the DNS resolver applies for an event message from the DNS event database, fills in the specific content of the event message, and at the same time, obtains the corresponding detection routine from the detection routine library through the identifier of the event message, and puts the detection routine into the waiting queue for scheduling execution by the CPU.

[0087] Among them, the event message includes information such as user address, request domain name, request type, NS server name, NS address, and asynchronous callback interface, which is not limited in the comparison in the embodiment of this application.

[0088] For example, the format of an event message is as follows:

[0089] Event message format:

[0090] {

[0091] "user_ip":"1.1.1.1",

[0092] "qname": www.test.com ,

[0093] "qtype":"A",

[0094] "ns_name":"ns.test.com",

[0095] "ns_ip":"2.2.2.2",

[0096] "callback":"timeout_process"

[0097] }

[0098] In an embodiment of the present application, after the DNS resolver sends the event message, due to the NS address resolution timeout, it is necessary to penalize the RTT in the NS address data and save this value in the second RTT (NRTT). Two RTTs (the first RTT and the second RTT) are saved in the NS address data structure. The NS address is set to the CHECK state. The NS in this state is unavailable. The DNS resolver selects other NS addresses according to the process to continue the subsequent process.

[0099] The smaller the initial RTT, the greater the penalty, which can be reduced by a maximum of 1 second. The first RTT is the preferred RTT, and the second RTT is the newly calculated RTT.

[0100] In an embodiment of the present application, the detection routine parses the DNS event message, obtains the content of the DNS event message, encapsulates the data packet of the detection DNS request using the requested domain name and NS request type, sends the detection DNS request to the NS server, and starts the timer.

[0101] Step 21: Determine the detection result based on the response status of the NS server to the detection DNS request.

[0102] The detection result indicates whether the resolution service of the NS server is faulty and whether the requested domain name has attack characteristics.

[0103] Optionally, in an embodiment of the present application, a possible embodiment is provided for determining the detection result based on the response status of the NS server to the detection DNS request, and the following operations are specifically performed:

[0104] Step 210: Determine whether, under the preset first response condition, no response to the DNS probe request is received from the NS server. If yes, execute step 211; otherwise, execute step 212.

[0105] The first response condition is composed of a timeout period and a number of retransmissions.

[0106] Exemplarily, the timeout period is set to 200 milliseconds, and the number of retransmissions is set to 3 times. If no response is received from the NS server within the timeout period, retransmission is performed, and the maximum number of retransmissions is 3 times.

[0107] Step 211: Determine that the resolution service of the NS server fails and the requested domain name has no attack characteristics.

[0108] In an embodiment of the present application, when no response is received from the NS server to the detection DNS request under a preset first response condition, it is determined that the resolution service of the NS server fails and the requested domain name has no attack characteristics.

[0109] Furthermore, in an embodiment of the present application, after determining that the resolution service of the NS server has a fault and the requested domain name has no attack characteristics, the detection routine sends the detection result to the DNS resolver, and then the DNS resolver uses the name and NS address of the NS server to query the address data of the NS address from the local cache, and replaces the value of the first round-trip time RTT contained in the address data with the value of the second RTT, sets the value of the second RTT to 0, sets the state to BYPASS, and re-enters the load balancing algorithm of the preferred strategy for scheduling.

[0110] The detection routine calls the asynchronous callback interface in the DNS event message and sends the detection result to the DNS resolver.

[0111] In this way, the NS server with resolution service failure is accurately detected, and actual penalties are imposed on the detected NS addresses, ensuring the effectiveness of DNS load balancing.

[0112] Step 212: Determine that the resolution service of the NS server is normal, send an original DNS request to the NS server, and determine whether the requested domain name has attack characteristics based on the response status of the NS server to the original DNS request.

[0113] In an embodiment of the present application, when a response from the NS server to the detection DNS request is received under the first response condition, it is determined that the resolution service of the NS server is normal, and the request data packet is re-encapsulated using the requested domain name and request type in the original request, the original DNS request is sent to the NS server, and based on the response status of the NS server to the original DNS request, it is determined whether the requested domain name has attack characteristics.

[0114] Optionally, in an embodiment of the present application, a possible embodiment is provided for determining whether a requested domain name has attack characteristics based on the response status of the NS server to the original DNS request, and the following operations are specifically performed:

[0115] Step 2120: Determine whether a response to the original DNS request from the NS server is not received under the preset second response condition. If so, execute step 2121; otherwise, execute step 2122.

[0116] The second response condition is composed of a timeout period and a number of retransmissions.

[0117] Exemplarily, the timeout period is set to 200 milliseconds, and the number of retransmissions is set to 3 times. If no response is received from the NS server within the timeout period, retransmission is performed, and the maximum number of retransmissions is 3 times.

[0118] Step 2121: Determine that the requested domain name has attack characteristics.

[0119] In the embodiment of the present application, when no response is received from the NS server to the original DNS request under the preset second response condition, it is determined that the resolution service of the NS server is normal, but no service is provided for the requested domain name, that is, the requested domain name has attack characteristics. Since the NS address is punished at this time, the secondary NS address will not be preferred for a period of time, which may be used by hackers to launch attacks and cause the DNS load balancing algorithm to fail. Therefore, it can be concluded that the requested domain name has attack characteristics.

[0120] In this way, by sending the original request packet and re-detecting the NS server, it is possible to accurately determine whether the requested domain name has attack characteristics when the resolution service of the NS server is normal.

[0121] Furthermore, in an embodiment of the present application, after determining that the resolution service of the NS server is normal and the requested domain name has attack characteristics, the detection routine sends the detection results to the DNS resolver, and then the DNS resolver uses the name and NS address of the NS server to query the address data of the NS address from the local cache, and sets the value of the second RTT contained in the address data to 0, sets the state to BYPASS, does not change the value of the first RTT, and re-enters the load balancing algorithm of the preferred strategy for scheduling.

[0122] The detection routine calls the asynchronous callback interface in the DNS event message and sends the detection result to the DNS resolver.

[0123] In this way, the request domain name with attacking intent is accurately detected, and no actual penalty is imposed on the NS address, thus ensuring the effectiveness of DNS load balancing.

[0124] Step 2121: Determine that the requested domain name has no attack characteristics.

[0125] In the embodiment of the present application, when a response to the original DNS request is received from the NS server under the second response condition, it is determined that the requested domain name has no attack characteristics.

[0126] Furthermore, in the embodiment of the present application, after determining the detection result, the client can also be traced back to detect whether the client is a botnet. In the embodiment of the present application, a possible embodiment is provided for tracing back to detect the client, and the following operations are specifically performed:

[0127] Step 22: When the detection result indicates that the requested domain name has attack characteristics, a DNS response packet is constructed and sent to the client.

[0128] The DNS response packet uses the User Datagram Protocol UDP, and the TC flag bit of the DNS response packet is 1.

[0129] In an embodiment of the present application, when constructing a DNS response packet, the TC flag bit in the flags field in the DNS message header is set to 1, and the answer_count part is set to 0.

[0130] Step 23: Determine whether the target DNS request returned by the client is received, if so, execute step 24, otherwise, execute step 25.

[0131] Among them, the target DNS request uses the transmission control protocol TCP.

[0132] Step 24: Determine that the client is a normal user.

[0133] In the embodiment of the present application, if a target DNS request returned by the client is received, it is determined that the client is a normal user.

[0134] Step 25: Determine whether the client has characteristics of a botnet.

[0135] In the embodiment of the present application, if the target DNS request returned by the client is not received, it is determined that the client has the characteristics of a botnet.

[0136] Furthermore, in an embodiment of the present application, the detection routine can also encapsulate the requested domain name or the requested domain name + IP address into an alarm message, and send the alarm information to the DNS management platform so that the DNS management platform issues an alarm, and based on the alarm information, generates a domain name list and an IP address list, and sends them to the DNS cache server in batches, so that the DNS cache server generates a domain name blacklist and an IP address blacklist based on the domain name list and the IP address list.

[0137] Optionally, in an embodiment of the present application, resources used by event messages and detection routines in a data resource pool are recycled.

[0138] The alarm information includes the request domain name, or the alarm information includes the request domain name and the IP address of the client.

[0139] Exemplarily, the format of the warning message is as follows:

[0140] {

[0141] "data_id":1,

[0142] "access_token":"",

[0143] "target":"2.2.2.2",

[0144] "data":{

[0145] "user_ip":"1.1.1.1",

[0146] "query_name":"alert.com",

[0147] "location":"",

[0148] "event_type":"ns_timeout",

[0149] "alert_msg":"this is alert msg type"

[0150] },

[0151] "timestamp":1661320521493

[0152] }

[0153] In the embodiment of the present application, after receiving the alarm information, the DNS management platform will issue an alarm to the operation and maintenance personnel, identify and parse the alarm message content, generate a domain name list and IP address list, and send them to the DNS cache server in batches.

[0154] Among them, the alarm types include: on-site monitoring page alarm, mobile phone text messages and email notifications, etc. When the alarm message contains the requested domain name, a domain name list is generated and sent to the DNS cache server in batches; when the alarm message contains the client's IP address, an IP address list is generated and sent to the DNS cache server in batches.

[0155] In the embodiment of the present application, after receiving the domain name list and IP address list sent by the DNS management platform, the DNS cache server generates a domain name blacklist and an IP address blacklist.

[0156] Among them, the DNS cache server uses a non-encrypted hash algorithm to store the requested domain name and IP address in the domain name blacklist and IP address blacklist respectively.

[0157] In this way, a domain name blacklist and an IP address blacklist are generated, and a security protection policy is automatically set on the DNS cache server side. When a user makes a request, the request data is parsed, and attacks can be intercepted and blocked on the DNS cache server. Interception or speed limiting processing is performed at the network entrance to ensure the stable operation of the upstream DNS service.

[0158] In the embodiment of the present application, when a user makes a request, the DNS cache server first parses the DNS request data, concatenates the requested domain name and IP address into a 256-bit string, and then slides on the 256-bit string with logM bits as a window size according to the length of the hash bucket, for example, M, to find the interval with the largest number of differences, and uses this interval as the modulus interval, so that the DNS data stream can be evenly distributed to each hash bucket. At the same time, in order to avoid the query performance degradation caused by too long a conflict chain, a two-level hash nested data organization method is adopted, that is, the same hash function is used in each hash bucket to create a first-level hash table, which greatly reduces the performance loss caused by hash conflicts.

[0159] In this way, uneven data distribution can be better handled, hot spot problems can be avoided, and data streams can be more evenly distributed in multiple hash buckets.

[0160] Based on the same inventive concept, an attack identification device is also provided in the embodiment of the present application. Figure 3 As shown, it is a schematic diagram of the structure of the attack identification device in the embodiment of the present application, which specifically includes:

[0161] The first processing module 301 is used for the detection routine to parse the DNS event message, generate a detection DNS request, and send the detection DNS request to the NS server, wherein the DNS event message is generated by the DNS resolver when it is determined that the NS server has no response to the original DNS request, the original DNS request includes: a requested domain name, and the DNS event message includes: a requested domain name and a NS request type;

[0162] The detection module 302 is used to determine the detection result based on the response status of the NS server to the detection DNS request, and the detection result represents: whether the resolution service of the NS server fails, and whether the requested domain name has attack characteristics.

[0163] In a possible embodiment, when determining the detection result based on the response status of the NS server to the detection DNS request, the detection module 302 is further used to:

[0164] When no response is received from the NS server to the DNS probe request under the preset first response condition, it is determined that the resolution service of the NS server is faulty and the requested domain name has no attack characteristics;

[0165] When a response from the NS server to the detection DNS request is received under the first response condition, it is determined that the resolution service of the NS server is normal, and the original DNS request is sent to the NS server. Based on the response status of the NS server to the original DNS request, it is determined whether the requested domain name has attack characteristics.

[0166] In a possible embodiment, when determining whether the requested domain name has attack characteristics based on the response status of the NS server to the original DNS request, the detection module 302 is further used to:

[0167] When no response is received from the NS server to the original DNS request under the preset second response condition, it is determined that the requested domain name has an attack feature;

[0168] When, under the second response condition, a response to the original DNS request from the NS server is received, it is determined that the requested domain name has no attack features.

[0169] In a possible embodiment, based on the response status of the NS server to the DNS detection request, after determining the detection result, a second processing module 303 is further included, and the second processing module 303 is used to:

[0170] Sending the detection result to the DNS resolver, so that when the detection result indicates that the resolution service of the NS server fails, the DNS resolver replaces the value of the first round-trip time RTT contained in the address data with the value of the second RTT, and sets the value of the second RTT to 0; and when the detection result indicates that the resolution service of the NS server is normal and the requested domain name has attack characteristics, the DNS resolver does not change the value of the first RTT contained in the address data, and sets the value of the second RTT to 0;

[0171] The first RTT is the RTT that is preferably used, and the second RTT is the newly calculated RTT.

[0172] In a possible embodiment, based on the response status of the NS server to the detection DNS request, after determining the detection result, a tracing module 304 is further included, and the tracing module 304 is used to:

[0173] When the detection result indicates that the requested domain name has attack characteristics, a DNS response packet is constructed and sent to the client, wherein the DNS response packet uses the User Datagram Protocol UDP, and the TC flag bit of the DNS response packet is 1;

[0174] If a target DNS request returned by the client is received, it is determined that the client is a normal user, wherein the target DNS request uses the transmission control protocol TCP;

[0175] If the target DNS request returned by the client is not received, it is determined that the client has the characteristics of a botnet.

[0176] In a possible embodiment, the device further includes a third processing module 305, and the third processing module 305 is used to:

[0177] Send alarm information to the DNS management platform so that the DNS management platform issues an alarm, and based on the alarm information, generates a domain name list and an IP address list, and sends them in batches to the DNS cache server, so that the DNS cache server generates a domain name blacklist and an IP address blacklist based on the domain name list and the IP address list;

[0178] The alarm information includes the requesting domain name, or the alarm information includes the requesting domain name and the IP address of the client.

[0179] Based on the above embodiments, see Figure 4 Shown is a schematic diagram of the structure of an electronic device in an embodiment of the present application.

[0180] An embodiment of the present application provides an electronic device, which may include a processor 410 (Center Processing Unit, CPU), a memory 420, an input device 430 and an output device 440, etc. The input device 430 may include a keyboard, a mouse, a touch screen, etc., and the output device 440 may include a display device, such as a liquid crystal display (Liquid Crystal Display, LCD), a cathode ray tube (Cathode Ray Tube, CRT), etc.

[0181] The memory 420 may include a read-only memory (ROM) and a random access memory (RAM), and provides the processor 410 with program instructions and data stored in the memory 420. In the embodiment of the present application, the memory 420 may be used to store the program of any attack identification method in the embodiment of the present application.

[0182] The processor 410 calls the program instructions stored in the memory 420, and the processor 410 is used to execute any attack identification method in the embodiments of the present application according to the obtained program instructions.

[0183] Based on the above embodiments, in an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the attack identification method in any of the above method embodiments is implemented.

[0184] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0185] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0186] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0187] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0188] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An attack identification method, characterized in that: include: The detection routine parses the DNS event message, generates a detection DNS request, and sends the detection DNS request to the NS server, wherein the DNS event message is generated by the DNS resolver when it is determined that the NS server has no response to the original DNS request, the original DNS request includes: a requested domain name, and the DNS event message includes: the requested domain name and an NS request type; Based on the response status of the NS server to the detection DNS request, a detection result is determined, and the detection result represents: whether the resolution service of the NS server fails, and whether the requested domain name has attack characteristics.

2. The method according to claim 1, characterized in that The determining of the detection result based on the response status of the NS server to the detection DNS request includes: When no response is received from the NS server to the detection DNS request under the preset first response condition, it is determined that the resolution service of the NS server fails and the requested domain name has no attack characteristics; When a response from the NS server to the detection DNS request is received under the first response condition, it is determined that the resolution service of the NS server is normal, and the original DNS request is sent to the NS server, and based on the response status of the NS server to the original DNS request, it is determined whether the requested domain name has attack characteristics.

3. The method according to claim 2, characterized in that The determining whether the requested domain name has attack characteristics based on the response status of the NS server to the original DNS request includes: When no response is received from the NS server to the original DNS request under the preset second response condition, determining that the requested domain name has an attack feature; When, under the second response condition, a response from the NS server to the original DNS request is received, it is determined that the requested domain name has no attack features.

4. The method according to claim 1, characterized in that After determining the detection result based on the response status of the NS server to the detection DNS request, the method further includes: Sending the detection result to the DNS resolver, so that when the detection result indicates that the resolution service of the NS server fails, the DNS resolver replaces the value of the first round-trip time RTT contained in the address data with the value of the second RTT, and sets the value of the second RTT to 0; and when the detection result indicates that the resolution service of the NS server is normal and the requested domain name has attack characteristics, the DNS resolver does not change the value of the first RTT contained in the address data, and sets the value of the second RTT to 0; The first RTT is the RTT that is preferably used, and the second RTT is the newly calculated RTT.

5. The method according to claim 1, characterized in that After determining the detection result based on the response status of the NS server to the detection DNS request, the method further includes: When the detection result indicates that the requested domain name has attack characteristics, construct a DNS response packet and send the DNS response packet to the client, wherein the DNS response packet uses the User Datagram Protocol UDP and the TC flag bit of the DNS response packet is 1; If a target DNS request returned by the client is received, it is determined that the client is a normal user, wherein the target DNS request uses the transmission control protocol TCP; If the target DNS request returned by the client is not received, it is determined that the client has the characteristics of a botnet.

6. The method according to claim 5, characterized in that The method further comprises: Sending alarm information to the DNS management platform so that the DNS management platform issues an alarm, and based on the alarm information, generating a domain name list and an IP address list, and sending them in batches to the DNS cache server, so that the DNS cache server generates a domain name blacklist and an IP address blacklist based on the domain name list and the IP address list; The alarm information includes the request domain name, or the alarm information includes the request domain name and the IP address of the client.

7. An attack identification device, characterized in that: include: A first processing module is used for the detection routine to parse the DNS event message, generate a detection DNS request, and send the detection DNS request to the NS server, wherein the DNS event message is generated by the DNS resolver when it is determined that the NS server has no response to the original DNS request, the original DNS request includes: a requested domain name, and the DNS event message includes: the requested domain name and the NS request type; The detection module is used to determine the detection result based on the response status of the NS server to the detection DNS request, and the detection result represents: whether the resolution service of the NS server fails, and whether the requested domain name has attack characteristics.

8. The device according to claim 7, characterized in that When determining the detection result based on the response status of the NS server to the detection DNS request, the detection module is further used to: When no response is received from the NS server to the detection DNS request under the preset first response condition, it is determined that the resolution service of the NS server fails and the requested domain name has no attack characteristics; When a response from the NS server to the detection DNS request is received under the first response condition, it is determined that the resolution service of the NS server is normal, and the original DNS request is sent to the NS server, and based on the response status of the NS server to the original DNS request, it is determined whether the requested domain name has attack characteristics.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images