WO2018095375A1

WO2018095375A1 - Dns protection method, management device, and domain name server

Info

Publication number: WO2018095375A1
Application number: PCT/CN2017/112666
Authority: WO
Inventors: 符立佳; 苗辉
Original assignee: 贵州白山云科技有限公司
Priority date: 2016-11-23
Filing date: 2017-11-23
Publication date: 2018-05-31
Also published as: CN108092940A; CN108092940B

Abstract

Disclosed in the present invention are a DNS protection method, management device, and related devices. The method comprises: a management device sends a monitoring task to a serving domain name server (DNS); the management device receives monitoring data sent by the serving DNS, the monitoring data comprising target QPS data and a target referrer IP corresponding to the target QPS data, and the target QPS data being data that is greater than a threshold and that is in the QPS data monitored by the serving DNS according to the monitoring task; the management device determines, according to the target QPS data, an anti-attack policy; and the management device points the target referrer IP to a standby DNS according to the anti-attack policy, so as to cause the attack traffic of the target referrer IP to be switched over to the standby DNS.

Description

DNS protection method, management device and domain name resolution server

The present application claims priority to Chinese Patent Application No. 201611042517.2, entitled "A DNS Protection Method and Related Equipment", filed on November 23, 2016, the entire contents of which are incorporated herein by reference. In the application.

Technical field

The embodiments of the present invention relate to, but are not limited to, a field of computer network security, and in particular, to a DNS protection method management device and a domain name resolution server.

Background technique

Domain name resolution is one of the most important aspects of the network access process. The main function of the domain name resolution server (DomainNameServer, abbreviation: DNS) is to convert the domain name into a network-recognizable IP. Due to the importance of DNS and low security, more and more DDOS attacks have targeted DNS in recent years. How to effectively defend against DNS DDOS attacks becomes an important task of network services. Currently, in order to prevent network congestion, the DNS usually adopts a marginal architecture, which means that the DNS server is pushed to the edge of the network by implementing the domain name NS record, that is, the DNS requests of different regions access different DNS servers.

The current method based on the DNS edge architecture to prevent DDOS attacks is: monitoring the query rate per second for a single DNS request (QueriesPerSecond, abbreviation: QPS). When the QPS is greater than a preset threshold, the traffic cleaning policy is initiated, which will exceed the threshold. Request packet discarding to protect the normal service.

In the prior art, when the attack traffic is greater than the uplink bandwidth of the network or the processing capability of the DNS, the defense policy will be completely invalid, and the DNS service will be unavailable. If the attack source is concentrated in a certain area and the attack traffic is greater than the uplink bandwidth or server processing capability, at least one DNS in the DNS edged structure is completely unavailable. When the attack traffic comes from various areas, each DNS server in the DNS edged architecture will be attacked. When the attack traffic is greater than the network uplink bandwidth or server processing capability, the defense policy will be completely invalid, and the DNS service will not be available. use.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

The method for protecting the DNS in the embodiment of the present invention includes:

The management device sends a monitoring task to the service domain name resolution server DNS; the management device receives the monitoring data sent by the service DNS, and the monitoring data includes the target QPS data and the target access source IP corresponding to the target QPS data, and the target QPS data is monitored by the service DNS according to the monitoring task. Data in the QPS data that is greater than the threshold;

The management device determines the attack defense policy according to the target QPS data; the management device points the target access source IP to the standby DNS according to the attack defense policy, so as to guide the attack traffic of the target access source IP to switch to the standby DNS.

The above methods also include:

The management device points the target access source IP to the alternate DNS according to the anti-attack policy, including:

The management device sends the IP of the alternate DNS to the target access source IP.

The above methods also include:

The management device determines an attack defense policy based on the target QPS data, including:

The management device determines the attack type according to the target QPS data and the mapping relationship table, and the QPS data has a mapping relationship table with the attack type; the management device determines the attack defense policy according to the attack type.

The above methods also include:

The management device includes a blacklist. The blacklist points to the standby DNS. The management device determines the attack defense policy based on the attack type.

If the attack type is a centralized attack, the management device determines to start the blacklist;

The management device adds the target access source IP to the blacklist;

The management device receives the DNS access request;

The management device determines whether the source IP corresponding to the DNS access request belongs to the blacklist, and if so, the management device routes the DNS access request to the standby DNS.

The above methods also include:

The management device includes a blacklist and a whitelist. The blacklist points to the standby DNS. The whitelist is used to cover the served IP. The whitelist points to the service DNS. The management device determines the attack defense policy according to the attack type. If the network is scattered, the management device determines to start the whitelist and blacklist.

The management device removes the target access source IP from the whitelist and adds it to the blacklist;

The management device receives the DNS access request;

The management device determines whether the source IP address corresponding to the DNS access request belongs to the whitelist. If the source IP address does not belong to the whitelist, the management device determines whether the source IP address belongs to the blacklist. If the blacklist is included, the management device routes the DNS access request to the standby DNS.

The above methods also include:

The QPS data includes QPS data corresponding to the access IP, QPS data corresponding to the domain name, and QPS data corresponding to the specified protocol packet.

The service domain name resolution server DNS receives the monitoring task sent by the management device; the service DNS monitors the QPS data according to the monitoring task;

The service DNS determines whether the QPS data exceeds a threshold, and if so, the service DNS determines target QPS data exceeding the threshold in the QPS data, and a target access source IP corresponding to the target QPS data;

The service DNS generates monitoring data according to the target QPS data and the target access source IP;

The service DNS sends monitoring data to the management device. The monitoring data is used to instruct the management device to determine an attack defense policy according to the target QPS data. The target access source IP address is directed to the standby DNS according to the attack defense policy, so as to guide the attack traffic of the target access source IP to be switched to the standby. DNS.

The above methods also include:

The monitoring tasks sent by the service DNS receiving management device include:

The DNS periodically receives the monitoring task sent by the management device, and the monitoring task includes the threshold of the QPS data.

The DNS monitors QPS data based on monitoring tasks, including:

The DNS periodically monitors the QPS data according to the monitoring task. The QPS data includes the QPS data corresponding to the access IP, the QPS data corresponding to the domain name, and the QPS data corresponding to the specified protocol packet, and each type of QPS data has a corresponding threshold.

The management device in the embodiment of the present invention includes:

a sending module, configured to send a monitoring task to the service DNS;

The first receiving module is configured to receive monitoring data sent by the serving DNS, where the monitoring data includes the target access source IP corresponding to the target QPS data and the target QPS data, and the target QPS data is greater than a threshold in the QPS data monitored by the serving DNS according to the monitoring task. data;

The policy determining module is configured to determine an attack defense policy according to the target QPS data received by the first receiving module;

The processing module is configured to point the target access source IP to the standby DNS according to the anti-attack policy determined by the policy determining module, so as to guide the attack traffic of the target access source IP to switch to the standby DNS.

The domain name resolution server in the embodiment of the present invention includes:

a receiving module, configured to receive a monitoring task sent by the management device;

a monitoring module, configured to monitor QPS data according to a monitoring task received by the receiving module;

a determining module, configured to determine whether the QPS data exceeds a threshold;

a determining module, configured to determine target QPS data exceeding a threshold in the QPS data, and a target access source IP corresponding to the target QPS data; and a generating module, configured to generate monitoring data according to the target QPS data determined by the determining module and the target access source IP;

a sending module, configured to send monitoring data generated by the generating module to the management device,

The monitoring data is used to indicate that the management device determines the attack defense policy according to the target QPS data; and the target access source IP is directed to the standby DNS according to the attack defense policy, so that the attack traffic of the target access source IP is switched to the standby DNS.

Embodiments of the invention have the following advantages:

The management device receives monitoring data according to the DNS feedback, and the monitoring data includes the target QPS data and the target access source IP. Wherein, the target QPS data is data larger than the threshold, then the target access source IP corresponding to the target QPS data may be the attacker IP. The management device determines whether the target access source IP is the attacker IP according to the target QPS data, and further determines the attack type. The management device determines the corresponding attack defense policy according to the attack type, and the management device points the target access source IP to the backup according to the attack defense policy. DNS, to redirect the attack traffic of the target access source IP to the standby DNS, to achieve the isolation of the target access source IP attack behavior.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

DRAWINGS

The accompanying drawings are intended to provide a further understanding of the embodiments of the embodiments of the invention Improper limitations. In the drawing:

FIG. 1 is a schematic diagram of an embodiment of a method for protecting a DNS according to an embodiment of the present invention;

2 is a schematic diagram of another embodiment of a method for protecting a DNS according to an embodiment of the present invention;

3 is a schematic diagram of an embodiment of a management device according to an embodiment of the present invention;

4 is a schematic diagram of an embodiment of a management device according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of another embodiment of a management device according to an embodiment of the present invention; FIG.

FIG. 6 is a schematic diagram of another embodiment of a management device according to an embodiment of the present disclosure;

FIG. 7 is a schematic diagram of an embodiment of a domain name resolution server according to an embodiment of the present invention.

detailed description

The embodiments of the present invention will be further described with reference to the drawings and specific embodiments.

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is an embodiment of the invention, but not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts shall fall within the scope of the present invention.

The embodiment of the present invention provides a DNS protection method and related device, which is used to point a target access source IP to an alternate DNS, to guide the attack traffic of the target access source IP to be switched to the standby DNS, and implement the target access source IP attack behavior. isolation.

The embodiment of the present invention provides a DNS protection method. The protection method of the DNS is applied to a protection system, which includes a service DNS, a management device, and an alternate DNS. The service DNS here is a DNS for normal domain name resolution.

The management device sends a monitoring task to the service DNS, and the service DNS monitors the QPS data according to the monitoring task, determines the target QPS data that is greater than the threshold in the QPS data, and determines the target access source IP corresponding to the target QPS data, and the target access source IP may For the attacker. The service DNS then sends monitoring data to the management device, the monitoring data including the target QPS data and the target access source IP.

The management device receives the monitoring data sent by the service DNS, and the management device determines according to the target QPS data. According to the anti-attack policy, the management device points the target access source IP to the standby DNS to guide the attack traffic of the target access source IP to the standby DNS. The standby DNS can be understood as a non-serving DNS. The standby DNS can also be understood as an anti-attack DNS. The management device switches the attack traffic to the standby DNS to ensure that the service DNS can work normally.

It should be noted that the function of the management device may be completed by multiple devices, or the functions of multiple devices may be integrated and implemented by one device. In actual applications, the specific layout mode of the management device is based on actual needs. The present invention is not limited to whether the function of the management device is performed by one integrated device or multiple devices. In the embodiment of the present invention, the management device is an integrated device as an example for description. Referring to FIG. 1 , an embodiment of a method for protecting a DNS in an embodiment of the present invention includes:

Step 101: The management device sends a monitoring task to the service DNS.

The management device combines the monitoring task according to the service DNSIP list and the manually configured monitoring parameters, and the management device periodically delivers the monitoring task to each service DNS according to the service DNSIP list. The service DNSIP list may be stored in the management device or may be obtained in real time. The specific implementation manner is not limited in the present invention.

The monitoring task format can be “detecting target, detecting monitoring item, detecting mode, threshold”. The detection target may be to detect QPS data accessed by each source IP, QPS data accessed by a single domain name, or QPS data of a specified protocol packet. Among them, the specified protocol package includes: UDP and TCP.

The detection monitoring items include: UDP, TCP, UDP port 53, and port number 53. The monitoring parameters include the detection methods of monitoring items such as UDP, TCP, UDP port 53 and TCP port 53, and the threshold corresponding to each monitoring parameter.

Step 102: The service DNS monitors the QPS data according to the monitoring task.

The service DNS periodically receives the monitoring tasks delivered by the management device and monitors the QPS data according to the monitoring tasks. The QPS data includes QPS data of each target access source IP. Optionally, the target QPS data may also include QPS data serving the DNS. The QPS data of the target access source IP is the first QPS data, and the QPS data of the serving DNS is the second QPS data.

Step 103: The service DNS determines whether the QPS data is greater than a threshold. If yes, step 104 is performed.

The service DNS is based on the detection data of the current period and the threshold in the monitoring task. The first QPS data includes QPS data corresponding to the target access source IP, QPS data corresponding to the single domain name, and a specified protocol. The corresponding QPS data of the package. The service DNS determines whether each type of monitoring QPS data is greater than a threshold, and each type of QPS data has a corresponding threshold. The specific determination manner of whether the QPS data of the service DNS is greater than a threshold may be: the service DNS may be separately for each type of The QPS is compared in size with its corresponding threshold, and then the weight of each type of QPS data is used to finally determine if the QPS data is greater than a threshold.

If the service DNS determines that the QPS data is less than the threshold, it indicates that there is no attack by the attacker, and the DNS continues to wait for the next detection period.

Step 104: The serving DNS determines target QPS data whose QPS data is greater than a threshold, and a target access source IP corresponding to the target QPS data.

If the QPS data is greater than the threshold, the serving DNS determines the target QPS data that the first QPS data is greater than the threshold, and the target access source IP corresponding to the target QPS data, where the target access source IP is the source IP of the attacking party.

The service DNS can determine whether the second QPS data of the service DNS is greater than the first threshold according to whether the second QPS data is greater than the first threshold, indicating that the service DNS is attacked, and multiple target access source IPs attack the service DNS together.

Step 105: The service DNS generates monitoring data according to the target QPS data and the target access source IP.

Step 106: The service DNS sends monitoring data to the management device.

The serving DNS periodically sends monitoring data to the management device, the monitoring data including the target QPS data and the target access source IP.

Step 107: The management device receives the monitoring data, where the monitoring data includes the target QPS data and the target access source IP, and the management device determines the attack defense policy according to the target QPS data. The target access source IP is directed to the alternate DNS according to the attack defense policy.

Specifically, the management device determines the IP of the standby DNS, and the management device sends the IP of the standby DNS to the target access source IP. In the embodiment of the present invention, the target access source IP is the source IP of the attacker, and the management device feeds back the IP of the standby DNS to the client of the target access source IP, so that when the attacker's client attacks, directly attack the backup. DNS has achieved separation of attack traffic to ensure that normal service DNS is not affected.

Referring to FIG. 2, an embodiment of the present invention provides another optimization method of a DNS protection method. Examples include:

The management device includes a blacklist and a whitelist, and the management device pre-configures the blacklist and whitelist. The blacklist points to the alternate DNS, and the blacklist is used to place the target access source IP. This whitelist is used to cover the served IP, which points to the serving DNS.

Steps 201 to 206 are the same as steps 101 to 106 in the embodiment corresponding to FIG. 1, and are not described herein.

Step 207: The management device receives the monitoring data, and determines an attack type according to the target QPS data and the mapping relationship table, where the QPS data has a mapping relationship table with the attack type.

Specifically, the management device can obtain offline operation data from the big data platform, and combine the attack parameters into an attack type library. The attack type library accesses the QPS data through a single IP, accesses the QPS data in a single domain name, and specifies the QPS data of the protocol package and each of them. The thresholds of the type of QPS data are combined to form a mapping table for the type of attack. The attack types include centralized attacks and distributed attacks on the entire network. The centralized attacks refer to the attacker attacking the DNS of a certain area. For example, attacking Beijing's DNS. A distributed attack on the entire network means that the attacker attacks multiple DNSs at the same time. The multiple DNSs belong to different areas.

The management device periodically receives the latest monitoring data sent by the service DNS, and saves the monitoring data to the local. The management device compares the target QPS data with the attack type library, and determines the attack type through the target QPS data and the mapping relationship table.

Step 208: The management device determines an attack defense policy according to the attack type. The first type, if the attack type is a centralized attack, or if only a small number of target access source IPs are used for attack, the management device starts the blacklist. The second type, if the attack type is a full-network distributed attack, or if the large-scale target access source IP attacks, the management device determines to start the whitelist, or starts the whitelist and the blacklist.

Step 209: The management device points the target access source IP to the standby DNS according to the attack defense policy.

First, the management device adds the target access source IP to the blacklist. When the management device receives the DNS access request, the management device determines whether the source IP corresponding to the DNS access request belongs to the blacklist, and if so, the management device routes the DNS access request to the standby DNS.

Second, the management device removes the target access source IP from the whitelist and adds it to the blacklist. When the management device receives the DNS access request, the management device determines whether the source IP corresponding to the DNS access request belongs to the whitelist, and if it does not belong to the whitelist, the management device A DNS access request is routed to the alternate DNS. Further, the source IP may be determined to be a blacklist, and if it belongs to the blacklist, the management device routes the DNS access request to the standby DNS. In the embodiment of the present invention, by determining the type of the attack, it is determined that the blacklist and/or the whitelist is activated, and the access request of the target access source IP is switched to the standby DNS by using the isolation function of the black and white list, and the standby DNS can be understood as an attack prevention. DNS, the normal access IP uses the service DNS to provide services, and achieves automatic isolation of target access source IP attacks.

Referring to FIG. 3, an embodiment of the management device 300 in the embodiment of the present invention includes:

The sending module 310 is configured to send a monitoring task to the service DNS.

The first receiving module 320 is configured to receive monitoring data sent by the serving DNS, where the monitoring data includes the target access source IP corresponding to the target QPS data and the target QPS data, and the target QPS data is greater than a threshold in the QPS data monitored by the serving DNS according to the monitoring task. The data;

The policy determining module 330 is configured to determine an attack defense policy according to the target QPS data received by the first receiving module 320.

The processing module 340 is configured to direct the target access source IP to the standby DNS according to the attack defense policy determined by the policy determining module 330 to guide the attack traffic of the target access source IP to the standby DNS.

Optionally, the sending module 310 is configured to send the IP of the standby DNS to the target access source IP.

Referring to FIG. 4, another embodiment of the management device 400 in the embodiment of the present invention includes:

The sending module 410 is configured to send a monitoring task to the service DNS.

The first receiving module 420 is configured to receive monitoring data sent by the serving DNS, where the monitoring data includes the target access source IP corresponding to the target QPS data and the target QPS data, and the target QPS data is monitored by the serving DNS according to the monitoring task, and the QPS data is determined. Medium greater than the threshold;

The policy determining module 430 is configured to determine an attack defense policy according to the target QPS data received by the first receiving module 320.

The processing module 440 is configured to direct the target access source IP to the standby DNS according to the attack defense policy determined by the policy determining module 430, so as to guide the attack traffic of the target access source IP to be switched to the standby DNS.

The sending module 410 is configured to send the IP of the standby DNS determined by the processing module 440 to the target access source IP.

Referring to FIG. 5, another embodiment of the management device 500 in the embodiment of the present invention includes:

The functions of the sending module 510, the first receiving module 520, and the processing module 540 are the same as those of the sending module 310, the first receiving module 320, and the processing module 340 in FIG.

The policy determination module 530 includes a type determination unit 5301 and a policy determination unit 5302.

The type determining unit 5301 is configured to determine an attack type according to the target QPS data and the mapping relationship table received by the receiving module, and the QPS data has a mapping relationship table with the attack type.

The policy determining unit 5302 is configured to determine an attack defense policy according to the attack type determined by the type determining unit 5301.

Referring to FIG. 6, on the basis of the embodiment corresponding to FIG. 5, in another embodiment of the management device 600 in the embodiment of the present invention, the management device includes a blacklist, and the blacklist points to the standby DNS.

The functions of the sending module 610, the first receiving module 620, and the processing module 640 in this management device are the same as those of the sending module 310, the first receiving module 320, and the processing module 340 in FIG. The function of the policy determination module 630 is the same as the function of the policy determination module 530 in the embodiment of FIG.

The policy determining unit 6302 is further configured to determine that the blacklist is activated when the type determining unit 6301 determines that the attack type is a centralized attack.

The processing module 640 is further configured to add the target access source IP in the monitoring data received by the receiving module to the blacklist.

The second receiving module 660 is configured to receive a DNS access request.

The determining module 650 is configured to determine whether the source IP corresponding to the DNS access request received by the second receiving module 660 belongs to the blacklist.

The processing module 640, when the determining module 650 determines that the source IP corresponding to the DNS access request belongs to the blacklist, routes the DNS access request to the standby DNS.

Optionally, the management device includes a blacklist and a whitelist, the blacklist points to the alternate DNS, the whitelist is used to cover the served IP, and the whitelist points to the serving DNS.

The policy determining unit 6302 is further configured to: when the type determining unit 6301 determines that the attack type includes a centralized attack and a network-wide distributed attack, determine to start a whitelist and a blacklist;

The processing module 640 is further configured to remove the target access source IP from the whitelist and add the blacklist to the blacklist;

The second receiving module 660 is configured to receive a DNS access request.

The determining module 650 is configured to determine that the source IP corresponding to the DNS access request received by the receiving module is If it is not a whitelist, it will continue to determine whether the source IP is blacklisted.

The processing module 640 is further configured to, when the determining module 650 determines that the source IP belongs to the blacklist, then route the DNS access request to the alternate DNS.

Referring to FIG. 7, an embodiment of a domain name resolution server according to an embodiment of the present invention includes:

The receiving module 710 is configured to receive a monitoring task sent by the management device.

The monitoring module 720 is configured to monitor the QPS data according to the monitoring task received by the receiving module 710. The determining module 730 is configured to determine whether the QPS data exceeds a threshold.

The determining module 740 is configured to determine target QPS data exceeding the threshold in the QPS data, and a target access source IP corresponding to the target QPS data.

The generating module 750 is configured to generate monitoring data according to the target QPS data determined by the determining module 740 and the target access source IP.

The sending module 760 is configured to send, to the management device, the monitoring data generated by the generating module 750, where the monitoring data is used to instruct the management device to determine an attack defense policy according to the target QPS data; and the target access source IP is directed to the standby DNS according to the attack defense policy to guide the target. The attack traffic accessing the source IP is switched to the alternate DNS.

Optionally, the receiving module 710 is further configured to periodically receive a monitoring task sent by the management device, where the monitoring task includes a threshold of QPS data.

The monitoring module 720 is further configured to periodically monitor the QPS data, where the QPS data includes the QPS data corresponding to the access IP, the QPS data corresponding to the domain name, and the QPS data corresponding to the specified protocol packet, and each type of QPS data has a corresponding threshold.

A person skilled in the art should understand that the technical solutions of the present invention may be modified or equivalent, without departing from the spirit and scope of the present invention, and should be included in the scope of the claims.

Those of ordinary skill in the art will appreciate that all or some of the steps, systems, and functional blocks/units of the methods disclosed above may be implemented as software, firmware, hardware, and suitable combinations thereof. In a hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or The steps can be performed cooperatively by several physical components. Some or all of the components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer readable medium, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As is well known to those of ordinary skill in the art, the term computer storage medium includes volatile and nonvolatile, implemented in any method or technology for storing information, such as computer readable instructions, data structures, program modules or other data. Sex, removable and non-removable media. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridge, magnetic tape, magnetic disk storage or other magnetic storage device, or may Any other medium used to store the desired information and that can be accessed by the computer. Moreover, it is well known to those skilled in the art that communication media typically includes computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and can include any information delivery media. .

Industrial applicability

In the embodiment of the present invention, the management device determines, according to the target QPS data, whether the target access source IP is the attacker IP, and further determines the attack type, and the management device determines the corresponding attack defense policy according to the attack type, and the management device accesses the target according to the attack defense policy. The source IP is directed to the alternate DNS to redirect the attack traffic of the target access source IP to the standby DNS, thereby achieving isolation of the target access source IP attack behavior.

Claims

A DNS protection method, comprising:

The management device sends a monitoring task to the service domain name resolution server DNS; the management device receives the monitoring data sent by the service DNS, and the monitoring data includes target QPS data and a target access source IP corresponding to the target QPS data, the target The QPS data is data greater than a threshold in the QPS data monitored by the serving DNS according to the monitoring task;

The management device determines an attack defense policy according to the target QPS data; the management device points the target access source IP to the standby DNS according to the attack defense policy, so as to guide the attack traffic of the target access source IP to switch to the standby DNS.
The protection method of claim 1, wherein the management device points the target access source IP to the standby DNS according to the attack defense policy, including:

The management device sends the IP of the standby DNS to the target access source IP.
The protection method according to claim 1, wherein the management device determines an attack defense policy according to the target QPS data, including:

The management device determines an attack type according to the target QPS data and a mapping relationship table, where the QPS data has a mapping relationship with the attack type; and the management device determines an attack defense policy according to the attack type.
The method for protecting a DNS according to claim 3, wherein the management device includes a blacklist, and the blacklist points to the standby DNS, and the management device determines the attack defense policy according to the attack type, including:

If the attack type is a centralized attack, the management device determines to start the blacklist;

The management device points the target access source IP to the standby DNS according to the attack defense policy, including:

The management device adds the target access source IP to the blacklist;

The management device receives a DNS access request;

The management device determines whether the source IP corresponding to the DNS access request belongs to the blacklist, and if yes, the management device routes the DNS access request to the standby DNS.
The method for protecting a DNS according to claim 3, wherein the management device comprises a blacklist and a whitelist, the blacklist is directed to an alternate DNS, and the whitelist is used to cover the served IP. The whitelist is directed to the service DNS, and the management device determines the attack defense policy according to the attack type, and if the attack type includes a centralized attack and a network-wide distributed attack, the management device determines to start the whitelist and the Blacklist

The management device points the target access source IP to the standby DNS according to the attack defense policy, including:

The management device removes the target access source IP from the whitelist and adds it to the blacklist;

The management device receives a DNS access request;

The management device determines whether the source IP corresponding to the DNS access request belongs to the whitelist, and if it does not belong to the whitelist, the management device determines whether the source IP belongs to the blacklist, and if it belongs to the blacklist, the The management device routes the DNS access request to the alternate DNS.
The method for protecting a DNS according to any one of claims 1 to 5, wherein the QPS data includes QPS data corresponding to the access IP, QPS data corresponding to the domain name, and QPS data corresponding to the specified protocol packet.
A DNS protection method, including:

The service domain name resolution server DNS receives the monitoring task sent by the management device; the service DNS monitors the QPS data according to the monitoring task;

The service DNS determines whether the QPS data exceeds a threshold, and if so, the service DNS determines target QPS data exceeding the threshold in the QPS data, and a target access source IP corresponding to the target QPS data;

The service DNS generates monitoring data according to the target QPS data and the target access source IP;

The service DNS sends the monitoring data to the management device, where the monitoring data is used to instruct the management device to determine an attack defense policy according to the target QPS data; and the target access source IP according to the attack defense policy Point to the alternate DNS to redirect the attack traffic from the target access source IP to the alternate DNS.
The method for protecting a DNS according to claim 7, wherein the monitoring task sent by the serving DNS receiving management device comprises:

The DNS periodically receives a monitoring task sent by the management device, where the monitoring task includes Threshold of QPS data;

The DNS monitors QPS data according to the monitoring task, including:

The DNS periodically monitors the QPS data according to the monitoring task, where the QPS data includes QPS data corresponding to the access IP, QPS data corresponding to the domain name, and QPS data corresponding to the specified protocol packet, and each type of QPS data is Has a corresponding threshold.
A management device that includes:

a sending module, configured to send a monitoring task to the service DNS;

a first receiving module, configured to receive monitoring data sent by the service DNS, where the monitoring data includes target QPS data and a target access source IP corresponding to the target QPS data, where the target QPS data is determined by the serving DNS The data of the QPS data monitored by the monitoring task that is greater than a threshold;

a policy determining module, configured to determine an attack defense policy according to the target QPS data received by the first receiving module;

The processing module is configured to direct the target access source IP to the standby DNS according to the attack defense policy determined by the policy determining module, so as to guide the attack traffic of the target access source IP to be switched to the standby DNS.
A domain name resolution server, comprising:

a receiving module, configured to receive a monitoring task sent by the management device;

a monitoring module, configured to monitor QPS data according to the monitoring task received by the receiving module;

a determining module, configured to determine whether the QPS data exceeds a threshold;

a determining module, configured to determine target QPS data exceeding the threshold in the QPS data, and a target access source IP corresponding to the target QPS data; and a generating module, configured to determine the target QPS data according to the determining module The target access source IP generates monitoring data;

a sending module, configured to send the monitoring data generated by the generating module to the management device, where

The monitoring data is used to indicate that the management device determines an attack defense policy according to the target QPS data, and points the target access source IP to the standby DNS according to the attack defense policy, so as to guide the attack traffic of the target access source IP to be switched to Alternate DNS.