Random prefix domain name attack prevention method and device based on multi-character screening

Abstract

The invention discloses a random prefix domain name attack prevention method and device based on multi-character screening. The invention aims to improve the safety and efficiency of the DNS system. The method is implemented by a custom pseudo resource record type (census type) agreed between an authoritative server and a recursive server. The authoritative server generates census records, and the recursive server caches the census records and prejudges domain name query requests by using the census records, so that attacks are intercepted in advance. According to the method, the resource consumption is effectively reduced, the response speed is improved, and the defense capability of the DNS system to the random prefix domain name attack is enhanced. Through simplified steps, quick pre-judgment and interception of domain name query are realized, and the stability and reliability of network service are ensured.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a random prefix domain name attack prevention method and device based on multi-character screening. Background Art

[0002] There is a type of attack based on changing prefixes for the DNS system, such as a simple random prefix domain name attack, which is usually intended to penetrate the cache of the DNS recursive server and generate recursion to consume server performance.

[0003] For this type of attack, if the full record involves all different domain names under a single recursive zone, and the total number of different domain names under the zone is calculated for judgment, the resource consumption may be very large. In addition, the simple number statistics may not reflect whether there is something special about the specific domain name, and there is a lack of basis for judging the nature of the relevant requests, so it is impossible to judge this type of attack more accurately. Summary of the invention

[0004] Based on this, the embodiment of the present application provides a random prefix domain name attack prevention method and device based on multi-character screening. By screening based on multiple rounds of related characters, it is predicted whether the NXDOMAIN result obtained by the usual random domain name query will be introduced, and based on this judgment, it attempts to directly intercept the query request, thereby achieving the purpose of alleviating the recursive and authoritative server performance pressure.

[0005] In a first aspect, a random prefix domain name attack prevention method based on multi-character screening is provided, the method comprising:

[0006] Defines the data format of census records. When the authoritative server loads or updates the authoritative zone data, it generates census records based on the zone data.

[0007] When receiving a domain name query request, the recursive server first checks whether there is corresponding census record data in the local cache. If so, the recursive server will start from the root zone and compare each label of the queried domain name with the census record data level by level;

[0008] When the recursive server finds that the data in the census record is incorrect during the comparison process, it sends a domain name query request to the authoritative server and encapsulates the census opt record in the request;

[0009] After receiving the response from the authoritative server, the recursive server verifies and extracts the census data part, sets the validity time according to the value of field E, and associates the updated census data with the corresponding query area.

[0010] Optionally, the data format of the census record is used to describe the nature and content of the domain name query request, specifically including defining a request / response flag, a label index number, a zone name, a maximum label length, a record validity period, and a statistical data table.

[0011] Optionally, when loading or updating authoritative zone data, the authoritative server generates a census record based on the zone data, including:

[0012] Construct a statistical data table, update the character existence description of each tag, and record the position of each character in the tag.

[0013] Optionally, upon receiving a domain name query request, the recursive server first checks whether the corresponding census record data exists in the local cache, including:

[0014] Check whether the label length of the queried domain name exceeds the maximum length recorded in the census data, and scan whether each character exists in the census data. If a mismatch is found, the recursive server will directly return an interception result code to intercept potential random prefix domain name attacks.

[0015] Optionally, when the recursive server finds that the data recorded by the census is incorrect during the comparison process, specifically including:

[0016] The recursive server found that the census data was missing or out of date during the comparison process, or did not find any missing characters after comparing all tags.

[0017] Optionally, when the recursive server finds that the data in the census record is incorrect during the comparison process, it sends a domain name query request to the authoritative server and encapsulates the census opt record in the request, including:

[0018] When processing a request, the authoritative server checks whether a census opt record is carried and updates the returned census data according to the value of field B in the request. The authoritative server fills in the census data according to the tag level value in the request and sets field A to 1 when returning a response. Field B is consistent with the request, field C is filled with the name of the area, field D is the maximum length of the tag, field E is the validity period, and field F is the actual data in the statistical data table.

[0019] In a second aspect, a random prefix domain name attack prevention device based on multi-character screening is provided, the device comprising:

[0020] Definition module, used to define the data format of census records. When the authoritative server loads or updates the authoritative zone data, it will generate census records based on the zone data.

[0021] The comparison module is used to check whether the corresponding census record data exists in the local cache when receiving a domain name query request. If so, the recursive server will start from the root zone and compare each label of the queried domain name with the census record data level by level;

[0022] The sending module is used to send a domain name query request to the authoritative server and encapsulate the census opt record in the request when the recursive server finds that the data in the census record is incorrect during the comparison process;

[0023] The verification module is used for the recursive server to verify and extract the census data part after receiving the response from the authoritative server, set the effective time according to the value of field E, and associate the updated census data with the corresponding query area.

[0024] In a third aspect, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the random prefix domain name attack prevention method described in any one of the first aspects is implemented.

[0025] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the random prefix domain name attack prevention method described in any one of the first aspects is implemented.

[0026] In a fifth aspect, a computer program product is provided, including a computer program / instruction, which, when executed by a processor, implements the random prefix domain name attack prevention method described in any one of the first aspects above.

[0027] The beneficial effects brought by the technical solution provided by the embodiment of the present application include at least:

[0028] (1) By predicting the nature of domain name query requests, it can effectively intercept random prefix domain name attacks, enhance the security of the DNS system, and reduce service interruptions and performance degradation caused by attacks.

[0029] (2) Compared with the traditional full-volume recording and statistical method, the multi-character screening method reduces resource consumption, improves processing efficiency, and reduces server load.

[0030] (3) Recursive servers can quickly obtain prediction information from authoritative servers and intercept attacks in advance, thereby reducing unnecessary domain name query processes and improving overall response speed and processing capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0032] Figure 1 A flowchart of a random prefix domain name attack prevention method based on multi-character screening provided in an embodiment of the present application;

[0033] Figure 2 A block diagram of a random prefix domain name attack prevention device based on multi-character screening provided in an embodiment of the present application;

[0034] Figure 3 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0036] In the description of the present invention, the terms "comprises", "has" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may also include other steps or units that are not explicitly listed but are inherent to these processes, methods, products or apparatuses, or steps or units added based on further optimization schemes conceived by the present invention.

[0037] There is a type of attack based on changing prefixes for the DNS system, such as a simple random prefix domain name attack, which is usually intended to penetrate the cache of the DNS recursive server and generate recursion to consume server performance.

[0038] For this type of attack, if the full record involves all different domain names under a single recursive zone, and the total number of different domain names under the zone is calculated for judgment, the resource consumption may be very large. In addition, the simple number statistics may not reflect whether there is something special about the specific domain name, and there is a lack of basis for judging the nature of the relevant requests, so it is impossible to judge this type of attack more accurately.

[0039] This solution provides a combination of authority and recursion. It predicts whether the NXDOMAIN result obtained by the usual random domain name query will be introduced through multiple rounds of screening of related characters, and tries to directly intercept the query request based on this judgment, so as to alleviate the performance pressure of recursion and authoritative servers.

[0040] Please refer to Figure 1 , which shows a flowchart of a random prefix domain name attack prevention method based on multi-character screening provided by an embodiment of the present application, the purpose of which is to improve the protection of existing random prefix domain name attacks, and may include the following steps:

[0041] S1, defines the data format of census records. When the authoritative server loads or updates the authoritative zone data, it will generate census records based on the zone data.

[0042] In this step, the data format of the census record is used to describe the nature and content of the domain name query request, including the definition of the request / response flag, the label index number, the zone name, the maximum length of the label, the record validity period, and the statistical data table. When the authoritative server loads or updates the authoritative zone data, it will generate a census record based on the zone data, including constructing a statistical data table, updating the character existence description of each label, and recording the position of each character in the label.

[0043] S2, when receiving a domain name query request, the recursive server first checks whether there is corresponding census record data in the local cache. If so, the recursive server will start from the root zone and compare each label of the queried domain name with the census record data level by level.

[0044] In this step, when the recursive server queries a domain name under a certain zone, it will collect and cache the census data of the zone. When receiving a domain name query request, the recursive server first checks whether the corresponding census data exists in the local cache. If so, the recursive server will start from the root zone and compare each label of the queried domain name with the records in the census data step by step. The implementation details of this step include checking whether the label length of the queried domain name exceeds the maximum length recorded in the census data, and scanning whether each character exists in the census data. If any mismatch is found, the recursive server will directly return the interception result code, thereby intercepting potential random prefix domain name attacks in advance.

[0045] S3: When the recursive server finds that the data in the census record is incorrect during the comparison process, it sends a domain name query request to the authoritative server and encapsulates the census opt record in the request.

[0046] If the recursive server finds that the census data is missing or expired during the comparison process, or does not find any missing characters after comparing all labels, it will send a domain name query request to the authoritative server and encapsulate the censusopt record in the request. When processing the request, the authoritative server will check whether the census opt record is carried, and update the returned census data according to the value of field B in the request. The implementation details of this step include the authoritative server filling in the census data according to the label level value in the request, and setting field A to 1 when returning the response, field B is consistent with the request, field C is filled with the name of the district, field D is the maximum length of the label, field E is the validity period, and field F is the actual data in the statistical data table.

[0047] S4, after receiving the response from the authoritative server, the recursive server will verify and extract the census data part, set the effective time according to the value of field E, and associate the updated census data with the corresponding query area.

[0048] After receiving the response from the authoritative server, the recursive server will verify and extract the census data, set the validity period according to the value of field E, and associate the updated census data with the corresponding query area. This step ensures that the recursive server can update its cached census data in a timely manner, so that it can more quickly and accurately predict whether the domain name exists in future domain name queries, thereby effectively blocking random prefix domain name attacks.

[0049] In an optional embodiment of the present application, the method can also be expanded into the following specific implementation process:

[0050] This solution involves a custom pseudo-resource record type (opt) agreed upon between the authority and the recursion. The opt record is named census type, and the domain name of the query request is examined through the data brought by this record. The key points of the solution include:

[0051] 1) Data format definition in census type records:

[0052] A) Request / response flag: An integer value used to describe whether this census record is provided by the requester or the responder. The value 0 represents the requester and the value 1 represents the responder.

[0053] B) Label index number: integer value, usually ranging from 0 to 126, corresponding to the theoretical maximum 127 labels of the domain name. The index value increases from the root zone to the sub-zone. There is also a special value 255, which indicates that the fill value of this field does not correspond to any label index.

[0054] C) District name: Fill in the district name to which the current census record belongs. This field consists of a 1-byte district name length value and a string of the corresponding length. If the value of field A is 0, this field needs to be left blank.

[0055] D) Maximum length of label: integer value, ranging from 0 to 63, which is the maximum length of all labels corresponding to this census record. If the value of field A is 0, this field should be left blank.

[0056] E) Census record validity period: The validity period in seconds. After the expiration, the internal data of this census record will expire. If the value of field A is 0, this field should be left blank.

[0057] F) Statistical data table: data used to describe whether the corresponding character exists at each position of the string under this label index position on the authoritative side. Because each character is actually an 8-bit value, there are at most 256 different characters. Therefore, a 32-byte byte sequence is defined for the character at each position, with a total of 256 bits. Each bit corresponds to the existence or non-existence of the above 256 different characters. 0 represents non-existence and 1 represents existence. The indexing method of each set of data above also starts from the character close to the root zone and increases the index number towards the sub-zone. If the value of field A is 0, this field needs to be left blank.

[0058] 2) When the authoritative server loads or updates the authoritative zone, it will generate data for filling the census record based on the zone data. The specific method is:

[0059] A) Construct a statistical data table.

[0060] B) Each time a domain name data is loaded, each of its tags is used to update the corresponding item in the statistical data table. If the statistical item does not exist, it will be created first.

[0061] C) After selecting a specific item in the statistical data table, scan each character of the current label, and update the existence description data bit corresponding to each character at the index position corresponding to the character in the label, and set it to 1, indicating that the corresponding character exists. Because the default value of the existence description data bit of the character is 0, the characters that have not been scanned and found are described as non-existent.

[0062] 3) When the recursive server queries a domain name in a certain zone, it will collect and cache the census data in this zone. When receiving a request, it will first check whether there is already cached census data locally. If so, it will start with the label close to the root zone and compare it with the census data to confirm whether it meets the requirements.

[0063] 4) When comparing each label, it will first determine whether the length of the label at this level of the query domain name exceeds the length in the census data. If it exceeds, this label must not exist on the authoritative end, and no further scanning is required. The corresponding result code can be returned for direct interception in the subsequent process. If it does not exceed, the scan starts from the character of the label close to the root zone. If a character is found to be non-existent, the corresponding result code for interception is also directly returned.

[0064] 5) If all characters in the entire label are confirmed to exist, continue to check the next label in the same way as point 4. During the check, it may happen that the census data corresponding to a certain level of label does not exist or has expired. In this case, you need to skip the check of this level, and when you encounter this situation for the first time, you need to record the label level corresponding to the missing data for subsequent requests from the authority.

[0065] 6) If all tags are checked and no characters are found to be missing, the domain name query can be sent to the authoritative server normally. When sending a query to the authoritative server, you need to encapsulate the census opt in the request and set the value of field A to 0. If there is missing census data in point 5, you need to fill the value of field B with the tag level value recorded in point 5. If this does not happen, fill the value of field B with 255 and leave the rest of the fields blank.

[0066] 7) After receiving the request, the authoritative server will confirm whether the request sent by the recursive server carries the opt of census based on the completion of the normal query process. If it carries it, it will fill the corresponding field with the data in the local machine when returning the response according to the value filled in field B by the recursive server. Field A of the census data in the returned response is filled with 1, field B is consistent with the request, field C is filled with the name of the local area, field D is filled with the maximum length of the label (if there is no data, it is filled with 0), field E is filled with the effective time given in the local policy (integer value in seconds), and field F is filled with the actual data in the statistical data table. If the value of field D is 0, this field needs to be left blank.

[0067] 8) After receiving the response from the authoritative server, the recursive server will do some additional processing on the census data part, that is, verify and extract the existing data, set the validity time according to the value of field E and associate it with the zone corresponding to this query.

[0068] Based on the above settings, the recursive server can quickly obtain prompt information about whether a domain name exists from the authoritative server in any zone, and thus intercept potential random prefix domain name attacks in advance.

[0069] Please refer to Figure 2, which shows a block diagram of a random prefix domain name attack prevention device based on multi-character screening provided by an embodiment of the present application. Figure 2 As shown, the device may include:

[0070] Definition module, used to define the data format of census records. When the authoritative server loads or updates the authoritative zone data, it will generate census records based on the zone data.

[0071] The comparison module is used to check whether the corresponding census record data exists in the local cache when receiving a domain name query request. If so, the recursive server will start from the root zone and compare each label of the queried domain name with the census record data level by level;

[0072] The sending module is used to send a domain name query request to the authoritative server and encapsulate the census opt record in the request when the recursive server finds that the data in the census record is incorrect during the comparison process;

[0073] The verification module is used for the recursive server to verify and extract the census data part after receiving the response from the authoritative server, set the effective time according to the value of field E, and associate the updated census data with the corresponding query area.

[0074] For the specific definition of the random prefix domain name attack prevention device based on multi-character screening, please refer to the definition of the random prefix domain name attack prevention method based on multi-character screening above, which will not be repeated here. Each module in the above-mentioned random prefix domain name attack prevention device based on multi-character screening can be implemented in whole or in part through software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0075] In one embodiment, an electronic device is provided. The electronic device may be a computer, and its internal structure diagram may be as follows: Figure 3As shown. The electronic device includes a processor, a memory and a network interface connected via a system bus. The processor of the device is used to provide computing and control capabilities. The memory of the device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used for random prefix domain name attack prevention data based on multi-character screening. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a random prefix domain name attack prevention method based on multi-character screening is implemented.

[0076] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0077] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, which involves all or part of the processes in the above-mentioned embodiment method.

[0078] In one embodiment, a computer program product is also provided, including a computer program / instruction, which involves all or part of the process in the above embodiment method.

[0079] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing related hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in M ​​forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (SyMchliMk) DRAM (SLDRAM), memory bus (RaMbus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0080] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0081] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the patent application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent application shall be subject to the attached claims.

Claims

1. A random prefix domain name attack prevention method based on multi-character screening, characterized in that: The method comprises: Defines the data format of census records. When the authoritative server loads or updates the authoritative zone data, it generates census records based on the zone data. When receiving a domain name query request, the recursive server first checks whether there is corresponding census record data in the local cache. If so, the recursive server will start from the root zone and compare each label of the queried domain name with the census record data level by level; When the recursive server finds that the data in the census record is incorrect during the comparison process, it sends a domain name query request to the authoritative server and encapsulates the census opt record in the request; After receiving the response from the authoritative server, the recursive server verifies and extracts the census data part, sets the validity time according to the value of field E, and associates the updated census data with the corresponding query area.

2. The random prefix domain name attack prevention method according to claim 1, characterized in that: The data format of the census record is used to describe the nature and content of the domain name query request, including the definition of the request / response flag, label index number, zone name, maximum label length, record validity period and statistical data table.

3. The random prefix domain name attack prevention method according to claim 1, characterized in that: When the authoritative server loads or updates the authoritative zone data, it generates a census record based on the zone data, including: Construct a statistical data table, update the character existence description of each tag, and record the position of each character in the tag.

4. The random prefix domain name attack prevention method according to claim 1, characterized in that: When receiving a domain name query request, the recursive server first checks whether the corresponding census record data exists in the local cache, including: Check whether the label length of the queried domain name exceeds the maximum length recorded in the census data, and scan whether each character exists in the census data. If a mismatch is found, the recursive server will directly return an interception result code to intercept potential random prefix domain name attacks.

5. The random prefix domain name attack prevention method according to claim 1, characterized in that: When the recursive server finds that the data recorded by the census is incorrect during the comparison process, it includes: The recursive server found that the census data was missing or out of date during the comparison process, or did not find any missing characters after comparing all tags.

6. The random prefix domain name attack prevention method according to claim 1, characterized in that: When the recursive server finds that the data in the census record is incorrect during the comparison process, it sends a domain name query request to the authoritative server and encapsulates the census opt record in the request, including: When processing a request, the authoritative server checks whether a census opt record is carried and updates the returned census data according to the value of field B in the request. The authoritative server fills in the census data according to the tag level value in the request and sets field A to 1 when returning a response. Field B is consistent with the request, field C is filled with the name of the area, field D is the maximum length of the tag, field E is the validity period, and field F is the actual data in the statistical data table.

7. A random prefix domain name attack prevention device based on multi-character screening, characterized in that: The device comprises: Definition module, used to define the data format of census records. When the authoritative server loads or updates the authoritative zone data, it will generate census records based on the zone data. The comparison module is used to check whether the corresponding census record data exists in the local cache when receiving a domain name query request. If so, the recursive server will start from the root zone and compare each label of the queried domain name with the census record data level by level; The sending module is used to send a domain name query request to the authoritative server and encapsulate the census opt record in the request when the recursive server finds that the data in the census record is incorrect during the comparison process; The verification module is used for the recursive server to verify and extract the census data part after receiving the response from the authoritative server, set the effective time according to the value of field E, and associate the updated census data with the corresponding query area.

8. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images