WO2011150579A1

WO2011150579A1 - Method and device for detecting domain name system (dns) anomaly

Info

Publication number: WO2011150579A1
Application number: PCT/CN2010/074577
Authority: WO
Inventors: 毛伟; 李晓东; 丁森林; 王欣; 吴军; 金键
Original assignee: 中国科学院计算机网络信息中心
Priority date: 2010-06-04
Filing date: 2010-06-28
Publication date: 2011-12-08
Also published as: CN101854404A; CN101854404B

Abstract

The present invention provides a method and device for detecting Domain Name System (DNS) anomaly, which belongs to the technical field of computer network. The method includes: dividing DNS query data stream into multiple data blocks; calculating the entropy values of said multiple data blocks according to predetermined query property to obtain the corresponding multiple entropy values; judging if there are a predetermined number of entropy values which exceed the predetermined threshold in the obtained multiple entropy values; if yes, determining DNS anomaly occurs. The device includes: a dividing module, a calculating module and a judging module. By calculating the entropy values of the multiple data blocks in DNS query data stream, this invention determines DNS anomaly occurs, if there are a predetermined number of entropy values which exceed the predetermined threshold in the obtained multiple entropy values. This invention can bears an early warning function for occurrence of DNS anomaly, thus reducing the loss after DNS anomaly occurs, and compared with the prior art, achieving high detection precision and low omission ratio.

Description

Method and apparatus for detecting domain name system anomalies

The present invention relates to computer network security technologies, and in particular, to a method and apparatus for detecting domain name system anomalies, and belongs to the technical field of computer networks. Background technique

The Domain Name System (DNS) is a distributed database system that translates domain names into IP addresses that the network can recognize. Since DNS is the foundation of the Internet, if DNS anomalies will have a serious impact on the entire network, it is important to detect DNS anomalies.

The methods for detecting DNS anomalies in the prior art mainly determine whether the DNS is abnormal based on the change of the query traffic or the change of the query attribute value. The determination of whether the DNS is abnormal based on the change of the query traffic means that the DNS is abnormal when the query traffic is particularly large or extremely small.

In the process of implementing the present invention, the inventors have found that at least the following problems exist in the prior art: The scheme for determining whether the DNS is abnormal based on the change of the query traffic has hysteresis, and when the abnormality is detected, the query traffic often accumulates to a certain extent. The degree has already caused serious consequences and therefore cannot serve as an early warning. Sometimes, the occurrence of an exception does not necessarily affect the DNS query traffic. Therefore, it is highly suspected that the DNS is abnormal based on the change in query traffic. Summary of the invention

The present invention provides a method and apparatus for detecting a DNS anomaly to solve the problem of detecting DNS abnormality lag in the prior art and having a high missed detection rate.

The method for detecting DNS anomaly provided by the present invention includes: Divide the domain name system query data stream into multiple data blocks;

Calculating an entropy value of the plurality of data blocks according to a preset query attribute, to obtain a corresponding plurality of entropy values;

Determining whether a predetermined number of entropy values of the plurality of entropy values exceeds a preset threshold, and if so, determining that the domain name system has an abnormality.

The device for detecting DNS abnormality provided by the present invention includes:

a dividing module, configured to divide the domain name system query data stream into a plurality of data blocks; and a calculating module, configured to calculate an entropy value of the plurality of data blocks according to a preset query attribute, to obtain a corresponding plurality of entropy values;

The determining module is configured to determine whether a predetermined number of entropy values of the plurality of entropy values exceed a preset threshold, and if yes, output information indicating that the domain name system is abnormal.

The present invention determines that the entropy value of the plurality of data blocks in the data stream is queried, and when the entropy value of the corresponding plurality of entropy values exceeds a preset threshold, determining that the DNS system has an abnormality, the present invention It can play an early warning role in the abnormality of the DNS system, thereby reducing the loss after the abnormality of the DNS system, and the missed detection rate is low. DRAWINGS

In order to more clearly illustrate the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly made below.

1 is a schematic flowchart of an embodiment of a method for detecting a DNS abnormality according to the present invention;

2 is a schematic diagram of dividing a data block according to a specified time;

Figure 3 is an entropy curve obtained when the window size is 10000;

Figure 4 shows the DNS query rate curve;

FIG. 5 is a schematic structural diagram of an apparatus for detecting a DNS abnormality according to the present invention. detailed description The present invention will be clearly and completely described in the following detailed description of the embodiments of the present invention. Not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The present invention applies the theory of entropy to the anomaly detection of DNS for the first time, so the entropy is first introduced. Entropy is defined in information theory as follows: If there is a set of events in a system S E={E1, E2,..., En}, El, E2, En are each event in the event set. The probability distribution of each event P = {P1, P2, ..., Pn}, PI, P2, Pn is the probability of occurrence of each event. The amount of information for each event r itself can be calculated by equation (1): r =- ^l0 g ₂ r (1) In equation (1), r = l, 2, ..., n.

For example: English has 26 letters. If the average number of occurrences of each letter in the article, the amount of information for each letter is: / = _log ₂ (l/26) = 4.7

There are 2,500 commonly used Chinese characters. If the average number of Chinese characters appears in the article, the amount of information for each Chinese character is: / = - log ₂ (l/2500) = 11.3

Entropy is the average information of the whole system S. If entropy is set, then the entropy is calculated as shown in formula (2):

Nn

In the field of information dissemination, entropy represents the uncertainty of information. The high-entropy entropy is low, indicating that the high-information system is relatively stable; while the low-information entropy is high, indicating that the low-information system is unstable and prone to anomalies, so it is possible to detect whether the DNS is based on the entropy value. An exception occurs.

Example 1

1 is a schematic flowchart of a method for detecting a DNS abnormality according to the present invention, as shown in FIG. Methods include:

Step 101: Divide the DNS query data stream into multiple data blocks;

It should be noted that: the larger the divided data blocks, that is, the more the amount of query data included in each data block, the more gradual changes in the entropy value of the data block, which can effectively reduce the occurrence of false detection, but at the same time It also reduces the sensitivity to abnormal traffic and increases the missed detection rate. Conversely, the smaller the data block, that is, the smaller the amount of query data included in each data block, the higher the sensitivity of detecting DNS anomalies, but the accuracy is Will be reduced accordingly.

In practical applications, the DNS query data stream can be divided into multiple data blocks according to a specified time and/or according to a specified query amount. For example, the amount of query data per minute in the DNS query data stream may be divided into one data block, or the query amount of each 1000 query records in the DNS query data stream may be divided into one data block; The specified query quantity is divided, for example, when the specified time is reached, but the specified query quantity is not divided into one data block, or the specified query quantity is reached, but it is divided into one data block when the specified time is not reached. It can also be divided according to the time period function. For example, between 8:30 and 12:00 in the morning, the data blocks can be divided into smaller time segments, for example: dividing a data block every 20-30 seconds; The data block can be divided into longer time periods from 12:00 noon to 1:00 pm, for example: One data block is divided every 2-3 minutes. This division can be adjusted by the technician according to the actual situation, or the data block can be divided according to the experience and the size of the query data.

Step 102: Calculate an entropy value of the plurality of data blocks according to the preset query attribute, to obtain a corresponding plurality of entropy values;

The default query attribute includes the query type, the type of error that occurs in the query, the query source IP appearing in the query, or the occurrence of the query domain name in the query, but is not limited to these query attributes, as long as the query attribute is classified according to a certain category. Yes.

The above query types include at least: an IP address record corresponding to the domain name (Address, abbreviated as A), an address record AAAA of the IPv6 host, a Pointer (PTR), a mail exchange (MX exchanger), a name server. Record (Name Server, referred to as NS), Start Of Authority (SOA).

The type of error that occurs in the query is: The sent DNS query request contains an illegal field. The main error types are: The query source address is a private address, the query type does not exist, the top-level domain of the query does not exist, and the name of the query contains illegal information. Characters, query name format errors, duplicate queries or normal query classes, etc. The normal query refers to a query with no errors. When the default query attribute is of the wrong type, the query with no errors is classified into the normal query class, so that each query record can be classified into a specific type.

Calculating the entropy value of multiple data blocks according to the preset query attribute, specifically:

Calculate the probability that each element of the preset query attribute appears in each data block;

The entropy value of each data block is calculated based on the probability that each element of the preset query attribute appears in each data block.

When there are overlapping portions between the divided plurality of data blocks, for example, FIG. 2 is a schematic diagram of dividing the data blocks according to the specified time. As shown in FIG. 2, the query amount between 8: 00 and 8: 10 is one. Data block, 8: The query amount between 03 and 8: 13 is a data block, ..., ie

A data block is divided into 10 minutes, and there is a 3-minute overlap time between each data block, so that the query data stream is divided into a plurality of overlapping data blocks. This embodiment will be described in detail by taking each of the divided data blocks including the specified query amount as an example.

Let each data block include a specified query quantity of 10 query records, the current data block is the i-th data block, and the previous data block adjacent to the current data block is the i-1th data block, and the current data block. The adjacent next data block is the i+1th data block, and if the i-1th data block includes the query records of the first to the tenth, the i th data block includes the second to the eleventh The query record, the i+1th data block includes the third to twelfth query records. The query quantity of the overlap of the i-1th data block and the i-th data block is the second to tenth query records, and the query quantity of the overlapping part of the i-th data block and the i+1th data block is the third. Articles to Article 11 query records.

When there are overlapping portions between the divided plurality of data blocks, calculating the entropy values of the plurality of data blocks according to the preset query attribute may include: Calculating an entropy value H of a previous data block adjacent to the current data block;

The entropy value H _{2 of the} current data block is calculated from the entropy value of the previous data block adjacent to the current data block.

Calculating an entropy value H _{2 of the} current data block according to an entropy value of a previous data block adjacent to the current data block, specifically:

Calculating a weighted information amount of the first specified query amount and the second specified query amount in the first data block respectively 7> and 7; the first specified query quantity means that the i-th data block overlaps with the i-1th data block The amount of the query that does not overlap the part before; the second specified query quantity refers to the query quantity of the part that does not overlap after the overlapping part of the i-th data block and the i+1th data block;

Continuing with the above example, the first specified query quantity refers to the first query record, and the second specified query quantity refers to the 12th query record.

The probability that the query type to which the query record belongs in the i-1th data block is corpse, then } =-i lo 7 ; the query type of the 12th query record belongs to the i-1th data block. The probability of occurrence is corpse /, then 7; two one lo.

Calculating a weighted information amount Γ/sum of the second specified query quantity and the third specified query quantity respectively in the i-th data block; the third specified query quantity is an overlapping part of the ith data block and the i+1th data block The amount of queries that do not overlap before;

Continuing with the above example, the probability that the query type of the 12th query record appears in the i-th data block is P; , then T; = log ₂ P;;

The third specified query quantity refers to the second query record, and the probability that the query type of the second query record belongs in the i-th data block is P _f ', then T _f ' =-P _f \ g ₂ P _f - calculating the entropy of the i-th data block based on the entropy values H, T Τ ρ 7 and Γ/ of the i-1th data block The value H ₂ , ie / ₂ = —7}—7; +7 +7;. Wherein, when i is 2, that is, the previous data block adjacent to the current data block is the first data block divided, the probability that each element of the preset query attribute appears in the first data block is calculated; The above probability calculates the entropy value H of the first data block.

For example, if the preset query attribute is a query type, the elements in the query type are specific query types, such as AAAA, PTR, MX, NS, SOA, etc., and each query record can belong to only one query type. The probability that the query type to which each query record belongs in the data block appears in the data block may be calculated, and then the entropy value of the data block is calculated according to the probability that the query type of each query record belongs in the data block. The calculation formula is

In formula (3), H _k is the entropy value of each data block, j represents the jth query record in each data block, and n represents n query records in each data block, which is the first in each data block. The probability that the query type to which the query record belongs appears in the data block;

When the default query attribute is the query source IP, the elements in the query source IP record the corresponding IP address for each query record. Since each query record in each data block can only come from one IP address, it can calculate the probability that the IP address of each query record in a data block appears in the data block, and then record the IP according to each query. The probability that the address appears in the data block to calculate the entropy value of the data block.

It should be noted that the preset query attribute may also include two or more types at the same time. For example, when the preset query attribute includes the query type and the query source IP, each data block may be separately calculated according to the two query attributes. The entropy value is then weighted and added according to the query type and the query source IP respectively, and the obtained weighted addition result is used as the final entropy value of the data block.

Step 103: Determine whether a predetermined number of entropy values of the plurality of entropy values obtained exceed a preset threshold, and if yes, determine that an abnormality occurs in the DNS. If the preset number is set to 5, if 5 entropy values of the plurality of entropy values obtained in step 102 exceed the preset threshold, it is determined that the DNS has an abnormality. The preset number can also be set to 1, 2 and so on. The preset number will affect the accuracy of the detection result. The larger the preset number, the higher the detection accuracy, but the miss detection rate also increases. The smaller the preset number, the lower the detection accuracy and the lower the detection rate. The selection of the preset number needs to be determined according to the actual network conditions and experience.

In this embodiment, the DNS query data may be historical DNS query data or real-time DNS query data. If the DNS query data is historical DNS query data, the method provided in this embodiment may be used to analyze the DNS usage, and the analysis result may be used for DNS optimization. In this embodiment, more applications are used in the real-time detection scenario. That is, the DNS query data is real-time DNS query data, which is used to detect abnormalities in the DNS in time to avoid serious loss of the DNS.

In order to better embody the effects of the present invention, an example of a large-scale network disconnection accident on the Internet in China on May 19, 2009 will be described as an example. The reason for the large-scale network disconnection accident is that the DNS system has been attacked, according to the DNS authoritative server from a top node of China (CN), which was collected on May 19, 2009, 9:00-24:00. The query record is analyzed in detail, and the query record between 9:00 and 24:00 on May 19, 2009 is divided into multiple data blocks, each of which has a size of 10000, that is, each data block includes 10000 query records, calculate the entropy value of each data block, and draw the obtained multiple entropy values into an entropy curve. Figure 3 shows the entropy curve obtained when the data block size is 10000. Figure 4 shows the DNS query rate curve. The query rate is the number of queries per minute. As can be seen from Figure 3, the entropy curve has fluctuated sharply around 16:00, that is, multiple entropy values have exceeded the preset threshold, indicating that a large amount of DNS abnormal traffic has begun to enter the network at this time, namely DNS. Anomalies have occurred; in the query rate curve shown in Figure 4, the query traffic shows significant abnormalities around 18:30, but at this time a large area of network disconnection has begun to occur, so it is obvious that the prior art is based on The detection scheme of the query traffic has hysteresis and high missed detection rate; the method for detecting DNS anomaly provided by the present invention can be pre- When the abnormality in the DNS is detected, it plays an early warning role.

The invention divides the DNS query data stream into a plurality of data blocks, calculates an entropy value of the plurality of data blocks according to the preset query attribute, and obtains a corresponding plurality of entropy values, where the preset number of the plurality of entropy values is When the entropy value exceeds the preset threshold, it is determined that an abnormality has occurred in the DNS. Since the entropy value is a measure of the random distribution of the query attributes of the DNS query data, when the DNS is abnormal, for example, when the DNS is attacked, the random distribution of the query attributes of the DNS query data changes, which also leads to entropy. The value has changed. According to the change of the entropy value, it can be known that the DNS is abnormal. However, in the prior art traffic-based detection method, when the DNS abnormality is not obvious, the DNS query traffic does not occur very much. Obvious changes, and therefore can not detect DNS anomalies, only when the DNS anomaly is very serious, such as a large-scale network 瘫痪, resulting in a large number of users can not use the network, the current technology based traffic-based detection method can The abnormality of the DNS traffic is detected, and the abnormality of the DNS is detected, which has obvious hysteresis. However, the present invention can detect that an abnormality occurs in the DNS before a serious abnormal situation such as a large-area network failure occurs, and an abnormality can occur in the DNS. It plays an early warning role, enabling users to prepare before the DNS is abnormally serious, avoiding the loss caused by serious DNS abnormality, reducing the missed detection rate and improving the user experience; and because DNS is an extremely complicated system The prior art determines whether the DNS is based on the change of the value of the query attribute. When an abnormality occurs, the complex state change within the DNS system is not considered, and thus the detection accuracy is not high. In a further embodiment of the present invention, when there is an overlap between the divided plurality of data blocks, the obtained plurality of entropy values are obtained. It also reflects the changes in the internal state of the DNS system, which greatly improves the detection accuracy. Example 2

5 is a schematic diagram of an apparatus for detecting a DNS abnormality according to the present invention. As shown in FIG. 5, the apparatus includes: a dividing module 201, a calculating module 202, and a determining module 203;

The dividing module 201 is configured to divide the DNS query data stream into multiple data blocks. Specifically, the dividing module 201 is configured to divide the DNS query data stream into multiple data blocks according to a specified time and/or according to a specified query amount.

The calculating module 202 is configured to calculate, according to the preset query attribute, an entropy value of the plurality of data blocks divided by the dividing module 201, to obtain a corresponding plurality of entropy values;

The calculation module 202 includes a first calculation unit and a second calculation unit;

a first calculating unit, configured to calculate a probability that each element of the preset query attribute appears in each data block;

a second calculating unit, configured to calculate, according to a probability that each element of the preset query attribute obtained by the first calculating unit appears in each data block, calculate an entropy value of the plurality of data blocks divided by the dividing module 201, and obtain corresponding multiple Entropy values.

When there are overlapping portions between the plurality of data blocks divided by the dividing module 201, the calculating module 202 includes:

a third calculating unit, configured to calculate an entropy value H of a previous data block adjacent to the current data block, and a fourth calculating unit, configured to calculate a previous data block adjacent to the current data block according to the third calculating unit H calculates the entropy value H _{2 of the} current data block.

The third computing unit includes:

a first calculating subunit, configured to: when the previous data block adjacent to the current data block is the first data block that is drawn, calculate each element of the preset query attribute to appear in the first data block Probability

And a second calculating sub-unit, configured to calculate an entropy value H of the first data block according to a probability that each element of the preset query attribute appears in the first data block.

The determining module 203 is configured to determine whether a predetermined number of entropy values of the plurality of entropy values obtained by the calculating module 202 exceed a preset threshold, and if yes, output information indicating that the DNS is abnormal.

It should be noted that, for the first embodiment of the apparatus for detecting a DNS abnormality, since it basically corresponds to the first embodiment of the method, the relevant parts can be referred to the description of the first embodiment of the method. The invention divides the DNS query data stream into a plurality of data blocks, calculates an entropy value of the plurality of data blocks according to the preset query attribute, and obtains a plurality of corresponding entropy values, where the preset number of the plurality of entropy values is When the entropy value exceeds the preset threshold, it is determined that an abnormality has occurred in the DNS. Since the entropy value is a measure of the random distribution of the query attributes of the DNS query data, when the DNS is abnormal, for example, when the DNS is attacked, the random distribution of the query attributes of the DNS query data changes, which also leads to entropy. The value has changed. According to the change of the entropy value, it can be known that the DNS is abnormal. However, in the prior art traffic-based detection method, when the DNS abnormality is not obvious, the DNS query traffic does not occur very much. Obvious changes, and therefore can not detect DNS anomalies, only when the DNS anomaly is very serious, such as a large-scale network 瘫痪, resulting in a large number of users can not use the network, the current technology based traffic-based detection method can The abnormality of the DNS traffic is detected, and the abnormality of the DNS is detected, which has obvious hysteresis. However, the present invention can detect that an abnormality occurs in the DNS before a serious abnormal situation such as a large-area network failure occurs, and an abnormality can occur in the DNS. It plays an early warning role, enabling users to prepare before the DNS is abnormally serious, avoiding the loss caused by serious DNS abnormality, reducing the missed detection rate and improving the user experience; and because DNS is an extremely complicated system The prior art determines whether the DNS is abnormal based on the change of the value of the query attribute, Considering the complicated state change inside the DNS system, the detection accuracy is not high. In a further embodiment of the present invention, when there is an overlap between the divided plurality of data blocks, the obtained plurality of entropy values are also reflected. The change in the internal state of the DNS system greatly improves the detection accuracy.

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing steps include the steps of the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention, rather than The present invention has been described in detail with reference to the foregoing embodiments, and those skilled in the art should understand that the technical solutions described in the foregoing embodiments may be modified or equivalently substituted for some of the technical features. The modifications and substitutions of the present invention do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

Rights request

A method for detecting an abnormality of a domain name system, the method comprising: dividing a domain name system query data stream into a plurality of data blocks;

The method for detecting a domain name system abnormality according to claim 1, wherein the dividing the domain name system query data stream into a plurality of data blocks comprises:

The domain name system query data stream is divided into a plurality of data blocks according to a specified time and/or a specified query amount.

The method for detecting an abnormality of a domain name system according to claim 1 or 2, wherein the entropy value of the plurality of data blocks is calculated according to a preset query attribute, specifically:

Calculating a probability that each element of the preset query attribute appears in each data block; calculating an entropy value of each data block according to the probability.

The method for detecting a domain name system abnormality according to claim 1 or 2, wherein when there are overlapping portions between the plurality of data blocks, calculating entropy of the plurality of data blocks according to the preset query attribute Values, including:

Calculating an entropy value of a previous data block adjacent to the current data block;

And calculating an entropy value of the current data block according to the entropy value of the previous data block adjacent to the current data block.

The method for detecting an abnormality of a domain name system according to claim 4, wherein when the previous data block adjacent to the current data block is the first data block that is drawn, the preset is calculated. The probability that each element of the query attribute appears in the first data block;

An entropy value of the first data block is calculated based on the probability.

6. The method of detecting an abnormality of a domain name system according to claim 1, wherein: The preset query attributes include: a query type, an error type, a query source IP address, and/or a query domain name.

The method for detecting an abnormality of a domain name system according to claim 6, wherein when the preset query attribute includes at least two types of query attributes, the entropy value is respectively obtained according to the at least two query attributes. At least two entropy values weight the result of the summation.

A device for detecting a domain name system abnormality, the device comprising: a dividing module, configured to divide a domain name system query data stream into a plurality of data blocks;

a calculation module, configured to calculate an entropy value of the plurality of data blocks according to a preset query attribute, to obtain a corresponding plurality of entropy values;

The device for detecting an abnormality of a domain name system according to claim 8, wherein the dividing module is specifically configured to divide the query data stream of the domain name system into a plurality of data according to a specified time and/or a specified query amount. Piece.

The device for detecting an abnormality of a domain name system according to claim 8 or 9, wherein the calculating module comprises:

And a second calculating unit, configured to calculate an entropy value of each data block according to the probability, to obtain a corresponding plurality of entropy values.

The device for detecting an abnormality of a domain name system according to claim 8 or 9, wherein the plurality of data blocks have mutually overlapping portions, and the calculating module comprises: a third calculating unit, configured to: Calculating an entropy value of a previous data block adjacent to the current data block; a fourth calculating unit, configured to calculate, according to an entropy value of a previous data block adjacent to the current data block, calculated by the third calculating unit The entropy value of the data block.

12. The apparatus for detecting an abnormality of a domain name system according to claim 11, wherein: The third computing unit includes:

a first calculating subunit, configured to: when the previous data block adjacent to the current data block is the first data block that is drawn, the first element of the preset query attribute is calculated in the first The probability of occurrence in the data block;

a second calculating subunit, configured to calculate an entropy value of the first data block according to the probability.