WO2024027079A1 - Domain-name reflection attack detection method and apparatus, and electronic device and storage medium - Google Patents

Abstract

A domain-name reflection attack detection method and apparatus, and an electronic device and a storage medium. The method comprises: acquiring the number of domain-name resolution requests, which are initiated, within a plurality of time windows, by a request object to be subjected to detection; according to a preset time relationship, constructing the number of requests within the plurality of time windows, so as to obtain at least two request sequences; calculating a correlation coefficient between the at least two request sequences; and according to the correlation coefficient between the at least two request sequences, determining whether said request object has initiated a domain-name reflection attack.

Description

Domain name reflection attack detection method and device, electronic equipment, storage media

cross reference

This disclosure claims priority to the Chinese patent application with application number 202210930014.8 and titled "Domain name reflection attack detection method and device, electronic device, storage medium" submitted on August 3, 2022. The entire content of this Chinese patent application is approved by All references are incorporated herein.

Technical field

The present disclosure relates to the field of security technology, and specifically to a domain name reflection attack detection method and device, electronic equipment, and computer-readable storage media.

Background technique

DNS (Domain Name System) is the Internet infrastructure. Because of its implicit commercial value, it has gradually been valued by large enterprises. All major enterprises have established DNS systems for the entire network. This kind of DNS system for the entire network cannot limit the range of query source IP, and objectively becomes a resource for traffic reflection attacks that attackers can use. In recent years, due to the low cost of DNS, easy evasion of detection and traceability, and obvious traffic amplification effect, DNS , DNS reflection attacks have repeatedly set attack traffic peak records, becoming the main target of abnormal traffic protection for current Internet infrastructure. Therefore, on the DNS server side, the detection ability of DNS reflection attacks is crucial for emergency response.

Existing detection methods for DNS reflection attacks mainly focus on the DNS server side or the victim side. The DNS server side or victim side monitors based on network bandwidth and server availability, and alerts when the threshold is exceeded. However, this detection method has There is obvious lag. When an alarm is issued, it is often too late. At the same time, there may be other reasons on the DNS server side or the victim side that reduce network bandwidth or server availability, which in turn affects the detection of DNS reflection attacks, making DNS reflection Attack detection accuracy is low. A series of DDoS (Distributed Denial of Service, Distributed Denial of Service) cases show that DNS reflection attacks can easily break through the processing capabilities of abnormal traffic cleaning equipment, making how to detect DNS reflection attacks in time an urgent problem to be solved.

Contents of the invention

In order to solve the above technical problems, embodiments of the present disclosure provide a domain name reflection attack detection method and device, electronic equipment, and computer-readable storage media, aiming to solve the technical problem of low accuracy of DNS reflection attack detection.

Additional features and advantages of the disclosure will be apparent from the following detailed description, or, in part, may be learned by practice of the disclosure.

According to an aspect of an embodiment of the present disclosure, a domain name reflection attack detection method is provided, including:

Obtain the number of domain name resolution requests initiated by the request object to be detected within multiple time windows;

Construct the number of requests in multiple time windows according to the preset time relationship to obtain at least two request sequences;

Calculate the correlation coefficient between at least two request sequences;

Based on the correlation coefficient between at least two request sequences, it is determined whether the request object to be detected initiates a domain name reflection attack.

According to an aspect of an embodiment of the present disclosure, a domain name reflection attack detection device is provided, including:

The acquisition module is configured to obtain the number of requests for domain name resolution requests initiated by the request object to be detected within multiple time windows;

A building module configured to build the number of requests in multiple time windows according to a preset time relationship to obtain at least two request sequences;

a calculation module configured to calculate a correlation coefficient between at least two request sequences;

The determination module is configured to determine whether the request object to be detected initiates a domain name reflection attack based on the correlation coefficient between at least two request sequences.

According to an aspect of an embodiment of the present disclosure, an electronic device is provided, including: one or more processors; a storage device configured to store one or more programs. When the one or more programs are processed by the one or more When executed by multiple processors, the electronic device implements the domain name reflection attack detection method as described above.

According to an aspect of an embodiment of the present disclosure, there is provided a computer-readable storage medium having computer-readable instructions stored thereon. When the computer-readable instructions are executed by a processor of a computer, the computer is caused to perform the above-mentioned steps. Domain name reflection attack detection method.

According to one aspect of an embodiment of the present disclosure, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the domain name reflection attack detection method provided in the above various optional embodiments.

In the technical solution provided by the embodiments of the present disclosure, in different time windows, the forged domain name resolution request behavior is highly self-similar, while the normal domain name resolution request behavior is unpredictable. The embodiment of the present disclosure constructs a request sequence based on the number of requests for domain name resolution requests initiated by the request object to be detected in multiple time windows. The request sequence can characterize the behavioral characteristics of the request object to be detected in multiple time windows, and the correlation coefficient is calculated based on the request sequence. Then, based on the correlation coefficient, it can be accurately determined whether the request object to be detected initiates a domain name reflection attack. The domain name emission attack detection method provided by the disclosure can promptly and accurately determine whether a domain name reflection attack is initiated.

Description of the drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the disclosure and together with the description, serve to explain the principles of the disclosure. Obviously, the drawings in the following description are only some embodiments of the present disclosure. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without exerting creative efforts. In the attached picture:

Figure 1 is a schematic diagram of an implementation environment related to the present disclosure.

Figure 2 is a flow chart of a domain name reflection attack detection method related to the present disclosure.

Figure 3 is a flowchart of step S210 in one embodiment of the present disclosure.

Figure 4 is a flowchart of step S220 in one embodiment of the present disclosure.

Figure 5 is a flowchart of step S410 in one embodiment of the present disclosure.

Figure 6 is a schematic diagram of determining the first time window and the second time window in one embodiment of the present disclosure.

FIG. 7 is a schematic diagram of determining the first time window and the second time window in another embodiment of the present disclosure.

Figure 8 is a flowchart of step S230 in one embodiment of the present disclosure.

Figure 9 is a flowchart of step S820 in one embodiment of the present disclosure.

Figure 10 is a flowchart of step S240 in one embodiment of the present disclosure.

Figure 11 is a flow chart of a domain name reflection attack detection method related to the present disclosure.

Figure 12 is a block diagram of a domain name reflection attack detection device related to the present disclosure.

FIG. 13 shows a schematic structural diagram of a computer system suitable for implementing an electronic device according to an embodiment of the present disclosure.

Detailed ways

Reference will now be made in detail to exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings refer to the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present disclosure. Rather, they are merely examples of apparatus and methods consistent with aspects of the disclosure as detailed in the appended claims.

The block diagrams shown in the figures are functional entities only and do not necessarily correspond to physically separate entities. That is, these functional entities may be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and/or processor devices and/or microcontroller devices. entity.

The flowcharts shown in the drawings are only illustrative, and do not necessarily include all contents and operations/steps, nor must they be performed in the order described. For example, some operations/steps can be decomposed, and some operations/steps can be merged or partially merged, so the actual order of execution may change according to the actual situation.

It should also be noted that the “plurality” mentioned in this disclosure refers to two or more. "And/or" describes the relationship between related objects, indicating that there can be three relationships. For example, A and/or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. The character "/" generally indicates that the related objects are in an "or" relationship.

DNS (Domain Name System) is a distributed database on the Internet that maps domain names and IP addresses (Internet Protocol Address) to each other. It allows users to access the Internet more conveniently without having to remember what can be accessed. The IP number string read directly by the machine. The process of finally obtaining the IP address corresponding to the host name through the host name is called domain name resolution.

During the normal domain name resolution process, the source IP address initiates a DNS request to the DNS server. The DNS server will perform domain name resolution based on the DNS request, obtain a DNS reply packet, and return the DNS reply packet to the source IP address. After domain name resolution, a DNS reply will be obtained. The packet is larger than the DNS request, and the reflection attack takes advantage of the fact that the DNS reply packet is larger than the DNS request, amplifies the traffic, forges the IP address of the victim network, and sends a DNS request to the DNS server with the IP address of the victim network. This directs traffic of DNS reply packets to servers on the victim's network. Please refer to FIG. 1 , which is a schematic diagram of an implementation environment related to the present disclosure. The implementation environment includes the botnet Zombie110, the DNS server 120, and the victim network Victim130. The botnet Zombie110, the DNS server 120, and the victim network Victim130 communicate with each other through wired or wireless networks.

Assume that the length of the data part of the DNS request is about 40 bytes, and the length of the data part of the DNS reply packet may reach 4000 bytes, which means that the attacker can use this technique to produce an amplification effect of about 100 times. Therefore, the attacker only needs to control a zombie network Zombie110 that can generate 150M traffic to carry out a DDoS attack of about 15G. As shown in Figure 1, the botnet Zombie110 sends a DNS request to the DNS server 120. After analysis and processing by the DNS server 120, it amplifies the DNS reply packet. The DNS server 120 sends the amplified DNS reply packet to the victim network Victim130. The attack The attacker carried out multiple implementations through the botnet Zombie110 to achieve the purpose of attacking the victim network Victim130.

In order to improve the traffic amplification effect, attackers often forge DNS requests with a response type of Non-Exist Domain type, forcing the DNS server 120 to initiate a recursive query, causing the DNS server 120's CPU (Central Processing Unit, Central Processing Unit), Ram (Random) to access memory (random access memory) has suddenly increased, and the existing domain name reflection attack detection scheme based on DNS server 120 availability monitoring on the DNS server side is often difficult to detect abnormalities, but in reality attackers often use multiple different public When a DNS server launches an attack, a single DNS server often does not have availability abnormalities. The domain name reflection attack detection scheme for monitoring link availability on the metropolitan area network close to the Victim130 side of the victim network will be interfered by other DDoS attack types. It also needs to be combined with Netflow information to determine whether it is a domain name reflection attack. Therefore, this detection scheme The judgment delay is large. A series of record-setting domain name reflection attack traffic peaks can paralyze the upstream link of the victim network Victim130, causing related research and judgment systems to fail to work.

The domain name reflection attack detection method provided by the embodiments of the present disclosure can construct a request sequence based on the number of domain name resolution requests initiated by the request object to be detected in multiple time windows. The request sequence can characterize the behavioral characteristics of the request object to be detected in multiple time windows. , in different time windows, the behavior of fake domain name resolution requests is highly self-similar, while the behavior of normal domain name resolution requests is unpredictable. Calculate the correlation coefficient according to the request sequence, and then determine whether the request object to be detected initiates a domain name reflection attack based on the correlation coefficient, which can timely and accurately determine whether to initiate a domain name reflection attack.

Figure 2 is a flow chart of a domain name reflection attack detection method according to an exemplary embodiment. This method can be applied to the implementation environment shown in Figure 1, and is specifically executed by the DNS server 120 in the implementation environment shown in Figure 1.

As shown in Figure 2, in an exemplary embodiment, the domain name reflection attack detection method may include steps S210 to S240, which are described in detail as follows:

Step S210: Obtain the number of domain name resolution requests initiated by the request object to be detected within multiple time windows.

In this disclosed embodiment, the request object to be detected is the source IP that sends the domain name resolution request to the DNS server. By analyzing the DNS network traffic or DNS system logs, the source IP and the time when the source IP sent the domain name resolution request can be obtained. stamp. According to the timestamp, obtain the number of domain name resolution requests initiated by the request object to be detected in multiple time windows. If the request object to be detected has not initiated domain name resolution requests within a certain time window, the number of requests corresponding to the time window is recorded. is 0.

In an exemplary embodiment of the present disclosure, please refer to Figure 3. Before step S210 to obtain the number of requests for domain name resolution requests initiated by the request object to be detected within multiple time windows, the method also includes step S310 and step S320. Detailed introduction as follows:

Step S310: Obtain the request object that initiated the domain name resolution request within the specified time window, and count the number of requests that the request object initiated the domain name resolution request within the specified time window.

In the embodiment of the present disclosure, when determining the request object to be detected, the request objects that send domain name resolution requests to the DNS server within the specified time window are obtained by parsing the DNS network traffic or DNS system logs, and the statistics of each request object in the specified time window are obtained. The number of requests for domain name resolution requests sent within the specified time window. For example, within the specified time window, a total of

Step S320: Determine the request object to be detected from the request objects based on the relationship between the request quantity and the preset quantity threshold.

In this disclosed embodiment, a preset quantity threshold is set in advance. Among the X request objects, request objects whose request quantity is smaller than the preset quantity threshold are filtered, and the remaining request objects can be used as request objects to be detected. After filtering, if there are multiple request objects to be detected, the request objects to be detected can be sorted in descending order according to the number of requests, and then based on the descending order, each request object to be detected can be detected to see whether it sends a domain name reflection attack.

Step S220: Construct the number of requests in multiple time windows according to the preset time relationship to obtain at least two request sequences.

In this disclosed embodiment, a request sequence is constructed based on the number of requests for each request object to be detected in each time window with a preset time relationship. For the same request object to be detected, in different time windows, the forged domain name resolution request behavior has a high degree of Self-similarity, based on the number of requests, can construct a request sequence that can characterize the behavior of the request object to be detected. Each request sequence consists of the number of requests in the corresponding time window, and the number of time windows corresponding to each request sequence same.

In an exemplary embodiment of the present disclosure, referring to Figure 4, in step S220, the number of requests in multiple time windows is constructed according to the preset time relationship to obtain at least two request sequences, including step S410 and step S420, The details are as follows:

Step S410: Divide multiple time windows into multiple first time windows and multiple second time windows according to a preset time relationship.

In the embodiment of the present disclosure, a first time window and a second time window are divided from multiple time windows. The sum of the number of the multiple first time windows and the multiple second time windows may be less than or equal to the multiple time windows. Through the third time window, A time window and a second time window, thereby forming two request sequences.

Relevant configuration parameters are defined in advance. The configuration parameters include time window t and cache time T, where T=n*t, n is a natural number >30; at the same time, the specified number k of the first time window and the second time window is configured. Among them, k*t should be greater than 30s, which can better overcome reasonable numerical fluctuations.

When multiple time windows are determined, n time windows within the adjacent previous cache time of the request object to be detected can be obtained; or n time windows within the adjacent cache time of the request object to be detected can be obtained; Or obtain the first p time windows adjacent to the specified time window and the last q time windows adjacent to the specified time window to form multiple time windows, where the sum of p+q+1 is equal to the number of time windows in the cache time n, at the same time, p or q are both greater than or equal to k. Within a cache time, the first time window and the second time window are divided from n time windows. The number of the first time window and the second time window are equal. At the same time, the number of the first time window and the second time window is equal to the number of the first time window and the second time window. sum is not equal to n.

Every time a time window t passes, the cache time T will add request objects within the latest time window t, and the request objects before the cache time T will be cleared and released. The DNS server always maintains a new request object every time window t. At the same time, unnecessary request objects are released within the cache time T to reduce the storage pressure on the DNS server.

Step S420: Construct a first request sequence based on the number of requests in multiple first time windows, and construct a second request sequence based on the number of requests in multiple second time windows.

In the embodiment of the present disclosure, the first request sequence is constructed based on the number of requests in the first time window, the plurality of first time windows are arranged in the order of time, and then the first request sequence is constructed based on the number of requests in the first time window according to the order of arrangement. A request sequence, according to the dictionary format of {src IP:[request number 1, request number 2,..., request number k]}, generate the first request sequence, such as 1.1.1.1: [20, 20,...], a total of k The number of requests in a time window, 1.1.1.1 represents the request object to be detected whose source IP address is 1.1.1.1.

Similarly, the first request sequence is constructed based on the number of requests in the second time window, the multiple second time windows are arranged in the order of time, and then the second request sequence is constructed based on the number of requests in the second time window according to the order. , generate the second request sequence according to the dictionary format of {src IP:[request quantity a, request quantity b,..., request quantity j]}.

In an exemplary embodiment of the present disclosure, please refer to FIG. 5 , multiple time windows are continuous time windows; in step S410, the multiple time windows are divided into multiple first time windows and Multiple second time windows, including step S510 and step S520, are described in detail as follows:

Step S510: Determine a specified number of consecutive time windows as multiple first time windows among multiple consecutive time windows.

In the embodiment of the present disclosure, the multiple time windows are n time windows within the adjacent cache time of the specified time window of the request object to be detected, or the adjacent time windows after the specified time window of the request object to be detected are acquired. When n time windows within a cache time are obtained, within these n time windows, according to the order of each time window, the first k consecutive time windows can be obtained as the first time window. As shown in Figure 6, the multiple time windows shown in Figure 6 are n time windows within the adjacent previous cache time of the specified time window of the request object to be detected, and the 1st to kth time windows are directly as the first time window.

In another embodiment, when multiple time windows are obtained by obtaining the first p time windows adjacent to the specified time window and the last q time windows adjacent to the specified time window, the continuous time windows are determined in the first p time windows. k time windows as the first time window, or determine k consecutive time windows in the last q time windows as the first time window, as shown in Figure 7. Among the multiple time windows shown in Figure 7, A Indicates the specified time window. The time window on the left side of A is the first p time windows, and the time window on the right side of A is the next q time windows. The 1st to kth time windows in the first p time windows are directly used as First time window.

Step S520: In other time windows except the first time window, determine a specified number of time windows as multiple second time windows; wherein the latest first time window among the multiple first time windows is earlier than the multiple first time windows. The earliest second time window among the second time windows.

In the embodiment of the present disclosure, k time windows are randomly obtained as the second time window in other time windows except the first time window.

Specifically, as shown in Figure 6, when the multiple time windows are n time windows within the adjacent previous cache time of the specified time window for obtaining the request object to be detected, or the specified time window for obtaining the request object to be detected is When n time windows in the adjacent cache time are obtained, k time windows are randomly determined as the second time window within the k+1 to nth time windows through the Shuffle algorithm, that is, the current system time is obtained, and The current system time is used as a random factor to calculate a random number. The formula for calculating the random number is: m=rand(time)*(i+1)mod(n-k). The above formula indicates that a range is obtained based on the system time in [1, (n-k)], time represents the current system time, i+1 represents which second time window is being calculated, the value range of i is [0,k-1], after calculating the random number through the above formula , take the m+kth time window as the second time window, and repeat k times to get the required k time windows. If there are duplicates in the calculated random numbers, recalculate until k different ones are taken out time window as the second time window.

As shown in Figure 7, when multiple time windows are obtained by obtaining the first p time windows adjacent to the specified time window and the last q time windows adjacent to the specified time window, the first time is determined in the p time windows. After the window, k time windows are randomly determined as the second time window within the next q time windows. Similarly, when k time windows are randomly determined as the second time window, the Shuffle algorithm is used to randomly determine the k time windows as the second time window. Determine k time windows as the second time window, that is, obtain the current system time, use the current system time as a random factor, and calculate a random number. The formula for calculating the random number is: m=rand(time)*(i+1) mod(q), the above formula represents obtaining a random number in the range [1, q] based on the system time, time represents the current system time, i+1 represents which second time window is being calculated, and the value range of i is [0,k-1], after calculating the random number through the above formula, take the m+p+1th time window as the second time window, and repeat k times to get the required k time windows. If the calculated If there are duplicates of random numbers, the calculation will be re-calculated until k different time windows are taken out as the second time window.

In other embodiments, when the multiple time windows are n time windows within the previous cache time adjacent to the specified time window for obtaining the request object to be detected, or adjacent to the specified time window for obtaining the request object to be detected, When the n time windows within the last cache time are obtained, within the n time windows, the last k consecutive time windows can be obtained as the first time window, and then in the remaining time windows, k time windows are randomly determined as Second time window. When k time windows are randomly determined, consistent with the above, k time windows are randomly determined as the second time window through the Shuffle algorithm.

In another embodiment, when multiple time windows are obtained by obtaining the first p time windows adjacent to the specified time window and the last q time windows adjacent to the specified time window, the first p time windows can be randomly selected. Determine k time windows as the second time windows, and then determine k consecutive time windows in the next q time windows as the second time windows. When k time windows are randomly determined, consistent with the above, k time windows are randomly determined as the second time window through the Shuffle algorithm.

Step S230: Calculate the correlation coefficient between at least two request sequences.

In the embodiment of the present disclosure, the correlation coefficient between at least two request sequences is calculated. If the request sequence includes two, the correlation coefficient between the two request sequences is directly calculated; if the request sequence has more than two, each request is calculated. The correlation coefficient between two sequences is calculated, and the average coefficient is calculated based on the correlation coefficient between each request sequence, and the average coefficient is used as the correlation coefficient between at least two request sequences.

In an exemplary embodiment of the present disclosure, referring to Figure 8, at least two request sequences include a first request sequence and a second request sequence; in step S230, calculating a correlation coefficient between the at least two request sequences includes the steps S810 and step S820 are described in detail as follows:

Step S810: perform an averaging operation on the number of requests included in the first request sequence to obtain a first average value, and perform an averaging operation on the number of requests included in the second request sequence to obtain a second average value.

In the embodiment of the present disclosure, the first average value X is calculated according to the number of requests in the first request sequence, and the second average value is calculated according to the number of requests in the second request sequence.

Step S820: Calculate the correlation coefficient between the first request sequence and the second request sequence based on the first mean value, the second mean value, the first request sequence, and the second request sequence.

In the embodiment of the present disclosure, the correlation coefficient between the first request sequence and the second request sequence is calculated based on the calculated first mean value, the second mean value, the first request sequence, and the second request sequence.

In an exemplary embodiment of the present disclosure, referring to FIG. 9, in step S820, the first request sequence and the second request sequence are calculated according to the first mean value, the second mean value, the first request sequence, and the second request sequence. The correlation coefficient, including step S910 and step S920, is described in detail as follows:

Step S910: Perform a difference operation on each request number contained in the first request sequence and the first average value to obtain a plurality of first difference values, and compare each request number contained in the second request sequence and the second average value respectively. Perform a difference operation to obtain multiple second difference values.

In the embodiment of the present disclosure, a difference operation is performed between each request number in the first request sequence and the first average value, that is, the first average value is subtracted from each request number in the first request sequence to obtain a plurality of first differences. value, perform a difference operation between each request number in the second request sequence and the second mean value, that is, subtract the second mean value from each request number in the second request sequence, to obtain a plurality of second difference values.

Step S920: Calculate the correlation coefficient between the first request sequence and the second request sequence based on the plurality of first difference values and the plurality of second difference values.

In the embodiment of the present disclosure, the correlation coefficient between the first request sequence and the second request sequence is calculated based on a plurality of first difference values and second difference values.

Specifically, through the formula

Calculate the correlation coefficient between the first sequence and the second sequence, where r represents the correlation coefficient, X _j represents the j-th request quantity in the first request sequence, Y _j represents the j-th request quantity in the second request sequence, k Indicates that there are k requests in the first request sequence and the second request sequence respectively,

represents the first mean,

represents the second mean.

Step S240: Determine whether the request object to be detected initiates a domain name reflection attack based on the correlation coefficient between at least two request sequences.

In this disclosed embodiment, in different time windows, the forged domain name resolution request behavior is highly self-similar, while the normal domain name resolution request behavior is unpredictable. According to the correlation coefficient, it can be known that the request object to be detected is in different time windows. Whether the behaviors of domain name resolution requests initiated within the time window are similar,

When there is similarity, it can indicate that the request object to be detected has launched a domain name reflection attack.

In this disclosed embodiment, in different time windows, the forged domain name resolution request behavior is highly self-similar, while the normal domain name resolution request behavior is unpredictable. The embodiment of the present disclosure constructs a request sequence based on the number of domain name resolution requests initiated by the request object to be detected in multiple time windows. The request sequence can characterize the behavioral characteristics of the request object to be detected in multiple time windows, and the correlation coefficient is calculated based on the request sequence. Furthermore, based on the correlation coefficient, it can be accurately determined whether the request object to be detected initiates a domain name reflection attack. The domain name launch attack detection method provided by the present disclosure detects whether a domain name reflection attack is initiated during the process of receiving a domain name resolution request, and can timely and accurately determine whether a domain name reflection attack is launched. Launch a domain name reflection attack.

In an exemplary embodiment of the present disclosure, please refer to Figure 10. In step S240, it is determined whether the request object to be detected initiates a domain name reflection attack based on the correlation coefficient between at least two request sequences, including steps S1010 to step S1030. The details are as follows:

Step S1010: Detect the relationship between the correlation coefficients of at least two request sequences and the preset threshold, and obtain the detection result.

In the embodiment of the present disclosure, the relationship between the correlation coefficient and the preset threshold is detected, that is, the correlation coefficient is compared with the preset threshold to obtain the detection result, and the preset threshold can be set to 0.5.

Step S1020: If the detection result indicates that the correlation coefficient is greater than or equal to the preset threshold, it is determined that the request object to be detected initiates a domain name reflection attack.

In this disclosed embodiment, if the correlation coefficient is greater than or equal to the preset threshold, it is determined that the request object to be detected initiates a domain name reflection attack, generates preset alarm information, and sends the preset alarm information to the victim network Victim130, that is, to the attacker through The forged source IP of the botnet Zombie110 sends preset alarm information to alert the victim network Victim130.

Step S1030: If the detection result indicates that the correlation coefficient is less than the preset threshold, it is determined that the request object to be detected has not initiated a domain name reflection attack.

In the embodiment of the present disclosure, if the correlation coefficient of the detection result representation is less than the preset threshold, it indicates that the domain name resolution request behaviors initiated by the request object to be detected in different time windows are not similar, that is, the request object to be detected does not initiate a domain name reflection attack.

In an exemplary embodiment of the present disclosure, please refer to Figure 11. Figure 11 illustrates a domain name reflection attack detection method according to an exemplary embodiment, including steps S1110 to step S1180. The details are as follows:

Step S1110: Obtain the system log and parse the system log to obtain multiple request objects and the timestamps of domain name resolution requests initiated by the multiple request objects.

In this disclosed embodiment, by parsing the system log, multiple request objects can be obtained, as well as the timestamp of the domain name resolution request sent by each request object.

Step S1120: According to the timestamp, obtain the request object that initiated the domain name resolution request within the specified time window, and count the number of requests that the request object initiated the domain name resolution request within the specified time window.

In the embodiment of the present disclosure, the time window t and the cache time T are pre-configured. According to the timestamp, the request object that initiates the domain name resolution request in the specified time window can be determined. Generally, within a time window, the corresponding request objects include multiple, Count the number of requests for each request object.

Step S1130: Determine the request object to be detected from the request objects based on the relationship between the request quantity and the preset quantity threshold.

In this disclosed embodiment, a preset quantity threshold is set in advance, and request objects whose request quantity is lower than the preset quantity threshold within a specified time window are filtered, and the remaining request objects can be used as request objects to be detected. At this time, There may be multiple request objects to be detected.

Step S1140: Obtain multiple time windows adjacent to the specified time window, and within the multiple time windows, determine a specified number of consecutive time windows as multiple first time windows, and use the Shuffle algorithm to divide the first time window into Among the other time windows, a specified number of time windows are randomly determined as multiple second time windows; the latest first time window among the multiple first time windows is earlier than the earliest second time window among the multiple second time windows. .

In the embodiment of the present disclosure, n time windows within the adjacent previous cache time of the specified time window are obtained, or n time windows within the adjacent subsequent cache time of the specified time window are obtained. The specified number is k, from Determine k consecutive time windows within n time windows as the first time windows, and then randomly determine k time windows as the second time windows from the remaining time windows through the Shuffle algorithm. Specifically, when determining the first time window, the 1st to kth time windows among n time windows are selected as the first time window. When determining the second time window, only the k+1th to nth time windows are considered. Time window, k time windows are randomly obtained from the k+1 to nth time window through the Shuffle algorithm as the second time window.

When there are multiple request objects to be detected, the first time window corresponding to each request object to be detected is the same, and the second time window is also the same. There is no need to separately determine the first time window and the second time window of each request object to be detected. Reduce the amount of calculation. This shuffle algorithm selects k time windows as the second time window, which can try to catch the attacker with highly similar behavioral characteristics within a relatively long time range, while normal DNS requests present a large randomness. sex. Through the Shuffle algorithm, the calculation speed of subsequent correlation coefficient judgment can be greatly improved.

Step S1150: Construct a first request sequence of the request object to be detected based on a specified number of first time windows, and construct a second request sequence of the request object to be detected based on a specified number of second time windows.

In the embodiment of the present disclosure, a corresponding first request sequence is constructed according to the number of requests of each request object to be detected in the first time window, and a corresponding second request sequence is constructed according to the number of requests for each request object to be detected in the second time window. Request sequence.

Step S1160: Calculate the correlation coefficient of the request object to be detected according to the first request sequence and the second request sequence.

In the embodiment of the present disclosure, the corresponding correlation coefficient is calculated based on the first request sequence and the second request sequence corresponding to each request object to be detected. The scheme for calculating the correlation coefficient has been described above and will not be described again here.

Step S1170: Detect the relationship between the correlation coefficient of the request object to be detected and the preset threshold, and obtain the detection result of the request object to be detected.

In the embodiment of the present disclosure, the correlation coefficient of each request object to be detected is compared with the preset threshold to obtain the corresponding detection result.

Step S1180: If the detection result representation correlation coefficient of the request object to be detected is greater than or equal to the preset threshold, it is determined that the request object to be detected initiates a domain name reflection attack, and preset alarm information is sent to the request object to be detected.

In the embodiment of the present disclosure, if the detection result representation correlation coefficient of the request object to be detected is greater than or equal to the preset threshold, then the request object to be detected is calibrated to launch a domain name reflection attack. Among the multiple request objects to be detected, there are multiple requests to be detected. When an object launches a domain name reflection attack, preset alarm information is sent to multiple request objects to be detected.

In this disclosed embodiment, in different time windows, the forged domain name resolution request behavior is highly self-similar, while the normal domain name resolution request behavior is unpredictable. The disclosed embodiment obtains the request object according to the system log, determines the request object to be detected according to the number of requests for domain name resolution requests initiated by the request object, and determines the first time window and the second time window of the request object to be detected from multiple time windows. The first time window of the request object to be detected is the same, and the second time window is also the same, which reduces the amount of calculation to a certain extent. Based on the number of requests for each request object to be detected in the first time window and the second time window, the object's Request sequence. The request sequence can characterize the behavioral characteristics of the request object to be detected in multiple time windows. The correlation coefficient is calculated based on the request sequence. Then based on the correlation coefficient, it can be accurately determined whether the request object to be detected initiates a domain name reflection attack. At the same time, a prediction is also generated. Set alarm information and send the preset alarm information to the request object to be detected, that is, send the preset alarm information to the source IP forged by the attacker through the botnet Zombie110 to remind the victim network Victim130. The domain name launch attack detection method provided by this disclosure detects whether a domain name reflection attack is initiated during the process of receiving a domain name resolution request, and can promptly and accurately determine whether a domain name reflection attack is initiated.

In an exemplary embodiment of the present disclosure, please refer to Figure 12. Figure 12 illustrates a domain name reflection attack detection device according to an exemplary embodiment, including:

The acquisition module 1210 is configured to obtain the number of requests for domain name resolution requests initiated by the request object to be detected within multiple time windows;

The construction module 1220 is configured to construct the number of requests in multiple time windows according to the preset time relationship to obtain at least two request sequences;

The calculation module 1230 is configured to calculate the correlation coefficient between at least two request sequences;

The determination module 1240 is configured to determine whether the request object to be detected initiates a domain name reflection attack based on the correlation coefficient between at least two request sequences.

In an exemplary embodiment of the present disclosure, building module 1220 includes:

A dividing sub-module configured to divide multiple time windows into multiple first time windows and multiple second time windows according to a preset time relationship;

The construction sub-module is configured to construct a first request sequence based on the number of requests in multiple first time windows, and construct a second request sequence based on the number of requests in multiple second time windows.

In an exemplary embodiment of the present disclosure, the multiple time windows are continuous time windows; divided into sub-modules, including:

The first determination unit is configured to determine a specified number of consecutive time windows as multiple first time windows in multiple consecutive time windows;

The second determination unit is configured to determine a specified number of time windows as multiple second time windows in other time windows except the first time window; wherein, the latest first time among the multiple first time windows The window is earlier than the earliest second time window of the plurality of second time windows.

In an exemplary embodiment of the present disclosure, at least two request sequences include a first request sequence and a second request sequence; the calculation module 1230 includes:

The operation submodule is configured to perform an averaging operation on the number of requests contained in the first request sequence to obtain a first average value, and perform an averaging operation on the number of requests contained in the second request sequence to obtain a second average value. ;

The calculation submodule is configured to calculate the correlation coefficient between the first request sequence and the second request sequence according to the first mean value, the second mean value, the first request sequence, and the second request sequence.

In an exemplary embodiment of the present disclosure, the calculation submodule includes:

The difference operation unit is configured to perform a difference operation on each request quantity contained in the first request sequence and the first mean value to obtain a plurality of first difference values, and to calculate each request quantity contained in the second request sequence respectively. Perform a difference operation with the second mean value to obtain multiple second difference values;

The calculation unit is configured to calculate the correlation coefficient between the first request sequence and the second request sequence according to the plurality of first difference values and the plurality of second difference values.

In an exemplary embodiment of the present disclosure, the domain name reflection attack detection device further includes:

The acquisition unit is configured to obtain the request object that initiates the domain name resolution request within the specified time window, and counts the number of requests that the request object initiates the domain name resolution request within the specified time window;

The request object to be detected determining unit is configured to determine the request object to be detected from the request objects based on the relationship between the number of requests and the preset quantity threshold.

In an exemplary embodiment of the present disclosure, the determining module 1240 includes:

The detection submodule is configured to detect the relationship between the correlation coefficient of at least two request sequences and the preset threshold, and obtain the detection result;

The first determination sub-module is configured to determine that the request object to be detected initiates a domain name reflection attack if the detection result representation correlation coefficient is greater than or equal to the preset threshold;

The second determination submodule is configured to determine that the request object to be detected has not initiated a domain name reflection attack if the detection result representation correlation coefficient is less than the preset threshold.

It should be noted that the device provided by the above embodiments and the method provided by the above embodiments belong to the same concept, and the specific manner in which each module, sub-module and unit performs operations has been described in detail in the method embodiments, here No longer.

Embodiments of the present disclosure also provide an electronic device, including: one or more processors; a storage device for storing one or more programs. When the one or more programs are processed by the one or more When executed, the electronic device is caused to implement the domain name reflection attack detection method provided in the above embodiments.

FIG. 13 shows a schematic structural diagram of a computer system suitable for implementing an electronic device according to an embodiment of the present disclosure.

It should be noted that the computer system 1300 of the electronic device shown in FIG. 13 is only an example, and should not bring any limitations to the functions and scope of use of the embodiments of the present disclosure.

As shown in Figure 13, the computer system 1300 includes a central processing unit (Central Processing Unit, CPU) 1301, which can be loaded into a random computer according to a program stored in a read-only memory (Read-Only Memory, ROM) 1302 or from a storage part 1308. Access the program in the memory (Random Access Memory, RAM) 1303 to perform various appropriate actions and processing, such as performing the method described in the above embodiment. In RAM 1303, various programs and data required for system operation are also stored. CPU 1301, ROM 1302 and RAM 1303 are connected to each other through bus 1304. An input/output (I/O) interface 1305 is also connected to bus 1304.

The following components are connected to the I/O interface 1305: an input part 1306 including a keyboard, a mouse, etc.; an output part 1307 including a cathode ray tube (Cathode Ray Tube, CRT), a liquid crystal display (Liquid Crystal Display, LCD), etc., and a speaker, etc. ; a storage part 1308 including a hard disk, etc.; and a communication part 1309 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1309 performs communication processing via a network such as the Internet. Driver 1310 is also connected to I/O interface 1305 as needed. Removable media 1311, such as magnetic disks, optical disks, magneto-optical disks, semiconductor memories, etc., are installed on the drive 1310 as needed, so that computer programs read therefrom are installed into the storage portion 1308 as needed.

In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product including a computer program carried on a computer-readable medium, the computer program comprising a computer program for performing the method illustrated in the flowchart. In such embodiments, the computer program may be downloaded and installed from the network via communications portion 1309, and/or installed from removable media 1311. When this computer program is executed by the central processing unit (CPU) 1301, various functions defined in the system of the present disclosure are performed.

It should be noted that the computer-readable medium shown in the embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the above two. The computer-readable storage medium may be, for example, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of computer readable storage media may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard drive, random access memory (RAM), read only memory (ROM), removable Programmable Read-Only Memory (Erasable Programmable Read Only Memory, EPROM), flash memory, optical fiber, portable compact disk read-only memory (Compact Disc Read-Only Memory, CD-ROM), optical storage device, magnetic storage device, or any of the above suitable The combination. In this disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying a computer-readable computer program therein. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device . Computer programs embodied on computer-readable media may be transmitted using any suitable medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. Each block in the flow chart or block diagram may represent a module, program segment, or part of the code. The above-mentioned module, program segment, or part of the code includes one or more executable components for implementing the specified logical function. instruction. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown one after another may actually execute substantially in parallel, or they may sometimes execute in the reverse order, depending on the functionality involved. It will also be noted that each block in the block diagram or flowchart illustration, and combinations of blocks in the block diagram or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or operations, or may be implemented by special purpose hardware-based systems that perform the specified functions or operations. Achieved by a combination of specialized hardware and computer instructions.

The units involved in the embodiments of the present disclosure can be implemented in software or hardware, and the described units can also be provided in a processor. Among them, the names of these units do not constitute a limitation on the unit itself under certain circumstances.

Another aspect of the present disclosure also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method as described above is implemented. The computer-readable storage medium may be included in the electronic device described in the above embodiments, or may exist separately without being assembled into the electronic device.

Another aspect of the present disclosure also provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the methods provided in the above embodiments.

The above contents are only preferred exemplary embodiments of the present disclosure and are not intended to limit the implementation of the present disclosure. Those of ordinary skill in the art can easily make corresponding modifications or modifications based on the main concept and spirit of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the protection scope required by the claims.

Claims (10)

1. A domain name reflection attack detection method, including:

   Obtain the number of domain name resolution requests initiated by the request object to be detected within multiple time windows;

   Construct the number of requests in the multiple time windows according to the preset time relationship to obtain at least two request sequences;

   Calculate the correlation coefficient between the at least two request sequences;

   According to the correlation coefficient between the at least two request sequences, it is determined whether the request object to be detected initiates a domain name reflection attack.
2. The method of claim 1, wherein the number of requests in the multiple time windows is constructed according to a preset time relationship to obtain at least two request sequences, including:

   Divide the plurality of time windows into a plurality of first time windows and a plurality of second time windows according to a preset time relationship;

   A first request sequence is constructed according to the number of requests in the plurality of first time windows, and a second request sequence is constructed according to the number of requests in the plurality of second time windows.
3. The method of claim 2, wherein the plurality of time windows are continuous time windows; and the plurality of time windows are divided into a plurality of first time windows and a plurality of third time windows according to a preset time relationship. Two time windows, including:

   Among multiple consecutive time windows, determine a specified number of consecutive time windows as the multiple first time windows;

   In other time windows except the first time window, the specified number of time windows is determined as the plurality of second time windows; wherein the latest first time window among the plurality of first time windows is The time window is earlier than the earliest second time window among the plurality of second time windows.
4. The method of claim 1, wherein the at least two request sequences include a first request sequence and a second request sequence; and calculating the correlation coefficient between the at least two request sequences includes:

   Perform an averaging operation on the number of requests contained in the first request sequence to obtain a first average value, and perform an averaging operation on the number of requests contained in the second request sequence to obtain a second average value;

   According to the first mean value, the second mean value, the first request sequence, and the second request sequence, a correlation coefficient between the first request sequence and the second request sequence is calculated.
5. The method of claim 4, wherein the first request sequence and the first request sequence are calculated based on the first mean value, the second mean value, the first request sequence, and the second request sequence. The correlation coefficient of the second request sequence includes:

   Perform a difference operation between each request number contained in the first request sequence and the first average value to obtain a plurality of first difference values, and compare each request number contained in the second request sequence with the first mean value respectively. The second mean value is subjected to a difference operation to obtain a plurality of second difference values;

   Calculate a correlation coefficient between the first request sequence and the second request sequence according to the plurality of first difference values and the plurality of second difference values.
6. The method according to any one of claims 1 to 5, wherein before obtaining the number of requests for domain name resolution requests initiated by the request object to be detected within multiple time windows, the method further includes:

   Obtain the request object that initiated the domain name resolution request within the specified time window, and count the number of requests that the request object initiated the domain name resolution request within the specified time window;

   The request object to be detected is determined from the request objects according to the relationship between the request quantity and the preset quantity threshold.
7. The method according to any one of claims 1 to 5, wherein determining whether the request object to be detected initiates a domain name reflection attack based on the correlation coefficient between the at least two request sequences includes:

   Detect the relationship between the correlation coefficient of the at least two request sequences and the preset threshold, and obtain the detection result;

   If the detection result indicates that the correlation coefficient is greater than or equal to the preset threshold, it is determined that the request object to be detected initiates a domain name reflection attack;

   If the detection result indicates that the correlation coefficient is less than the preset threshold, it is determined that the request object to be detected has not initiated a domain name reflection attack.
8. A domain name reflection attack detection device, including:

   The acquisition module is configured to obtain the number of requests for domain name resolution requests initiated by the request object to be detected within multiple time windows;

   A construction module configured to construct the number of requests in the multiple time windows according to a preset time relationship to obtain at least two request sequences;

   A calculation module configured to calculate the correlation coefficient between the at least two request sequences;

   The determination module is configured to determine whether the request object to be detected initiates a domain name reflection attack based on the correlation coefficient between the at least two request sequences.
9. An electronic device including:

   one or more processors;

   Storage device, used to store one or more programs, when the one or more programs are executed by the one or more processors, so that the electronic device implements any one of claims 1 to 7 Domain name reflection attack detection method.
10. A computer-readable storage medium having computer-readable instructions stored thereon. When the computer-readable instructions are executed by a processor of a computer, the computer is caused to perform the domain name reflection attack described in any one of claims 1 to 7. Detection method.

Images