CN106209852A - A kind of DNS refusal service attack defending method based on DPDK - Google Patents

Abstract

The invention discloses a kind of DNS refusal service attack defending method based on DPDK, comprise the following steps: DPDK reads DNS query request data package；Use whether DNS refusal service detection module detection packet is attack, if attacking then packet discard, otherwise forward the packet to KNI module；Packet is forwarded to dns resolution program through kernel protocol stack by KNI module, resolves packet；The present invention uses DPDK application to process, and improves the unit disposal ability of dns server, and decreases development and maintenance cost.

Description

A kind of DNS refusal service attack defending method based on DPDK

Technical field

The present invention relates to a kind of refusal service attack defending method, be specifically related to a kind of DNS based on DPDK refusal service Attack defense method.

Background technology

DNS is a Internet infrastructure service, the distributed data base mutually mapped as domain name and IP address, makes user The Internet can be accessed easily；When user is by a certain website of domain name access, can first initiate a DNS query and ask Dns server, the IP address that nslookup is corresponding, then user utilizes this IP address to go to access the resource of server；But one A little illegal or malicious user to dns server, causes service by the substantial amounts of Botnet of control, the inquiry request initiating to forge Device cannot process normal request, to reach the purpose attacked；Dns server uses Unix(Unix-like mostly at present) be System platform, the defence method of existing DNS Denial of Service attack is speed limit or closure inquiry request in system level, i.e. from NIC (network interface card) receives inquiry request packet, after the relief area of kernel state and driver process, data is copied to user The DNS of state detects program, if detection finds ddos attack, then performs speed limit or the closure action pre-set, packet discard, If the DNS service program that normal legal inquiry request then forwards requests to rear end completes to resolve；Existing DNS refuses clothes In business attack defense method, all of DNS query request data package is intended to after the protocol stack of kernel state processes transfer to user again The DDoS of state detects program, including the illegal request forged；Kernel protocol stack is made to become the bottleneck of performance, and at unit Reason ability is relatively low, and time especially by a large amount of ddos attack, the service quality of dns server is substantially reduced, it is impossible to meet quickly The business demand of development.

Summary of the invention

The present invention provides a kind of unit disposal ability improving dns server, and performance preferably DNS based on DPDK refuses Service attack defence method.

The technical solution used in the present invention is: a kind of DNS refusal service attack defending method based on DPDK, including following Step:

DPDK reads DNS query request data package；

Use whether DNS refusal service detection module detection packet is attack, if attacking then packet discard, on the contrary will Packet is forwarded to KNI module；

Packet is forwarded to dns resolution program through kernel protocol stack by KNI module, resolves packet.

Further, described DNS refusal service detection module detection process is as follows:

A, the data in DNS query request data package are carried out legal DNS head detection, if not conforming to rule packet discard, Otherwise proceed to step B；

B, obtaining DNS query data, whether be domain name service area in, if not in service area, abandon number if detecting it According to bag, otherwise proceed to step C；

C, detection data, the most by ddos attack, then perform closure or speed limit if it find that attack, on the contrary the step of proceeding to D；

Whether D, detection query rate reach the threshold value set, if it exceeds the threshold value set, then perform closure or speed limit, otherwise Proceed to step E；

E, forwarding packet；

In step C and step D, if performing closure, abandoning all packets, deblocking proceeds to step E；If performing speed limit, Discarded part divided data makes query rate be limited in threshold range, and the deblocking of predetermined execution time to after date proceeds to step E.

The invention has the beneficial effects as follows:

(1) present invention uses DPDK application to process, and improves the unit disposal ability of dns server, enabling defence scale Bigger DNS Denial of Service attack；

(2) The present invention reduces development and maintenance cost, low cost；

(3) present invention performs different defence action to attacking, and can realize automatically unsealing after reaching the execution time.

Accompanying drawing explanation

Fig. 1 is the flowage structure figure of the present invention.

Fig. 2 is the workflow diagram of DNS refusal service detection module in the present invention.

Fig. 3 is existing DNS refusal service attack defending method flow diagram.

Detailed description of the invention

The present invention will be further described with specific embodiment below in conjunction with the accompanying drawings.

As in figure 2 it is shown, a kind of DNS refusal service attack defending method based on DPDK, comprise the following steps:

DPDK reads DNS query request data package；

Use whether DNS refusal service detection module detection packet is attack, if attacking then packet discard, on the contrary will Packet is forwarded to KNI module；

Packet is forwarded to dns resolution program through kernel protocol stack by KNI module, resolves packet.

General DPDK is the packet reading DNS query request from NIC, then uses DNS refusal service detection module inspection Survey whether packet is attack, if attacking then packet discard, then forward the packet to KNI mould if not attacking Block；KNI module forwards the packet to kernel protocol stack, and kernel protocol stack processes and forwards packet to dns resolution program； Dns resolution program analysis request packet, inquires about data, Query Result is configured to corresponding data bag and returns to core protocol Stack；Kernel protocol stack process and forward corresponding data bag to KNI module, KNI resume module, and write data phase to network interface card NIC Should wrap, network interface card NIC sends data to user.

Further, it is characterised in that described DNS refusal service detection module detection process is as follows:

A, the data in DNS query request data package are carried out legal DNS head detection, if not conforming to rule packet discard, Otherwise proceed to step B；

B, obtaining DNS query data, whether be domain name service area in, if not in service area, abandon number if detecting it According to bag, otherwise proceed to step C；

C, detection data, the most by ddos attack, then perform closure or speed limit if it find that attack, on the contrary the step of proceeding to D；

Whether D, detection query rate reach the threshold value set, if it exceeds the threshold value set, then perform closure or speed limit, otherwise Proceed to step E；

E, forwarding packet；

In step C and step D, if performing closure, abandoning all packets, deblocking proceeds to step E；If performing speed limit, Discarded part divided data makes query rate be limited in threshold range, and the deblocking of predetermined execution time to after date proceeds to step E.

Be on the defensive before detection configuration to the domain name in service area, presets message rate threshold value, execution action and execution Time；Execution action includes speed limit, closure and normal；When certain domain name query rate within the unit interval exceedes predetermined threshold value Time, then perform speed limit or closure action, automatically carry out deblocking process when reaching the execution time；When attack being detected, can hold Row speed limit or closure action, two actions all can unseal to after date in the time automatically；" blocking " action is that all of request all can It is dropped, and " speed limit " action is that request speed is limited in threshold range, that is a part can be abandoned, let pass one Point；Defence configuration can carry out self-defined according to actual needs, as message rate threshold value, execution time etc. can sets itself, use Family can be according to the regulation defence configuration of actual attack situation.

The present invention utilizes the poll pattern of DPDK, caching, big page table management and without characteristics such as lock mechanisms, improves DNS service The unit disposal ability of device, performance reaches ten million rank, enabling defend more massive DNS Denial of Service attack, simultaneously Compared to prior art, decrease substantial amounts of development and maintenance cost.

Wen Zhong, DNS(Domain Name Server) domain name system, DDoS(Distributed Denial of Service) distributed denial of service attack, DPDK(Data Plane Development Kit) datum plane development kit, KNI(Kernel NIC Interface) a kind of interface mutual with kernel protocol stack, IP address (Internet Protocol Address), a kind of Internet protocol address, NIC(Network interface controller) network adapter, it is commonly called as Network interface card, Unix is existing a kind of computer operating system, has the feature of multitask, multi-user.

At present, also have and DNS Denial of Service attack detection program is embodied as kernel module, kernel module carry out detection and attack Hit and complete defence；Compared with the method for the present invention, the complexity of developing kernel module is the highest, the cost of later maintenance simultaneously Put into the biggest；Although haveing a certain upgrade for DNS Denial of Service attack detection performance, but with the impact of performance of the present invention Compare also a certain distance.

The foregoing is only presently preferred embodiments of the present invention, not in order to limit the present invention, all essences in the present invention Any amendment, equivalent and the improvement etc. made within god and principle, should be included within the scope of the present invention.

Claims (2)

1. a DNS refusal service attack defending method based on DPDK, it is characterised in that comprise the following steps:

DPDK reads DNS query request data package；

Use whether DNS refusal service detection module detection packet is attack, if attacking then packet discard, on the contrary will Packet is forwarded to KNI module；

Packet is forwarded to dns resolution program through kernel protocol stack by KNI module, resolves packet.

A kind of DNS refusal service attack defending method based on DPDK the most according to claim 1, it is characterised in that institute State DNS refusal service detection module detection process as follows:

A, the data in DNS query request data package are carried out legal DNS head detection, if not conforming to rule packet discard, Otherwise proceed to step B；

B, obtaining DNS query data, whether be domain name service area in, if not in service area, abandon number if detecting it According to bag, otherwise proceed to step C；

C, detection data, the most by ddos attack, then perform closure or speed limit if it find that attack, on the contrary the step of proceeding to D；

Whether D, detection query rate reach the threshold value set, if it exceeds the threshold value set, then perform closure or speed limit, otherwise Proceed to step E；

E, forwarding packet；

In step C and step D, if performing closure, abandoning all packets, deblocking proceeds to step E；If performing speed limit, Discarded part divided data makes query rate be limited in threshold range, and the deblocking of predetermined execution time to after date proceeds to step E.