CN104618351A - Method for identifying DNS spoofing attack packet and detecting DNS spoofing attack - Google Patents

Abstract

The invention relates to a method for identifying DNS spoofing attack packets and detecting DNS spoofing attacks. For several DNS response packets with the same five-tuple (transaction identifier, source IP address, destination IP address, source port number, and destination port number), those that meet the following four characteristics are DNS spoofing packets: only one response Domain, the response domain is an IP address; the response domain does not contain Cname type records; the TTL value corresponding to the A type record in the response packet is unreasonable; the response packet does not contain the authorization domain and additional domain. When detecting DNS spoofing attacks, first capture all DNS data packets between the client and the domain name server, and then judge whether each response packet is a DNS spoofing attack packet according to the above method. The invention can effectively identify the DNS spoofing attack packet and detect the DNS spoofing attack in time, and has high practical value for improving the attack resistance of the DNS system and protecting the DNS service system.

Description

A method for identifying DNS spoofing attack packets and detecting DNS spoofing attacks

technical field

The invention belongs to the field of communication technology and DNS technology, and in particular relates to a method for identifying DNS spoofing attack packets and a method for detecting DNS spoofing attacks by using the method.

Background technique

DNS is a distributed database system used to manage the mapping of host names and address information. It associates names that are easy to remember and understand with boring IP addresses, which greatly facilitates people's use. DNS is the basis of most network applications, but due to the design flaws of the protocol itself, it does not provide appropriate information protection and authentication mechanisms, making DNS vulnerable to attacks.

DNS spoofing (DNS Spoofing) is the use of design flaws - only one sequence number (transaction identifier) is used as the basis for identifying the validity of DNS response messages, causing attackers to forge a large number of DNS responses after listening to query requests Packets are sent to the client, and these response packets redirect some legitimate domain names to malicious IP addresses, thereby achieving the purpose of deceiving users. DNS spoofing attacks may exist between the client and the DNS server, or between DNS servers. The attacked object may not only be the DNS Server or a certain host, but may also be a user application, such as a browser, domain name query Software (NS lookup), etc.

At present, some scholars have given solutions to defend against domain name system spoofing attacks. For example, A. Sherrister uses encrypted hash functions to generate transaction identifiers (Transaction IDs) and construct new DNS queries to improve the attack resistance of requests. Ma Shaobu converts the letters in the query domain name field in the request packet to upper and lower case according to predetermined rules to prevent DNS spoofing attacks. But these preventive strategies have not been well promoted and applied.

At the same time, the detection of spoofing attacks is also a hot issue in the field of DNS security research. According to the principle of DNS spoofing attack, if attacked, the client will receive at least two response packets, one spoofing packet and one legal response packet. Therefore, if a DNS request receives two or more response packets within a period of time, it may have been subjected to a DNS spoofing attack, and if there is a spoofing packet in the response packet, it indicates that it must have been subjected to a spoofing attack.

Contents of the invention

Aiming at the above problems, the present invention provides a method for identifying DNS spoofing attack packets, and a method for further detecting DNS spoofing attacks by using the method.

Specifically, the technical scheme adopted in the present invention is as follows:

A method for identifying DNS spoofing attack packets, several DNS response packets with the same quintuple (transaction identifier, source IP address, destination IP address, source port number, destination port number), which meet the following four characteristics at the same time Spoof packets for DNS:

There is only one response domain, and the response domain is an IP address;

The response field does not contain records of type Cname;

The TTL value corresponding to the class A record in the response packet is unreasonable;

Authorized fields and additional fields are not included in the response packet.

A method for detecting DNS spoofing attacks, the steps comprising:

1) Capture all DNS packets between the client and the domain name server through bypass monitoring;

2) Select the response packets that arrive within a certain time interval, and establish a request-reply mapping table according to the transaction identifier;

3) Extract the number of response domains, the number of authorized domains, the number of additional domains, the resource record type of the response domain and the corresponding TTL value in each response message;

4) Determine whether each response packet is a DNS spoofing attack packet according to the above four characteristics, and discard it if it is a DNS spoofing attack packet, otherwise it is a legal DNS response packet, and forward it to the client.

The invention can simply and effectively identify DNS spoofing attack packets, detect DNS spoofing attacks in time, and has high practical value for improving the attack resistance of the DNS system and protecting the DNS service system.

Description of drawings

FIG. 1 is a flow chart of the steps of the method for detecting spoofing attacks of the present invention.

Detailed ways

In order to make the above objects, features and advantages of the present invention more obvious and understandable, the present invention will be further described below through specific embodiments and accompanying drawings.

Normally, after receiving the response message returned by the upper-level DNS server, the local DNS server will process the message as follows:

Check whether the destination port of the response message is equal to the source port of the DNS request message. If not, it means that it is not a response to the request, and the protocol stack will discard the data message;

Check the problem domain of the response message, that is, make sure that the domain name of the request in the response packet is consistent with the domain name in the request packet;

Check the transaction ID (TID) of the response message. A TID will be included in the query request sent by the DNS server to identify a certain query. The TID will also be included in the received DNS reply packet, indicating that it is for a certain query. The response to the request. The DNS server judges the request-response pair according to the TID, and discards the data message if the two TIDs are not equal;

Check the authorized domain and additional domain. The domain names in the authorized domain and additional domain must belong to the same subdomain name as the domain name in the problem domain;

If all the above conditions are met, the domain name server will accept the response packet as a reply to its query request and cache the result. To sum up, if the attacker successfully spoofs the DNS server, the above four conditions must be met, and none of them is dispensable.

On the other hand, for a DNS request, the domain name server will not give multiple response packets with different results. Even if the target domain name corresponds to multiple IP addresses, the DNS server will return in one DNS response packet, but there are multiple response domains. That's all. Therefore, if a request corresponds to two or more quintuples (transaction identifier, source IP address, destination IP address, source port number, destination port number) that are the same and have different response fields, it is suspected that it may be attacked. spoofing attack.

At present, all DNS clients handle DNS response packets by simply trusting the first arriving data packets and discarding all later arrivals without any analysis of the legality of the data packets. Therefore, in order to attack successfully, the attacker must ensure that the spoofed packet sent by it reaches the client before the legitimate response packet. This determines the simplification of the spoofed packet, which is specifically reflected in the fact that there is only one response domain, and there is no authorization domain and additional domain. In contrast, the information of the legal response packet is relatively rich. In addition to multiple response fields, there are usually authorized fields, additional fields, and so on.

Tom Callahan et al. (Tom Callahan, Mark Allman, Michael Rabinovich. On Modern DNS Behavior and Properties. SIGCOMM ACM Special Interest Group on Data communication. 2013) pointed out in a paper published in June 2013: 40% of domain names have a TTL value less than One minute, 50% of domain names are less than 350 seconds, 80% are less than one hour, and only about 1% of domain names have TTL values exceeding one day; while Rajab et al. (RajabM A, Monrose F, Terzis A, et al. cloud:DNS-based estimation and its applications[C].Applied Cryptography and Network Security,2008:21-38.) Measured the authoritative TTL values of the world's top 100 website domain names on the Alexa website, indicating that: about 85% of the domain names The TTL value is less than 1 hour. The ultimate goal of a DNS spoofing attack is to induce users to visit a malicious website to perform malicious acts such as fraud and data theft. The attacker hopes that this DNS record will be cached in the domain name server for as long as possible to expand the scope of the attack. Therefore, the spoofed response packet contains The TTL value is usually very large and unreasonable, which is specifically reflected in the TTL value of a class A record (mapping a domain name to a corresponding IPv4 address) greater than one hour, or even more than one day.

The record of type Cname marks the regular name corresponding to the alias. In order to return the spoofed data packet to the client as soon as possible, it is necessary to save the construction time of the data packet as much as possible. Therefore, even if the requested domain name is an alias, the spoofed response packet does not contain a record of the Cname type.

The reasons for the formation of the four major characteristics of the DNS spoofing attack packet have been explained above, and the attack detection system will be described in detail next.

Fig. 1 is a flow chart of the method for detecting spoofing attacks provided by the present invention, and the specific steps include:

101. Capture all DNS request packets and response packets through bypass monitoring;

102. Obtain the sending time T of the DNS request packet, select all response packets that arrive before time T+ΔT, and establish a mapping table based on the transaction ID; ΔT is delayed from the request response (the client sends the request to the receipt of the first response Packet time interval) is a relatively large time interval. Experimental measurements show that the request response delay is less than 1 second, so ΔT can take a value of 2 to 5 seconds;

103. Based on the network data packet capture development kit Libpcap, programming implements protocol analysis on captured DNS data packets, and extracts the number of response domains, the number of authorized domains, the number of additional domains, and the number of response domains in each response message Resource record type, corresponding TTL value and other information;

104. Determine whether each response packet is a spoofing attack packet in turn according to the four features proposed by the present invention, if yes, then perform step 105, if not, then perform step 106;

105. Discard DNS spoofing attack packets;

106. This packet is a legal DNS response packet, and is forwarded to the target domain name system client.

The above embodiments are only used to illustrate the technical solution of the present invention and not to limit it. Those of ordinary skill in the art can modify or equivalently replace the technical solution of the present invention without departing from the spirit and scope of the present invention. The scope of protection should be determined by the claims.

Claims (6)

1. A method for identifying DNS spoofing attack packets, characterized in that, for several DNS response packets that are identical in transaction identifier, source IP address, destination IP address, source port number and destination port number, meet the following four characteristics simultaneously The DNS spoofing package is: a) There is only one response domain, and the response domain is an IP address; b) The response domain does not contain records of type Cname; c) The TTL value corresponding to the class A record in the response packet is unreasonable; d) Authorized fields and additional fields are not included in the response packet. 2. The method according to claim 1, wherein the TTL value corresponding to the type A record is unreasonable, which means that the TTL value exceeds 1 hour. 3. A method for detecting DNS spoofing attacks, comprising the steps of: 1) Capture all DNS packets between the client and the domain name server through bypass monitoring; 2) Select the response packets that arrive within a certain time interval, and establish a request-reply mapping table according to the transaction identifier; 3) Extract the number of response domains, the number of authorized domains, the number of additional domains, the resource record type of the response domain and the corresponding TTL value in each response message; 4) adopting four features in the method described in claim 1 to judge whether each response packet is a DNS spoofing attack packet, if it is a DNS spoofing attack packet, it is discarded, otherwise it is a legal DNS response packet, which is forwarded to the client end. 4. The method according to claim 3, characterized in that: step 2) first obtain the sending time T of the DNS request packet, then select all response packets that arrive before the time T+ΔT, and establish a mapping according to the transaction identifier Table, the ΔT is a time interval greater than the time interval from the client sending a request to receiving the first response packet. 5. The method according to claim 4, characterized in that: said ΔT is 2-5 seconds. 6. The method according to claim 3, characterized in that: step 3) implements protocol analysis on the captured DNS data packets through programming, and then extracts information in each response message.