Method, device and equipment for DNS server to defend DoS attack and storage medium

Abstract

The application relates to the technical field of DNS domain name resolution services in a computer network and security protection thereof, in particular to a DNS server DoS attack defense method and device, equipment and a storage medium. The method comprises the following steps: after a DNS record value corresponding to a DNS query request of a target domain name is queried, determining a query time required for querying the DNS record value; determining a timing weight of an IP credit level to which a client IP address initiating the DNS query request belongs and a timing weight weighting factor; and updating the accumulated time of a preset global timer according to the product of the query time, the timing weight and the timing weight weighting factor. The method solves the problem that a related DNS resolution is time-consuming and cannot solve the DoS attack, can effectively limit the query frequency of non-cached records while ensuring normal DNS query services, and prevents the problem of backend storage congestion caused by the DoS attack.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of DNS domain name resolution services in computer networks and their security protection, in particular to a DNS server defense DoS attack method, device, equipment and storage medium. BACKGROUND

[0002] DNS (Domain Name System) is a core component of the Internet, providing a standard protocol and database for converting human-readable domain names (such as www.example.com) into machine-readable IP addresses (such as 192.0.2.1). However, the function of DNS is far more than this, it also supports other types of records such as alias (CNAME), mail exchange (MX), text information (TXT), etc. These records provide additional information about domain names, such as the address of the mail server, the management information of the website, etc. DNS domain name query system usually includes DNS recursive query server (also known as local DNS server or resolver) and DNS authoritative server.

[0003] DNS recursive query server: When a user device (such as a browser, mail client, etc.) needs to resolve a domain name, it will first send a query request to the local DNS server. The local DNS server will try to find the IP address of the domain name in its local cache. If found, it will immediately return the address to the user device. If the local cache does not have the record, the local DNS server will send a query request to the upstream DNS server (which may be the top-level domain DNS server, intermediate DNS server or DNS server pointing to the authoritative server).

[0004] DNS authoritative server: The authoritative server is responsible for managing the DNS records of a specific domain. These records may include A records (mapping domain names to IPv4 addresses), AAAA records (mapping domain names to IPv6 addresses), CNAME records (aliasing domain names to another domain name), MX records (specifying mail exchange servers), etc. The authoritative server stores these records and returns the corresponding information when receiving a query request.

[0005] The importance of DNS system lies in its ensuring the smooth communication on the Internet. However, DNS also faces various network attacks, among which DoS (Denial of Service) attack is a common threat. DoS attack occupies the resources of DNS server by sending a large number of invalid or malicious query requests, causing the server to be unable to handle normal query requests. This will cause the target DNS system to be unable to provide services to legitimate users, or cause the quality of service to be severely degraded.

[0006] In order to cope with the DoS attack, the related DoS attack defense technology mainly uses a flow analysis tool to detect, analyze and intercept malicious traffic. However, due to the complexity of the flow mode and the camouflage technology that the DoS attack may adopt, the traditional defense method may be difficult to effectively cope with. Therefore, it is urgent to provide a more advanced DoS attack defense technology which can accurately identify malicious traffic and reduce the interference to the legal traffic, so as to ensure the stability and security of the DNS system. SUMMARY

[0007] Therefore, one of the technical problems solved by the embodiments of the present application is to provide a DNS server defense method, device, equipment and storage medium against DoS attack, which solves the problem of the related art that the DoS attack defense technology can accurately identify malicious traffic and reduce the interference to the legal traffic.

[0008] The first aspect of the embodiments of the present application discloses a DNS server defense method against DoS attack, which comprises the following steps:

[0009] When the DNS record value corresponding to the DNS query request of the target domain name is queried, the query time required for querying the DNS record value is determined.

[0010] The timing weight and the timing weight weighting factor of the IP reputation level to which the client IP address sending the DNS query request belongs are determined.

[0011] The accumulated time of the preset global timer is updated according to the product of the query time, the timing weight and the timing weight weighting factor.

[0012] The second aspect of the embodiments of the present application discloses a DNS server defense device against DoS attack, which comprises the following modules:

[0013] The query time determination module is configured to determine the query time required for querying the DNS record value when the DNS record value corresponding to the DNS query request of the target domain name is queried.

[0014] The timing parameter determination module is configured to determine the timing weight and the timing weight weighting factor of the IP reputation level to which the client IP address sending the DNS query request belongs.

[0015] The timer parameter updating module is configured to update the accumulated time of the preset global timer according to the product of the query time, the timing weight and the timing weight weighting factor.

[0016] The third aspect of the embodiments of the present application discloses an electronic device, which comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above method are implemented.

[0017] The fourth aspect of the embodiment of the present application discloses a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the steps of the above method.

[0018] The present application has the following advantages: after determining the query time required for the DNS query request corresponding to the DNS record value of the target domain name and the timing weight and timing weight weighting factor of the IP reputation level to which the client IP address sending the DNS query request belongs, the accumulated time of the preset global timer is updated according to the product of the query time, the timing weight and the timing weight weighting factor. This way can effectively limit the query frequency of non-cached records while ensuring normal DNS query service, and prevent backend storage congestion caused by DoS attacks. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 The flowchart of the method for the DNS server to defend against DoS attacks provided by one embodiment of the present application is shown.

[0020] Figure 2 The flowchart of the method for the DNS server to defend against DoS attacks provided by one embodiment of the present application is shown.

[0021] Figure 3 The structural diagram of the device for the DNS server to defend against DoS attacks provided by one embodiment of the present application is shown. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical scheme and advantages of the present application clearer, further detailed description of the present application will be made below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0023] It should be noted that although the functional modules are divided in the device schematic diagram, and the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order from the module division in the device or the order in the flowchart.

[0024] In order to make the purpose, technical scheme and advantages of the present application clearer, further detailed description of the present application will be made below in combination with the drawings and embodiments.

[0025] According to one embodiment of the present application, a method for the DNS server to defend against DoS attacks is provided, as shown in Figure 1 The method comprises steps S101 to S103.

[0026] Step S101: After the DNS record value corresponding to the DNS query request of the target domain name is queried, the query time required for querying the DNS record value is determined.

[0027] Specifically, the query time can be the time consumed by the DNS system to query the DNS record corresponding to the domain name.

[0028] Step S102: determining the timing weight and the timing weight weighting factor of the IP reputation level to which the IP address of the client sending the DNS query request belongs.

[0029] In the embodiments of the present application, the IP reputation level is used to represent the credibility of the DNS query request. Specifically, the IP reputation level can be set to high, medium and low, and the corresponding defense levels are gradually increased, i.e., the low level is the request of the focus defense. When applied, the IP reputation level can also be set according to other representations, such as 1 to 3 levels, which are not exemplified one by one here.

[0030] In the embodiments of the present application, the timing weight and the timing weight weighting factor are factors affecting the cumulative time of the global timer.

[0031] In the embodiments of the present application, the timing weight weighting factor is used to represent the influencing factor of the DNS cache record not being hit in the recent time period (such as the last 1 minute).

[0032] Specifically, the timing weight and the timing weight weighting factor of different IP reputation levels are different. Generally, the timing weight of the high-level IP reputation level is less than that of the medium-level IP reputation level, and the timing weight of the medium-level IP reputation level is less than that of the low-level IP reputation level.

[0033] Step S103: updating the cumulative time of the preset global timer according to the product of the query time, the timing weight and the timing weight weighting factor.

[0034] Specifically, the cumulative time of the global timer can be updated according to the following formula: counter1 = counter0 + query time * timing weight * timing weight weighting factor, counter0 is the last cumulative time, and counter1 is the cumulative time updated after the query time consumed by the new DNS query request.

[0035] After determining the query time required for the DNS query request corresponding to the DNS record value of the target domain name and the timing weight and the timing weight weighting factor of the IP reputation level to which the IP address of the client sending the DNS query request belongs, the cumulative time of the preset global timer is updated according to the product of the query time, the timing weight and the timing weight weighting factor. This way can effectively limit the query frequency of non-cache records while ensuring normal DNS query service, and prevent the backend storage from being congested due to DoS attack.

[0036] In some embodiments, the step of querying the DNS record value corresponding to the DNS query request of the target domain name in S101 comprises:

[0037] S1011 (not shown in the figure): when detecting the DNS query request of the target domain name, querying in the DNS cache record of the preset DNS server;

[0038] S1012 (not shown in the figure): when the query fails and the DNS query request is an external request, determining the latest update time of the preset global timer and the current cumulative time;

[0039] S1013 (not shown in the figure): if the difference between the current time and the latest update time is less than the preset reset threshold and the current cumulative time is less than the preset cumulative time threshold, querying the target domain name by using the pre-constructed backend database of the DNS authoritative server to obtain the DNS record value of the target domain name, wherein the backend database comprises a plurality of pre-stored DNS record values corresponding to a plurality of specific domain names respectively.

[0040] In application, the preset DNS server and the DNS authoritative server can be the same or different. When the preset DNS server and the DNS authoritative server are different, the preset DNS server is generally the website authorization DNS of the operator.

[0041] Specifically, the DNS cache record comprises the corresponding relationship between the domain name and the DNS record. By the DNS cache record, when accessing a domain name, the corresponding DNS record value can be obtained directly from the cache without querying the DNS server, so as to quickly determine the IP address of the target domain name, thereby saving time and traffic and improving the loading speed of the webpage.

[0042] Specifically, the backend database is provided by the DNS hosting platform for resolving the website domain name of the operator, and stores the DNS record of the hosted domain name. By the backend database, the fast query data basis of the domain name not accessed recently is provided. When the query in the DNS cache record fails, the result can be found directly in the backend database without querying the DNS server, thereby further saving time and traffic and improving the loading speed of the webpage. More specifically, the backend database can adopt MySQL or other data storage systems.

[0043] The memory caching mechanism is adopted in the embodiments of the present application to guarantee service performance. There are two ways to generate the memory cache. One is DNS cache record, that is, the domain name configured in the automatic cache whitelist is checked according to a strategy to update the memory cache from the backend storage. The other is the backend database, that is, the domain name not in the automatic cache whitelist is stored in the memory cache and set with TTL expiration time when the DNS query request is received, and the cache is automatically cleaned up after expiration. Through such configuration, when the result is not found in the memory cache, the IP address can be quickly obtained by querying the backend database. Compared with the way of obtaining the IP address by querying the DNS server, the query step is reduced, the query time is shortened, and the subsequent webpage loading speed is further accelerated.

[0044] In some embodiments, the step of querying the DNS record value corresponding to the DNS query request of the target domain name in S101 further includes: S1014 (not shown in the figure): when the query fails and the DNS query request is an internal request, the corresponding record is obtained from the backend database, and the DNS cache record is updated according to the record.

[0045] Specifically, internal means that the request client IP is an internal network segment IP and an IP configured in the trusted IP list. In this way, when it is identified that the query request comes from the internal (such as refreshing the memory cache or the health check request from the internal monitoring service), the record is obtained from the backend storage and cached in the memory, so as to update the DNS cache record.

[0046] In some embodiments, the step of querying the DNS record value corresponding to the DNS query request of the target domain name in S101 further includes:

[0047] If the difference between the current time and the latest update time is not less than the reset threshold, the latest update time of the global timer is replaced with the current time and the current accumulated time is reset to 0.

[0048] If the current accumulated time is not less than the preset accumulated time threshold, the query processing of the DNS query request is rejected, and the accumulated time threshold is greater than 0 and less than the reset threshold.

[0049] The embodiments of the present application control whether the global timer is restarted by the reset threshold, and control whether the query processing of the DNS query request is rejected by the accumulated time threshold, so as to control the query service of the DNS query request by the reset threshold and the accumulated time threshold, and avoid the congestion problem caused by the long time consumption of the query of the DNS query request.

[0050] In the above embodiments, the reset threshold is a multiple of the accumulated time threshold, so that the query processing of the DNS query request is rejected when the accumulated time reaches the accumulated time threshold, i.e., when the accumulated time reaches 1 / N (N is the multiple) of the reset threshold, so that the congestion problem caused by the long time consumption of the query of the DNS query request is avoided in the remaining time (1-1 / N) until the global timer is restarted according to the reset threshold.

[0051] In application, the accumulated time threshold is generally set to 1 / 3 of the reset threshold. In this way, both efficient DNS query and avoidance of service congestion and paralysis can be ensured.

[0052] In some embodiments, step S102 further includes:

[0053] determining the key indicators of the DNS server of the client IP address initiating the DNS query request, the key indicators including request stability SF, request normality NF, request volume change trend TF, cache hit rate CHR, and strangeness NFV;

[0054] If the request stability SF is greater than a preset first stability threshold, the request normality NF is greater than a preset first normal stability threshold, and the request volume change trend TF is within a preset request volume change trend TF range, it is determined that the IP reputation level to which the client IP address sending the DNS query request belongs is a high reputation level, and the timing weight corresponding to the high reputation level is determined;

[0055] If the request stability SF is greater than a preset second stability threshold and less than the first stability threshold, and the request normality NF is greater than a preset second normal stability threshold and less than the first stability threshold, it is determined that the IP reputation level to which the client IP address sending the DNS query request belongs is a medium reputation level, and the timing weight corresponding to the medium reputation level is determined;

[0056] If the cache hit rate CHR is less than a preset hit rate threshold, or the strangeness NFV is greater than a preset strangeness threshold, it is determined that the IP reputation level to which the client IP address sending the DNS query request belongs is a low reputation level, and the timing weight corresponding to the low reputation level is determined.

[0057] Specifically, the request stability SF can be reflected by the ratio of the standard deviation of requests (Sandard Deviation of Requests) to the average value (Average Requests per Time Window), as shown in the following formula:

[0058]

[0059] In application, the time window can be selected according to actual situation, such as 1 day, 1 week or 1 month, and the ratio of the standard deviation and the average value of the request amount in the preset time window is calculated.

[0060] Specifically, the request normality NF is used to measure the proportion of the number of DNS recursive queries (Numver of DNS Recursive Queries) to the total number of requests (Total Number of Requests), as follows:

[0061]

[0062] Specifically, the request trend TF is used to measure whether the request amount presents a stable growth or decline trend. It can be achieved by comparing the request amount change rates of different time windows, specifically whether the ratio of the request amount of the current time window (Current Window Requests) to the request amount of the previous time window (Previous Window Requests) is within a reasonable range, as follows:

[0063] Wherein, Lower Bound and Upper Bound are reasonable range thresholds configured according to historical data. In the formula, TF is 1 for normal trend, and 0 for possible sudden increase or decrease of trend.

[0064] Specifically, the cache hit rate CHR is used to measure the proportion of the number of cache hits (Number of Cache Hits) to the total number of requests (Total Number of Requests), which is particularly important for low reputation levels. The formula is as follows:

[0065] Specifically, the strangeness NFV is used to measure whether it is a new or rarely appeared request. It can be evaluated by the first appearance time of IP or the historical request number (Total Requests). The formula is as follows:

[0066] Wherein, Threshold is a set threshold value, representing the minimum request number required for IP to be considered "familiar".

[0067] The IP reputation level can be determined according to actual needs when the method is applied. For example, if the SF and the NF are both higher than a certain threshold (configured as 0.8), and the TF is within a reasonable range (1 is reasonable), it is determined as a high reputation level; if at least one of the SF and the NF is within a medium range (configured as between 0.5 and 0.8), and does not satisfy the condition that the recent magnitude suddenly increases (TF is 0) and the CHR is very low (configured as lower than 0.2) or the NFV is very high (greater than 0.5), it is determined as a medium reputation level; and if it does not satisfy the high reputation level and the medium reputation level, it is determined as a low reputation level.

[0068] In some embodiments, the step S101 determines a time weight weighting factor of an IP reputation level to which a client IP address sending the DNS query request belongs, including:

[0069] The product of the number of cache misses per minute in the corresponding time period of the last day without attack and a preset abnormality judgment weight is calculated to obtain an abnormality sudden increase judgment threshold of the cache miss request amount;

[0070] The ratio of the cache miss request amount in the recent time period to the abnormality sudden increase judgment threshold of the cache miss request amount is calculated.

[0071] If the ratio is greater than 1, the ratio is taken as the time weight weighting factor.

[0072] If the ratio is not greater than 1, a preset default value is taken as the time weight weighting factor.

[0073] Specifically, the abnormality judgment weight can be configured by the system according to business needs. For example, the abnormality judgment weight configured by the system can be 3.

[0074] The method provided by the embodiments of the present application will be described below. Figure 2 The method provided by the embodiments of the present application will be described below. Figure 2The shown system includes a local DNS server and an authorized DNS service system. In the embodiment, the authorized DNS service system includes a website DNS server and a DNS dispatch server for hosting. When the website DNS server receives a domain name query request (the query request is a request for querying the IP corresponding to the domain name www.a.com) sent by the local DNS server, the website DNS server first queries in the A record or the AAAA record of the DNS cache record, and in the case that no corresponding result is queried, the CNAME record is queried to obtain the mapped domain name (xxx.bbb.com), and the CNAME record value is returned to the local DNS server, i.e., www.a.com is mapped to the domain name xxx.bbb.com of the DNS dispatch server for hosting; then, after the DNS dispatch server for hosting receives the request for querying the IP address corresponding to xxx.bbb.com sent by the local DNS server, the DNS dispatch server for hosting queries the backend database, and returns the corresponding IP address to the local DNS server, so that the local DNS server provides the returned IP to the browser.

[0075] In the embodiment in which the authorized DNS service system includes the DNS dispatch server for hosting, after the DNS dispatch server receives a DNS query request, the DNS dispatch server first queries in the DSN cache record, and in the case that no result is queried, it is first determined whether the query request is from inside or outside (i.e., whether the client IP sending the request is a pre-configured trusted IP address), if it is from inside, the DNS record stored in the backend database is obtained and stored in the DNS cache record, so as to update the DNS cache record; and in the case that the query request is from outside, the state of the timer is checked. Assuming that the timer reset threshold is 3 seconds, i.e., the timer is reset every 3 seconds, and the timer cumulative time threshold is 1 / 3 of the timer reset threshold, i.e., 1 second. Then, the DNS query request is rejected when the difference between the current time of the timer and the latest update time reaches 3 seconds, or the DNS query request is rejected when the current cumulative time reaches 1 second, otherwise, the target domain name is queried from the backend database of the DNS authorized server, the corresponding DNS record value is obtained, and the DNS query request is responded according to the DNS record value.

[0076] One embodiment of the present application provides a DNS server for defending DoS attack, as shown in the figure, the device 30 includes a query time determination module 301, a timing parameter determination module 302 and a timer parameter update module 303. Figure 3

[0077] The query time determination module 301 is configured to determine the query time required for querying the DNS record value corresponding to the DNS query request of the target domain name when the DNS record value is queried. ​

[0078] The timing parameter determination module 302 is configured to determine a timing weight and a timing weight weighting factor of an IP reputation level to which a client IP address sending a DNS query request belongs;

[0079] The timer parameter updating module 303 is configured to update a cumulative time of a preset global timer according to a product of the query time, the timing weight and the timing weight weighting factor.

[0080] The embodiment of the present application can update the cumulative time of the preset global timer according to the product of the query time, the timing weight and the timing weight weighting factor after determining the query time required for the DNS query request corresponding to the DNS record value of the target domain name to be queried and the timing weight and the timing weight weighting factor of the IP reputation level to which the client IP address sending the DNS query request belongs, which can effectively limit the query frequency of non-cached records while ensuring normal DNS query service, and prevent the backend storage from being congested due to DoS attacks.

[0081] Further, the query time determination module comprises:

[0082] The cache lookup submodule is configured to, when detecting the DNS query request of the target domain name, query in a DNS cache record of a preset DNS server;

[0083] The time determination submodule is configured to, when the query fails and the DNS query request is an external request, determine a latest update time and a current cumulative time of the preset global timer;

[0084] The external request backend lookup submodule is configured to, if a difference between the current time and the latest update time is less than a preset reset threshold and the current cumulative time is less than a preset cumulative time threshold, query the target domain name by using a pre-constructed backend database of a DNS authoritative server to obtain a DNS record value of the target domain name, wherein the backend database comprises a plurality of DNS record values corresponding to a plurality of specific domain names respectively.

[0085] Further, the query time determination module further comprises:

[0086] The internal request backend lookup submodule is configured to, when the query fails and the DNS query request is an internal request, acquire a corresponding record from the backend database and update the DNS cache record according to the record.

[0087] Further, the query time determination module further comprises:

[0088] The time updating submodule is configured to, if the difference between the current time and the latest update time is not less than the reset threshold, replace the latest update time of the global timer with the current time and reset the current cumulative time to 0.

[0089] a timer resetting submodule, configured to perform query processing rejection on the DNS query request when the current accumulated time is not less than a preset accumulated time threshold, the accumulated time threshold being greater than 0 and less than the resetting threshold.

[0090] Further, the resetting threshold is a multiple of the accumulated time threshold.

[0091] Further, the timing parameter determination module comprises:

[0092] a key indicator determination submodule, configured to determine a key indicator of the DNS server of the client IP address sending the DNS query request, the key indicator comprising a request stability SF, a request normality NF, a request volume change trend TF, a cache hit rate CHR, and a strangeness NFV;

[0093] a high level determination submodule, configured to determine that the IP reputation level of the client IP address sending the DNS query request is a high reputation level, and determine a timing weight corresponding to the high reputation level, if the request stability SF is greater than a preset first stability threshold, the request normality NF is greater than a preset first normality threshold, and the request volume change trend TF is within a preset request volume change trend TF range.

[0094] a medium level determination submodule, configured to determine that the IP reputation level of the client IP address sending the DNS query request is a medium reputation level, and determine a timing weight corresponding to the medium reputation level, if the request stability SF is greater than a preset second stability threshold and less than the first stability threshold, and the request normality NF is greater than a preset second normality threshold and less than the first stability threshold.

[0095] a low level determination submodule, configured to determine that the IP reputation level of the client IP address sending the DNS query request is a low reputation level, and determine a timing weight corresponding to the low reputation level, if the cache hit rate CHR is less than a preset hit rate threshold, or the strangeness NFV is greater than a preset strangeness threshold.

[0096] Further, the timing parameter determination module comprises:

[0097] an abnormal threshold determination submodule, configured to calculate a product of the number of cache miss requests per minute in a corresponding time period of a latest day without attack and a preset abnormality judgment weight, to obtain a cache miss request volume abnormal surge judgment threshold;

[0098] an abnormal ratio determination submodule, configured to calculate a ratio of the cache miss request volume in a latest time period to the cache miss request volume abnormal surge judgment threshold;

[0099] a first determination submodule, configured to take the ratio as a timing weight weighting factor if the ratio is greater than 1.

[0100] The second determining sub-module is configured to take a preset default value as the timing weight weighting factor if the ratio is not greater than 1.

[0101] The device of the embodiment can perform the method shown in the first embodiment of the application, and the implementation principle is similar, which will not be described here.

[0102] Another embodiment of the application provides a terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor executes the computer program to implement the data processing method based on a search engine.

[0103] Specifically, the processor can be a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logical blocks, modules, and circuits described in combination with the disclosure. The processor can also be a combination of computing functions, such as a combination of one or more microprocessors, a combination of DSP and microprocessor, etc.

[0104] Specifically, the processor is connected with the memory through a bus, and the bus can include a path for transmitting information. The bus can be a PCI bus or an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0105] The memory can be a ROM or other types of static storage devices that can store static information and instructions, a RAM or other types of dynamic storage devices that can store information and instructions, an EEPROM, a CD-ROM or other optical disc storage, an optical disc storage (including a compact disc, a laser disc, an optical disc, a digital versatile disc, a Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program codes in the form of instructions or data structures and capable of being accessed by a computer, but not limited to this.

[0106] Optionally, the memory is used to store the code of the computer program for executing the scheme of the application, and the processor is used to control the execution. The processor is used to execute the application program code stored in the memory to realize the actions of the device.

[0107] Another embodiment of the application provides a computer readable storage medium, which stores computer executable instructions for executing the above method.

[0108] The apparatus embodiments described above are only illustrative, wherein the units described as separate components can or can not be physically separate, i.e., can be located in one place, or can be distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiment.

[0109] Those of ordinary skill in the art will appreciate that all or some of the steps, systems, and techniques described above can be embodied in software, firmware, hardware, and / or any suitable combination thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a micro-processing unit, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on computer readable media, which can comprise computer storage media (or non-transitory media), and communication media (or transitory media). As is well known to those of ordinary skill in the art, the term computer storage media includes both volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by a computer. Further, as is well known to those of ordinary skill in the art, communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. In this document, the term "modulated data signal" means a signal that has one or more of its characteristics changed or set in a manner so as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as wireless networks, cellular telephone networks, code division multiple access (CDMA) networks, and other terrestrial and satellite radio frequency communication networks or other wireless media.

[0110] The above is a specific description of the preferred embodiments of the present application, but the present application is not limited to the above-described embodiments, and those skilled in the art can make various equivalent modifications or replacements without departing from the spirit of the present application, and these equivalent modifications or replacements are all included in the scope defined by the claims of the present application.

Claims

1. A method for defending a DNS server against DoS attacks, characterized in that, The method includes: Once the DNS record value corresponding to the DNS query request for the target domain name is found, the query time required to query the DNS record value is determined. The process involves determining the timing weight and timing weight weighting factor for the IP reputation level of the client IP address sending the DNS query request. This step further includes: calculating the product of the number of cache misses per minute within the corresponding time period of the most recent day without an attack and a preset anomaly judgment weight, to obtain a threshold for judging an abnormal surge in cache miss requests; calculating the ratio of the number of cache miss requests in the most recent time period to the threshold for judging an abnormal surge in cache miss requests; if the ratio is greater than 1, then the ratio is used as the timing weight weighting factor; if the ratio is not greater than 1, then a preset default value is used as the timing weight weighting factor. The cumulative time of the preset global timer is updated based on the product of the query time, the timing weight, and the timing weight weighting factor.

2. The method according to claim 1, characterized in that, The DNS record values ​​corresponding to the DNS query request for the target domain name were found, including: When a DNS query request for the target domain name is detected, a query is performed in the DNS cache records of the preset DNS server; When the query fails and the DNS query request is an external request, determine the most recent update time and the current cumulative time of the preset global timer; If the difference between the current time and the most recent update time is less than a preset reset threshold and the current cumulative time is less than a preset cumulative time threshold, then the target domain name is queried using the backend database of the pre-built DNS authoritative server to obtain the DNS record value of the target domain name. The backend database includes pre-stored DNS record values ​​corresponding to multiple specific domain names.

3. The method according to claim 2, characterized in that, The DNS record value corresponding to the DNS query request for the target domain name also includes: When the query fails and the DNS query request is an internal request, the corresponding record is retrieved from the backend database, and the DNS cache record is updated based on the record.

4. The method according to claim 2, characterized in that, The DNS record values ​​corresponding to the DNS query request for the target domain name also include: If the difference between the current time and the most recently updated time is not less than the reset threshold, then the most recently updated time of the global timer is replaced with the current time and the current accumulated time is reset to 0; If the current cumulative time is not less than a preset cumulative time threshold, then the DNS query request is rejected. The cumulative time threshold is greater than 0 and less than the reset threshold.

5. The method according to claim 2, characterized in that, The reset threshold is a multiple of the cumulative time threshold.

6. The method according to claim 1, characterized in that, The timing weight for determining the IP reputation class of the client IP address that sent the DNS query request includes: The key metrics for determining the DNS server that initiated the DNS query request include Request Stability (SF), Request Normality (NF), Request Volume Trend (TF), Buffer Hit Rate (CHR), and Unfamiliarity (NFV). If the request stability SF is greater than a preset first stability threshold, the request normality NF is greater than a preset first normal stability threshold, and the request volume change trend TF is within a preset request volume change trend TF range, then the IP reputation level of the client IP address is determined to be a high reputation level, and the timing weight corresponding to the high reputation level is determined. If the request stability SF is greater than a preset second stability threshold and less than the first stability threshold, and the request normality NF is greater than a preset second normality stability threshold and less than the first stability threshold, then the IP reputation level of the client IP address is determined to be medium reputation level, and the timing weight corresponding to the medium reputation level is determined. If the buffer hit rate (CHR) is less than a preset hit rate threshold, or the unfamiliarity value (NFV) is greater than a preset unfamiliarity value threshold, then the IP reputation level of the client IP address is determined to be a low reputation level, and the timing weight corresponding to the low reputation level is determined.

7. A device for defending a DNS server against DoS attacks, characterized in that, include: The query time determination module is used to determine the query time required to query the DNS record value after the DNS query request for the target domain name is found. The timing parameter determination module is used to determine the timing weight and timing weight weighting factor of the IP reputation class to which the client IP address that sent the DNS query request belongs; The timing parameter determination module includes: an anomaly threshold determination submodule, used to calculate the product of the number of cache misses per minute in the corresponding time period of the most recent day without an attack and a preset anomaly judgment weight, to obtain the threshold for judging an abnormal surge in the number of cache miss requests; an anomaly ratio determination submodule, used to calculate the ratio of the number of cache misses in the most recent time period to the threshold for judging an abnormal surge in the number of cache misses; a first determination submodule, used to use the ratio as a timing weighting factor if the ratio is greater than 1; and a second determination submodule, used to use a preset default value as a timing weighting factor if the ratio is not greater than 1. The timer parameter update module is used to update the cumulative time of a preset global timer based on the product of the query time, the timer weight, and the timer weighting factor.

8. An electronic device, characterized in that, The device includes a processor and a memory, the memory storing computer-readable instructions, and the processor being configured to execute the computer-readable instructions, wherein the computer-readable instructions, when executed, perform the method according to any one of claims 1 to 6.

9. A computer-readable storage medium storing computer-executable instructions for performing the method according to any one of claims 1 to 6.

Images