TWI787168B - Defense method, device and system for network attack - Google Patents

Abstract

This application provides a network attack defense method, device and system, wherein the method includes: receiving a target DNS response message sent by an external network device to an internal network device; including the target DNS response message in the dynamic whitelist In the case of the source address, it is judged whether the target DNS response message meets the preset condition; if the target DNS response message meets the preset condition, the target DNS response message is discarded; wherein the preset condition is at least Including: the target domain name in the target DNS response message is not included in the historical domain name record, and each historical domain name in the historical domain name record is the historical domain name sent from the external network device Extracted from the DNS response message. This application can filter out DNS response messages from real sources attacking intranet devices with different network domain names, thereby alleviating the impact of DNS response attacks on services and networks.

Description

Defense method, device and system for network attack

The present application relates to the field of network technology, in particular to a method, device and system for defending against network attacks.

With the continuous advancement of network technology, there are more and more network attacks in the network field. At present, distributed denial of service attack (Distributed Denial of Service, DDoS) has become a relatively serious attack method in many network attacks. In the DDOS attack, the DNS response attack has become a mainstream attack type, and the DNS response attack can also be called a Domain Name System (DNS, Domain Name System) response attack.

In order to prevent DNS response attacks, cleaning devices can be added to the original system to form a defense system. Referring to FIG. 1 , it is a schematic structural diagram of a defense system. It can be seen from the illustration that the bypass of the cleaning equipment is set on one side of the routing equipment.

In the case of cleaning device bypass settings, source detection can be used to clean the aggressive DNS response messages sent from external network devices to internal network devices. The specific cleaning process can be as follows: After the cleaning device receives the DNS response message sent by the external network device to the internal network device, it extracts the source address and determines whether the source address is included in the dynamic white list. If the source address is not included in the dynamic whitelist, then send a DNS Request message to the external network device as a detection message, if no DNS response message from the external network device is received, determine that the external network device is a false source, and discard the DNS Response message; if the DNS response message fed back by the external network device is received, and the domain name in the DNS response message meets certain conditions, then the external network device is determined to be the real source, and the IP address of the external network device is added to the dynamic white list middle. If the source address is included in the dynamic white list, that is, the external network device is the real source, the DNS response message will be forwarded.

DNS response attacks can be divided into attack types: real source attacks and false source attacks. Since the dynamic whitelist only contains IP addresses of real sources and does not contain IP addresses of false sources, the source detection method can only clean DNS response attacks initiated by false sources, but not DNS response attacks initiated by real sources. .

In view of this, there is a need for a method to clean DNS response attacks initiated by real sources, so as to alleviate the impact of DNS response attacks on services and networks.

This application provides a network attack defense method, device and system, which cleans DNS response attacks initiated by real sources, so as to alleviate the impact of DNS response attacks on services and networks.

In order to achieve the above purpose, this application provides the following technical means: a method for defending against network attacks, including: receiving a target DNS response message sent by an external network device to an internal network device; including the target DNS in the dynamic whitelist In the case of the source address in the response message, it is judged whether the target DNS response message meets the preset condition; if the target DNS response message meets the preset condition, the target DNS response message is discarded; wherein, the preset The set conditions at least include: the target domain name in the target DNS response message is not included in the historical domain name record, and each historical domain name in the historical domain name record is obtained from the external network device Extract from historical DNS response messages sent.

Preferably, the preset condition further includes: the time interval between the first sending time and the second sending time when the external network device initiates access to the target network domain name is less than a preset time interval; wherein, the first The sending time is the sending time of the target DNS response message, and the second sending time is the latest time when the external network device sent the DNS response message containing the target domain name before the first sending time.

Preferably, the method further includes: forwarding the target DNS response message to the intranet device when the time interval is not less than a preset time interval.

Preferably, it also includes: if the target domain name in the target DNS response message is not included in the historical domain name record, storing the target domain name and the sending time of the target DNS response message in the historical domain name record.

Preferably, it also includes: according to the historical domain name record corresponding to the source address of the external network device, calculating the ratio of the number of domain names whose number of hits exceeds the preset number to the number of all domain names; wherein , the historical domain name record includes all domain names in the historical DNS response message sent by the external network device and the number of hits of each domain name; the preset number of times is a natural number not less than 3; If the ratio is greater than the preset ratio, delete the source address of the external network device in the dynamic white list; add the source address of the external network device to the dynamic black list.

Preferably, the method for calculating the number of hits of each domain name in the historical domain name record includes: after receiving a DNS response message, searching for the domain name in the DNS response message in the historical domain name record domain name; increasing the number of hits of said domain name by 1; wherein, the initial value of the number of hits of each domain name is zero.

Preferably, the preset condition further includes: the total flow value of the traffic value of the target DNS response message and the traffic value of the historical DNS response message is greater than the preset traffic value; wherein, the historical DNS response message is All DNS response messages sent by the external network device before sending the target DNS response messages.

Preferably, the method further includes: when the total traffic value is greater than the preset traffic value, deleting the source address in the dynamic whitelist; adding the source address to a dynamic blacklist.

Preferably, the calculation process of the traffic value of the historical DNS response message includes: after the source address of the external network device sends a DNS response message, superimposing the DNS response message on the traffic value of the historical DNS response message the flow value of the historical DNS response message; the initial value of the flow value of the historical DNS response message is zero.

Preferably, the method further includes: discarding the target DNS response message when the source address in the target DNS response message is included in the dynamic blacklist.

A network attack defense device, comprising: a receiving unit, configured to receive a target DNS response message sent by an external network device to an internal network device; a judging unit, configured to include the target DNS response message in a dynamic whitelist In the case of the source address, judging whether the target DNS response message meets a preset condition; a first discarding unit, configured to discard the target DNS response message if the target DNS response message meets a preset condition; wherein, The preset condition at least includes: the target domain name in the target DNS response message is not included in the historical domain name record, and each historical domain name in the historical domain name record is obtained from the foreign Extract from historical DNS response messages sent by network devices.

Preferably, the preset condition further includes: the time interval between the first sending time and the second sending time when the external network device initiates access to the target network domain name is less than a preset time interval; wherein, the first The sending time is the sending time of the target DNS response message, and the second sending time is the latest time when the external network device sent the DNS response message containing the target domain name before the first sending time.

Preferably, it further includes: a forwarding unit, configured to forward the target DNS response message to the intranet device when the time interval is not less than a preset time interval.

Preferably, it also includes: a storage unit, used to save the target domain name and the target DNS response message if the target domain name in the target DNS response message is not included in the historical domain name record The sending time of is stored in the historical domain name record.

Preferably, it also includes: a ratio calculation unit, configured to calculate the number of domain names whose hit times exceed a preset number and all domain names according to the historical domain name records corresponding to the source address of the external network device. The ratio of the number of names; wherein, the historical domain name records include all domain names and the number of hits of each domain name in the historical DNS response message sent by the external network device; the preset number of times is not a natural number less than 3; the first deletion unit is used to delete the source address of the external network device in the dynamic white list if the ratio is greater than the preset ratio; the first addition unit is used to add the Add the source address of the external network device to the dynamic blacklist.

Preferably, it also includes: a hit count calculation unit, which is used to search the historical domain name record for the domain name in the DNS response message after receiving a DNS response message; The count is incremented by 1; where the hit count for each domain name is initially zero.

Preferably, the preset condition further includes: the total flow value of the traffic value of the target DNS response message and the traffic value of the historical DNS response message is greater than the preset traffic value; wherein, the historical DNS response message is All DNS response messages sent by the external network device before sending the target DNS response messages.

Preferably, it also includes: a second deleting unit, configured to delete the source address in the dynamic whitelist when the total traffic value is greater than the preset traffic value; a second adding unit, using Then add the source address to the dynamic blacklist.

Preferably, it also includes: a traffic calculation unit, configured to superimpose the traffic value of the DNS response message on the traffic value of the historical DNS response message after the source address of the external network device sends a DNS response message; The initial value of the flow value of the historical DNS response message is zero.

Preferably, it further includes: a second discarding unit, configured to discard the target DNS response message when the source address in the target DNS response message is included in the dynamic blacklist.

A network attack defense system, comprising: external network equipment, cleaning equipment and internal network equipment; the external network equipment is used to send to the cleaning equipment a target DNS response message intended to be sent to the internal network equipment; the cleaning equipment is used to receive the target DNS response message that the external network device intends to send to the internal network device; if the dynamic whitelist includes the source address in the target DNS response message, determine whether the target DNS response message satisfies the predetermined Set a condition; if the target DNS response message meets a preset condition, then discard the target DNS response message; wherein, the preset condition includes at least: the target domain name in the target DNS response message is not included in the history In the domain name record, each historical domain name in the historical domain name record is extracted from the historical DNS response message sent by the external network device; the internal network device is used to receive the cleaning device after cleaning DNS response message.

As can be seen from the above technical content, the application has the following beneficial effects:

In the embodiment of this application, after confirming that the source address in the target DNS response message is in the dynamic whitelist, it can be confirmed that the external network device that initiated the target DNS response message is not a false source but a real source. One way for the real source to initiate DNS response attacks is to frequently send DNS response messages containing different domain names to attack intranet devices. Therefore, there is a historical domain name record in this application, which records all domain names sent by external network devices.

When the target domain name in the target DNS response message is not included in the historical domain name record, it indicates that the external network device sends the DNS response message containing the target domain name for the first time. In this case, the target DNS response message may be a DNS response attack initiated by an external network device using a different domain name. In order to prevent the internal network device from being attacked, the target DNS response message is discarded at this time.

Since normal external network devices have an automatic retransmission mechanism, if the DNS response message sent by the normal external network device is discarded, the normal external network device will resend the target DNS request message after receiving the resent DNS Request message from the internal network device. DNS response message, so this application will not affect the normal DNS response message sent to the intranet device. Attacking external network devices do not have a retransmission mechanism, so this application can filter out DNS response messages from real sources attacking internal network devices with different network domain names, thereby alleviating the impact of DNS response attacks on services and networks. road impact.

61‧‧‧receiving unit

62‧‧‧judgment unit

63‧‧‧The first discard unit

64‧‧‧Forwarding unit

65‧‧‧storage unit

66‧‧‧ratio calculation unit

67‧‧‧The first deletion unit

68‧‧‧The first addition unit

69‧‧‧Hit Count Calculation Unit

71‧‧‧Flow calculation unit

72‧‧‧The second deletion unit

73‧‧‧The second addition unit

74‧‧‧The second discarding unit

100‧‧‧Internet equipment

200‧‧‧routing equipment

300‧‧‧Intranet equipment

400‧‧‧Cleaning equipment

In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings that need to be used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings in the following description are only For some embodiments of the present application, those skilled in the art can also obtain other drawings according to these drawings without making progressive efforts.

Fig. 1 is a schematic structural diagram of a defense system; Fig. 2 is a flow chart of a defense method for a network attack disclosed in an embodiment of the present application; Fig. 3 is a diagram of another defense method for a network attack disclosed in an embodiment of the present application Flow chart; FIG. 4 is a flow chart of changing the dynamic whitelist in a defense method of a network attack disclosed in the embodiment of the application; FIG. 5 is a flow chart of another network attack defense method disclosed in the embodiment of the application ; FIG. 6 is a schematic structural diagram of a network attack defense device disclosed in the embodiment of the present application; FIG. 7 is a structural schematic diagram of another network attack defense device disclosed in the embodiment of the present application; A schematic structural diagram of another network attack defense device disclosed in the embodiment.

The technical solution in the embodiment of the application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiment of the application. Obviously, the described embodiment is only a part of the embodiment of the application, not all implementation example. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making progressive efforts belong to the scope of protection of this application.

In order to clearly introduce the application scenario of this application, see Figure 1, which is a network attack defense system, which specifically includes an external network device 100, a routing device 200, an internal network device 300, and a bypass setting with the routing device 200 Cleaning device 400 .

Among them, the external network device 100 is used to send to the cleaning device 400 a DNS response message intended to be sent to the internal network device 300; the DNS response message sent by the external network device may be mixed with an attacking DNS response message in the normal DNS response message. Respond to the message. Therefore, the cleaning device 400 is used to clean the offensive DNS response message in the normal DNS response message of the external network device, and then forward the normal DNS response message after cleaning the offensive DNS response message to the internal network device 300 .

On the basis of the network attack defense system shown in FIG. 1 , the present application provides a network attack defense method. In this application, only an external network device and an internal network device to be accessed by the external network device will be described in detail. It can be understood that the implementation methods of other external network devices and internal network devices are consistent with the methods provided in this application .

As shown in Figure 2, this application provides a defense method for network attacks, which is applied to cleaning equipment, and the method specifically follows steps S201~S203:

Step S201: Receive a target DNS response message that the external network device intends to send to the internal network device.

After the external network device receives the target DNS response message sending instruction, it will send the target DNS response message intended to be sent to the internal network device to the cleaning device. The target DNS response message includes: the source address (IP address) of the external network device that sends the target DNS response message, and the target domain name that the external network device needs to access the internal network device. After receiving the target DNS response message, the cleaning device can judge the target DNS response message to determine whether the target DNS response message is an offensive DNS response message.

Step S202: If the dynamic whitelist includes the source address in the target DNS response message, determine whether the target DNS response message satisfies a preset condition.

A dynamic whitelist is set in the cleaning device, and the IP addresses of real sources that are temporarily not offensive are stored in the dynamic whitelist. The non-aggressive IP addresses in the dynamic whitelist are temporary. When an IP address has changed to an offensive IP address according to the judgment conditions of this application, the IP address will be listed in the dynamic whitelist. removed from the whitelist. That is, the IP addresses in the dynamic whitelist in this application are not fixed, but change dynamically, so it is called a dynamic whitelist. After the cleaning device receives the target DNS response message, it extracts the source address of the external network device from the target DNS response message, and then determines whether the dynamic whitelist contains the source address of the external network device.

If the source address of the external network device is not included in the dynamic white list, use the source detection method to determine whether the external network device corresponding to the source address is a false source; if the external network device is a false source, the target DNS response message is false The source sends an aggressive DNS response message, and the target DNS response message is discarded at this time.

If the source address of the external network device is included in the dynamic white list, it means that the external network device is the real source; the target DNS response message is the DNS response message sent by the real source. With the development of attack technology, the real source can also be used as the attack source by attackers. Therefore, after confirming that the external network device is the real source, it is necessary to take further judgment to determine whether the target DNS response message is an offensive message.

Since the first way for the real source to initiate DNS response attacks is to frequently send DNS response messages containing different domain names to attack intranet devices, the cleaning device in this application builds a history for each IP address in the dynamic whitelist Domain name records. The historical domain name record is used to record the domain name contained in the DNS response message sent by each IP address. It can be seen that in this embodiment, the cleaning device also has a historical domain name record corresponding to the external network device, which records the domain name that appeared in the historical DNS response message sent by the external network device.

In order to further determine whether the target DNS response message is an offensive message, a preset condition is preset in this embodiment. The preset conditions at least include: the target domain name in the target DNS response message is not included in the historical domain name record, and each historical domain name in the historical domain name record is obtained from the external network device Extracted from the historical DNS response messages sent.

After determining that the dynamic whitelist contains the source address of the target DNS response message, extract the target domain name in the target DNS response message, and then further determine whether the historical domain name record corresponding to the source address contains the target domain name Name, which is to judge whether the target DNS response message satisfies the preset condition.

Step S203: discarding the target DNS response message if the target DNS response message satisfies a preset condition. If the target DNS response message does not satisfy the preset condition, other processing is performed.

If the historical domain name record does not contain the target domain name, it indicates that the external network device sends a DNS response message containing the target domain name for the first time. In this case, the target DNS response message may be a DNS response attack initiated by an external device using a different domain name, so the target domain name does not exist in the historical domain name record. In this case, in order to prevent the intranet device from being attacked, the target DNS response message is discarded at this time. This process may be referred to as the "first packet drop mechanism".

It is understandable that the target DNS response message may also be initiated by a normal external network device (the external network device accesses the internal network device corresponding to the target domain name for the first time). In this application, it is assumed that the target DNS response message is normal. It is also discarded in this step. In view of this, after discarding the target DNS response message, store the target domain name in the historical domain name record, so that the normal external network device can resend the target domain name in the target DNS response message under the retransmission mechanism It will be included in the historical domain name record, that is, the target domain name in the historical domain name record is hit, so as to ensure that normal DNS messages will not be discarded due to the "first packet discarding mechanism".

Since the normal external network device has a retransmission mechanism, that is, after the internal network device sends a DNS request to the external network device, but does not receive the DNS response message sent by the external network device, the internal network device will send a DNS Request message to the external network. Triggered by the DNS Request message, the normal external network device will resend the target DNS response message. When the cleaning device receives the target domain name again, since the target domain name already exists in the historical domain name record, it will not be discarded again due to the "first packet discarding mechanism", thus ensuring that the normal DNS response message will not Affected.

Aggressive external network devices do not have a retransmission mechanism, so this application can accurately clean up the DNS response messages of the real source to attack internal network devices in the form of different network domain names, thereby alleviating the impact of DNS response attacks on services and the impact of the Internet.

Embodiment 2 of a network attack defense method provided by the present application is introduced below. As shown in Figure 3, the method includes steps S301 ~ S304:

Step S301: Receive a target DNS response message that the external network device intends to send to the internal network device.

Step S302: If the dynamic whitelist includes the source address in the target DNS response message, determine whether the target DNS response message satisfies a first preset condition; the first preset condition is that the target DNS The target domain name in the response message is not included in the historical domain name record. If the first preset condition is not met, go to step S303; if the first preset condition is met, go to step S304.

The specific execution process of this step has been described in detail in the embodiment shown in FIG. 2 , and will not be repeated here.

Step S303: Determine whether the target DNS response message satisfies a second preset condition; the second preset condition is: the time between the first sending time and the second sending time when the external network device initiates access to the target domain name The interval is less than the preset time interval. Wherein, the first sending time is the sending time of the target DNS response message, and the second sending time is the latest sending time of the external network device including the target domain name before the first sending time. Time for the DNS to respond to the message. If the second preset condition is met, go to step S304. If the second preset condition is not met, go to step S305.

The second way for the real source to initiate a DNS response attack is to frequently send DNS response messages with a limited number of domain names or the same domain name. Since the real source sends DNS response messages frequently, in this case, the interval between DNS response messages containing the same domain name will be very short. Therefore, the present application sets a preset time interval, such as 1S. The preset time interval is the time interval that a normal external network device should have when sending DNS response messages with the same domain name twice.

In the case that the historical domain name record contains the target domain name, the preset condition for determining the target DNS response message also includes: the first sending time and the second sending time when the external network device initiates access to the target domain name The time interval of time is less than the preset time interval.

When the cleaning device receives the target DNS response message, it uses the current time as the sending time of the target DNS response message, that is, the first sending time. The historical domain name record of the cleaning device will record the latest sending time of the DNS response message containing the target domain name, that is, the second sending time.

If the time interval between the first sending time and the second sending time is less than the preset time interval, it means that the external network device frequently sends DNS response messages containing the same domain name, that is, the external network device sends DNS responses with the same domain name The frequency of the message is too high. At this time, the external network device may attack the internal network device by sending DNS response messages frequently with a limited number of domain names or the same domain name. Therefore, the cleaning device discards the target DNS response message to protect intranet devices from attacks.

Step S304: Discard the target DNS response message.

Step S305: Forward the target DNS response message to the intranet device.

If the time interval between the first sending time and the second sending time is not less than the preset time interval, it means that the target DNS response message is temporarily sent by a normal external network device, so the DNS response message is forwarded to the internal network device.

The IP addresses in the dynamic whitelist used in the above-mentioned embodiments of FIG. 2 and FIG. 3 are only temporarily non-aggressive devices. Therefore, it is necessary to regularly detect whether the IP addresses in the dynamic whitelist have been converted into attacks. permanent devices to update the dynamic whitelist. Specifically, the following methods can be used:

The real source in the dynamic whitelist can initiate a DNS response attack method three: the domain name in the sent DNS response message is relatively large but changes periodically, and the interval between the same domain name attack messages is greater than 1 second. In this case, neither of the above two preset conditions can clean up such offensive DNS response messages. Therefore, the following method is adopted to solve the attack of method 3:

On the basis of the embodiment shown in Figure 2 or 3, the embodiment provided by this application also includes: for the DNS response message sent by the external network device, after the cleaning device receives a DNS response message, the history Find the domain name in the DNS response message in the domain name record; if the domain name in the DNS response message is found in the historical domain name, it means that the domain name is hit, so the domain name of the domain name The number of hits is incremented by 1; where the number of hits for each domain name is initially zero. Therefore, the historical domain name records record all domain names sent by external network devices, and the total number of times each domain name is hit.

In this application, a preset number of hits is set, and the number of hits is at least 3 times. Because under normal circumstances, a normal DNS response message will send at most 2 DNS response messages containing the same domain name twice. When the number of hits of DNS response messages corresponding to a domain name exceeds the preset number of hits, it means that the domain name is frequently used to send DNS response messages to intranet devices, so it can be considered that the domain name is used as an attack network. Domain names to attack intranet devices.

As shown in Figure 4, on the basis of the embodiment shown in Figure 2 or Figure 3, the cleaning equipment will regularly perform the following steps:

Step S401: According to the historical domain name record corresponding to the source address of the external network device, calculate the ratio of the number of domain names whose hit times exceed the preset number to the number of all domain names; wherein, the historical The domain name record includes all domain names in the historical DNS response messages sent by the external network device and the number of hits for each domain name.

Count the number of domain names whose hit times exceed the preset number of times (the first number) in the historical domain name records. The purpose of this is to count the number of attack domain names sent by external network devices; and then count external network devices The quantity of all network domain names sent (the second quantity); calculate the ratio of the first quantity and the second quantity, so as to determine the ratio of the attack domain name and all network domain names sent by the external network device.

Step S402: Determine whether the ratio is greater than a preset ratio, if yes, go to step S403, otherwise perform other processing.

This application can set a preset ratio, such as 0.5, which is used to represent the ratio of attacking domain names to all domain names under normal circumstances.

Step S403: Delete the source address of the external network device in the dynamic white list.

When the ratio calculated in S401 is greater than the preset ratio, it means that the external network device frequently sends DNS response messages containing the name of the attacking domain name, that is, the external network device has now been transformed into an aggressive external network device, so the external network The source address of the device is deleted in the dynamic whitelist.

Step S404: Add the source address of the external network device to the dynamic blacklist.

Regularly add the source addresses of aggressive external network devices in the dynamic whitelist to the dynamic blacklist, so that when the external network device sends a DNS response message again, the DNS response message sent by the external network device is discarded, thereby protecting internal Network devices are protected from attacks.

The embodiment shown in FIG. 4 uses the target domain name in the target DNS response message as the starting point to determine whether the target DNS response message sent by the external network device is offensive, thereby achieving the purpose of updating the dynamic whitelist. In addition to the method of using the domain name, this application also provides a method of using the traffic to update the dynamic white list.

Specifically, it may be: the source address of the external network device sends a DNS response message and the source address is included in the dynamic whitelist, and the traffic value of the DNS response message is superimposed on the traffic value of the historical DNS response message; the historical DNS The initial value of the flow value of the response message is zero. That is, the purpose of doing this is to continuously count the traffic value of DNS response messages sent by external network devices.

In this case, the preset condition further includes: the total flow value of the traffic value of the target DNS response message and the traffic value of the historical DNS response message is greater than the preset traffic value; wherein, the historical DNS response message All DNS response messages sent by the external network device before sending the target DNS response message.

This application sets a preset traffic value, which is used to represent the sum of traffic values sent by normal external network devices within a period of time. When the traffic value of the DNS response messages sent by the external network device exceeds the preset traffic value within a period of time, it means that the external network device frequently sends DNS response messages. In this case, it indicates that the external network device in the dynamic whitelist has been converted into an aggressive external network device, so when the total traffic value is greater than the preset traffic value, delete the external network device in the dynamic whitelist The source address; adding the source address to a dynamic blacklist.

Method 3 of initiating a DNS response attack against the real source (there are many domain names in the DNS response message sent but change periodically, and the interval between attack messages of the same domain name is greater than 1 second), although in Figure 2 or Figure 2 In the embodiment shown in 3, there is no way to clear it in time, but by regularly checking the sum of the traffic values sent by the external network equipment, or by using the method that the number of hits of the attacking domain name exceeds the preset ratio, the external network can be determined. Whether the device is an aggressive device. If it is an aggressive device, add the source address corresponding to the external network device to the dynamic blacklist, so that the next time the external network device sends a DNS response message, the message can be discarded immediately.

Embodiment 3 of a network attack defense method provided by the present application is introduced below. As shown in Figure 5, the method includes steps S501 to S504:

Step S501: Receive a target DNS response message that the external network device intends to send to the internal network device.

Step S502: Determine whether the source address in the target DNS response message is included in the dynamic blacklist; if yes, proceed to step S512; if not, proceed to step S503.

After the cleaning device receives a DNS response message sent by an external network device, it inquires whether the internal network device corresponding to the destination address is in a defensive state according to the destination address (IP address) of the message. If the intranet device is in the defense state, the process in this embodiment can be executed.

The source address of the offensive external network device is stored in the dynamic blacklist, so when the source address of the external network device hits the dynamic blacklist, it is determined that the target DNS response message is an offensive message, and discarded at this time Target DNS response message.

Step S503: Determine whether the dynamic whitelist includes the source address in the target DNS response message; if yes, go to step S508 and step S514, otherwise go to step S504.

Step S504: Send a DNS Request message including a special domain name to the external network device as a detection message.

The cleaning device will construct a DNS Request message as a detection message and send it to the external network device. The domain name in the DNS Request message can be constructed from the quintuple information and domain name information in the target DNS response message through a certain hash method. , and ensure that the constructed domain name is a domain name that does not exist in the live network.

Step S505: The cleaning device judges whether it has received a DNS response message including the special domain name fed back by the external network device; if yes, proceed to step S506, otherwise proceed to step S507.

After the cleaning device receives the DNS response message sent by the external network device again, it checks whether the domain name in the message is constructed by the method in step S504. If it is a normal external network device, after receiving the DNS Request message, it will load the domain name in the DNS response message generated according to the DNS Request message. Therefore, if the DNS response message received again contains the special domain name, it means that the external network device is a normal external network device, otherwise it indicates that the external network device is an aggressive external network device.

Step S506: Add the IP address of the external network device into the dynamic white list, and construct a historical domain name record and a traffic monitoring table for the IP address of the external network device.

Step S507: Add the IP address corresponding to the external network device into the dynamic blacklist.

Step S508: Determine whether the target DNS response message satisfies a first preset condition; the first preset condition is that the target domain name in the target DNS response message is not included in the historical domain name record. If the first preset condition is not met, then enter step S509; if the first preset condition is met, then enter step S511.

Step S509: Add 1 to the hit count of the target domain name in the target DNS response message in the historical domain name record.

Step S510: Determine whether the target DNS response message satisfies a second preset condition; the second preset condition is: the time between the first sending time and the second sending time when the external network device initiates access to the target domain name The interval is less than the preset time interval. If the second preset condition is met, go to step S512. If the second preset condition is not met, go to step S513.

Step S511: Add the target domain name and the sending time including the target domain name to the historical domain name record of the external network device, and set the hit count of the target domain name to 1.

Step S512: Discard the target DNS response message.

Step S513: Forward the target DNS response message to the intranet device.

Step S514: Add the traffic value of the target DNS response message to the traffic monitoring table.

Step S515: If the flow value in the flow monitoring table is greater than the preset flow value, delete the source address of the external network device in the dynamic whitelist, and add the source address of the external network device to the dynamic blacklist.

Step S516: Periodically calculate the ratio of the number of domain names whose number of hits exceeds a preset number to the number of all domain names.

Step S517: If the ratio is greater than the preset ratio, delete the source address of the external network device in the dynamic whitelist, and add the source address of the external network device to the dynamic blacklist.

Through the embodiment shown in Figure 5, all types of DNS response attacks can be filtered:

For the DNS response attack of false source type: can be filtered out by the mode of step S503 dynamic white list; For the DNS response attack mode one (the domain name in the attack message changes randomly) of the true source, adopt the mode of step S508 (network Domain name first packet discarding mechanism) can be filtered out; DNS response attack method for the real source (the number of domain names in the attack message is limited or unchanged, and the interval between attack messages with the same domain name is less than 1 second ), can be filtered out by the judgment of step S510; mode three for the DNS response attack of the real source (the domain name in the attack message is more but changes periodically, and the interval between the attack messages of the same domain name is greater than 1 second ), which can be filtered out through steps S515-S517.

Therefore, this application can filter all types of DNS response attacks, thereby alleviating the impact of DNS response attacks on services and networks.

Corresponding to the network attack defense method provided in the present application, the present application also provides a network attack defense device. As shown in FIG. 6 , the device includes: a receiving unit 61 for receiving a target DNS response message sent by an external network device to an internal network device; a judging unit 62 for including the target DNS response message in a dynamic whitelist In the case of the source address, determine whether the target DNS response message meets a preset condition; the first discarding unit 63 is configured to discard the target DNS response message if the target DNS response message meets a preset condition ; Wherein, the preset condition at least includes: the target domain name in the target DNS response message is not included in the historical domain name record, and each historical domain name in the historical domain name record is from Extracted from historical DNS response messages sent by the external network device.

The preset condition further includes: the time interval between the first sending time and the second sending time when the external network device initiates access to the target network domain name is less than a preset time interval. Wherein, the first sending time is the sending time of the target DNS response message, and the second sending time is the latest sending time of the external network device including the target domain name before the first sending time. The time for the DNS to respond to the message.

The preset condition also includes: the total flow value of the traffic value of the target DNS response message and the traffic value of the historical DNS response message is greater than the preset traffic value; wherein, the historical DNS response message is the external network All DNS response messages sent by the device before sending the target DNS response message.

As shown in FIG. 7 , the present application also provides a network attack defense device, which further includes: a forwarding unit 64, configured to send the target DNS response message when the time interval is not less than a preset time interval forwarded to the intranet device.

a storage unit 65, configured to store the target domain name and the sending time of the target DNS response message in the The historical domain name records.

The ratio calculation unit 66 is configured to calculate the ratio of the number of domain names whose number of hits exceeds a preset number of times to the number of all domain names according to the historical domain name records corresponding to the source address of the external network device; wherein , the historical domain name record includes all domain names and the number of hits of each domain name in the historical DNS response message sent by the external network device; the first deletion unit 67 is configured to if the ratio is greater than If the ratio is preset, the source address of the external network device in the dynamic whitelist is deleted; the first adding unit 68 is configured to add the source address of the external network device to the dynamic blacklist.

The number of hits calculation unit 69 is used to search the historical domain name record for the domain name in the DNS response message after a DNS response message is discarded; increase the number of hits of the domain name by 1; wherein , with an initial value of zero hits for each domain name.

As can be seen from the above, the application has the following beneficial effects:

In the embodiment of this application, after confirming that the source address in the target DNS response message is in the dynamic whitelist, it can be confirmed that the external network device that initiated the target DNS response message is not a false source but a real source. One way for the real source to initiate DNS response attacks is to frequently send DNS response messages containing different domain names to attack intranet devices. Therefore, there is a historical domain name record in this application, which records all domain names sent by external network devices.

When the target domain name in the target DNS response message is not included in the historical domain name record, it indicates that the external network device is sending a DNS response message containing the target domain name for the first time. In this case, the target DNS response message may be a DNS response attack initiated by an external network device using a different domain name. In order to prevent the internal network device from being attacked, the target DNS response message is discarded at this time.

Since normal external network devices have an automatic retransmission mechanism, if the DNS response message sent by the normal external network device is discarded, the normal external network device will resend the target DNS response message, so as not to affect the normal DNS response message sent to Intranet equipment. Attacking external network devices do not have an automatic retransmission mechanism, so this application can filter out DNS response messages from real sources attacking internal network devices with different network domain names, thereby alleviating the impact of DNS response attacks on services and Internet impact.

As shown in FIG. 8 , the present application also provides a network attack defense device, which further includes: a traffic calculation unit 71, configured to send a DNS response message at the source address of the external network device, and then The traffic value of the historical DNS response message is superimposed on the traffic value of the DNS response message; the initial value of the traffic value of the historical DNS response message is zero.

The second deleting unit 72 is used to delete the source address in the dynamic whitelist when the total traffic value is greater than the preset traffic value; the second adding unit 73 is used to add the source address The address is added to the dynamic blacklist.

The second discarding unit 74 is configured to discard the target DNS response message when the source address in the target DNS response message is included in the dynamic blacklist.

Referring to FIG. 1 , the present application provides a network attack defense system, including: an external network device 100, a routing device 200, a cleaning device 400 and an internal network device 300; Sending a target DNS response message intended to be sent to the intranet device 300 .

The cleaning device 400 is configured to receive a target DNS response message that the external network device intends to send to the internal network device; if the dynamic whitelist includes the source address in the target DNS response message, determine whether the target DNS Whether the response message meets the preset condition; if the target DNS response message meets the preset condition, then discard the target DNS response message; wherein, the preset condition includes at least: the target domain in the target DNS response message The name is not included in the historical domain name record, and each historical domain name in the historical domain name record is extracted from the historical DNS response message sent by the external network device; the internal network device 300 is used to Receive the DNS response message after the cleaning device is cleaned.

The system has the following beneficial effects:

In the embodiment of this application, after confirming that the source address in the target DNS response message is in the dynamic whitelist, it can be confirmed that the external network device that initiated the target DNS response message is not a false source but a real source. One way for the real source to initiate DNS response attacks is to frequently send DNS response messages containing different domain names to attack intranet devices. Therefore, there is a historical domain name record in this application, which records all domain names sent by external network devices.

When the target domain name in the target DNS response message is not included in the historical domain name record, it indicates that the external network device sends the DNS response message containing the target domain name for the first time. In this case, the target DNS response message may be a DNS response attack initiated by an external network device using a different domain name. In order to prevent the internal network device from being attacked, the target DNS response message is discarded at this time.

Since normal external network devices have an automatic retransmission mechanism, if the DNS response message sent by the normal external network device is discarded, the normal external network device will resend the target DNS response message, so as not to affect the normal DNS response message sent to Intranet equipment. Attacking external network devices do not have an automatic retransmission mechanism, so this application can filter out DNS response messages from real sources attacking internal network devices with different network domain names, thereby alleviating the impact of DNS response attacks on services and Internet impact.

If the functions described in the method of this embodiment are realized in the form of software function units and sold or used as independent products, they can be stored in a computing device readable storage medium. Based on this understanding, the part of the embodiment of the application that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions to make a A computing device (which may be a personal computer, a server, a mobile computing device or a network device, etc.) executes all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk, etc., which can store program codes. media.

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same or similar parts of each embodiment can be referred to each other.

The above description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the application. Accordingly, the present application will not be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (19)

A method for defending against network attacks, comprising: receiving a target DNS response message sent by an external network device to an internal network device; when the dynamic whitelist includes the source address in the target DNS response message, judging whether the target DNS response message meets a preset condition; if the target DNS response message meets a preset condition, then discarding the target DNS response message; wherein, the preset condition includes at least: the target domain in the target DNS response message The name is not included in the historical domain name record, and each historical domain name in the historical domain name record is extracted from the historical DNS response message sent by the external network device; and the external network device initiates access to the target The time interval between the first sending time and the second sending time of the domain name is less than the preset time interval, wherein the first sending time is the sending time of the target DNS response message, and the second sending time is when the external network device The latest sending time of the DNS response message containing the target domain name before the first sending time. The method described in item 1 of the patent application, further comprising: forwarding the target DNS response message to the intranet device when the time interval is not less than a preset time interval. The method described in item 1 of the scope of the patent application, which also includes: If the target domain name in the target DNS response message is not included in the historical domain name record, then store the target domain name and the sending time of the target DNS response message in the historical domain name record. The method described in item 3 of the scope of the patent application, which also includes: according to the historical domain name record corresponding to the source address of the external network device, calculating the number of domain names whose hit times exceed the preset number and all The ratio of the number of domain names; wherein, the historical domain name record includes all domain names in the historical DNS response messages sent by the external network device and the number of hits for each domain name; the default number is not less than A natural number of 3; if the ratio is greater than the preset ratio, delete the source address of the external network device in the dynamic whitelist; add the source address of the external network device to the dynamic blacklist. The method described in item 4 of the scope of the patent application, wherein the calculation method of the number of hits of each domain name in the historical domain name record includes: after receiving a DNS response message, in the historical domain name record Find the domain name in the DNS response message; increase the hit count of the domain name by 1; wherein, the initial value of the hit count for each domain name is zero. The method described in item 1 of the scope of the patent application, wherein the preset condition also includes: the traffic value of the target DNS response message and the historical DNS response message The total flow value of the traffic values is greater than the preset traffic value; wherein, the historical DNS response message is all DNS response messages sent by the external network device before sending the target DNS response message. The method described in item 6 of the scope of the patent application, which also includes: when the total traffic value is greater than the preset traffic value, deleting the source address in the dynamic white list; adding the source address to In the dynamic blacklist. The method described in item 7 of the scope of the patent application, wherein the calculation process of the flow value of the historical DNS response message includes: after the source address of the external network device sends a DNS response message, the flow of the historical DNS response message The traffic value of the DNS response message is superimposed on the value; the initial value of the traffic value of the historical DNS response message is zero. The method as described in any one of items 1-7 of the scope of patent application, further comprising: discarding the target DNS response message when the source address in the target DNS response message is included in the dynamic blacklist. A network attack defense device, characterized in that it includes: a receiving unit, used to receive a target DNS response message sent by an external network device to an internal network device; a judging unit, used to include the target DNS response in a dynamic white list In the case of the source address in the message, determine whether the target DNS response message satisfies the preset condition; The first discarding unit is configured to discard the target DNS response message if the target DNS response message satisfies a preset condition; wherein the preset condition at least includes: the target domain name in the target DNS response message is not included in the history In the domain name record, each historical domain name in the historical domain name record is extracted from the historical DNS response message sent by the external network device; and the first time the external network device initiates access to the target domain name A time interval between a sending time and a second sending time is less than a preset time interval, wherein the first sending time is the sending time of the target DNS response message, and the second sending time is the external network device at the first sending time The last time a DNS response message was sent containing the target domain name. The device as described in item 10 of the patent application, further comprising: a forwarding unit, configured to forward the target DNS response message to the intranet device when the time interval is not less than a preset time interval. The device as described in item 10 of the scope of the patent application, which also includes: a storage unit, used to save the target domain name if the target domain name in the target DNS response message is not included in the historical domain name record The name and the time when the target DNS response message was sent are stored in the historical domain name record. The device as described in item 12 of the scope of the patent application, which also includes: a ratio calculation unit, which is used to correspond to the source address of the external network device The historical domain name record, calculate the ratio of the number of domain names whose number of hits exceeds the preset number to the number of all domain names; wherein, the historical domain name record contains the historical DNS response message sent by the external network device All domain names and the number of hits of each domain name; the preset number is a natural number not less than 3; the first deletion unit is used to delete the dynamic whitelist if the ratio is greater than the preset ratio The source address of the external network device; the first adding unit is used to add the source address of the external network device to the dynamic blacklist. The device as described in item 13 of the scope of the patent application, which also includes: a hit count calculation unit, which is used to search the domain name in the DNS response message in the historical domain name record after receiving a DNS response message ;Increase the hit count of the domain name by 1; wherein, the initial value of the hit count of each domain name is zero. The device described in item 10 of the scope of the patent application, wherein the preset condition further includes: the total flow value of the flow value of the target DNS response message and the flow value of the historical DNS response message is greater than the preset flow value; wherein, The historical DNS response messages are all DNS response messages sent by the external network device before sending the target DNS response messages. The device as described in item 15 of the scope of the patent application, which also includes: a second deletion unit, used for when the total flow value is greater than the preset flow value, delete the source address in the dynamic whitelist; the second adding unit is used to add the source address to the dynamic blacklist. The device described in item 16 of the scope of the patent application, further comprising: a traffic calculation unit, configured to superimpose on the traffic value of the historical DNS response message after the source address of the external network device sends a DNS response message The flow value of the DNS response message; the initial value of the flow value of the historical DNS response message is zero. The device according to any one of items 11-16 of the scope of the patent application, further comprising: a second discarding unit, configured to include the source address in the target DNS response message in the dynamic blacklist, Discard the target DNS response message. A network attack defense system, characterized in that it includes: an external network device, a cleaning device and an internal network device; the external network device is used to send a target DNS response message intended to be sent to the internal network device to the cleaning device; the The cleaning device is used to receive the target DNS response message sent by the external network device to the internal network device; if the dynamic whitelist contains the source address in the target DNS response message, it is judged whether the target DNS response message meets the predetermined requirements. A condition is set; if the target DNS response message meets the preset condition, the target DNS response message is discarded; wherein, the default condition includes at least: the target domain name in the target DNS response message does not contain In the historical domain name record, each historical domain name in the historical domain name record is extracted from the historical DNS response message sent by the external network device; and the external network device initiates access to the target domain name The time interval between the first sending time and the second sending time is less than the preset time interval, wherein the first sending time is the sending time of the target DNS response message, and the second sending time is when the external network device is in the first The last time before sending time the DNS response message containing the target domain name was sent; the intranet device is used to receive the DNS response message after cleaning by the cleaning device.

Images