DoS attack defense method and device for DNS server, equipment and storage medium

Abstract

The invention relates to the technical field of DNS domain name resolution service and safety protection thereof in a computer network, in particular to a method, device and equipment for a DNS server to defend DoS attacks and a storage medium. The method comprises the following steps: when a DNS record value corresponding to a DNS query request of a target domain name is queried, determining query time required for querying the DNS record value; determining a timing weight and a timing weight weighting factor of an IP reputation level to which the IP address of the client initiating the DNS query request belongs; and updating the cumulative time of a preset global timer according to the product of the query time, the timing weight and the timing weight weighting factor. According to the method and the device, the problems of long time consumption and incapability of solving DoS attacks in DNS analysis in related technologies are solved, the query frequency of non-cache records can be effectively limited while normal DNS query service is ensured, and the problem of back-end storage congestion caused by the DoS attacks is prevented.

Description

Technical Field

[0001] The present application relates to the field of DNS domain name resolution services and security protection technologies in computer networks, and more specifically, to a method, apparatus, device and storage medium for DNS servers to defend against DoS attacks. Background Art

[0002] DNS (Domain Name System) is a core component of the Internet. It provides a set of standard protocols and databases for converting human-readable domain names (such as www.example.com) into machine-readable IP addresses (such as 192.0.2.1). However, the function of DNS is much more than that. It also supports other types of records, such as aliases (CNAME), mail exchanges (MX), text messages (TXT), etc. These records provide additional information about domain names, such as the addresses of mail servers, administrative information of websites, etc. The DNS domain name query system usually includes a DNS recursive query server (also called a local DNS server or resolver) and a DNS authoritative server.

[0003] DNS recursive query server: When a user device (such as a browser, email client, etc.) needs to resolve a domain name, it will first send a query request to the local DNS server. The local DNS server will try to find the IP address of the domain name in its local cache. If it finds it, it will immediately return the address to the user device. If there is no record in the local cache, the local DNS server will send a query request to the upstream DNS server (which may be a top-level domain DNS server, an intermediate DNS server, or a DNS server that ultimately points to an authoritative server).

[0004] DNS authoritative server: An authoritative server is a server responsible for managing DNS records for a specific domain name. These records may include A records (mapping a domain name to an IPv4 address), AAAA records (mapping a domain name to an IPv6 address), CNAME records (mapping a domain name to an alias of another domain name), MX records (specifying mail exchange servers), etc. The authoritative server stores these records and returns the corresponding information when receiving a query request.

[0005] The importance of the DNS system lies in the fact that it ensures that communications on the Internet can proceed smoothly. However, DNS is also exposed to various network attacks, among which DoS (Denial of Service) attacks are a common threat. DoS attacks occupy the resources of the DNS server by sending a large number of invalid or malicious query requests, causing the server to be unable to process normal query requests. This will cause the target DNS system to be unable to provide services to legitimate users, or cause the service quality to be seriously degraded.

[0006] In order to deal with DoS attacks, related DoS attack defense technologies mainly use traffic analysis tools to detect, analyze and intercept malicious traffic. However, since DoS attacks may use complex traffic patterns and camouflage techniques, this traditional defense method may be difficult to effectively deal with. Therefore, it is urgent to provide a more advanced DoS attack defense technology that can accurately identify malicious traffic and reduce interference with legitimate traffic to ensure the stability and security of the DNS system. Summary of the invention

[0007] In view of this, one of the technical problems solved by the embodiments of the present application is to provide a method, device, equipment and storage medium for a DNS server to defend against DoS attacks, thereby solving the problem of DoS attack defense technology in the related art of accurately identifying malicious traffic and reducing interference with legitimate traffic.

[0008] In a first aspect of an embodiment of the present application, a method for a DNS server to defend against DoS attacks is disclosed, the method comprising:

[0009] After the DNS record value corresponding to the DNS query request of the target domain name is found, the query time required for querying the DNS record value is determined;

[0010] Determine the timing weight and timing weighting factor of the IP reputation level to which the client IP address that sends the DNS query request belongs;

[0011] The accumulated time of the preset global timer is updated according to the product of the query time, the timing weight and the timing weight factor.

[0012] In a second aspect of the embodiment of the present application, a device for defending a DNS server against DoS attacks is disclosed, the device comprising:

[0013] A query time determination module, used to determine the query time required to query the DNS record value after the DNS query request of the target domain name is queried;

[0014] A timing parameter determination module, used to determine the timing weight and timing weighting factor of the IP reputation level to which the client IP address that sends the DNS query request belongs;

[0015] The timer parameter updating module is used to update the accumulated time of the preset global timer according to the product of the query time, the timing weight and the timing weighting factor.

[0016] In a third aspect of an embodiment of the present application, an electronic device is disclosed. The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above method are implemented.

[0017] In a fourth aspect of the embodiments of the present application, a computer-readable storage medium is disclosed, which stores a computer program. When the computer program is executed by a processor, the steps of the above method are implemented.

[0018] The present application has the following advantages: after determining the query time required for the DNS record value corresponding to the DNS query request for the target domain name and the timing weight and timing weight weighting factor of the IP reputation level to which the client IP address that sends the DNS query request belongs, the accumulated time of the preset global timer is updated according to the product of the query time, the timing weight and the timing weighting factor. This method can effectively limit the query frequency of non-cached records while ensuring normal DNS query services, and prevent backend storage congestion caused by DoS attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A flowchart of a method for a DNS server to defend against DoS attacks provided in one embodiment of the present application;

[0020] Figure 2 A flowchart of a method for using a DNS server to defend against DoS attacks provided in one embodiment of the present application;

[0021] Figure 3 A schematic diagram of the structure of a device for defending a DNS server against DoS attacks provided in one embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0023] It should be noted that although the functional modules are divided in the device schematic and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart.

[0024] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0025] According to an embodiment of the present application, a method for a DNS server to defend against DoS attacks is provided, such as Figure 1 As shown, the method includes steps S101 to S103.

[0026] Step S101: after the DNS record value corresponding to the DNS query request of the target domain name is queried, the query time required for querying the DNS record value is determined.

[0027] Specifically, the query time may be the time consumed by the DNS system to query the DNS record corresponding to the domain name.

[0028] Step S102: Determine the timing weight and timing weight factor of the IP reputation level to which the IP address of the client sending the DNS query request belongs.

[0029] In the embodiment of the present application, the IP reputation level is used to characterize the credibility of the DNS query request. Specifically, the IP reputation level can be set to high, medium and low, and the corresponding defense level gradually increases, that is, the low level is the request for key defense. When applied, the IP reputation level can also be set according to other representations, such as setting it to 1 to 3 levels, which will not be given one by one here.

[0030] In the embodiment of the present application, the timing weight and the timing weight weighting factor are factors that affect the accumulated time of the global timer.

[0031] In the embodiment of the present application, the timing weighting factor is used to characterize the influencing factors of missing DNS cache records in the most recent time period (such as the most recent 1 minute).

[0032] Specifically, different IP reputation levels have different timing weights and timing weighting factors. Generally speaking, the timing weight of a high-level IP reputation level is less than the timing weight of a medium-level IP reputation level, and the timing weight of a medium-level IP reputation level is less than the timing weight of a low-level IP reputation level.

[0033] Step S103: updating the accumulated time of the preset global timer according to the product of the query time, the timing weight and the timing weight factor.

[0034] Specifically, the accumulated time of the global timer can be updated according to the following formula: counter1=counter0+query time*timing weight*timing weighting factor, counter0 is the previous accumulated time, counter1 is the accumulated time updated after the query time is consumed for the new DNS query request.

[0035] The embodiment of the present application determines the query time required for the DNS record value corresponding to the DNS query request for the target domain name and the timing weight and timing weight weighting factor of the IP reputation level to which the client IP address that sends the DNS query request belongs, and then updates the accumulated time of the preset global timer according to the product of the query time, the timing weight and the timing weighting factor. This method can effectively limit the query frequency of non-cached records while ensuring normal DNS query services, thereby preventing back-end storage congestion caused by DoS attacks.

[0036] In some embodiments, the step of querying the DNS record value corresponding to the DNS query request of the target domain name in S101 includes:

[0037] S1011 (not shown in the figure): when a DNS query request of a target domain name is detected, a query is performed in a DNS cache record of a preset DNS server;

[0038] S1012 (not shown in the figure): when the query fails and the DNS query request is an external request, determining the last update time and the current accumulated time of a preset global timer;

[0039] S1013 (not shown in the figure): If the difference between the current time and the most recent update time is less than a preset reset threshold and the current cumulative time is less than a preset cumulative time threshold, the target domain name is queried using the back-end database of the pre-built DNS authorization server to obtain the DNS record value of the target domain name, wherein the back-end database includes the DNS record values ​​corresponding to each of a plurality of pre-stored specific domain names.

[0040] When applied, the preset DNS server and the DNS authorization server may be the same or different. When the preset DNS server and the DNS authorization server are different, the preset DNS server is generally the operator's website authorization DNS.

[0041] Specifically, the DNS cache record includes the correspondence between the domain name and the DNS record. Through the DNS cache record, when accessing a domain name, there is no need to query the DNS server, but to directly obtain the corresponding DNS record value from the cache, so as to quickly determine the IP address of the target domain name, which can save time and traffic and increase the loading speed of web pages.

[0042] Specifically, the backend database is provided by the DNS hosting platform that resolves the operator's website domain name, and stores the DNS records of the hosted domain name. The backend database provides a fast query data basis for domain names that have not been visited recently, so that when the query fails in the DNS cache record, there is no need to query the DNS server, and the result can be found directly in the backend database, which further saves time and traffic and improves the loading speed of web pages. More specifically, the backend database can use MySQL or other data storage systems.

[0043] The embodiment of the present application adopts a memory cache mechanism to ensure service performance. There are two ways to generate the memory cache. One is the DNS cache record, that is, the domain name configured in the automatic cache whitelist checks the backend storage and updates the memory cache according to the policy. The second is the backend database, that is, the domain name not in the automatic cache whitelist is retrieved from the backend storage when receiving the DNS query request, and the response is sent to the customer. At the same time, it is stored in the memory cache and the TTL expiration time is set. The cache is automatically cleaned up after expiration. Through this configuration, when no result is found in the memory cache, the IP address can be quickly obtained by directly querying the backend database. Compared with the method of obtaining the IP address by querying the DNS server, this method reduces the query steps, shortens the query time, and further speeds up the loading speed of subsequent web pages.

[0044] In some embodiments, the step of querying the DNS record value corresponding to the DNS query request of the target domain name in S101 also includes: S1014 (not shown in the figure): when the query fails and the DNS query request is an internal request, obtain the corresponding record from the backend database and update the DNS cache record based on the record.

[0045] Specifically, internal means that the requesting client IP is an intranet segment IP and an IP configured in the trusted IP list. In this way, when the query request is identified to be from the internal source (such as refreshing the memory cache or a health check request from the internal monitoring service), the record is obtained from the backend storage and cached to the memory, which serves the purpose of updating the DNS cache record.

[0046] In some embodiments, the step of querying the DNS record value corresponding to the DNS query request of the target domain name in S101 further includes:

[0047] If the difference between the current time and the last updated time is not less than the reset threshold, the last updated time of the global timer is replaced with the current time and the current accumulated time is reset to 0;

[0048] If the current cumulative time is not less than the preset cumulative time threshold, query processing of rejecting the DNS query request is executed, and the cumulative time threshold is greater than 0 and less than the reset threshold.

[0049] The embodiment of the present application controls whether the global timer is restarted by resetting the threshold, and controls whether to reject the query processing of the DNS query request by accumulating the time threshold, thereby controlling the query service of the DNS query request by resetting the threshold and accumulating the time threshold, and avoiding congestion problems caused by a long query time for the DNS query request.

[0050] In the above embodiment, the reset threshold is a multiple of the cumulative time threshold, so when the cumulative time reaches the cumulative time threshold, that is, when the cumulative time reaches 1 / N (N is a multiple) of the reset threshold, the query processing of the DNS query request is rejected, so that during the remaining time (1-1 / N) until the global timer is restarted according to the reset threshold, congestion problems caused by the long query time of the DNS query request are avoided.

[0051] When applied, the cumulative time threshold is generally set to 1 / 3 of the reset threshold. This can not only ensure efficient DNS query, but also avoid service congestion and paralysis.

[0052] In some embodiments, step S102 further includes:

[0053] Determine the key indicators of the DNS server of the client IP address that initiates the DNS query request. The key indicators include request stability SF, request normality NF, request volume change trend TF, cache hit rate CHR and unfamiliarity NFV;

[0054] If the request stability SF is greater than the preset first stability threshold, the request normality NF is greater than the preset first normal stability threshold, and the request volume change trend TF is within the preset request volume change trend TF range, then it is determined that the IP reputation level of the client IP address that sends the DNS query request is a high reputation level, and the timing weight corresponding to the high reputation level is determined;

[0055] If the request stability SF is greater than the preset second stability threshold and less than the first stability threshold, and the request normality NF is greater than the preset second normal stability threshold and less than the first stability threshold, then it is determined that the IP reputation level of the client IP address that sends the DNS query request is a medium reputation level, and the timing weight corresponding to the medium reputation level is determined;

[0056] If the cache hit rate CHR is less than the preset hit rate threshold, or the strangeness NFV is greater than the preset strangeness threshold, it is determined that the IP reputation level of the client IP address sending the DNS query request is a low reputation level, and the timing weight corresponding to the low reputation level is determined.

[0057] Specifically, request stability SF can be reflected by the ratio of the standard deviation of requests (Sandard Deviation of Requests) to the average (Average Requests per Time Window), as shown in the following formula:

[0058]

[0059] When applied, the time window can be a choice that can be configured for the system according to actual conditions, such as 1 day, 1 week or 1 month, by calculating the ratio of the standard deviation of the request volume within the preset time window to the average value.

[0060] Specifically, request normality NF is used to measure the ratio of the number of DNS recursive queries (Numver of DNS Recursive Queries) to the total number of requests (Total Number of Requests), as follows:

[0061]

[0062] Specifically, the request volume change trend TF is used to measure whether the request volume shows a stable growth or decline trend. This can be achieved by comparing the change rate of the request volume in different time windows, specifically whether the ratio of the request volume in the current time window (CurrentWindow Requests) to the request volume in the previous time window (PreviousWindowRequests) is within a reasonable range. The formula is as follows:

[0063] Among them, Lower Bound and Upper Bound are reasonable range thresholds configured based on historical data. In the formula, TF is 1 for a normal trend, and 0 for a sudden increase or decrease in the trend (which may be a problem).

[0064] Specifically, the cache hit rate (CHR) is used to measure the ratio of the number of cache hits to the total number of requests, which is particularly important for low reputation levels. The formula is as follows:

[0065] Specifically, the unfamiliarity NFV is used to measure whether it is a new request or a request that has rarely appeared before. It can be evaluated by the time when the IP first appears or the number of historical requests (Total Requests). The formula is as follows:

[0066] Among them, Threshold is a set threshold, which represents the minimum number of requests required for an IP to be considered "familiar".

[0067] When applied, the IP reputation level can be determined according to actual needs. For example, if both SF and NF are higher than a certain threshold (configured as 0.8), and TF is within a reasonable range (1 is reasonable), it is determined to be a high reputation level; if at least one of SF and NF is within a medium range (configured between 0.5 and 0.8), and does not meet the recent magnitude surge (TF is 0) and CHR is very low (configured to be lower than 0.2) or NFV is very high (greater than 0.5), it is determined to be a medium reputation level; if it does not meet the high reputation level and medium reputation level, it is determined to be a low reputation level.

[0068] In some embodiments, step S101 determines a timing weight factor of an IP reputation level to which the client IP address that sends the DNS query request belongs, including:

[0069] Calculate the product of the number of cache misses per minute in the corresponding time period of the most recent day when no attack occurred and the preset abnormal judgment weight to obtain the abnormal sudden increase judgment threshold of the cache miss request volume;

[0070] Calculate the ratio of the number of cache miss requests in the most recent period to the threshold for judging an abnormal increase in the number of cache miss requests;

[0071] If the ratio is greater than 1, the ratio is used as a timing weighting factor;

[0072] If the ratio is not greater than 1, the preset default value is used as the timing weighting factor.

[0073] Specifically, the abnormality judgment weight can be configured by the system according to business needs. For example, the abnormality judgment weight configured by the system can be 3.

[0074] Combine the following Figure 2 The method provided in the embodiments of the present application is described. Figure 2The system shown includes a local DNS server and an authorized DNS service system. In this embodiment, the authorized DNS service system includes a website DNS server and a DNS scheduling server that accepts hosting. When the website DNS server receives a domain name query request sent by the local DNS server (the query request is a request to query the IP corresponding to the domain name www.a.com), first, it queries the A record or AAAA record of its DNS cache record. If no corresponding result is found, it queries its mapped domain name (xxx.bbb.com) through the CNAME record, and returns its CNAME record value to the local DNS server, that is, www.a.com is mapped to the domain name xxx.bbb.com of the DNS scheduling server that accepts hosting; then, after the DNS scheduling server that accepts hosting receives the request sent by the local DNS server to query the IP address corresponding to xxx.bbb.com, the DNS scheduling server that accepts hosting queries its back-end database and returns the corresponding IP address to the local DNS server, so that the local DNS server provides the returned IP to the browser.

[0075] In an embodiment where the authorized DNS service system further includes a DNS dispatch server that accepts hosting, after receiving a DNS query request, the DNS dispatch server first searches in the DSN cache record. If no result is found, it first determines whether the source of the query request is internal or external. If it is from the internal (i.e., the client IP that sends the request is a pre-configured trusted IP address), then the back-end database is obtained from the DNS record stored therein and stored in the DNS cache record, so as to achieve the purpose of updating the DNS cache record; and when the source of the query request is external, the state of the timer is checked. Assuming that the timer reset threshold is 3 seconds, i.e., the timer is reset every 3 seconds, and the timer cumulative time threshold is 1 / 3 of the timer reset threshold, i.e., 1 second. Then, when the difference between the current time of the timer and the most recently updated time reaches 3 seconds, the DNS query request is rejected, or when the current cumulative time reaches 1 second, the DNS query request is rejected, otherwise, the target domain name is queried from the back-end database of the DNS authorization server, the corresponding DNS record value is obtained, and the DNS query request is responded to according to the DNS record value.

[0076] An embodiment of the present application provides a device for a DNS server to defend against DoS attacks, such as Figure 3 As shown, the device 30 includes: a query time determination module 301, a timing parameter determination module 302 and a timer parameter updating module 303.

[0077] The query time determination module 301 is used to determine the query time required to query the DNS record value after the DNS query request of the target domain name is queried;

[0078] A timing parameter determination module 302, for determining a timing weight and a timing weighting factor of an IP reputation level to which the client IP address that sends the DNS query request belongs;

[0079] The timer parameter updating module 303 is used to update the accumulated time of the preset global timer according to the product of the query time, the timing weight and the timing weight factor.

[0080] The embodiment of the present application determines the query time required for the DNS record value corresponding to the DNS query request for the target domain name and the timing weight and timing weight weighting factor of the IP reputation level to which the client IP address that initiates the DNS query request belongs, and then updates the accumulated time of the preset global timer according to the product of the query time, the timing weight and the timing weighting factor. This method can effectively limit the query frequency of non-cached records while ensuring normal DNS query services, thereby preventing backend storage congestion caused by DoS attacks.

[0081] Furthermore, the query time determination module includes:

[0082] The cache search submodule is used to search the DNS cache records of the preset DNS server when a DNS query request of the target domain name is detected;

[0083] A time determination submodule, used to determine the last update time and current accumulated time of a preset global timer when the query fails and the DNS query request is an external request;

[0084] The external request backend search submodule is used to query the target domain name using the backend database of the pre-built DNS authorization server to obtain the DNS record value of the target domain name if the difference between the current time and the most recent update time is less than a preset reset threshold and the current cumulative time is less than a preset cumulative time threshold, wherein the backend database includes the DNS record values ​​corresponding to each of multiple pre-stored specific domain names.

[0085] Furthermore, the query time determination module also includes:

[0086] The internal request backend search submodule is used to obtain the corresponding record from the backend database when the query fails and the DNS query request is an internal request, and update the DNS cache record based on the record.

[0087] Furthermore, the query time determination module also includes:

[0088] A time update submodule, for replacing the last update time of the global timer with the current time and resetting the current accumulated time to 0 if the difference between the current time and the last update time is not less than a reset threshold;

[0089] The timer reset submodule is used to execute query processing of rejecting the DNS query request when the current cumulative time is not less than a preset cumulative time threshold, and the cumulative time threshold is greater than 0 and less than a reset threshold.

[0090] Further, the reset threshold is a multiple of the accumulated time threshold.

[0091] Furthermore, the timing parameter determination module includes:

[0092] The key indicator determination submodule is used to determine the key indicators of the DNS server of the client IP address that sends the DNS query request. The key indicators include request stability SF, request normality NF, request volume change trend TF, buffer hit rate CHR and strangeness NFV;

[0093] A high-level determination submodule is used to determine that the IP reputation level of the client IP address that sends the DNS query request is a high reputation level if the request stability SF is greater than a preset first stability threshold, the request normality NF is greater than a preset first normal stability threshold, and the request volume change trend TF is within a preset request volume change trend TF range, and determine the timing weight corresponding to the high reputation level;

[0094] A medium level determination submodule, for determining that the IP reputation level of the client IP address that sends the DNS query request is a medium reputation level if the request stability SF is greater than the preset second stability threshold and less than the first stability threshold, and the request normality NF is greater than the preset second normal stability threshold and less than the first stability threshold, and determining the timing weight corresponding to the medium reputation level;

[0095] The low-level determination submodule is used to determine that the IP reputation level of the client IP address that sends the DNS query request is a low reputation level if the buffer hit rate CHR is less than the preset hit rate threshold, or the strangeness NFV is greater than the preset strangeness threshold, and determine the timing weight corresponding to the low reputation level.

[0096] Furthermore, the timing parameter determination module includes:

[0097] The abnormal threshold determination submodule is used to calculate the product of the number of cache misses per minute in the corresponding time period of the most recent day without an attack and the preset abnormal judgment weight, and obtain the abnormal sudden increase judgment threshold of the cache miss request volume;

[0098] The abnormal ratio determination submodule is used to calculate the ratio of the number of cache miss requests in the most recent time period to the abnormal sudden increase judgment threshold of the number of cache miss requests;

[0099] A first determination submodule, for using the ratio as a timing weighting factor if the ratio is greater than 1;

[0100] The second determination submodule is used to use a preset default value as a timing weighting factor if the ratio is not greater than 1.

[0101] The above-mentioned device of this embodiment can execute the method shown in the first embodiment of the present application, and its implementation principle is similar, which will not be repeated here.

[0102] Another embodiment of the present application provides a terminal, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned search engine-based data processing method when executing the computer program.

[0103] Specifically, the processor may be a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0104] Specifically, the processor is connected to the memory via a bus, and the bus may include a path for transmitting information. The bus may be a PCI bus or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc.

[0105] The memory can be a ROM or other type of static storage device that can store static information and instructions, a RAM or other type of dynamic storage device that can store information and instructions, or an EEPROM, CD-ROM or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to this.

[0106] Optionally, the memory is used to store the code of the computer program for executing the solution of the present application, and the execution is controlled by the processor. The processor is used to execute the application program code stored in the memory to realize the action of the above-mentioned device.

[0107] Another embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions for executing the above method.

[0108] The device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0109] It will be appreciated by those skilled in the art that all or some of the steps and systems in the disclosed method above may be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that may be used to store desired information and may be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0110] The above is a specific description of the preferred implementation of the present application, but the present application is not limited to the above-mentioned implementation mode. Technical personnel familiar with the field can also make various equivalent deformations or substitutions without violating the spirit of the present application. These equivalent deformations or substitutions are all included in the scope defined by the claims of the present application.

Claims

1. A method for DNS server to defend against DoS attacks, characterized in that: The method comprises: After the DNS record value corresponding to the DNS query request of the target domain name is queried, the query time required to query the DNS record value is determined; Determining a timing weight and a timing weighting factor of an IP reputation level to which the client IP address that sends the DNS query request belongs; The accumulated time of the preset global timer is updated according to the product of the query time, the timing weight and the timing weight factor.

2. The method according to claim 1, characterized in that The DNS record value corresponding to the DNS query request of the target domain name is queried, including: When a DNS query request for a target domain name is detected, a query is performed in the DNS cache record of a preset DNS server; When the query fails and the DNS query request is an external request, determining the last update time and the current accumulated time of a preset global timer; If the difference between the current time and the most recent update time is less than a preset reset threshold and the current cumulative time is less than a preset cumulative time threshold, the target domain name is queried using a back-end database of a pre-built DNS authorization server to obtain the DNS record value of the target domain name, wherein the back-end database includes DNS record values ​​corresponding to each of a plurality of pre-stored specific domain names.

3. The method according to claim 2, characterized in that The DNS record value corresponding to the DNS query request for the target domain name also includes: When the query fails and the DNS query request is an internal request, the corresponding record is obtained from the back-end database, and the DNS cache record is updated according to the record.

4. The method according to claim 2, characterized in that: The DNS record value corresponding to the DNS query request of the target domain name is queried, including: If the difference between the current time and the last updated time is not less than the reset threshold, the last updated time of the global timer is replaced by the current time and the current accumulated time is reset to 0; If the current accumulated time is not less than a preset accumulated time threshold, query processing of rejecting the DNS query request is executed, and the accumulated time threshold is greater than 0 and less than the reset threshold.

5. The method according to claim 2, characterized in that: The reset threshold is a multiple of the accumulated time threshold.

6. The method according to claim 1, characterized in that The determining of the timing weight of the IP reputation level to which the IP address of the client sending the DNS query request belongs includes: Determine key indicators of the DNS server of the client IP address that initiates the DNS query request, wherein the key indicators include request stability SF, request normality NF, request volume change trend TF, buffer hit rate CHR and strangeness NFV; If the request stability SF is greater than the preset first stability threshold, the request normality NF is greater than the preset first normal stability threshold, and the request volume change trend TF is within the preset request volume change trend TF range, then the IP reputation level to which the client IP address belongs is determined to be a high reputation level, and the timing weight corresponding to the high reputation level is determined; If the request stability SF is greater than the preset second stability threshold and less than the first stability threshold, and the request normality NF is greater than the preset second normal stability threshold and less than the first stability threshold, then it is determined that the IP reputation level to which the client IP address belongs is a medium reputation level, and the timing weight corresponding to the medium reputation level is determined; If the buffer hit rate CHR is less than the preset hit rate threshold, or the strangeness NFV is greater than the preset strangeness threshold, it is determined that the IP reputation level to which the client IP address belongs is a low reputation level, and the timing weight corresponding to the low reputation level is determined.

7. The method according to claim 1, characterized in that The timing weighting factor for determining the IP reputation level to which the IP address of the client sending the DNS query request belongs includes: Calculate the product of the number of cache misses per minute in the corresponding time period of the most recent day when no attack occurred and the preset abnormal judgment weight to obtain the abnormal sudden increase judgment threshold of the cache miss request volume; Calculate the ratio of the number of cache miss requests in the most recent period to the threshold for judging an abnormal increase in the number of cache miss requests; If the ratio is greater than 1, the ratio is used as a weighting factor of the timing weight; If the ratio is not greater than 1, a preset default value is used as the timing weighting factor.

8. A device for defending a DNS server against DoS attacks, characterized in that: include: A query time determination module, used to determine the query time required to query the DNS record value after the DNS query request of the target domain name is queried; A timing parameter determination module, used to determine the timing weight and timing weight weighting factor of the IP reputation level to which the client IP address that sends the DNS query request belongs; The timer parameter updating module is used to update the accumulated time of the preset global timer according to the product of the query time, the timing weight and the timing weighting factor.

9. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores computer-readable instructions, and the processor is used to execute the computer-readable instructions, wherein the computer-readable instructions execute the method according to any one of claims 1 to 7 when executed.

10. A computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the method according to any one of claims 1 to 7.

Images