KR20080063952A - System for anomaly detection of dns sever with real time in internet and method thereof - Google Patents

Abstract

A system and a method for detecting anomaly of a DNS(Domain Name Service) server in real-time on the Internet are provided to block risk for the DNS server and offer a service stably by detecting the anomaly through real-time packet analysis in a DNS application. A plurality of DNS servers(100a,100b) convert a domain name into an IP(Internet Protocol) address. A plurality of switches(200a,200b) controls connection of a connection call received from each DNS server. A plurality of networks(400a,400b) are connected the Internet(100) and the switches, and enable computers included in each network to exchange/process information by using the DNS server of the corresponding network. A real-time DNS analyzer(500a,500b) outputs an analysis result by obtaining and analyzing the DNS packet transmitted or received from the DNS server, and transfers a normal operation notice and/or a detail performance value of each DNS server by transmitting a DNS query periodically to each DNS server. The real-time DNS analyzer informs the predetermined DNS server of an anomaly by generating a predetermined event when the anomaly occurs in the predetermined DNS.

Description

System for Anomaly Detection of DNS Sever with Real Time in Internet and Method

1A and 1B show the configuration of a system for performing real-time abnormal detection of a DNS server in the Internet according to the present invention.

2 is a control flowchart for executing real-time abnormal detection of a DNS server in the Internet according to the present invention.

<Description of Symbols for Main Parts of Drawings>

100a, 100b: DNS server 200a, 200b: switch

500a, 500b, 500c: DNS Real Time Analyzer 400a, 400b: Network

800: Web Server 900: Central Server

100: Internet

The present invention relates to a real-time anomaly detection technology of a DNS server in the Internet, and more particularly, extracts various statistical information from DNS packets, analyzes it, detects anomaly, and threatens the DNS server as an internet infrastructure. The present invention relates to a real-time anomaly detection system and method of the DNS server in the Internet suitable for detecting the error.

A DNS server is a server that translates domain names (eg www.kt.co.kr) commonly used for communication on the Internet into IP addresses used for actual computer communication. The DNS server is the most important infrastructure of the Internet, and if this DNS server fails, the Internet is not available immediately. Examples include the 1.25 Internet turbulence and attacks against denial of service against top-level root DNS servers in '02.

Therefore, there is a growing interest in protecting the DNS server, which is an Internet infrastructure, and recently, more sophisticated hacking techniques are developing from the attack on the corporate network to the attack of the Internet infrastructure such as DNS. The situation is increasing.

Various existing network security solutions such as firewall and IPS are used, but the DNS service port must always be open for internet communication, so the DNS server is always exposed to various threats disguised as normal DNS packets.

The present invention was created in view of the above circumstances, and an object of the present invention is to detect abnormal behavior through real-time packet analysis of a DNS application, thereby preventing threats to DNS servers (services), which are Internet infrastructures, to be stable and stable. It is to provide a real-time anomaly detection method of DNS server in the Internet which can provide service.

In order to achieve the above object, a real-time abnormality detection system of the DNS server in the Internet according to the present invention, a plurality of DNS server for converting a specific domain name into an IP address used for actual computer communication; A plurality of switches for switching and controlling connection of access calls transmitted from the respective DNS servers; A plurality of networks connected to the Internet and the respective switches, for exchanging information and processing information between computers in the network using a DNS server of a corresponding network; Obtains packets sent or received to a specific DNS server in real time, analyzes and outputs DNS packets from the obtained packets, and executes DNS queries periodically to the specific DNS server to determine whether the individual DNS server is operating normally and / or detailed performance values. It is configured as a real-time DNS analyzer for delivering, when the real-time DNS analyzer is anomalous phenomenon occurs in the corresponding DNS server generates a notification and notify.

Here, when a plurality of real-time DNS analyzer is provided, the corresponding DNS server is diagnosed using the information received from the plurality of real-time DNS analyzer, and if an abnormality occurs in the DNS server, a predetermined event is generated and notified. It is preferable to further include a central server for analyzing all traffic to the corresponding DNS server during the set time flowing into its own network interface.

In order to achieve the above object, the real-time abnormality detection method of the DNS server in the Internet according to the present invention, in the system for performing real-time abnormality detection of the DNS server having at least one real-time DNS analyzer, in the real-time DNS analyzer Setting a rank threshold and a value change threshold for each of at least one preset DNS metric; In the real-time DNS analyzer, setting a flag of the DNS metric as an initial reference value; Determining, by the real-time DNS analyzer, whether there is a change in the current value of the DNS metric; As a result of the determination, when there is a change in the current value of the DNS metric, setting a flag of the DNS metric as a change value indicating that an abnormal state has occurred; In the real-time DNS analyzer, the step of analyzing the abnormal state of the corresponding DNS metric.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1A and 1B are diagrams showing the configuration of a system for executing real-time abnormal detection of a DNS server in the Internet according to the present invention. FIG. 1A is a real-time abnormality of a DNS server in the Internet when a plurality of networks are connected to a central server. 1B shows the configuration of a system for executing real-time anomaly detection of a DNS server in the Internet when collecting and analyzing DNS packets for only one DNS server farm. Drawing.

1A and 1B, the central server 700 synthesizes all information transmitted from the plurality of real time analyzers 500a and 500b in FIG. 1A, but the individual real time analyzer 500c in FIG. 1B. Perform the diagnosis directly.

Referring to FIG. 1A, a system for performing real-time abnormal detection of a DNS server in the Internet according to the present invention includes a plurality of DNS servers 100a and 100b for converting a specific domain name into an IP address used for actual computer communication. Wow; A plurality of switches 200a and 200b for switching and controlling connection of connection calls transmitted from the respective DNS servers 100a and 100b; A plurality of networks 400a and 400b connected to the respective switches 200a and 200b for exchanging information and processing information between computers therein using a DNS server of a corresponding network; An internet 100 connected to a plurality of networks 400a and 400b, respectively; Obtains packets sent or received to a specific DNS server in real time, analyzes and outputs DNS packets from the obtained packets, and executes DNS queries periodically to the specific DNS server to determine whether the individual DNS server is operating normally and / or detailed performance values. And a plurality of real-time DNS analyzer (500a, 500b) for transmitting; Diagnose the corresponding DNS server by using the information received from each real-time DNS analyzer 500a, 500b. If an abnormality occurs in the corresponding DNS server, a predetermined event is generated and notified, and during the set time flowed into its own network interface. A central server 700 for analyzing all traffic to the corresponding DNS server of; The information generated by the central server 700 is reported to the operator in a predefined format, and the operator is configured as a web server 800 for providing a user interface.

Each network 400a and 400b shown in FIG. 1 may be a network of one organization (ISP, company, etc.) or may be a network of different organizations.

In addition, each real-time DNS analyzer (500a, 500b) tapping or switch port mirroring at the front end of the switch (300a, 300b) of each DNS server for all packets originating from or arriving at a specific DNS server of a specific network user Acquisition in real time through such methods. At this time, the acquired packet is to perform in-depth analysis including header information and payload information only for the DNS packet, and the analysis information is compressed to a predetermined format to the central server 700 through the set path 900a of the Internet. Delivered. Also, the real-time DNS analyzer 500a and 500b periodically executes DNS queries 600a and 600b to the corresponding DNS server, and transmits whether the corresponding DNS server is normally operated and detailed performance values to the central server 700.

The central server 700 stores the information received from each of the real-time DNS analyzer (500a, 500b) in the database 750, and integrates the information to diagnose in accordance with preset criteria and analysis methods, statistical data in a preset format And stores the result in the database 750.

At this time, if anomaly occurs, the central server 700 generates an event in a preset manner and notifies the corresponding DNS server 100a or 100b and automatically provides control information for controlling the anomaly. The real-time DNS analyzer (500a or 500b) is passed to (900a, 900b), and the raw packets are collected and stored in the database 750 for further analysis. The real-time DNS analyzer (500a, 500b) receiving the control information stores all the traffic arriving or outgoing to each DNS server (100a or 100b) for a predetermined time flowing into its own network interface on disk for further analysis. .

At this time, each of the real-time DNS analyzer (500a, 500b) performs the in-depth analysis of the packet to generate a counter for the next predetermined item, the ratio occupied by the corresponding item, Top-N information, in FIG. Although the server 700 synthesizes all information transmitted from the plurality of real-time analyzers 500a and 500b, the diagnosis is performed by the individual real-time analyzer 500c in FIG. 1B.

DNS metrics

(1) Source IP address rank change

Each DNS server records the source IP addresses of the top 100 users with high queries and ranks first. This rank is recorded every 5 minutes, and the rank difference with the previous measurement value is recorded for each Source IP, and it is determined whether the rank has increased beyond the threshold.

(2) increase of recursive queries

Incoming queries to the DNS server are user-initiated queries, and the DNS query initiated by the DNS server is defined as material. Measure whether the number ratio of the material increases. Measure the packet rate of the material in 1 minute increments and continue to record this value for at least 5 minutes in 1 minute increments. Here, the packet ratio of the material is a value obtained by dividing the number of packets of the material by the number of user queries.

(3) decrease in response rate

The response rate is the ratio of the number of packets from the user to the number of packets the DNS server responds to. Measure the response rate in 1 minute increments and continue to record this value for at least 5 minutes.

(4) Increase in abnormal quality among query types

The query type is classified into A type, MX type, and other types to measure the ratio in 1 minute increments. Continue to record A type query rate, MX type rate, and other type rate for more than 5 minutes. An increase in MX type or an increase in other types is considered to be an increase in abnormal quality.

(5) Increase of abnormal response among response types

Classify the response types into NoError and others to measure the ratio of these types to the total query in minutes. Record continuously for at least 5 minutes to observe whether the NoError rate has decreased.

(6) Increase ServFail Response

The ratio of ServFail responses to total response packets among response types is measured in 1 minute increments. Continue to record more than 5 minutes to observe the increase in ServFail response.

(7) Increasing Query Incoming to Secondary DNS Server

Observe the increase in queries coming to the secondary DNS server. Record the number of packets coming into the primary (or primary) DNS and the packets coming into the secondary DNS in 1 minute increments to observe if the rate of incoming queries to the secondary DNS server increases. Record this value continuously for more than 5 minutes.

(8) occurrence of excessive material for the same content

Collect the contents of the material for 5 minutes, count the number of query occurrences for each query content and generate statistics. If more than 5% of the same material occurs in the same material is classified as excessive material.

2 is a control flowchart for executing real-time abnormal detection of a DNS server in the Internet according to the present invention. Referring to FIG. 2, the corresponding real-time DNS analyzer sets the rank thresholds and the value change thresholds for the DNS metrics described above (S201).

Then, the real-time DNS analyzer analyzes the flag of DNS metrics (Source IP address error, material problem, response rate decrease, query type error, DNS response code error, ServFail increase, secondary DNS query increase, CPU increase) described above. Is set to 0 (S202).

At this time, when the measured value increases or decreases above the threshold, the corresponding flag is set to 1. Therefore, if all of these flags are 0, it is diagnosed that there is no abnormality in the corresponding DNS server. If the flags are 1, the detailed diagnosis is performed as follows. For precise diagnosis, the following metrics should be additionally measured.

Subsequently, the real-time DNS analyzer checks whether there is a change in the source IP address rank, and determines whether there is a source IP whose rank change is greater than or equal to the threshold (S203).

As a result of the determination in S203, if there is a source IP whose rank change is greater than or equal to the threshold value, the flag of more than the source IP address is set to 1, the content of the query for the problem source IP address is analyzed (S204), and the process moves to the next step. However, if there is no Source IP whose rank change is greater than or equal to the threshold, the flow moves directly to the next step.

Next, the real-time DNS analyzer checks whether the recursive query has increased, and determines whether the increase is greater than or equal to the threshold (S205).

As a result of the determination in S205, when the increase is greater than or equal to the threshold value, the abnormal flag of the material is set to 1 to analyze the query content of the material, generate a TopN rank for the query content (S206), and move to the next step. However, if the increase is less than or equal to the threshold, go directly to the next step.

Subsequently, the real-time DNS analyzer checks whether the response rate decreases, and determines whether the reduction degree is greater than or equal to the threshold (S207).

As a result of the determination in S207, if the reduction degree is more than the threshold, no further analysis is performed, but the response rate reduction flag is set to 1 to indicate that the service performance of the DNS server is degraded (S208), and the flow advances to the next step. However, if the reduction is less than or equal to the threshold, go directly to the next step.

Then, the real-time DNS analyzer checks the query type to determine whether the abnormal query has increased beyond the threshold (S209).

As a result of the determination of S209, when the abnormal query increases more than the threshold value, the query type abnormal flag is set to 1 to analyze the contents of the query for each abnormal query (S210), and the process moves to the next step. However, if the abnormal query does not increase beyond the threshold, it moves directly to the next step.

Subsequently, the real-time DNS analyzer examines the DNS response code to determine whether the abnormal response has increased beyond the threshold (S211).

As a result of the determination in S211, when the abnormal response increases above the threshold, the DNS response code abnormal flag is set to 1 to analyze the query contents for the abnormal response (S212), and the process moves to the next step. However, if the abnormal response does not increase beyond the threshold, go directly to the next step.

Subsequently, the real-time DNS analyzer checks whether the ServFail response is increased, and determines whether the increase is greater than or equal to the threshold (S213).

As a result of the determination in S213, when the increase value is greater than or equal to the threshold value, the ServFail increase flag is set to 1 to analyze the contents of the query that generates the ServFail response (S214), and the process moves to the next step. At this time, it is analyzed whether ServFail is generated by a specific query or ServFail response occurs in various queries regardless of the contents of the query. However, if the increase is not more than the threshold, the flow moves directly to the next step.

In this case, if the query content for generating the ServFail is not specified, it is determined that there is a problem in the processing capability of the DNS server.If the ServFail is generated in the same query, it is determined that there is a problem in the DNS server setting, and the operator is notified. It is preferable.

Subsequently, the real-time DNS analyzer checks whether an incoming query to the secondary DNS server increases, and determines whether the increase is greater than or equal to the threshold (S215).

As a result of the determination in S215, when the increase value is greater than or equal to the threshold value, the secondary DNS increase flag is set to 1 to analyze the query content coming into the secondary DNS (S216), and the process moves to the next step. However, if the increase is not more than the threshold, the flow moves directly to the next step.

Then, the real-time DNS analyzer determines whether there is excessive material for the same content (S217).

As a result of the determination in S217, if there is an excessive material for the same content, the occurrence flag of the excessive material is set to 1 to analyze the cause of the excessive material (S218) and move on to the next step. However, if there is no excessive material for the same content, go directly to the next step.

Subsequently, the real-time DNS analyzer determines whether all flags of DNS metrics are 0 (S219).

As a result of the determination in S219, if the flags of the DNS metric are all zero, the preset measurement is restarted (S220). If the flags of the DNS metric are not all zero, the preset measurement is started. Start (S221).

Referring to the control flow diagram for executing the real-time abnormal detection of the DNS server in the Internet shown in Figure 3, through the analysis of step S203 can identify the source IP having a problem, S205, S207, S209, S211, S213, S215 The analysis of the steps S217 may identify the content of the question in question.

Therefore, the real-time DNS analyzer can find out the problem user IP, query content to inform the DNS server operator the analysis described above to solve the problem of the DNS server operation.

As described above, according to the system and method for real-time anomaly detection of a DNS server in the Internet according to an embodiment of the present invention, it is possible to actively monitor the actual service performance of the DNS server which is the Internet infrastructure, and also all DNS packets. It collects without degrading the performance of DNS server, detects abnormality through in-depth analysis and diagnosis, and informs the operator to operate the Internet stably.

When the present invention is applied to major ISPs and major DNS operations in Korea (for example, root / gTLD / ccTLD DNS operations), it is possible to simply and in detail monitor most of the DNS flows in Korea in real time, as well as DNS. Anomalies in the protocol can be easily detected.

On the other hand, the present invention is not limited to the above-described embodiment, but can be modified and modified within the scope not departing from the gist of the present invention, such modifications and changes should be regarded as belonging to the following claims. will be.

Claims (5)

A plurality of DNS servers for converting a specific domain name into an IP address used for actual computer communication; A plurality of switches for switching and controlling connection of access calls transmitted from the respective DNS servers; A plurality of networks connected to the Internet and the respective switches, for exchanging information and processing information between computers in the network using a DNS server of a corresponding network; Obtains packets sent or received to a specific DNS server in real time, analyzes and outputs DNS packets from the obtained packets, and executes DNS queries periodically to the specific DNS server to determine whether the individual DNS server is operating normally and / or detailed performance values. It consists of a real-time DNS analyzer that delivers The real-time DNS analyzer system for executing real-time abnormal detection of the DNS server on the Internet, characterized in that by generating a predetermined event when an abnormality occurs in the DNS server. The method of claim 1, wherein when a plurality of real-time DNS analyzers are provided, the corresponding DNS server is diagnosed using information received from the plurality of real-time DNS analyzers, and when an abnormal phenomenon occurs in the corresponding DNS server, a predetermined event is generated. The system for executing real-time abnormal detection of the DNS server on the Internet, characterized in that it further comprises a central server for notifying and analyzing all traffic to the DNS server during the set time flowing into its own network interface. The method of claim 1, wherein each of the real-time DNS analyzer is a source IP address rank change, recursive query increase, response rate decrease, abnormal query increase in query type, abnormal response increase in response type, ServFail response increase, secondary (Secondary) A system for performing real-time anomaly detection of a DNS server on the Internet, characterized by analyzing DNS metrics consisting of a selective combination of increased queries coming into the DNS server and excessive material occurrences for the same content. In a system for performing real-time anomaly detection of a DNS server with at least one real-time DNS analyzer, Setting, by the real-time DNS analyzer, a rank threshold and a value change threshold for each of at least one preset DNS metric; In the real-time DNS analyzer, setting a flag of the DNS metric as an initial reference value; Determining, by the real-time DNS analyzer, whether there is a change in the current value of the DNS metric; As a result of the determination, when there is a change in the current value of the DNS metric, setting a flag of the DNS metric as a change value indicating that an abnormal state has occurred; And analyzing, by the real-time DNS analyzer, an abnormal state of a corresponding DNS metric, respectively. 5. The method of claim 4, wherein determining whether there is a change in the current value of the DNS metric, Determining, by the real-time DNS analyzer, whether there is a change in source IP address rank; Determining, by the real-time DNS analyzer, whether a recursive query has increased; Determining, by the real-time DNS analyzer, whether an abnormal query has increased beyond a threshold; Determining, by the real-time DNS analyzer, whether an abnormal response has increased beyond a threshold; Determining, by the real-time DNS analyzer, whether a ServFail response is increased; A sixth step of determining, by the real-time DNS analyzer, whether an incoming query to a secondary DNS server increases; In the real-time DNS analyzer, to perform the real-time abnormal detection of the DNS server on the Internet, characterized in that for performing the optional combination under the control of the operator from the step consisting of the seventh step of determining whether there is excessive material for the same content Way.

Images