Method and device for detecting dns amplification attack

Abstract

The application discloses a DNS amplification attack detection method and device, comprising: periodically acquiring domain name system traffic data including at least one domain name system response packet, and performing feature extraction on the domain name system traffic data of the current period to obtain a traffic feature matrix. The traffic feature matrix includes a feature vector corresponding to each domain name system response packet, which is used to indicate the traffic behavior of the domain name system response packet. The traffic feature matrix is input into a detection model to obtain an output detection result. The detection model is obtained by training a convolutional neural network model based on a back propagation algorithm according to normal domain name system traffic data and domain name system amplification attack traffic data. The detection result represents the abnormality degree of the domain name system traffic data. If the detection result is greater than a threshold value, the domain name system traffic data of the current period has an amplification attack behavior, and an amplification attack defense strategy is started. The application improves the accuracy and detection efficiency of DNS amplification attack detection.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a method and apparatus for detecting DNS amplification attacks. Background Technology

[0002] With the popularization and development of the Internet, the methods and types of network attacks have become increasingly complex. Among them, DNS amplification attacks have become a typical form of distributed denial-of-service attack. DNS amplification attacks exploit the design flaws of the DNS protocol itself, allowing attackers to generate huge amounts of traffic without sending large amounts of data, making the attack more covert and efficient.

[0003] Existing solutions, such as firewalls, intrusion detection systems, and distributed denial-of-service (DDoS) defense systems, typically employ methods like traffic analysis, IP blacklists, and traffic limiting for detection and defense. These methods have limited effectiveness against DNS amplification attacks, especially when the attack traffic is massive, distributed, and highly covert; in such cases, the detection results are often unsatisfactory.

[0004] Therefore, improving the detection efficiency and accuracy of DNS amplification attacks is an urgent problem to be solved in the field of network security. Summary of the Invention

[0005] This invention provides a method for detecting DNS amplification attacks, which improves the accuracy and efficiency of DNS amplification attack detection by extracting deep features from traffic data and using a convolutional neural network model to perform in-depth analysis of the features of the traffic data.

[0006] In a first aspect, embodiments of the present invention provide a method for detecting DNS amplification attacks, including:

[0007] Domain Name System (DNS) traffic data is periodically acquired, and features are extracted from the DNS traffic data of the current period to obtain a traffic feature matrix for the current period. The DNS traffic data includes at least one DNS response packet, and the traffic feature matrix includes feature vectors corresponding to each DNS response packet in the DNS traffic data. The feature vectors corresponding to each DNS response packet are used to indicate the traffic behavior of the DNS response packet.

[0008] The traffic feature matrix of the current period is input into the detection model to obtain the detection result of the domain name system traffic data of the current period output by the detection model. The detection model is obtained by training a convolutional neural network model based on normal domain name system traffic data and domain name system amplification attack traffic data using the backpropagation algorithm. The detection result characterizes the degree of abnormality of the domain name system traffic data of the current period.

[0009] If the detection result of the Domain Name System (DNS) traffic data in the current period is greater than the threshold, then the DNS traffic data in the current period indicates an amplification attack, and the amplification attack defense strategy is activated.

[0010] The above technical solution filters Domain Name System (DNS) traffic data and periodically detects the acquired DNS traffic data. DNS traffic data includes at least one DNS response packet. Therefore, feature extraction of the DNS traffic data involves extracting features from at least one DNS response packet, resulting in a traffic feature matrix for the current period. This traffic feature matrix includes feature vectors corresponding to each DNS response packet in the DNS traffic data. The current period's traffic feature matrix is ​​input into the detection model, which analyzes the traffic behavior of each DNS response packet within the current period based on the feature vectors in the traffic feature matrix, producing the output detection result. The detection result characterizes the degree of anomaly in the DNS traffic data for the current period. Therefore, determining whether the detection result exceeds a threshold determines whether amplification attack behavior exists in the DNS traffic data for the current period. If the detection result exceeds the threshold, indicating amplification attack behavior in the DNS traffic data for the current period, an amplification attack defense strategy is activated. By extracting deep features from traffic data and using a convolutional neural network model to perform in-depth analysis of these features, the accuracy and efficiency of DNS amplification attack detection are improved.

[0011] Optionally, feature extraction is performed on the Domain Name System (DNS) traffic data for the current period to obtain a traffic feature matrix for the current period, including:

[0012] Based on the DNS response packets in the DNS traffic data of the current period, determine the response packet information and traffic statistics information; the response packet information includes one or more of the following: payload size of each DNS response packet, number of response records, number of extra records, time to live, whether fragmentation is used, whether expansion is used, source IP address, destination IP address, source port number, destination port number, and UDP checksum result; the traffic statistics information includes one or more of the following: total DNS traffic per unit time, number of DNS response packets per unit time, number of requests per second, and response packet size per second;

[0013] Feature extraction and quantification are performed on the response packet information and traffic statistics information to obtain feature vectors corresponding to each DNS response packet. The feature vectors corresponding to each DNS response packet include one or more of the following: normalized payload size, number of response records, number of extra records, time to live, interaction frequency between the source IP address and the target IP address of the DNS response packet, number of DNS response packets received within the target IP address period of the DNS response packet, frequency of change of the target port number of the DNS response packet, number of source IP addresses of the DNS response packets received within the target IP address period of the DNS response packet, total DNS traffic per unit time, number of DNS response packets per unit time, ratio of query number to response number within the target IP address period of the DNS response packet, and binarized DNS response packet: whether it is fragmented, whether it is expanded, UDP check result, and whether the source IP address has changed.

[0014] Using the response packets of each domain name system as rows and the dimension of the feature vector of each domain name system response packet as columns, construct the traffic feature matrix for the current period.

[0015] In the above technical solution, by extracting features from the response packets of each domain name system and quantifying them to form a traffic feature matrix, the domain name system traffic data is converted into a form suitable for input to the convolutional neural network model, thereby improving the detection model's ability to identify amplified attack traffic.

[0016] Optionally, after determining the response packet information and traffic statistics information, the method further includes:

[0017] The response packet information and the traffic statistics information are converted into JSON format or structured data format.

[0018] Optionally, the detection model is obtained by training a convolutional neural network model using the backpropagation algorithm on normal DNS traffic data and DNS amplification attack traffic data, including:

[0019] Obtain normal Domain Name System (DNS) traffic data and DNS amplification attack traffic data;

[0020] The normal DNS traffic data and the DNS amplified attack traffic data are respectively subjected to feature extraction to obtain a training set. The training set includes a first traffic feature matrix with amplified attack behavior and a normal second traffic feature matrix.

[0021] The first traffic feature matrix and the second traffic feature matrix are respectively input into the convolutional neural network model to obtain the first detection result and the second detection result;

[0022] Based on the error between the first detection result and the amplified attack detection result and the error between the second detection result and the normal detection result, the parameters in the convolutional neural network model are optimized and iterated until the error converges to obtain the detection model.

[0023] In the above technical solution, the detection model is obtained by iteratively optimizing the parameters of the convolutional neural network model, thereby improving the detection model's ability to detect amplification attacks. Furthermore, by performing multi-level and multi-angle analysis of domain name system traffic data, the convolutional neural network model can more accurately identify genuine attack behavior, reduce the misclassification of normal business traffic as attacks, and improve the accuracy of amplification attack detection.

[0024] Optionally, the amplification attack defense strategy includes one or more of the following: discarding malicious DNS response packets in the DNS traffic data of the current period, limiting the request frequency of specific IP addresses, adding malicious IPs to the blacklist, and adjusting the DNS query rate threshold.

[0025] Optionally, the method further includes:

[0026] Obtain DNS amplification attack traffic data, traffic feature matrices for each period, and detection results;

[0027] The detection model is iteratively optimized based on the domain name system amplified attack traffic data, the traffic feature matrix of each period, and the detection results to obtain an updated detection model.

[0028] In the above technical solution, the detection model parameters are dynamically adjusted based on the domain name system amplified attack traffic data and the domain name system traffic data detected daily. The detection capability of the detection model is continuously improved through incremental learning, enabling the system to adapt to constantly changing attack methods.

[0029] Secondly, embodiments of the present invention provide a detection device for DNS amplification attacks, comprising:

[0030] The acquisition module is used to periodically acquire Domain Name System (DNS) traffic data and extract features from the DNS traffic data of the current period to obtain a traffic feature matrix for the current period. The DNS traffic data includes at least one DNS response packet. The traffic feature matrix includes feature vectors corresponding to each DNS response packet in the DNS traffic data. The feature vectors corresponding to each DNS response packet are used to indicate the traffic behavior of the DNS response packet.

[0031] The processing module is used to input the traffic feature matrix of the current period into the detection model and obtain the detection result of the domain name system traffic data of the current period output by the detection model. The detection model is obtained by training a convolutional neural network model based on normal domain name system traffic data and domain name system amplification attack traffic data using the backpropagation algorithm. The detection result characterizes the degree of abnormality of the domain name system traffic data of the current period.

[0032] If the detection result of the Domain Name System (DNS) traffic data in the current period is greater than the threshold, then the DNS traffic data in the current period indicates an amplification attack, and the amplification attack defense strategy is activated.

[0033] Optionally, the processing module is specifically used for:

[0034] Based on the DNS response packets in the DNS traffic data of the current period, determine the response packet information and traffic statistics information; the response packet information includes one or more of the following: payload size of each DNS response packet, number of response records, number of extra records, time to live, whether fragmentation is used, whether expansion is used, source IP address, destination IP address, source port number, destination port number, and UDP checksum result; the traffic statistics information includes one or more of the following: total DNS traffic per unit time, number of DNS response packets per unit time, number of requests per second, and response packet size per second;

[0035] Feature extraction and quantification are performed on the response packet information and traffic statistics information to obtain feature vectors corresponding to each DNS response packet. The feature vectors corresponding to each DNS response packet include one or more of the following: normalized payload size, number of response records, number of extra records, time to live, interaction frequency between the source IP address and the target IP address of the DNS response packet, number of DNS response packets received within the target IP address period of the DNS response packet, frequency of change of the target port number of the DNS response packet, number of source IP addresses of the DNS response packets received within the target IP address period of the DNS response packet, total DNS traffic per unit time, number of DNS response packets per unit time, ratio of query number to response number within the target IP address period of the DNS response packet, and binarized DNS response packet: whether it is fragmented, whether it is expanded, UDP check result, and whether the source IP address has changed.

[0036] Using the response packets of each domain name system as rows and the dimension of the feature vector of each domain name system response packet as columns, construct the traffic feature matrix for the current period.

[0037] Optionally, the processing module is further configured to:

[0038] The response packet information and the traffic statistics information are converted into JSON format or structured data format.

[0039] Optionally, the processing module is specifically used for:

[0040] Obtain normal Domain Name System (DNS) traffic data and DNS amplification attack traffic data;

[0041] The normal DNS traffic data and the DNS amplified attack traffic data are respectively subjected to feature extraction to obtain a training set. The training set includes a first traffic feature matrix with amplified attack behavior and a normal second traffic feature matrix.

[0042] The first traffic feature matrix and the second traffic feature matrix are respectively input into the convolutional neural network model to obtain the first detection result and the second detection result;

[0043] Based on the error between the first detection result and the amplified attack detection result and the error between the second detection result and the normal detection result, the parameters in the convolutional neural network model are optimized and iterated until the error converges to obtain the detection model.

[0044] Optionally, the amplification attack defense strategy includes one or more of the following: discarding malicious DNS response packets in the DNS traffic data of the current period, limiting the request frequency of specific IP addresses, adding malicious IPs to the blacklist, and adjusting the DNS query rate threshold.

[0045] Optionally, the processing module is further configured to:

[0046] Obtain DNS amplification attack traffic data, traffic feature matrices for each period, and detection results;

[0047] The detection model is iteratively optimized based on the domain name system amplified attack traffic data, the traffic feature matrix of each period, and the detection results to obtain an updated detection model.

[0048] Thirdly, embodiments of the present invention also provide a computer device, comprising:

[0049] Memory, used to store program instructions;

[0050] The processor is used to call the program instructions stored in the memory and execute the above-described method for detecting DNS amplification attacks according to the obtained program.

[0051] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing computer-executable instructions for causing a computer to execute the aforementioned method for detecting DNS amplification attacks.

[0052] Fifthly, embodiments of the present invention also provide a computer program product, the computer program product including an executable program, which is executed by a processor to perform the above-described method for detecting DNS amplification attacks. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 A schematic diagram of a system architecture provided for an embodiment of the present invention;

[0055] Figure 2 A flowchart illustrating a method for detecting DNS amplification attacks provided in an embodiment of the present invention;

[0056] Figure 3 This is a schematic diagram of a DNS amplification attack detection device provided in an embodiment of the present invention. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0058] The application scenarios described in this application are for the purpose of more clearly illustrating the technical solutions protected by the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will understand that with the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems. The terms "first" and "second" in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. In the description of this application, unless otherwise stated, "multiple" means two or more.

[0059] Before introducing the DNS amplification attack detection method provided in the embodiments of this application, for ease of understanding, the terms and background technology involved in the embodiments of this application will be introduced below.

[0060] Windows Filtering Platform (WFP) is a core network and security framework in the Windows operating system that provides functionality for handling network packet filtering and flow control.

[0061] Convolutional Neural Network (CNN): A deep learning model primarily used for tasks such as image data classification, detection, and segmentation, but it can also be used for the analysis of other two-dimensional data (such as speech signals, video, etc.).

[0062] Distributed Denial of Service (DDoS) is a type of network attack where attackers use multiple distributed devices (usually controlled botnets) to send large amounts of malicious traffic to a target server or network device, causing the target resources to become overloaded and unable to provide normal services.

[0063] Domain Name System (DNS): A distributed naming system used to translate domain names into IP addresses, allowing people to access websites through easy-to-remember domain names instead of having to remember complex numerical IP addresses.

[0064] One-Dimensional Convolution (Conv1D): This is a core layer in CNN (Convolutional Neural Network). It uses a sliding window (Filter) to perform sliding convolution operations on the traffic feature vector to extract temporal features, behavioral patterns, and anomalous mutation features from the traffic sequence.

[0065] Fully Connected Layer (FC): This is the basic layer in a neural network, where each neuron is connected to all neurons in the previous layer. It is typically used for feature fusion and final classification, mapping features extracted from previous layers to specific output categories or regression values.

[0066] Max Pooling in One Dimension (MaxPooling1D) is a commonly used pooling operation in deep learning, primarily used to process one-dimensional data (such as time series, text data, or one-dimensional feature vectors). Its function is to downsample the input data, thereby reducing the dimensionality of the data while retaining important feature information.

[0067] The following problems exist in existing network security technologies:

[0068] 1) Limitations of traditional DNS amplification attack defense techniques

[0069] Traditional firewalls and intrusion detection systems (IDS) primarily rely on rule matching for attack detection, making them ill-equipped to handle evolving DNS amplification attack patterns. These methods are poorly adaptable to new attack methods and have a high false positive rate, impacting normal business traffic.

[0070] 2) Defense methods based on traffic feature matching are difficult to accurately detect DNS amplification attacks.

[0071] Existing defense systems typically detect attacks by statistically analyzing specific traffic characteristics (such as packet size and request frequency), but DNS amplification attackers can forge legitimate traffic patterns to bypass detection, resulting in attacks not being detected and intercepted in a timely manner.

[0072] 3) Lack of real-time and automated defense capabilities

[0073] Traditional defense methods rely on manual analysis and intervention, resulting in slow response times and difficulty in timely blocking DNS amplification attacks. Existing systems lack intelligent real-time detection and automatic defense mechanisms, making it difficult to respond quickly to large-scale attack outbreaks.

[0074] 4) Lack of dynamic learning and adaptive capabilities

[0075] Most existing DNS amplification attack defense systems rely on static rules or fixed models for detection, which cannot dynamically adjust detection strategies according to new attack behaviors. They lack continuous optimization and adaptive capabilities, resulting in a decline in defense effectiveness over time.

[0076] Figure 1 An exemplary system architecture applicable to an embodiment of the present invention is illustrated. This system architecture includes a traffic capture module 110, a data preprocessing module 120, a model analysis module 130, a defense module 140, and an online learning and optimization module 150. This system architecture can be deployed on the DNS server side or the client side. This embodiment of the invention uses a system architecture deployed on the DNS server side as an example for illustration.

[0077] The traffic capture module 110 is used to periodically capture Domain Name System (DNS) traffic data from outbound traffic data and extract the required information from the DNS traffic data of the current period. For example, the Windows Filtering Platform (WFP) is used to capture DNS traffic data. WFP provides efficient network layer packet filtering capabilities, enabling real-time extraction of key information from the traffic, such as response packet information and traffic statistics, providing foundational data for subsequent analysis.

[0078] The data preprocessing module 120 is used to extract features and quantify the response packet information and traffic statistics information extracted by the traffic capture module 110, and construct the traffic feature matrix for the current period. The traffic feature matrix is ​​in a format suitable for the input of the convolutional neural network model, which can improve the convolutional neural network model's ability to identify amplified attack traffic.

[0079] The model analysis module 130 is used to input the traffic feature matrix of the current period constructed by the data preprocessing module 120 into the detection model to obtain the detection result. The detection model is obtained by training a convolutional neural network model based on the backpropagation algorithm using normal DNS traffic data and DNS amplification attack traffic data. It learns the pattern differences between normal DNS traffic and DNS amplification attack traffic, achieving efficient attack detection. For example, during detection, the detection model first extracts deep features from the traffic feature matrix through convolutional layers, performs feature dimensionality reduction using pooling layers, and then performs classification through fully connected layers, outputting an attack probability score.

[0080] The defense module 140 is used to initiate an amplification attack defense strategy based on WFP in the traffic capture module 110 when the detection result obtained by the model analysis module 130 is greater than the threshold.

[0081] The online learning and optimization module 150 is used for adaptive learning and optimization of the detection model. It updates the detection model based on the latest DNS amplification attack traffic data, traffic feature matrices from each system runtime period, and detection results. Through incremental learning and dynamic adjustment of detection parameters, it improves the system's ability to detect new DNS amplification attacks, ensuring the continued effectiveness of defense strategies.

[0082] It should be noted that the above Figure 1 The structure shown is merely an example, and the embodiments of the present invention are not limited thereto.

[0083] Based on the above description Figure 2 An exemplary flowchart of a DNS amplification attack detection method provided by an embodiment of the present invention is shown. This process can be executed by a DNS amplification attack detection device.

[0084] like Figure 2 As shown, the process specifically includes:

[0085] Step 210: Periodically acquire Domain Name System (DNS) traffic data and extract features from the DNS traffic data of the current period to obtain a traffic feature matrix for the current period. The DNS traffic data includes at least one DNS response packet. The traffic feature matrix includes feature vectors corresponding to each DNS response packet in the DNS traffic data. The feature vectors corresponding to each DNS response packet are used to indicate the traffic behavior of the DNS response packet.

[0086] In this embodiment of the invention, it is first necessary to periodically acquire Domain Name System (DNS) traffic data. The acquisition period is a value set based on experience, for example, a period of 2 seconds or 3 seconds, meaning that DNS traffic data from the previous two or three seconds is acquired every two or three seconds. For example, on the Windows platform, traffic capture is performed on UDP port 53 using the WFP kernel filter driver. The FWPM_LAYER_INBOUND_TRANSPORT_V4 layer is selected for outbound UDP traffic capture, and the UDP protocol (protocol number 17) is monitored, with the target port number being 53.

[0087] Then, feature extraction is performed on the DNS traffic data for the current period to obtain the traffic feature matrix for the current period. The obtained DNS traffic data for the current period includes at least one DNS response packet. Therefore, feature extraction on the DNS traffic data for the current period is equivalent to feature extraction on at least one DNS response packet. Specifically, based on the message of each DNS response packet in the DNS traffic data for the current period, response packet information and traffic statistics are determined. For example, after WFP captures DNS traffic that matches the filtering rules, a callback function is triggered to extract key information from the FWPS_INCO MING_METADATA_VALUES0 structure. The response packet information includes one or more of the following:

[0088] The payload size of response packets from each domain name system: that is, the UDP payload size. The response packets in amplified attack traffic will be abnormally large (usually >512B).

[0089] The number of response records in the response packets of each domain name system: that is, the response ANCOUNT. A large number of ANY queries will return a high ANCOUNT.

[0090] The number of extra records in the response packets of each domain name system: The response ARCOUNT indicates that an amplification attack may contain a large number of extra records;

[0091] Time to Live (TTL) of response packets in each domain name system: The TTL value of a DNS record may be set to an abnormally long time (caching pollution) or a short time (to evade detection) during an amplification attack.

[0092] Whether the response packets of each domain name system are fragmented: that is, whether they are fragmented by the IP layer. Large response data packets may require IP fragmentation.

[0093] Whether the response packets of each domain name system are expanded: that is, whether EDNS0 is used. Amplification attacks usually use ED NS0 expansion to send larger response packets;

[0094] The source IP address of each domain name system response packet: that is, the server IP. During an amplification attack, there may be multiple different DNS servers.

[0095] The target IP address of each domain name system response packet: that is, the client IP, which is the victim IP when an amplification attack occurs, and the attack target IP (usually the same IP is continuously attacked);

[0096] The source port number of each domain name system response packet: that is, the port on which the DNS server returns data, typically 53;

[0097] The target port number of each domain name system response packet: that is, the port on which the client receives data. When an amplification attack occurs, this is the victim port. The UDP port may be random.

[0098] The UDP verification result of each domain name system response packet: that is, whether the UDP verification passed or failed. Forged traffic may fail the verification.

[0099] It is understandable that response packets from DNS amplification attacks typically have large response packets, extremely long TTLs, and high ANCOUNT / ARCOUNT. Some attacks may exploit the characteristics of EDNS0 extensions. At the IP layer, they typically exhibit features such as random changes in the victim's IP port, a large number of IP fragments, and abnormally high UDP traffic. Therefore, the focus is on collecting the above data.

[0100] Traffic statistics include one or more of the following:

[0101] Domain Name System (DNS) traffic per unit time: This refers to the DNS traffic received by each client IP per second. When an amplification attack occurs, the DNS traffic received by the victim IP per second will surge in a short period of time.

[0102] Number of DNS response packets per unit of time: that is, the number of DNS response packets received by each client IP per second. When an amplification attack occurs, the number of DNS response packets received by the victim IP per second will be very large.

[0103] Requests per second: This refers to the frequency of requests initiated by the same source IP to the same destination IP.

[0104] Response packet size per second: Detects abnormally high traffic responses.

[0105] It is understandable that DNS amplification attacks typically involve a large number of DNS response traffic in a short period of time, far exceeding the number of normal requests, and the source IP is often variable. Therefore, the above data is the focus of our collection.

[0106] In some embodiments, after obtaining the response packet information and traffic statistics information, the response packet information and traffic statistics information are converted into JSON format or structured data format so that the data can be subsequently extracted and quantified.

[0107] Then, features are extracted and quantified from the response packet information and traffic statistics to obtain feature vectors corresponding to the response packets of each domain name system. When quantifying the features, two methods are used: normalization and binarization. For example, Min-Max normalization is used to unify the data to the range [0,1], and the specific formula used is as follows:

[0108]

[0109] Where X is a characteristic value of the current response packet (e.g., the size of the DNS response packet); X min X is the minimum value of the current feature across the entire dataset; max X is the maximum value of the current feature across the entire dataset; dst The value is the normalized value (range: [0,1]).

[0110] Binarization is a numerical transformation method in data preprocessing. By setting features to convert them into binary values ​​(0 or 1), it simplifies the data structure and computational complexity. For example, in this application, it is set as follows: "will" is set to 1, and "not" is set to 0.

[0111] The feature vectors corresponding to the response packets of each domain name system include one or more of the following:

[0112] Normalized load size;

[0113] Normalized number of response records;

[0114] The number of additional records after normalization;

[0115] Normalized survival time;

[0116] The frequency of interaction between the source IP address and the destination IP address in the normalized domain name system response packet;

[0117] The number of DNS response packets received by the target IP address of the normalized DNS response packet within a given period;

[0118] The frequency of change of the target port number in the normalized domain name system response packets;

[0119] The number of source IP addresses of the DNS response packets received within the target IP address period of the normalized DNS response packet;

[0120] Normalized total DNS traffic per unit time;

[0121] The normalized number of Domain Name System (DNS) response packets per unit time;

[0122] The ratio of the number of queries to the number of responses to the target IP address of the normalized domain name system response packet within a given period;

[0123] Whether the binarized domain name system response packet is fragmented;

[0124] Whether the binarized domain name system response packet is expanded;

[0125] The UDP verification result of the binarized domain name system response packet;

[0126] Does the source IP address of the binarized DNS response packet change? That is, is the source IP address of the current DNS response packet different from that of the previous DNS response packet?

[0127] It is understandable that standardizing and quantifying numerical features can significantly eliminate the differences between different feature dimensions, thereby improving the stability and convergence speed of GNN model training and detection.

[0128] Finally, using each DNS response packet as its rows and the dimension of its feature vector as its columns, a traffic feature matrix for the current period is constructed. For example, a traffic feature matrix of shape (N, F) is constructed as follows:

[0129]

[0130] Where X represents the value of each feature vector, N represents the number of DNS response packets within a period, and F represents the dimension of the feature vector for each DNS response packet. It can be understood that each row in the traffic feature matrix represents a DNS response packet, and each column represents a feature vector of one dimension.

[0131] It is understandable that standardizing and quantifying the extracted information, and converting the traffic data into a matrix format suitable for CNN processing, can improve the quality of the data and enhance the accuracy of CNN models in detecting anomalies in DNS amplification attacks.

[0132] Step 220: Input the traffic feature matrix of the current period into the detection model to obtain the detection result of the domain name system traffic data of the current period output by the detection model. The detection model is obtained by training a convolutional neural network model based on normal domain name system traffic data and domain name system amplification attack traffic data using the backpropagation algorithm. The detection result characterizes the degree of abnormality of the domain name system traffic data of the current period.

[0133] In this embodiment of the invention, after obtaining the traffic feature matrix for the current period, the traffic feature matrix is ​​input into the detection model, and then the detection model outputs the detection result of the DNS traffic data for the current period. The detection model is obtained by training a convolutional neural network model based on the backpropagation algorithm using normal DNS traffic data and DNS amplification attack traffic data. During detection, the detection model extracts deep features of DNS traffic through convolutional layers, performs feature dimensionality reduction using pooling layers, and classifies the data through fully connected layers, finally obtaining the output result. The detection result characterizes the degree of anomaly in the DNS traffic data for the current period. The specific model detection process is as follows:

[0134] One-dimensional convolutional layer processing: The goal of graph convolutional layers is to extract time-series features and capture traffic behavior patterns, enhancing feature representation capabilities. Since DNS traffic data is arranged chronologically, Conv1D can extract short-term traffic behavior changes, such as abnormal request frequency and traffic spikes, through a sliding window. Conv1D, through multiple convolutions (Filters), can extract DNS traffic features from different perspectives, such as traffic size distribution, IP address distribution, and query frequency patterns, improving the model's detection capabilities. The specific formula used is as follows:

[0135]

[0136] Where W(j) is the weight parameter of the j-th convolutional kernel, X(i+j) is the 15-dimensional feature vector of the (i+j)-th DNS response packet, F is the kernel size, b is the bias term, and Y(i) is the feature value output at the i-th position.

[0137] The specific steps for processing a one-dimensional convolutional layer are as follows:

[0138] 1. Set the Conv1D kernel size to (3,15), perform a sliding window on the 15-dimensional features, with 3 response packets as one window, and extract time series features;

[0139] 2. With a step size of 1, slide one packet at a time to ensure the continuity of feature extraction and capture changes in traffic behavior within a short period of time;

[0140] 3. The number of channels is 64. 64 different attack mode features are extracted through 64 different convolution kernels (each convolution kernel will output a new feature vector, so the final output has 64 channels).

[0141] 4. Output shape calculation: The original input length is N response packets, the convolution kernel size F = 3, and the stride s = 1. The length of the sequence after convolution is N-2. Since there are 64 convolution kernels, the final output shape is (N-2, 64).

[0142] Pooling layer processing: Max Pooling (MaxPooling1D) is used to reduce the feature dimension, improve computational efficiency, and retain the most critical attack mode information. The final output is a dimensionality-reduced feature matrix (size (N-2) / 2*64), which retains the key features in the input data and reduces the amount of computation and the risk of overfitting.

[0143] The specific pooling layer processing steps are as follows:

[0144] 1. Input the shape (N-2, 64) obtained in the previous step into the pooling layer for processing;

[0145] 2. Set the pooling window size to 2, perform pooling on two adjacent time steps, and extract the maximum value;

[0146] 3. Set the step size to 2, and slide 2 time steps each time to halve the output length.

[0147] 4. Perform max pooling by sliding the window sequentially until the entire sequence has been traversed.

[0148] The steps for processing a fully connected layer are as follows:

[0149] 1. Flattening the input data: Reduce the dimension of the matrix of size (N-2) / 2*64 to a one-dimensional vector with a length of...

[0150] 2. Linear Transformation Processing: A linear transformation is performed on the flattened data to combine all extracted local features into a global feature, which is then mapped to the final output category. The formula used is as follows:

[0151] Z = W fc ·X fc +b fc

[0152] Among them, W fc Let X be the weight matrix. fc b is the feature vector after flattening in step 1. fc Z is the bias term, and Z is the weighted sum of the fully connected layers after linear transformation;

[0153] 3. Sigmoid Classification: The Sigmoid activation function is used to achieve binary classification (normal traffic / DNS amplification attack). The Sigmoid function is as follows:

[0154]

[0155] Where Z is the weighted sum of the fully connected layers after the linear transformation obtained in the previous step, and X is the flattened feature vector from the previous step. P(y=1|X) is the output detection result. The Sigmoid output result P(y=1|X) represents the probability that the traffic belongs to a DNS amplification attack. The value of P(y=1|X) ranges between (0,1) and represents the model's classification confidence score for the current traffic data.

[0156] If P(y=1|X) is close to 1, it is predicted to be a DNS amplification attack; if P(y=1|X) is close to 0, it is predicted to be normal traffic.

[0157] In one possible implementation, the detection model is trained by acquiring normal DNS traffic data and DNS amplification attack traffic data. The normal DNS traffic data can be obtained from daily data; the DNS amplification attack traffic data can be negative DNS samples published by Cloudflare Security Center, Akamai Security Insights, or Arbor Networks Security Reports. Features are extracted from both the normal DNS traffic data and the DNS amplification attack traffic data to obtain a training set. The training set includes a first traffic feature matrix exhibiting amplification attack behavior and a second normal traffic feature matrix. The methods for feature extraction and constructing the traffic feature matrices are the same as in step 210 and will not be elaborated here. Then, the first and second traffic feature matrices are input into a convolutional neural network model to obtain a first detection result and a second detection result. Based on the error between the first detection result and the amplification attack detection result, and the error between the second detection result and the normal detection result, the parameters in the convolutional neural network model are optimized iteratively until the error converges, thus obtaining the detection model. For example, for any traffic feature matrix, the traffic feature matrix is ​​input into a convolutional neural network model, passing through convolutional layers, pooling layers, and fully connected layers, and finally the detection result is calculated using the Sigmoid function. Then, the error between the detection result and the true label (whether it is amplified attack traffic) is measured by binary cross-entropy. The gradient is then calculated and the parameters of the convolutional neural network model are updated. The above steps are repeated until the error converges, and the detection model is obtained.

[0158] Step 230: If the detection result of the Domain Name System (DNS) traffic data in the current period is greater than the threshold, then the DNS traffic data in the current period has amplification attack behavior, and the amplification attack defense strategy is activated.

[0159] In this embodiment of the invention, after obtaining the detection result from the detection model, since the detection result represents the degree of abnormality of the Domain Name System (DNS) traffic data in the current period, it is necessary to determine the magnitude of the detection result and whether it exceeds a threshold. The threshold can be a preset value based on experience; for example, a threshold of 0.5. When the detection result is greater than 0.5, it is considered that the DNS traffic data in the current period exhibits amplified attack behavior; when the detection result is not greater than 0.5, it is considered that the DNS traffic data in the current period does not exhibit amplified attack behavior. No specific limitation is made to the threshold here.

[0160] If the detected DNS traffic data for the current period exceeds a threshold, an amplification attack defense strategy is activated. This strategy includes one or more of the following: discarding malicious DNS response packets from the current period's DNS traffic data, limiting the request frequency of specific IP addresses, adding malicious IPs to a blacklist, and adjusting the DNS query rate threshold.

[0161] In one possible implementation, the detection model is periodically updated. Based on newly captured data and continuously crawled negative samples of the latest official DNS amplification attacks, the CNN model parameters are dynamically optimized. Through incremental learning, the detection capability is continuously improved, enabling the system to adapt to constantly changing attack methods. Specifically, DNS amplification attack traffic data, traffic feature matrices for each period, and detection results are acquired. The traffic feature matrices and detection results for each period are obtained from daily detection; the DNS amplification attack traffic data are DNS negative samples periodically crawled from Cloudflare Security Center, Akamai Security Insights, and Arbor Networks security reports. The detection model is iteratively optimized based on the DNS amplification attack traffic data, the traffic feature matrices for each period, and the detection results to obtain an updated detection model. For example, after obtaining the DNS negative samples, feature extraction is performed to obtain the negative sample traffic feature matrix. First, forward propagation is performed: the negative sample traffic feature matrix and the traffic feature matrices for each period are input into the detection model, passing through convolutional layers, pooling layers, and fully connected layers. Finally, the attack probability, i.e., the detection result, is calculated using the Sigmoid function. Then, the loss is calculated: the error between the attack probability and the true label (i.e., whether it is an amplification attack) is measured using binary cross-entropy. Next, backpropagation is performed: the gradient is calculated and the parameters W (the weight matrix of the fully connected layer) and b (the bias term of the fully connected layer) are updated. Finally, iterative optimization is performed: the above steps are repeated until the loss function converges, the model learns the optimal DNS amplification attack detection capability, and the detection model is updated.

[0162] In this embodiment of the invention, unlike traditional methods that rely on manually formulated rules, CNN can automatically extract complex features from large amounts of data, making it more adaptable to unknown or complex attack patterns. By analyzing traffic data at multiple levels and from multiple angles, CNN can more accurately identify genuine attack behaviors and reduce the misclassification of normal business traffic as attacks. This helps reduce the false positive rate and ensures the smooth operation of normal business. Furthermore, by capturing DNS traffic data through WFP and using CNN for deep feature extraction, accurate identification of complex DNS amplification attack traffic is achieved. CNN is used to identify time-series features and request-response patterns in the traffic, improving detection accuracy and reducing the false positive rate. The CNN model can classify traffic data in real time. Once a DNS amplification attack is detected, the system will automatically trigger defense strategies (such as discarding malicious traffic and limiting the frequency of abnormal requests), reducing reliance on manual intervention and improving response speed and defense efficiency. This system supports online learning and can dynamically adjust CNN model parameters and optimize WFP filtering rules according to new DNS amplification attack patterns. Incremental learning continuously improves detection capabilities, enabling the system to adapt to constantly changing attack methods. Traffic capture and filtering based on WFP requires no additional hardware, reducing deployment costs. It is suitable for various network security environments, such as enterprise networks, cloud platforms, and ISP networks, and can effectively address security threats posed by DNS amplification attacks. Furthermore, it combines deep learning to automatically detect attack traffic, reducing the workload of manual analysis and maintenance, and improving overall defense efficiency.

[0163] Based on the same technological concept Figure 3 An exemplary schematic diagram of a DNS amplification attack detection device provided in an embodiment of the present invention is shown. This device can execute the process of a DNS amplification attack detection method.

[0164] like Figure 3 As shown, the device specifically includes:

[0165] The acquisition module 310 is used to periodically acquire Domain Name System (DNS) traffic data and extract features from the DNS traffic data of the current period to obtain a traffic feature matrix of the current period. The DNS traffic data includes at least one DNS response packet. The traffic feature matrix includes feature vectors corresponding to each DNS response packet in the DNS traffic data. The feature vectors corresponding to each DNS response packet are used to indicate the traffic behavior of the DNS response packet.

[0166] The processing module 320 is used to input the traffic feature matrix of the current period into the detection model to obtain the detection result of the domain name system traffic data of the current period output by the detection model. The detection model is obtained by training a convolutional neural network model based on normal domain name system traffic data and domain name system amplification attack traffic data using the backpropagation algorithm. The detection result characterizes the degree of abnormality of the domain name system traffic data of the current period.

[0167] If the detection result of the Domain Name System (DNS) traffic data in the current period is greater than the threshold, then the DNS traffic data in the current period indicates an amplification attack, and the amplification attack defense strategy is activated.

[0168] Optionally, the processing module 320 is specifically used for:

[0169] Based on the DNS response packets in the DNS traffic data of the current period, determine the response packet information and traffic statistics information; the response packet information includes one or more of the following: payload size of each DNS response packet, number of response records, number of extra records, time to live, whether fragmentation is used, whether expansion is used, source IP address, destination IP address, source port number, destination port number, and UDP checksum result; the traffic statistics information includes one or more of the following: total DNS traffic per unit time, number of DNS response packets per unit time, number of requests per second, and response packet size per second;

[0170] Feature extraction and quantification are performed on the response packet information and traffic statistics information to obtain feature vectors corresponding to each DNS response packet. The feature vectors corresponding to each DNS response packet include one or more of the following: normalized payload size, number of response records, number of extra records, time to live, interaction frequency between the source IP address and the target IP address of the DNS response packet, number of DNS response packets received within the target IP address period of the DNS response packet, frequency of change of the target port number of the DNS response packet, number of source IP addresses of the DNS response packets received within the target IP address period of the DNS response packet, total DNS traffic per unit time, number of DNS response packets per unit time, ratio of query number to response number within the target IP address period of the DNS response packet, and binarized DNS response packet: whether it is fragmented, whether it is expanded, UDP check result, and whether the source IP address has changed.

[0171] Using the response packets of each domain name system as rows and the dimension of the feature vector of each domain name system response packet as columns, construct the traffic feature matrix for the current period.

[0172] Optionally, the processing module 320 is further configured to:

[0173] The response packet information and the traffic statistics information are converted into JSON format or structured data format.

[0174] Optionally, the processing module 320 is specifically used for:

[0175] Obtain normal Domain Name System (DNS) traffic data and DNS amplification attack traffic data;

[0176] The normal DNS traffic data and the DNS amplified attack traffic data are respectively subjected to feature extraction to obtain a training set. The training set includes a first traffic feature matrix with amplified attack behavior and a normal second traffic feature matrix.

[0177] The first traffic feature matrix and the second traffic feature matrix are respectively input into the convolutional neural network model to obtain the first detection result and the second detection result;

[0178] Based on the error between the first detection result and the amplified attack detection result and the error between the second detection result and the normal detection result, the parameters in the convolutional neural network model are optimized and iterated until the error converges to obtain the detection model.

[0179] Optionally, the amplification attack defense strategy includes one or more of the following: discarding malicious DNS response packets in the DNS traffic data of the current period, limiting the request frequency of specific IP addresses, adding malicious IPs to the blacklist, and adjusting the DNS query rate threshold.

[0180] Optionally, the processing module 320 is further configured to:

[0181] Obtain DNS amplification attack traffic data, traffic feature matrices for each period, and detection results;

[0182] The detection model is iteratively optimized based on the domain name system amplified attack traffic data, the traffic feature matrix of each period, and the detection results to obtain an updated detection model.

[0183] Based on the same technical concept, embodiments of the present invention also provide a computer device, including:

[0184] Memory, used to store program instructions;

[0185] The processor is used to call the program instructions stored in the memory and execute the above-mentioned DNS amplification attack detection method according to the obtained program.

[0186] Based on the same technical concept, embodiments of the present invention also provide a computer-readable storage medium storing computer-executable instructions for causing a computer to execute the aforementioned method for detecting DNS amplification attacks.

[0187] Based on the same technical concept, this invention also provides a computer program product, characterized in that the computer program product includes an executable program, which is executed by a processor to perform the above-described method for detecting DNS amplification attacks.

[0188] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0189] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0190] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0191] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1The steps of the function specified in one or more boxes.

[0192] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for detecting DNS amplification attacks, characterized in that, include: Domain Name System (DNS) traffic data is periodically acquired, and features are extracted from the DNS traffic data of the current period to obtain a traffic feature matrix for the current period. The DNS traffic data includes at least one DNS response packet, and the traffic feature matrix includes feature vectors corresponding to each DNS response packet in the DNS traffic data. The feature vectors corresponding to each DNS response packet are used to indicate the traffic behavior of the DNS response packet. The traffic feature matrix of the current period is input into the detection model to obtain the detection result of the domain name system traffic data of the current period output by the detection model. The detection model is obtained by training a convolutional neural network model based on normal domain name system traffic data and domain name system amplification attack traffic data using the backpropagation algorithm. The detection model includes a one-dimensional convolutional layer, a pooling layer and a fully connected layer. The detection model is used to extract the temporal features and behavioral patterns of domain name system traffic through the one-dimensional convolutional layer, perform feature dimensionality reduction by combining the pooling layer, and perform classification by the fully connected layer to obtain the output result. The detection result characterizes the degree of abnormality of the domain name system traffic data of the current period. If the detection result of the Domain Name System (DNS) traffic data in the current period is greater than the threshold, then the DNS traffic data in the current period shows amplification attack behavior, and the amplification attack defense strategy is activated. Feature extraction is performed on the Domain Name System (DNS) traffic data for the current period to obtain the traffic feature matrix for the current period, including: Based on the DNS response packets in the DNS traffic data of the current period, determine the response packet information and traffic statistics information; the response packet information includes one or more of the following: payload size of each DNS response packet, number of response records, number of extra records, time to live, whether fragmentation is used, whether expansion is used, source IP address, destination IP address, source port number, destination port number, and UDP checksum result; the traffic statistics information includes one or more of the following: total DNS traffic per unit time, number of DNS response packets per unit time, number of requests per second, and response packet size per second; Feature extraction and quantification are performed on the response packet information and traffic statistics information to obtain feature vectors corresponding to each DNS response packet. The feature vectors corresponding to each DNS response packet include one or more of the following: normalized payload size, number of response records, number of extra records, time to live, interaction frequency between the source IP address and the target IP address of the DNS response packet, number of DNS response packets received within the target IP address period of the DNS response packet, frequency of change of the target port number of the DNS response packet, number of source IP addresses of the DNS response packets received within the target IP address period of the DNS response packet, total DNS traffic per unit time, number of DNS response packets per unit time, ratio of query number to response number within the target IP address period of the DNS response packet, and binarized DNS response packet: whether it is fragmented, whether it is expanded, UDP check result, and whether the source IP address has changed. Using the response packets of each domain name system as rows and the dimension of the feature vector of each domain name system response packet as columns, construct the traffic feature matrix for the current period.

2. The method as described in claim 1, characterized in that, After determining the response packet information and traffic statistics information, the method further includes: The response packet information and the traffic statistics information are converted into JSON format or structured data format.

3. The method as described in claim 1, characterized in that, The detection model is obtained by training a convolutional neural network model using the backpropagation algorithm on normal DNS traffic data and DNS amplification attack traffic data, including: Obtain normal Domain Name System (DNS) traffic data and DNS amplification attack traffic data; The normal DNS traffic data and the DNS amplified attack traffic data are respectively subjected to feature extraction to obtain a training set. The training set includes a first traffic feature matrix with amplified attack behavior and a normal second traffic feature matrix. The first traffic feature matrix and the second traffic feature matrix are respectively input into the convolutional neural network model to obtain the first detection result and the second detection result; Based on the error between the first detection result and the amplified attack detection result and the error between the second detection result and the normal detection result, the parameters in the convolutional neural network model are optimized and iterated until the error converges to obtain the detection model.

4. The method as described in claim 1, characterized in that, The amplification attack defense strategy includes one or more of the following: discarding malicious DNS response packets in the DNS traffic data of the current period, limiting the request frequency of specific IP addresses, adding malicious IPs to the blacklist, and adjusting the DNS query rate threshold.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: Obtain DNS amplification attack traffic data, traffic feature matrices for each period, and detection results; The detection model is iteratively optimized based on the domain name system amplified attack traffic data, the traffic feature matrix of each period, and the detection results to obtain an updated detection model.

6. A detection device for DNS amplification attacks, characterized in that, include: The acquisition module is used to periodically acquire Domain Name System (DNS) traffic data and extract features from the DNS traffic data of the current period to obtain a traffic feature matrix for the current period. The DNS traffic data includes at least one DNS response packet. The traffic feature matrix includes feature vectors corresponding to each DNS response packet in the DNS traffic data. The feature vectors corresponding to each DNS response packet are used to indicate the traffic behavior of the DNS response packet. The processing module is used to input the traffic feature matrix of the current period into the detection model, and obtain the detection result of the domain name system traffic data of the current period output by the detection model. The detection model is obtained by training a convolutional neural network model based on normal domain name system traffic data and domain name system amplification attack traffic data using the backpropagation algorithm. The detection model includes a one-dimensional convolutional layer, a pooling layer and a fully connected layer. The detection model is used to extract deep features of domain name system traffic through the one-dimensional convolutional layer, perform feature dimensionality reduction by combining the pooling layer, and perform classification by the fully connected layer to obtain the output result. The detection result characterizes the degree of abnormality of the domain name system traffic data of the current period. If the detection result of the Domain Name System (DNS) traffic data in the current period is greater than the threshold, then the DNS traffic data in the current period shows amplification attack behavior, and the amplification attack defense strategy is activated. Optionally, the processing module is specifically used for: Based on the DNS response packets in the DNS traffic data of the current period, determine the response packet information and traffic statistics information; the response packet information includes one or more of the following: payload size of each DNS response packet, number of response records, number of extra records, time to live, whether fragmentation is used, whether expansion is used, source IP address, destination IP address, source port number, destination port number, and UDP checksum result; the traffic statistics information includes one or more of the following: total DNS traffic per unit time, number of DNS response packets per unit time, number of requests per second, and response packet size per second; Feature extraction and quantification are performed on the response packet information and traffic statistics information to obtain feature vectors corresponding to each DNS response packet. The feature vectors corresponding to each DNS response packet include one or more of the following: normalized payload size, number of response records, number of extra records, time to live, interaction frequency between the source IP address and the target IP address of the DNS response packet, number of DNS response packets received within the target IP address period of the DNS response packet, frequency of change of the target port number of the DNS response packet, number of source IP addresses of the DNS response packets received within the target IP address period of the DNS response packet, total DNS traffic per unit time, number of DNS response packets per unit time, ratio of query number to response number within the target IP address period of the DNS response packet, and binarized DNS response packet: whether it is fragmented, whether it is expanded, UDP check result, and whether the source IP address has changed. Using the response packets of each domain name system as rows and the dimension of the feature vector of each domain name system response packet as columns, construct the traffic feature matrix for the current period.

7. A computer device, characterized in that, include: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions for causing a computer to perform the method according to any one of claims 1 to 5.

9. A computer program product, characterized in that, The computer program product includes an executable program that is executed by a processor to implement the method of any one of claims 1 to 5.

Images