XDP-based defense method and system for multi-level DNS amplification attack

Abstract

The invention discloses a defense method and system for a multi-level DNS amplification attack based on an XDP. The method comprises the following steps: 1) mounting a Hook XDP point on a target host, wherein the Hook XDP point is used for capturing a message which is sent to the target host and is amplified and attacked by a DNS; 2) setting an extensible multi-layer filtering module in an XDP kernel of the target host, wherein the extensible multi-layer filtering module is used for filtering high-risk DNS response messages from the messages amplified and attacked by the DNS and sending the high-risk DNS response messages to a DNS query response matching module; other messages are sent to the kernel protocol stack of the target host for processing; 3) a DNS query response matching module matches each high-risk DNS response message with the record of the DNS query message sent by the target host; if the matching is successful, the DNS response message which is regarded as a benign DNS response message is sent to a DNS response message processing module; and 4) the DNS response message processing module sends the DNS response message to the user space for analysis and processing.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and relates to a defense method and system for multi-level DNS amplification attacks based on XDP. Background Art

[0002] DNS Amplification Attack is a form of distributed denial of service (DDoS) attack widely exploited in recent years. This attack uses open DNS servers to flood the target DNS system by amplifying the attack traffic. The attacker takes advantage of the characteristics of the DNS protocol to forge the IP address of the victim server and send a relatively small DNS query request to the DNS server. The DNS server generates a large amount of data during the response process and transmits it to the victim host, resulting in network congestion.

[0003] Currently, to resist the above attack, the characteristics of one-to-one correspondence between DNS query and response messages are often utilized. The sent DNS query messages are recorded and matched with the received DNS response messages to detect and mitigate the attack messages. However, this method has its limitations:

[0004] (1) If all DNS response messages are detected, the time-consuming for querying and matching messages results in low reception efficiency;

[0005] (2) If the DNS response messages in a time period are filtered after an attack message is detected, a relatively high false alarm rate may be caused;

[0006] (3) The matching mechanism runs in the user space, resulting in low mitigation efficiency. At the same time, the kernel network protocol stack is still vulnerable to amplification attacks.

[0007] DNS amplification attacks usually abuse open DNS servers as amplifiers. Such DNS servers are usually configured to allow recursive queries and allow queries from any IP address, providing conditions for amplification of the attack. In addition, these open DNS servers are usually easy to discover and can be easily found through public network scanning or DNS queries. Different types of DNS servers have different probabilities of DNS amplification attacks. Therefore, in the DNS query-response message matching method, the reception efficiency of messages can be improved by only checking high-risk messages, thus solving the time-consuming problem in the matching process.

[0008] BPF (Berkeley Packet Filter) is a technology developed for UNIX, aiming to improve the performance of network monitoring applications by filtering packets. Its extended form, eBPF (extended Berkeley Packet Filter), allows sandbox programs to run in the operating system, which is a more flexible and cost-effective way to modify the kernel without modifying the kernel source code or loading new kernel modules. XDP (eXpress Data Path) is a fast data path data plane technology based on the Linux platform. XDP can be used as a hook to mount eBPF programs and be embedded in the network processing flow. Generally, it is used for packet monitoring, sampling, load balancing, packet inspection, and other forms of network analysis. eBPF can provide XDP hooks at the hardware and kernel levels, and set detection and interception mechanisms at the XDP hooks to preprocess packets before the traditional kernel protocol processing.

[0009] The XDP+eBPF technology allows for secure processing of packets at the network card and kernel levels. On the packet receiving channel, XDP operates before the kernel network protocol stack to detect or determine whether a packet is involved in a DNS amplification attack. Compared with custom packet processing in the user space, the advantage of XDP is that it significantly reduces the possibility of the kernel network protocol stack being attacked by DNS amplification, while improving the receiving efficiency of legitimate packets.

[0010] The traditional solution cannot yet preprocess DNS response packets and redirect them, so there is still much room for improvement in terms of defense strength. Summary of the Invention

[0011] Aiming at the problems existing in the prior art, the purpose of the present invention is to provide a defense method and system for multi-level DNS amplification attacks based on XDP.

[0012] The present invention can preprocess DNS response packets and redirect them, thereby improving the defense strength and achieving the following effects:

[0013] (1) The matching mechanism focuses on checking high-risk DNS response packets, reducing the burden of matching DNS query packets, and improving the receiving efficiency of DNS response packets;

[0014] (2) Reducing the false alarm rate;

[0015] (3) Reducing the impact of attacks on the kernel network protocol stack and legitimate communications.

[0016] The technical solution of the present invention is as follows:

[0017] A defense method against multi-level DNS amplification attacks based on XDP, the steps of which include:

[0018] 1) Mount a Hook XDP point on the target host to capture packets subject to DNS amplification attacks sent to the target host;

[0019] 2) Set an extensible multi-layer filtering module in the XDP kernel of the target host to filter out high-risk DNS response packets from the packets subject to DNS amplification attacks and send them to the DNS query response matching module; send other packets to the kernel protocol stack of the target host for processing;

[0020] 3) The DNS query response matching module matches each high-risk DNS response packet with the records of DNS query packets sent by the target host; if the packet matches successfully, it is regarded as a benign DNS response packet and sent to the DNS response packet processing module; if the packet fails to match, it is discarded;

[0021] 4) The DNS response packet processing module sends the DNS response packet to the user space for parsing and processing.

[0022] Furthermore, the extensible multi-layer filtering module includes multi-layer filtering units set according to the characteristics of DNS amplification attacks, which are used to gradually narrow the attribute range of high-risk DNS response packets to obtain high-risk DNS response packets; the extensible multi-layer filtering module includes at least two layers of filtering units, where the first layer of filtering unit is a DNS response packet filtering module, which is used to separate DNS response packets and non-DNS response packets from network packets, and the second layer of filtering unit is a high-risk DNS response packet filtering module, which is used to separate packets from open DNS servers and other packets from non-open DNS servers from the separated DNS response packets.

[0023] Furthermore, the high-risk DNS response packet filtering module determines the type of openness of the current DNS response packet from the DNS server according to the source IP address in the DNS response packet. If it comes from an open DNS server, it is marked as a high-risk DNS response packet and set to the first priority when the network is congested; if it comes from a conditionally open DNS server, it is marked as a high-risk DNS response packet and set to the second priority when the network is congested.

[0024] Furthermore, record the IP addresses of the selected non-open DNS servers in the XDP kernel. If the source address in the current DNS response packet belongs to a non-open IP address, it is determined that the current DNS response packet is not a high-risk DNS response packet; otherwise, it is determined that the current DNS response packet is a high-risk DNS response packet.

[0025] Furthermore, initialize a first memory pool required for data transfer between the XDP receiving process and the DNS query response matching process in the target host, and initialize a second memory pool required for data transfer between the DNS query response matching process and the user space protocol stack process; when the target host sends each DNS query message, record the 16-bit identifier ID of the DNS query message header in the form of a trie tree; the method for the DNS query response matching module to match each high-risk DNS response message with the record of the DNS query message sent by the target host is as follows: use the trie tree to match the identifier ID of the high-risk DNS response message bit by bit. If the current bit fails to match, discard the high-risk DNS response message; if all 16 bits match successfully, transfer the high-risk DNS response message to the second memory pool and delete the corresponding DNS query message ID from the trie tree.

[0026] A defense system against multi-level DNS amplification attacks based on XDP, characterized in that it includes a host, and an XDP Hook point of a network card driver, an extensible multi-layer filtering module, a DNS query response matching module, and a DNS response message processing module are provided on the host;

[0027] The XDP Hook point of the network card driver is used to capture the packets attacked by DNS amplification sent to the target host;

[0028] The extensible multi-layer filtering module is used to filter out high-risk DNS response messages from the packets attacked by DNS amplification and send them to the DNS query response matching module; send other packets to the kernel protocol stack of the target host for processing;

[0029] The DNS query response matching module is used to match each high-risk DNS response message with the record of the DNS query message sent by the target host; if the message matches successfully, regard it as a benign DNS response message and send it to the DNS response message processing module; if the message fails to match, discard it;

[0030] The DNS response message processing module is used to send the DNS response message to the user space for parsing and processing.

[0031] The technical solution adopted by the present invention is as Figure 1 shown, including the following modules:

[0032] (1) An extensible multi-layer filtering module is used to screen high-risk DNS response packets as much as possible. The "multi-layer" means that by leveraging the characteristics of DNS amplification attacks, different filtering mechanisms are set at multiple levels to continuously narrow down the attribute range of high-risk DNS response packets and reduce the false positive rate of the matching module. The "extensible" means that without changing the core code and with sufficient memory, it can continuously perform multi-layer expansion to adapt to new filtering mechanisms. The first layer in this module is a fixed DNS response packet filtering module, which is used to divert DNS response packets and other non-DNS response packets from network packets. The second layer of this module is a high-risk DNS response packet filtering module, which is used to divert packets from open DNS servers and other packets from non-open DNS servers. The "open DNS servers" include fully open DNS servers and conditionally open DNS servers. According to the source IP address field in the packet, it is determined whether the packet comes from an open DNS server or a non-open DNS server. The "fully open DNS server" refers to a DNS server that anyone can freely access and use without authentication, usually a global public DNS service provider, such as Google PublicDNS, Cloudflare DNS, etc.; the "conditionally open DNS server" refers to a DNS server that is open to the public with usage conditions, which may require registration, verification, or be subject to certain restrictions, such as the DNS server provided by an ISP. The "non-open DNS server" refers to a private, enterprise-internal, or DNS server that requires specific permissions and authentication, such as an enterprise-internal DNS server and a private DNS server. DNS response packets from open servers are at higher risk and are more likely to be attack packets compared to those from non-open servers. For response packets from open DNS servers, when the network is congested, they are preferentially marked as high-risk DNS response packets (first priority); for response packets from conditionally open DNS servers, when the network is congested, they can be considered marked as high-risk DNS response packets (second priority); for response packets from non-open DNS servers, no operation is performed. When the network is slightly congested, only the packets with the first priority need to be marked as high-risk; if the congestion still cannot be alleviated, the packets with the first priority and the second priority are both marked as high-risk.

[0033] (2) DNS query response matching module, which is used to match the high-risk DNS response packets received by the host with the records of the DNS query packets sent by the host. When the host sends a DNS query packet each time, it will record the 16-bit identifier ID in the header of the DNS query packet to form a "record", which contains the 16-bit identifier ID. If the packet matches successfully, it will be handed over to the DNS response packet processing module for processing; if the packet fails to match, it will be discarded. The successfully matched packets are used as benign DNS response packets and sent to the DNS response packet processing module.

[0034] (3) DNS response packet processing module, which is a user-space protocol stack for processing DNS response packets, used to migrate benign DNS response packets to the user space, and parse and process the benign DNS response packets in the user space.

[0035] The packet processing process of the present invention is as Figure 2 shown, specifically as follows:

[0036] (1) Real-time packets arrive at the XDP Hook point of the network card driver in the target host, and the XDP program is used to capture the packets attacked by the DNS amplification attack;

[0037] (2) Enter the custom-designed filter at the XDP Hook point to achieve traffic splitting. Determine whether the current packet is a DNS response packet according to the packet structure. If it is not a DNS response packet, it will be handed over to the kernel network protocol stack for further processing. If it is a DNS response packet, then determine the open type of the current packet from the DNS server according to the source IP address. If it comes from an open DNS server, it will be marked as a high-risk DNS response packet when the network is congested; if it comes from a conditionally open DNS server, it will be marked as a high-risk DNS response packet when the network is congested for a certain period of time.

[0038] (3) Through the set multi-layer filtering mechanism, high-risk packets are redirected to the user space by eBPF, and other packets (for the first layer, it refers to non-DNS response packets; for the second layer, it refers to non-high-risk DNS response packets) enter the kernel protocol stack for processing;

[0039] (4) High-risk packet redirection, specifically: call bpf_map_lookup_elem() to find the AF_XDP socket in the user space according to the network card in the eBPF Map as the target socket for redirection. Use bpf_redirect_map() to redirect the packet, and the eBPF Map is used as the channel connecting the kernel and the user space to store high-risk packets;

[0040] (5) Through an inter - process communication method, transfer the high - risk packets from the XDP receiving process to the DNS query response matching process for matching. Match the 16 - bit identifier ID of the high - risk DNS response packet with the identifier ID in the record. If the match is successful, it is determined as a benign DNS response packet; otherwise, it is determined as a DNS amplification attack packet and discarded.

[0041] (6) Through an inter - process communication method, transfer the benign DNS response packets from the DNS query response matching process to the user - space protocol stack.

[0042] The advantages of the present invention are as follows:

[0043] (1) Shorten the receiving path of high - risk DNS response packets and improve the defense efficiency against DNS amplification attacks.

[0044] (2) Greatly alleviate the impact of DNS amplification attacks on the kernel network protocol stack, so that most benign packets are not affected by attacks during the packet - processing stage.

[0045] (3) The multi - layer filtering structure in advance reduces the false - alarm rate of the query response matching method.

[0046] (4) The scalable filtering structure provides room for further reducing the false - alarm rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a defense module diagram for multi - level DNS amplification attacks.

[0048] Figure 2 It is a packet - processing flow chart.

[0049] Figure 3 It is the recording of the identifier ID of the DNS query packet in a trie tree manner.

[0050] Figure 4 It is the matching of the identifier ID of the DNS query response packet in a trie tree manner. DETAILED DESCRIPTION OF THE INVENTION

[0051] The present invention will be further described in detail below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0052] The defense method against multi - level DNS amplification attacks based on XDP specifically includes the following steps:

[0053] (1) Mount the Hook XDP point on the target host to capture the packets attacked by DNS amplification sent to the target host.

[0054] (2) Set an extensible multi-layer filtering module in the XDP kernel and design a processing mechanism for multi-layer filtering.

[0055] (3) In the XDP kernel, determine whether the current packet is a DNS response packet. Specifically: Use the QR flag bit in the parsed header of the packet for determination. If QR is 1, then determine that the packet is a DNS response packet; if QR is 0, then determine it is a DNS query packet.

[0056] (4) In the XDP kernel, determine whether the current packet comes from an open DNS server. Specifically: Record the common non-open IP addresses in the program. If the source address belongs to a non-open IP address, then determine that the packet is not a high-risk packet; otherwise, determine that the packet is a high-risk packet.

[0057] (5) Take the high-risk packet as a redirect packet and initialize the data structures and space required for redirecting the packet to the user space.

[0058] (6) Initialize the first memory pool required for data transfer between the XDP receiving process and the DNS query response matching process. The XDP receiving process and the DNS query response matching process are two different processes, and shared memory, that is, the first memory pool, needs to be set for data transfer between these two processes.

[0059] (7) Initialize the second memory pool required for data transfer between the DNS query response matching process and the user space protocol stack process, as data transfer between processes requires shared memory.

[0060] (8) In the DNS query response matching program, design a matching scheme and initialize the memory. Specifically: When the target host sends a DNS query packet, record the 16-bit identifier ID in the DNS header in the form of a trie, as Figure 3 shown. Taking ID as 0101100111001110 as an example, use the trie to match the identifier ID of the received DNS response packet bit by bit, as Figure 4 shown. Once there is a mismatch, discard it; if all 16 bits match successfully, then pass the packet to the second memory pool for inter-process communication and delete the corresponding DNS query packet ID from the trie.

[0061] (9) In the DNS response packet user space protocol stack of the DNS response packet processing module, design and initialize the protocol stack structure for the DNS response packet.

[0062] Although specific embodiments of the present invention are disclosed for illustrative purposes, which are intended to help understand the content of the present invention and implement it accordingly, those skilled in the art can understand that various substitutions, changes, and modifications are possible without departing from the spirit and scope of the present invention and the appended claims. Therefore, the present invention should not be limited to the content disclosed in the best embodiments, and the scope of protection claimed by the present invention shall be defined by the scope defined in the claims.

Claims

1. A defense method against multi - level DNS amplification attacks based on XDP, the steps of which include: 1) Mount a Hook XDP point on the target host to capture packets of DNS amplification attacks sent to the target host; 2) Set an extensible multi - layer filtering module in the XDP kernel of the target host to filter out high - risk DNS response packets from the packets of DNS amplification attacks and send them to the DNS query response matching module; Send other packets to the kernel protocol stack of the target host for processing; 3) The DNS query response matching module matches each high - risk DNS response packet with the record of the DNS query packet sent by the target host; if the packet matches successfully, it is regarded as a benign DNS response packet and sent to the DNS response packet processing module; If the packet fails to match, it is discarded; 4) The DNS response packet processing module sends the DNS response packet to the user space for parsing and processing.

2. The method according to claim 1, characterized in that the extensible multi - layer filtering module includes multi - layer filtering units set according to the characteristics of DNS amplification attacks, which are used to gradually narrow the attribute range of high - risk DNS response packets to obtain high - risk DNS response packets; the extensible multi - layer filtering module includes at least two layers of filtering units, wherein the first - layer filtering unit is a DNS response packet filtering module, which is used to separate DNS response packets and non - DNS response packets from network packets, and the second - layer filtering unit is a high - risk DNS response packet filtering module, which is used to separate packets from open DNS servers and other packets from non - open DNS servers from the separated DNS response packets.

3. The method according to claim 2, characterized in that the high - risk DNS response packet filtering module determines the type of openness of the current DNS response packet from the source IP address in the DNS response packet. If it comes from an open DNS server, it is marked as a high - risk DNS response packet and set to the first priority when network congestion occurs; If it comes from a conditionally open DNS server, it is marked as a high - risk DNS response packet and set to the second priority when network congestion occurs.

4. The method according to claim 1 or 2 or 3, characterized in that Record the IP addresses of the selected non - open DNS servers in the XDP kernel. If the source address in the current DNS response packet belongs to a non - open IP address, it is determined that the current DNS response packet is not a high - risk DNS response packet; otherwise, it is determined that the current DNS response packet is a high - risk DNS response packet.

5. The method according to claim 1 or 2 or 3, characterized in that Initialize the first memory pool required for data transmission between the XDP receiving process and the DNS query response matching process in the target host, and initialize the second memory pool required for data transmission between the DNS query response matching process and the user space protocol stack process; when the target host sends each DNS query message, record the 16-bit identifier ID in the header of the DNS query message in the form of a trie tree; the method for the DNS query response matching module to match each high-risk DNS response message with the record of the DNS query message sent by the target host is: use the trie tree to perform bit-by-bit matching on the identifier ID of the high-risk DNS response message. If the current bit matching fails, discard the high-risk DNS response message; if all 16 bits match successfully, transfer the high-risk DNS response message to the second memory pool and delete the corresponding DNS query message ID from the trie tree.

6. A defense system for multi-level DNS amplification attacks based on XDP Characterized in that it includes a host, and an XDP Hook point of the network card driver, an extensible multi-layer filtering module, a DNS query response matching module, and a DNS response message processing module are provided on the host; The XDP Hook point of the network card driver is used to capture the messages attacked by DNS amplification sent to the target host; The extensible multi-layer filtering module is used to filter out high-risk DNS response messages from the messages attacked by DNS amplification and send them to the DNS query response matching module; Send other messages to the kernel protocol stack of the target host for processing; The DNS query response matching module is used to match each high-risk DNS response message with the record of the DNS query message sent by the target host; if the message matches successfully, regard it as a benign DNS response message and send it to the DNS response message processing module; If the message fails to match, discard it; The DNS response message processing module is used to send the DNS response message to the user space for parsing and processing.

Images