Method and device for determining normal range of probability density of DNS response length

Abstract

The invention discloses a DNS response length probability density normal range determination method and device, and the method comprises the steps: carrying out the statistics of DNS response results of different sizes according to the byte granularity, and recording the number of packages of the size corresponding to each byte granularity, and obtaining a statistical result; determining an initial boundary and left side total package number and right side total package number of the initial boundary according to a statistical result; setting a proportion according to the left-side total package number and the right-side total package number, and dynamically adjusting the position of the initial boundary point according to the proportion; and converging the initial boundary point in a stable range through multiple times of sampling, and locking the initial boundary point to obtain a locked boundary point. Through the method provided by the invention, a locked boundary point can be determined, and the locked boundary point can be used for distinguishing normal DNS requests and potential attack traffic, so that the attack traffic of DNS amplification attacks can be intercepted more accurately.

Description

Technical Field

[0001] This application relates to the field of DNS amplification attack protection technology, specifically to a method and apparatus for determining the normal range of DNS response length probability density. Background Technology

[0002] DNS amplification attacks are a common type of distributed denial-of-service (DDoS) attack. They exploit the characteristics of the Domain Name System (DNS) to amplify attack traffic, thereby overwhelming the target server and causing service interruption.

[0003] The working principle of DNS amplification attacks is as follows:

[0004] Step 1: Forged Requests. The attacker impersonates the target victim's IP address and sends a large number of DNS query requests to publicly available DNS resolution servers;

[0005] Step 2: Amplification Effect. These queries are typically designed to request small inputs (e.g., a simple domain name lookup) but trigger DNS servers to return large response data (e.g., complete DNS records). This input-output asymmetry causes traffic to be "amplified."

[0006] Step 3: Traffic Flooding. A large number of amplified responses are sent to the spoofed IP address (i.e., the target server), exhausting the target's bandwidth or computing resources, making it unable to process legitimate requests.

[0007] This type of attack is prone to occur because DNS servers are open systems, and many are misconfigured, allowing anyone to query them, thus becoming tools for attackers. Furthermore, DNS queries lack an authentication process, meaning the DNS protocol itself doesn't need to verify the request's origin, making it easy for IP spoofing. Additionally, it has a high amplification factor; certain DNS records (such as ANY type requests) will return exceptionally large responses.

[0008] Existing DNS amplification attack protection methods mainly restrict the source of access. By limiting queries from trusted sources, they can be processed, or certain response results with amplification effects (such as ANY type queries) can be restricted. The disadvantage of these protection methods is that they are relatively rigid and cannot accurately intercept attack traffic. Summary of the Invention

[0009] To address this issue, this application provides a method and apparatus for determining the normal range of DNS response length probability density, thereby resolving the problem that existing DNS amplification attack protection methods cannot accurately intercept attack traffic.

[0010] To achieve the above objectives, this application provides the following technical solution:

[0011] Firstly, a method for determining the normal range of DNS response length probability density includes:

[0012] Step 1: Statistically analyze DNS response results of different sizes based on byte granularity, and record the number of packets corresponding to each byte granularity to obtain the statistical results;

[0013] Step 2: Determine the initial boundary based on the statistical results;

[0014] Step 3: Determine the total number of packages on the left and right sides of the initial boundary;

[0015] Step 4: Set a ratio based on the total number of packages on the left and the total number of packages on the right, and dynamically adjust the position of the initial boundary point according to the ratio;

[0016] Step 5: After multiple samplings, the initial boundary point is converged within a stable range, and the initial boundary point is locked to obtain the locked boundary point; the locked boundary point is used to distinguish between normal DNS requests and potential attack traffic.

[0017] Preferably, in step 4, when dynamically adjusting the position of the initial boundary point according to the ratio, if the actual ratio is less than the ratio, the initial boundary is slid to the right; if the actual ratio is greater than the ratio, the initial boundary is slid to the left.

[0018] Preferably, when the initial boundary is slid to the right, the sliding amount is half the difference between the current boundary point and the maximum statistical length.

[0019] Preferably, when the initial boundary is slid to the left, the sliding amount is the difference between the current boundary point and the boundary point before the last rightward sliding, divided by 2.

[0020] Preferably, when the locking boundary point is used to distinguish between normal DNS requests and potential attack traffic, response packets with a length greater than the value corresponding to the locking boundary point are considered as amplified attack traffic and are directly discarded.

[0021] Secondly, a device for determining the normal range of DNS response length probability density includes:

[0022] The statistics module is used to count DNS response results of different sizes based on byte granularity, and record the number of packets of each byte granularity to obtain the statistical results;

[0023] An initial boundary determination module is used to determine the initial boundary based on the statistical results;

[0024] The total number of packages determination module is used to determine the total number of packages to the left and the total number of packages to the right of the initial boundary.

[0025] An adaptive adjustment module is used to set a ratio based on the total number of packages on the left and the total number of packages on the right, and to dynamically adjust the position of the initial boundary point according to the ratio;

[0026] The convergence module is used to converge the initial boundary point to a stable range through multiple samplings and lock the initial boundary point to obtain the locked boundary point; the locked boundary point is used to distinguish between normal DNS requests and potential attack traffic.

[0027] Thirdly, a method for protecting against DNS amplification attacks includes:

[0028] Step 1: Obtain the DNS response packet;

[0029] Step 2: Determine the DNS response packet based on the locked boundary point; the locked boundary point is determined according to the method for determining the normal range of DNS response length probability density;

[0030] Step 3: If the DNS response packet is larger than the locked boundary point, the DNS response packet is determined to be amplified attack traffic and is discarded directly;

[0031] Step 4: If the DNS response packet is smaller than the locking boundary point, then the DNS response packet is determined to be normal traffic.

[0032] Fourthly, a computer device includes a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the method for determining the normal range of DNS response length probability density.

[0033] Fifthly, a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method for determining the normal range of the probability density of the DNS response length.

[0034] Sixthly, a computer program product includes a computer program or instructions that, when executed by a processor, implement the steps of the method for determining the normal range of the DNS response length probability density.

[0035] Compared with the prior art, this application has at least the following beneficial effects:

[0036] This application provides a method for determining the normal range of DNS response length probability density, comprising: statistically analyzing DNS response results of different sizes based on byte granularity, and recording the number of packets corresponding to each byte granularity to obtain statistical results; determining an initial boundary and the total number of packets to the left and right of the initial boundary based on the statistical results; setting a ratio based on the total number of packets to the left and right of the initial boundary, and dynamically adjusting the position of the initial boundary point according to the ratio; and converging the initial boundary point within a stable range through multiple samplings, and locking the initial boundary point to obtain a locked boundary point. The method provided in this application can determine a locked boundary point, which can be used to distinguish between normal DNS requests and potential attack traffic, thereby more accurately intercepting DNS amplification attack traffic. Attached Figure Description

[0037] To more intuitively illustrate the prior art and this application, exemplary drawings are provided below. It should be understood that the specific shapes and structures shown in the drawings should not generally be regarded as limiting conditions for implementing this application; for example, based on the technical concept disclosed in this application and the exemplary drawings, those skilled in the art are able to easily make conventional adjustments or further optimizations to the addition / reduction / classification, specific shapes, positional relationships, connection methods, size ratios, etc. of certain units (components).

[0038] Figure 1 A flowchart of a method for determining the normal range of DNS response length probability density provided in Embodiment 1 of this application;

[0039] Figure 2 This is a flowchart of a DNS amplification attack protection method provided in Embodiment 3 of this application. Detailed Implementation

[0040] The present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0041] In the description of this application: unless otherwise stated, "a plurality of" means two or more. The terms "first," "second," "third," etc., in this application are intended to distinguish the objects referred to and do not have any special meaning in terms of technical connotation (e.g., they should not be construed as an emphasis on importance or order). Expressions such as "including," "comprising," and "having" also mean "not limited to" (certain units, components, materials, steps, etc.).

[0042] The terms used in this application, such as "upper," "lower," "left," "right," and "middle," are generally used to indicate the general relative positional relationship for the purpose of intuitive understanding by referring to the accompanying drawings, and are not absolute limitations on the positional relationship in the actual product.

[0043] Example 1

[0044] Please see Figure 1 This embodiment provides a method for determining the normal range of DNS response length probability density, including:

[0045] S1: Statistically analyze DNS response results of different sizes based on byte granularity, and record the number of packets corresponding to each byte granularity to obtain the statistical results;

[0046] Specifically, this embodiment performs statistics on DNS response results of different sizes, with the statistical granularity accurate to the byte. That is, if the size range of the DNS response result is 1 to 512 bytes, 512 statistical items are set, and each statistical item records the number of packets of the corresponding size. The statistics are continuously collected to obtain the statistical results.

[0047] S2: Determine the initial boundary based on the statistical results;

[0048] Specifically, taking a statistical length range of 1 to 512 bytes as an example, an initial boundary is set, which is the minimum size range of traffic that may contain amplification attacks. Requests smaller than this initial boundary range will be considered normal requests and will not be restricted by the protection policy, while requests larger than this initial boundary range will be considered potential attack traffic and will be restricted by the protection policy.

[0049] S3: Determine the total number of packages on the left and right sides of the initial boundary;

[0050] Specifically, this embodiment counts the total number of packets to the left (less than the boundary point value) and to the right (greater than or equal to the boundary point value) of the initial boundary point, thereby facilitating subsequent dynamic adjustment of the boundary point's position for more accurate identification of attack traffic. The left-side count corresponds to the sum of all statistical items whose packet size is less than the boundary point value, while the right-side count corresponds to the sum of all statistical items whose packet size is greater than or equal to the boundary point value.

[0051] S4: Set the ratio based on the total number of packages on the left and the total number of packages on the right, and dynamically adjust the position of the initial boundary point according to the ratio;

[0052] Specifically, in this embodiment, a ratio R is set. This ratio R is the normal ratio of the total number of packages on the left to the total number of packages on the right. After the total number of samples reaches a certain number, the boundary point can be set to slide according to whether the ratio is lower than the threshold.

[0053] For example: if the total number of packets on the left should normally be twice that on the right, but the actual ratio is less than 2, it is assumed that the number of larger response packets is growing faster. In this case, the initial boundary point needs to be slid to the right. The specific method is to take half the difference between the current boundary point and the maximum value (512), and slide the boundary point to the right by this value. During the sliding, the normal ratio value R will be updated to the current ratio.

[0054] We will continue to monitor the ratio R between the left and right sides. If the ratio is less than R after a certain number of new samples are added, it means that the right side is still growing faster, and we will continue to slide the boundary point to the right by half the difference between the initial boundary point and the maximum value. If the ratio is greater than R, it means that more packets have appeared on the left side during this period, and the boundary point needs to be slid to the left by a distance equal to the difference between the current boundary point and the boundary point before the last rightward slide, divided by 2.

[0055] S5: After multiple samplings, the initial boundary point converges within a stable range, and the initial boundary point is locked to obtain the locked boundary point; the locked boundary point is used to distinguish between normal DNS requests and potential attack traffic.

[0056] Specifically, after multiple samplings, the final boundary point location will converge to a stable and relatively small range. At this point, the boundary point location can be locked, resulting in the locked boundary point (i.e., the final boundary point). By using the locked boundary point location, amplification attack protection can be implemented. That is, response packets with a length greater than the value corresponding to this boundary point are considered amplification attack traffic and are directly discarded.

[0057] This embodiment provides a method for determining the normal range of DNS response length probability density. After multiple rounds of analysis, it ultimately identifies the starting size of large packets that exceed the set normal range. At this point, targeted protection can more accurately intercept necessary traffic. Since DNS amplification attacks typically use as large response results as possible, the actual boundary point may be closer to the right. Therefore, finding the minimum size of large packets with a higher probability than normal that are closer to the right can prevent other relatively large but less impactful response packets from being unnecessarily blocked.

[0058] The DNS response length probability density normal range determination method provided in this embodiment can determine a locking boundary point. This locking boundary point can be used to distinguish between normal DNS requests and potential attack traffic, thereby more accurately intercepting DNS amplification attack traffic and achieving a more precise amplification attack protection method.

[0059] Example 2

[0060] This embodiment provides a device for determining the normal range of DNS response length probability density, including:

[0061] The statistics module is used to count DNS response results of different sizes based on byte granularity, and record the number of packets of each byte granularity to obtain the statistical results;

[0062] An initial boundary determination module is used to determine the initial boundary based on the statistical results;

[0063] The total number of packages determination module is used to determine the total number of packages to the left and the total number of packages to the right of the initial boundary.

[0064] An adaptive adjustment module is used to set a ratio based on the total number of packages on the left and the total number of packages on the right, and to dynamically adjust the position of the initial boundary point according to the ratio;

[0065] The convergence module is used to converge the initial boundary point to a stable range through multiple samplings and lock the initial boundary point to obtain the locked boundary point; the locked boundary point is used to distinguish between normal DNS requests and potential attack traffic.

[0066] For details on the implementation of each module in a DNS response length probability density normal range determination device, please refer to the above description of the limitation on a DNS response length probability density normal range determination method, which will not be repeated here.

[0067] Example 3

[0068] Please see Figure 2 This embodiment provides a method for protecting against DNS amplification attacks, including:

[0069] S1: Obtain DNS response packet;

[0070] S2: Determine the DNS response packet based on the locked boundary point; the locked boundary point is determined according to the method for determining the normal range of DNS response length probability density;

[0071] S3: If the DNS response packet is larger than the locked boundary point, the DNS response packet is determined to be amplified attack traffic and is discarded directly;

[0072] S4: If the DNS response packet is smaller than the locking boundary point, then the DNS response packet is determined to be normal traffic.

[0073] For details on the specific implementation of the method for determining the normal range of DNS response length probability density, please refer to the limitations of Embodiment 1, which will not be repeated here.

[0074] Example 4

[0075] This embodiment provides a computer device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the method for determining the normal range of DNS response length probability density.

[0076] Example 5

[0077] This embodiment provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the method for determining the normal range of DNS response length probability density.

[0078] Example 6

[0079] This embodiment provides a computer program product, including a computer program or instructions, which, when executed by a processor, implement the steps of the method for determining the normal range of the probability density of the DNS response length.

[0080] The technical features of the above embodiments can be combined in any way (as long as there is no contradiction in the combination of these technical features). For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described; these embodiments not explicitly written should also be considered to be within the scope of this specification.

Claims

1. A method for determining the normal range of DNS response length probability density, characterized in that, include: Step 1: Statistically analyze DNS response results of different sizes based on byte granularity, and record the number of packets corresponding to each byte granularity to obtain the statistical results; Step 2: Determine the initial boundary based on the statistical results; Step 3: Determine the total number of packages on the left and right sides of the initial boundary; Step 4: Set a ratio based on the total number of packages on the left and the total number of packages on the right, and dynamically adjust the position of the initial boundary point according to the ratio; Step 5: After multiple samplings, the initial boundary point is converged within a stable range, and the initial boundary point is locked to obtain the locked boundary point; the locked boundary point is used to distinguish between normal DNS requests and potential attack traffic.

2. The method for determining the normal range of DNS response length probability density according to claim 1, characterized in that, In step 4, when dynamically adjusting the position of the initial boundary point according to the ratio, if the actual ratio is less than the ratio, the initial boundary is slid to the right; if the actual ratio is greater than the ratio, the initial boundary is slid to the left.

3. The method for determining the normal range of DNS response length probability density according to claim 2, characterized in that, When the initial boundary is slid to the right, the sliding amount is half the difference between the current boundary point and the maximum statistical length.

4. The method for determining the normal range of DNS response length probability density according to claim 2, characterized in that, When the initial boundary is slid to the left, the sliding amount is the difference between the current boundary point and the boundary point before the last rightward sliding, divided by 2.

5. The method for determining the normal range of DNS response length probability density according to claim 1, characterized in that, When the locking boundary point is used to distinguish between normal DNS requests and potential attack traffic, response packets with a length greater than the value corresponding to the locking boundary point are considered as amplified attack traffic and are directly discarded.

6. A device for determining the normal range of DNS response length probability density, characterized in that, include: The statistics module is used to count DNS response results of different sizes based on byte granularity, and record the number of packets of each byte granularity to obtain the statistical results; An initial boundary determination module is used to determine the initial boundary based on the statistical results; The total number of packages determination module is used to determine the total number of packages to the left and the total number of packages to the right of the initial boundary. An adaptive adjustment module is used to set a ratio based on the total number of packages on the left and the total number of packages on the right, and to dynamically adjust the position of the initial boundary point according to the ratio; The convergence module is used to converge the initial boundary point to a stable range through multiple samplings and lock the initial boundary point to obtain the locked boundary point; the locked boundary point is used to distinguish between normal DNS requests and potential attack traffic.

7. A method for protecting against DNS amplification attacks, characterized in that, include: Step 1: Obtain the DNS response packet; Step 2: Determine the DNS response packet based on the locked boundary point; The locking boundary point is determined by the DNS response length probability density normal range determination method according to any one of claims 1-5; Step 3: If the DNS response packet is larger than the locked boundary point, the DNS response packet is determined to be amplified attack traffic and is discarded directly; Step 4: If the DNS response packet is smaller than the locking boundary point, then the DNS response packet is determined to be normal traffic.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 5.

Images