WO2021077811A1 - 分布式拒绝服务ddos攻击的防护方法、装置及系统 - Google Patents

分布式拒绝服务ddos攻击的防护方法、装置及系统 Download PDF

Info

Publication number
WO2021077811A1
WO2021077811A1 PCT/CN2020/102076 CN2020102076W WO2021077811A1 WO 2021077811 A1 WO2021077811 A1 WO 2021077811A1 CN 2020102076 W CN2020102076 W CN 2020102076W WO 2021077811 A1 WO2021077811 A1 WO 2021077811A1
Authority
WO
WIPO (PCT)
Prior art keywords
server
domain name
service
target domain
address
Prior art date
Application number
PCT/CN2020/102076
Other languages
English (en)
French (fr)
Inventor
王伟
许汝波
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2021077811A1 publication Critical patent/WO2021077811A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]

Definitions

  • the embodiments of this application relate to the field of software protection technology, and in particular to a distributed denial of service DDOS attack prevention
  • DNS cache server is DDOS Attacks are paralyzed, which affects the Internet access of the entire network; frequent DDOS attacks occupy the enterprise's bandwidth for a long time, causing enterprises to have to expand capacity and increase investment pressure.
  • the embodiments of the present application provide a method, device, and system for preventing distributed denial-of-service DDOS attacks, so as to solve the technical problem of long service interruption time when switching high defense in the prior art.
  • the embodiments of the present application provide a method for preventing distributed denial of service DDOS attacks.
  • the method includes: the terminal sends a resolution request containing the target domain name to the DNS server of the primary domain name resolution system;
  • the Internet Protocol IP address of the business server corresponding to the target domain name sends business request data to the business server; in the case of a DDOS attack on the business server, the terminal accesses the business server with an error; the terminal sends a resolution request containing the target domain name to the backup DNS server;
  • the backup DNS server resolves the target domain name to the IP address of the high defense server; among them, when the business server is attacked by DDOS, the business end informs the backup DNS server to set the resolution address for the target domain name to the IP address of the high defense server; terminal According to the IP address of the anti-defense server fed back by the backup DNS server, the service request data is sent to the anti-defense server.
  • a backup DNS server is added.
  • the backup DNS server modifies the IP address, and uses the trigger mechanism set by the terminal to trigger when an access error is detected. Request the resolution of the backup DNS server instead of the primary DNS server. Therefore, there is no need to wait for the aging time of the DNS cache server. This achieves the effect that the terminal can quickly obtain the IP address of the high-defense server and solves the problem of switching the high-defense server in the existing technology. Technical problems with long business interruptions.
  • the method further includes: the security server performs traffic cleaning on the service request data sent by the terminal, forwards the cleaned data to the service server, and The service response data fed back by the service server is forwarded to the terminal.
  • the cleaning of the high-defense server reduces the pressure on the service server and ensures that users who normally send service request data can receive normal feedback data.
  • the access to the target domain name is executed by the client installed in the terminal.
  • the method further includes: if the client is not closed, if the terminal receives To access the operation request of the target domain name, the terminal sends a resolution request containing the target domain name to the backup DNS server.
  • the terminal's client is not closed, if the terminal again receives an operation request to access the service server corresponding to the target domain name, the terminal still sends the resolution request of the target domain name to the backup DNS server to prevent The terminal has service interruption due to IP address switching, which improves user experience.
  • the access to the target domain name is executed by the client installed in the terminal.
  • the method further includes: if the terminal is restarted after being closed, if the terminal is restarted Upon receiving the operation request for accessing the target domain name, the terminal sends a resolution request containing the target domain name to the main DNS server.
  • the resolution request of the target domain name is sent to the primary DNS server by default, so that the switch can be switched when the DDOS attack on the service server has stopped. To obtain the resolution address of the target domain name from the primary DNS server.
  • the method further includes: the business end determines that the backup DNS server has resolved the target domain name The address is set to the IP address of the high-defense server; the business side informs the operator of the main DNS server, and instructs the operator of the main DNS server to notify the main DNS server to block the IP address of the business server.
  • the IP address of the service server is blocked after being attacked, and the terminal is prevented from sending service request data to the service server from continuing to occupy bandwidth, and the export bandwidth of the service server can be saved.
  • the method further includes: the business side notifies the operator of the primary DNS server, and instructs the operator of the primary DNS server to notify the primary DNS server to change the business server
  • the IP address is unblocked.
  • the embodiment of the present application provides a protection system for distributed denial of service DDOS attacks.
  • the system includes: a terminal, which is used to send a resolution request containing the target domain name to the main DNS server, according to the target domain name fed back by the main DNS server
  • the IP address of the corresponding business server sends the business request data to the business server; in the case of an error in accessing the business server, the resolution request containing the target domain name is sent to the backup DNS server; the IP address of the security server according to the feedback from the backup DNS server , To send business request data to the high defense server; the business side, used to notify the backup DNS server to set the resolution address for the target domain name to the IP address of the high defense server when the business server is attacked by DDOS; the backup DNS server uses After receiving the notification from the business end, the resolution address for the target domain name is set to the IP address of the security server; after the resolution address for the target domain name is set to the IP address of the security server, the target domain name is sent to the terminal
  • a backup DNS server is added.
  • the backup DNS server modifies the IP address, and uses the trigger mechanism set by the terminal to trigger when an access error is detected. Request the resolution of the backup DNS server instead of the primary DNS server. Therefore, there is no need to wait for the aging time of the DNS cache server. This achieves the effect that the terminal can quickly obtain the IP address of the high-defense server and solves the problem of switching the high-defense server in the existing technology. Technical problems with long business interruptions.
  • the system also includes a high-defense server for performing traffic cleaning on the service request data sent by the terminal, forwarding the cleaned data to the service server, and forwarding the service response data fed back by the service server to the service server. terminal.
  • the embodiments of the present application provide a domain name access method against a distributed denial of service DDOS attack.
  • the method is applied to a terminal.
  • the method includes receiving an operation request to access a business server corresponding to the target domain name; in response to the operation request, Send a resolution request containing the target domain name to the main DNS server; send service request data to the service server according to the IP address of the service server corresponding to the target domain name fed back by the main DNS server; determine to access the service server when the service server is attacked by DDOS Error; send the resolution request containing the target domain name to the backup DNS server; according to the IP address of the high defense server corresponding to the target domain name fed back by the backup DNS server, send the service request data to the high defense server; among them, the business server is attacked by DDOS
  • the backup DNS server is configured to resolve the target domain name to the IP address of the high defense server.
  • the trigger mechanism set in the terminal triggers the request for the resolution of the backup DNS server when an access error is sensed, without requesting the resolution of the primary DNS server, so there is no need to wait for the aging time of the DNS cache server, which enables the terminal to be able to
  • the effect of quickly obtaining the IP address of the high-defense server solves the technical problem of long service interruption time when switching the high-defense server in the prior art.
  • the terminal is installed with a client that integrates the SDK function; the SDK function is used to configure the terminal to send a resolution request containing the target domain name to the backup DNS server that contains the target domain name when an error occurs when accessing the business server. Parse the request.
  • the integrated SDK function is used to execute the trigger mechanism of the backup DNS server, which facilitates the integration of the SDK function into other applications.
  • the SDK function is used to encapsulate the information of the target domain name in the target information format to obtain the resolution request sent to the backup DNS server.
  • the information carried in the analysis request also includes the identification of the terminal and/or the error code returned by the IP address of the access service server.
  • the resolution request received by the backup DNS server contains more information, which can be used for subsequent analysis.
  • the method further includes: according to the backup DNS The server resolves the target domain name to obtain the IP address of the business server, and sends the business request data to the business server; among them, the backup DNS server is used to set the resolution address for the target domain name as the business server's address when the business server is not attacked by DDOS.
  • the IP address of the service server is fed back to the terminal; if it is determined that there is an error in accessing the service server, it will include the target domain name
  • the resolution request is sent to the backup DNS server.
  • the terminal sends a resolution request to the backup DNS server, but the backup DNS server does not switch the IP address of the high-defense server before retrying to send the resolution request to the backup DNS server, which improves the access success rate .
  • the access target domain name is executed by the client installed in the terminal. After sending the service request data to the high defense server, the method further includes: if the client is not closed, if the access target is received The domain name operation request sends the resolution request containing the target domain name to the backup DNS server.
  • the terminal's client is not closed, if the terminal again receives an operation request to access the service server corresponding to the target domain name, the terminal still sends the resolution request of the target domain name to the backup DNS server to prevent The terminal has service interruption due to IP address switching, which improves user experience.
  • the access to the target domain name is executed by the client installed in the terminal.
  • the method further includes: if the client is restarted after being closed, if it receives The operation request for accessing the target domain name is to send the resolution request containing the target domain name to the primary DNS server containing the resolution request of the target domain name.
  • the embodiment of the present application provides a method for protecting a distributed denial-of-service DDOS attack.
  • the method is applied to the business end.
  • the method includes: determining the business server corresponding to the target domain name in the resolution request sent by the terminal to the primary DNS server Subject to DDOS attack; notify the backup DNS server to resolve the target domain name to the IP address of the high-defense server, so that the terminal that sends the resolution request containing the target domain name to the primary DNS server changes to the backup DNS server after sending the resolution request containing the target domain name , Obtain the IP address of the high defense server corresponding to the target domain name resolved by the backup DNS server.
  • a backup DNS server is added.
  • the backup DNS server modifies the IP address, so that the terminal triggers a request for resolution of the backup DNS server when it senses an access error. There is no need to request the main DNS server to resolve, so there is no need to wait for the aging time of the DNS cache server, which realizes the effect that the terminal can quickly obtain the IP address of the high-defense server, and solves the long service interruption time when switching the high-defense server in the existing technology Technical issues.
  • determining that the service server is attacked by DDOS includes: determining that the upstream bandwidth of the service server exceeds a preset threshold.
  • the method further includes: notifying the operator of the primary DNS server, and instructing the operator of the primary DNS server to notify the primary DNS server Block the IP address of the business server.
  • the method further includes: notifying the operator of the primary DNS server, and instructing the operator of the primary DNS server to notify the primary DNS server to change the IP of the business server The address is unblocked.
  • the service end and the service server share the network exit, and the communication priority of the notification message sent by the service end to the operator of the main DNS server is configured to be at least higher than the communication priority of the service server and the terminal.
  • the notification message is a message that the business end notifies the operator of the primary DNS server to notify the primary DNS server to block or unblock the block.
  • instructing the backup DNS server to resolve the target domain name to the IP address of the high defense server includes: instructing the dispatch end through the dispatcher to notify the backup DNS server to resolve the target domain name to the IP address of the high defense server.
  • an embodiment of the present application provides a domain name access device for a distributed denial of service DDOS attack.
  • the device is applied to a terminal.
  • the device includes: a receiving module for receiving an operation request to access a service server corresponding to the target domain name ;
  • the first sending module is used to send a resolution request containing the target domain name to the main DNS server in response to the operation request;
  • the second sending module is used to send the service to the service according to the IP address of the service server corresponding to the target domain name fed back by the main DNS server
  • the server sends the service request data;
  • the determining module is used to determine that there is an error in accessing the service server when the service server is attacked by DDOS;
  • the third sending module is used to send the resolution request containing the target domain name to the backup DNS server;
  • the fourth sending The module is used to send service request data to the high defense server according to the IP address of the high defense server corresponding to the target domain name fed back by the backup DNS server; among them, when the
  • the trigger mechanism set in the terminal triggers the request for the resolution of the backup DNS server when an access error is sensed, without requesting the resolution of the primary DNS server, so there is no need to wait for the aging time of the DNS cache server, which enables the terminal to be able to
  • the effect of quickly obtaining the IP address of the high-defense server solves the technical problem of long service interruption time when switching the high-defense server in the prior art.
  • the device further includes: a configuration module, configured to configure the terminal to send a resolution request containing the target domain name to the backup DNS server in the case of an error in accessing the business server, wherein ,
  • the configuration module is a client-side integrated SDK function installed in the terminal.
  • the configuration module includes: an encapsulation unit, configured to encapsulate the information of the target domain name in a target information format to obtain a resolution request sent to the backup DNS server.
  • the information carried in the analysis request also includes the identification of the terminal and/or the error code returned by the IP address of the access service server.
  • the resolution request received by the backup DNS server contains more information, which can be used for subsequent analysis.
  • the device further includes: a fifth sending module, which is used to send the resolution request containing the target domain name to the backup DNS server, after sending the resolution request containing the target domain name to the backup DNS server, the security server corresponding to the target domain name resolved by the backup DNS server Before the IP address, according to the IP address of the business server obtained by the backup DNS server parsing the target domain name, send business request data to the business server; among them, the backup DNS server is used to target the target domain name when the business server is not attacked by DDOS.
  • a fifth sending module which is used to send the resolution request containing the target domain name to the backup DNS server, after sending the resolution request containing the target domain name to the backup DNS server, the security server corresponding to the target domain name resolved by the backup DNS server Before the IP address, according to the IP address of the business server obtained by the backup DNS server parsing the target domain name, send business request data to the business server; among them, the backup DNS server is used to target the target domain name when the business server is not attacked by DDOS.
  • the resolution address is set to the IP address of the business server, and if the resolution address for the target domain name is not successfully set to the IP address of the high defense server, the IP address of the business server is fed back to the terminal; the sixth sending module is used to When it is determined that there is an error in accessing the business server, the resolution request containing the target domain name is sent to the backup DNS server.
  • the terminal sends a resolution request to the backup DNS server, but the backup DNS server does not switch the IP address of the high-defense server before retrying to send the resolution request to the backup DNS server, which improves the access success rate .
  • the access to the target domain name is executed by the client installed in the terminal, and the device further includes: a seventh sending module, which is used to send the service request data to the high defense server when the client is not closed
  • a seventh sending module which is used to send the service request data to the high defense server when the client is not closed
  • the resolution request containing the target domain name is sent to the backup DNS server.
  • the access to the target domain name is executed by the client installed in the terminal, and the device further includes: an eighth sending module, which is used to restart the client after the client is closed after sending the service request data to the high defense server In the case of, if an operation request to access the target domain name is received, the resolution request containing the target domain name is sent to the primary DNS server that contains the resolution request of the target domain name.
  • an embodiment of the present application provides a protection device against distributed denial of service DDOS attacks.
  • the device is applied to the business end.
  • the device includes: a determining module for determining the resolution request sent by the terminal to the primary DNS server.
  • the business server corresponding to the target domain name is attacked by DDOS; the first notification module is used to notify the backup DNS server to resolve the target domain name to the IP address of the high defense server, so that the terminal that sends the resolution request containing the target domain name to the primary DNS server is changing
  • the IP address of the high defense server corresponding to the target domain name resolved by the backup DNS server is obtained.
  • a backup DNS server is added.
  • the backup DNS server modifies the IP address, so that the terminal triggers a request for resolution of the backup DNS server when it senses an access error. There is no need to request the main DNS server to resolve, so there is no need to wait for the aging time of the DNS cache server, which realizes the effect that the terminal can quickly obtain the IP address of the high-defense server, and solves the long service interruption time when switching the high-defense server in the existing technology Technical issues.
  • the determining module includes: a determining unit, configured to determine that the uplink bandwidth of the service server exceeds a preset threshold.
  • the device further includes: a second notification module for notifying the operator of the primary DNS server to instruct the primary DNS server after notifying the backup DNS server to resolve the target domain name to the IP address of the high defense server
  • the operator instructs the main DNS server to block the IP address of the business server.
  • the device further includes: a third notification module, which is used to notify the operator of the primary DNS server when the DDOS attack on the service server has stopped, and instruct the operator of the primary DNS server to notify the host
  • the DNS server unblocks the IP address of the business server.
  • the service end and the service server share the network exit, and the communication priority of the notification message sent by the service end to the operator of the main DNS server is configured to be at least higher than the communication priority of the service server and the terminal.
  • the first notification module includes: a notification unit for instructing the dispatching terminal to notify the backup DNS server to resolve the target domain name to the IP address of the high defense server through the dispatching terminal.
  • an embodiment of the present application provides a computer-readable storage medium in which a computer program is stored, and when it runs on a computer, the computer executes the method described in the third aspect.
  • an embodiment of the present application provides a communication device including: a processor; a memory; an application program; wherein the application program is stored in the memory, and the application program includes instructions.
  • the device executes such as The method described in the third aspect.
  • an embodiment of the present application provides a computer-readable storage medium in which a computer program is stored, and when it runs on a computer, the computer executes the method described in the fourth aspect.
  • an embodiment of the present application provides a communication device, including: a processor; a memory; an application program; wherein the application program is stored in the memory, and the application program includes instructions.
  • the device executes such as The method of the fourth invention.
  • Figure 1 is a schematic diagram of the architecture of an optional distributed denial-of-service DDOS attack protection system in the prior art
  • FIG. 2 is a schematic diagram of an optional protection method for distributed denial of service DDOS attacks in the prior art
  • FIG. 3 is a schematic diagram of an optional distributed denial-of-service DDOS attack protection system provided by an embodiment of the application;
  • FIG. 4 is a schematic diagram of another optional distributed denial-of-service DDOS attack protection system provided by an embodiment of the application;
  • FIG. 5 is a schematic diagram of another optional distributed denial-of-service DDOS attack protection system provided by an embodiment of the application;
  • FIG. 6 is a schematic diagram of a sequence of an optional distributed denial-of-service DDOS attack protection method provided by an embodiment of the application;
  • FIG. 7 is a schematic sequence diagram of another optional distributed denial-of-service DDOS attack protection method provided by an embodiment of the application.
  • FIG. 8 is a sequence diagram of another optional method for protecting against distributed denial of service DDOS attacks provided by an embodiment of the application.
  • FIG. 9 is a schematic diagram of an optional domain name access device for a distributed denial of service DDOS attack provided by an embodiment of the application.
  • FIG. 10 is a schematic diagram of an optional device for protecting against distributed denial of service DDOS attacks according to an embodiment of the application.
  • FIG. 11 is a schematic diagram of an optional communication device provided by an embodiment of this application.
  • FIG. 12 is a schematic diagram of another optional communication device provided by an embodiment of this application.
  • DDOS Distributed Denial of Service
  • DOS Delivery of Service, Denial of Service
  • a single DOS attack generally uses a one-to-one approach.
  • DDOS distributed denial of service attack
  • DN also known as domain name, domain name, the abbreviation of Domain Name
  • domain name is a string of characters separated by ".”, it is the name of a computer or computer group on the Internet (that is, the Internet), used in the data Identifies the computer’s electronic location (sometimes also referred to as geographic location) during transmission.
  • www.wikipedia.org is a domain name.
  • DNS the abbreviation of Domain Name System
  • DNS is a service of the Internet. It is a distributed database that maps domain names and IP (full name Internet Protocol) addresses to each other, which can make it easier for people to access the Internet.
  • DNS uses TCP and UDP port 53. To put it simply, DNS is a system that translates domain names into IP addresses. IP addresses are digital identifiers used as routing addressing of Internet hosts, which are not easy for people to remember, so a character type identifier of domain names is created. For example, www.wikipedia.org is a domain name corresponding to the IP address 208.80.152.2. DNS is like an automatic telephone directory.
  • time to live is the time that a domain name resolution record is stored in the DNS server.
  • the DNS servers in various places receive the resolution request, they will send the resolution request to the NS server (authoritative domain name server) designated by the domain name to obtain the resolution record. After obtaining the resolution record, the record will be stored in the DNS server (caching server in various places, also called recursive domain name server) for a period of time.
  • TTL has a longer time.
  • APP application program, short for Application, can also be called application.
  • the client refers to the application corresponding to the server, which provides local services for the client on the terminal, and needs to cooperate with the server to run.
  • SDK the abbreviation of Software Development Kit, can extend the functions of applications by using SDK software, and can be easily integrated into different applications through interfaces.
  • DC the abbreviation of Data Center
  • the main purpose of a data center is to run applications to process the data of business and operational organizations (such as enterprises).
  • Such systems belong to and are developed internally by the organization, or from enterprise software vendors buy.
  • CNAME short for Canonical name, canonical name, also known as alias record. This type of recording allows multiple names to be mapped to the same computer.
  • a high-defense server can provide security maintenance for a single customer. Simply put, it is a type of server that can help website denial-of-service attacks. All can be defined as high-defense servers.
  • the high-defense server has a large bandwidth and can withstand large traffic attacks.
  • Flow cleaning is the real-time monitoring of the data flow entering the data center DC, and timely detection of abnormal traffic including DOS attacks.
  • Traffic cleaning services can be provided by software operators to customers who use data centers.
  • At least one refers to one or more, and “multiple” refers to two or more.
  • “And/or” describes the association relationship of the associated objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B exists alone, where A, B can be singular or plural.
  • the character “/” generally indicates that the associated objects before and after are in an “or” relationship.
  • the following at least one item (a)” or similar expressions refers to any combination of these items, including any combination of a single item (a) or a plurality of items (a).
  • at least one item (a) of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple .
  • FIG 1 is a schematic diagram of the architecture of an optional distributed denial of service DDOS attack protection system in the prior art.
  • the architecture of the system includes a DNS side, a local business side, a high-defense server and a terminal.
  • the DNS side includes a DNS server operator and a DNS server managed by the DNS server operator.
  • the business side includes the business side and the business server managed by the business side.
  • the operator refers to a service provider that provides corresponding server services, and the operator can manage and maintain the corresponding server.
  • the DNS server operator mentioned in the embodiment of this application refers to the software used to manage the DNS server Management platform, the software platform can be mounted on the managed DNS server or other hardware devices that can communicate with the managed DNS server.
  • the business end described in the embodiments of the present application refers to a software management platform used to manage the business server. The business end can be mounted on the business server or can be mounted on a hardware device capable of communicating with the business server.
  • the server described in the embodiment of the present application may be one server or a server cluster including multiple servers, which is not specifically limited in the embodiment of the present application.
  • the terminal and the service server can communicate through the communication link shown by the dotted line.
  • a user opens the browser APP installed in the mobile phone, enters or clicks the web address (that is, the domain name) "www.xxxx.com" that needs to be accessed, the browser APP will send the domain name resolution request carrying the domain name to the DNS server.
  • the DNS server In response to the request, the DNS server returns the IP address of the service server corresponding to the domain name (that is, the server that provides the content corresponding to the URL "www.xxxx.com") to the user's mobile phone, and the browser APP can directly connect to the corresponding domain name based on the IP address
  • the service server requests access to the domain name, and the service server searches for the content corresponding to the domain name in the service server and feeds it back to the user's mobile phone, so that the user's mobile phone can display the content of the domain name.
  • the upstream bandwidth of the network exit on the business side (that is, the bandwidth from the terminal to the business server communication direction) will be largely occupied, and the attack traffic can reach a maximum of T (full name Terabyte, abbreviated as Terabyte).
  • the maintenance personnel can notify the DNS server operator, so that the DNS server operator can modify the resolution IP addresses of multiple domain names corresponding to the service server to the IP address of the high-defense server, so that the terminal can report to the DNS server
  • the IP of the high-defense server is obtained, and the data services are exchanged with the high-defense server to direct the service traffic of the user terminal to the service server to the high-defense server (or the high-defense server cluster/high-defense computer room).
  • the attacker can attack the business server through the control terminal, after the IP address returned by the DNS server resolution becomes the high defense server, the attacker can also perceive that the IP address has been switched to the high defense server by capturing the data packet returned by the DNS server The IP address of the server may continue to attack the high-defense server, sending a large amount of attack traffic data to occupy the bandwidth of the high-defense server. At this time, normal user traffic and attack traffic will be directed to the high defense server.
  • the high-defense server has a large bandwidth, it can accommodate large traffic attacks, and can perform traffic cleaning processing methods such as near-source cleaning on the traffic, so as to retain the real business data in the received data and clean the attack data.
  • traffic cleaning processing methods such as near-source cleaning on the traffic
  • the real business data is sent to the business server.
  • the upstream bandwidth of the service server has been unoccupied, and the real business data provided by the high defense server can be processed and responded to, and the response data will be fed back to the high defense server.
  • the server distributes to the terminal.
  • the communication link of the service server after being attacked is shown as the solid line in Figure 1. After artificially determining that the attack is over, the business side then informs the DNS server operator to switch the domain name resolution in the DNS server back to the IP address of the business server.
  • the CANME mechanism When changing the IP address corresponding to the domain name in the DNS server, the CANME mechanism can be used. The following information needs to be pre-configured:
  • the manager configures the IP address of the high defense server, the IP address of the business server and the domain name A on the business side.
  • Step 1001 The terminal receives an operation request for accessing the target domain name.
  • Step 1002 The terminal sends a resolution request of the target domain name to the DNS server.
  • Step 1003 The DNS server returns the IP address of the service server to the terminal.
  • Step 1004 The terminal sends service request data to the service server according to the IP address of the service server.
  • Step 1005 When the service server is attacked by DDOS, terminal access error occurs, which may be due to access timeout or access failure.
  • the business end is a software management platform that manages the business server.
  • Step 2001 can be executed to detect whether the business server is attacked in real time.
  • step 2002 when the service server is attacked by DDOS, the service end detects that the service server is attacked.
  • step 2003 the business end notifies the operator of the DNS server, and the operator of the DNS server notifies the DNS server to change the resolved IP address of the domain name A on the DNS server to the IP address of the high defense server.
  • step 2004 the DNS server operator notifies the DNS server to modify all the resolved IP addresses of the relevant domain names on the business side to the IP addresses of the high defense server.
  • the DNS server modifies the IP address of domain name A to the IP address of the anti-defense server, when all terminals request the DNS server to resolve the domain name, the IP address obtained is the IP address of the anti-defense server, and all the traffic sent by the terminal is directed to High-defense server, the high-defense server performs traffic cleaning.
  • the DNS server will not refresh the IP address during the TTL update period, that is, the update time of the resolved IP address corresponding to the domain name in the DNS server is longer, for example , 2 to 10 minutes. If it is an Internet service provider, the TTL time may be longer, reaching one hour or even one or two days. The switching time of the domain name resolution IP address in the DNS server is too slow, resulting in a long-term interruption of the service server.
  • the terminal provides business services.
  • step 1006 the terminal sends a resolution request of the target domain name to the DNS server.
  • the IP address cached in the DNS server is still that of the business server. IP address, go to step 1007, the DNS server returns the IP address of the service server, the terminal still accesses the service server, and the result is still an access error. Only after waiting for the TTL time and the resolution record for domain name A in the DNS server becomes invalid, will the resolution address of domain name A be updated to the IP address of the high defense server, as shown in step 1010 and step 1011 in Figure 2.
  • the terminal sends the service request data to the high defense server, and the high defense server performs traffic cleaning on the service request data, forwards it to the service server, and forwards the service response data returned by the service server to the terminal, as shown in step 1012 in Figure 2 ⁇ 1016. Therefore, since it takes a long time for the DNS server to switch to the IP address of the high-defense server and is restricted by the TTL time set by the operator, the terminal’s business will be interrupted for a long time and the user experience will be poor.
  • the embodiment of the present application provides a distributed denial-of-service DDOS attack protection system, which includes at least a terminal and a service terminal.
  • DDOS attack protection system which includes at least a terminal and a service terminal.
  • Figure 3 is a schematic diagram of the application scenario of an optional distributed denial-of-service DDOS attack protection system provided by an embodiment of the application.
  • the application scenario shown in Figure 3 it is divided into the primary DNS side (including the primary DNS).
  • Server operator and main DNS server local business side (including business side and business server), terminal side (including terminal), cloud side (including backup DNS server), high defense server side (including high defense server).
  • Figure 3 only provides an exemplary system architecture. In other application scenarios, you can configure more or less components than the distributed denial-of-service DDOS attack protection system shown in Figure 3 Parts, and/or part of them may be implemented in combination or separately.
  • the distributed denial-of-service DDOS attack protection system provided by some vendors only includes the above-mentioned business end and terminal.
  • the distributed denial-of-service DDOS attack provided by other vendors can also include at least one of the above servers: namely, a backup DNS server, a business server, and a high-defense server.
  • the terminal side includes a terminal, and optionally, may also include other terminals.
  • the terminal may be a terminal device with communication function such as a mobile phone or a tablet computer.
  • the main DNS side includes a main DNS server (or a main DNS server cluster).
  • the main DNS server is a DNS server used by the terminal by default. It is optional and can also be a DNS server set by the user or the terminal.
  • the main DNS server can be managed and maintained by the main DNS server operator.
  • the primary DNS server operator may be a local Internet service provider of the network where the terminal device carrying the client is located (for example, mobile, telecommunications, etc.). It should be noted that the primary DNS server operator mentioned in the embodiments of this application may refer to a software management platform that manages the primary DNS server, or a device equipped with the software management platform, and the software management platform can be mounted on the platform
  • the managed primary DNS server can also be mounted on other hardware devices that can communicate with the primary DNS server managed by the platform.
  • the primary DNS server operator can be used to configure the primary DNS server.
  • the primary DNS server is used to respond to the request for resolving the target domain name sent by the terminal, resolve the target domain name to obtain the IP address of the business server, and feed it back to the terminal.
  • the client of the terminal can access the service server based on the IP address. For example, the terminal requests to access the domain name "www.xxxx.com", the main DNS server resolves the domain name to obtain the IP address corresponding to the business server as "111.11.1.111", and sends the resolved IP address to the terminal.
  • the primary DNS server can be used as a domain name server for the terminal to request domain name resolution under the normal working condition of the service server without DDOS attack.
  • the local business side can be a government/enterprise data center DC, including a business end, a business server (or a business server cluster).
  • the business end is used to manage the business server, and it can be a software management platform mounted on the business server or other terminal devices that can communicate with the business server.
  • the service server is used to exchange service data with the terminal. When the service server is not attacked by DDOS and can respond normally, the data exchange path is shown by the dotted line in Figure 3.
  • the service server receives the service request data sent by the terminal and sends it to the terminal Feedback business response data. For example, after receiving the IP address of the business server fed back by the main DNS server, the terminal can communicate with the business server based on the IP address and request access to the content of the directory where the domain name in the business server is located.
  • the upstream bandwidth of the network outlet on the local business side will be heavily occupied, and the attack traffic can reach the level of terabytes, causing the business server to respond slowly to the terminal or stop responding, so that normal users cannot access the business. .
  • the method of detecting whether the service server is attacked by DDOS can be judged by the service side based on the detection result of the status parameter (such as export bandwidth) of the local service side.
  • the local business side shares the network exit.
  • the local business side can also deploy a bandwidth detection device (not shown in Figure 2).
  • the bandwidth detection device mirrors the network exit of the network by means of light splitting.
  • Incoming traffic can sense the inbound bandwidth (uplink bandwidth) of the network outlet in real time.
  • the business end can judge whether the business server is attacked by DDOS based on the state parameters detected by the bandwidth detection device. If the upstream bandwidth exceeds the threshold, the business server is determined to be DDOS attacked. attack.
  • a backup DNS server is added in this embodiment of the application.
  • the backup DNS server is set on the cloud side.
  • the backup DNS server can be a cloud configured by the enterprise itself.
  • Server or server cluster
  • the backup DNS server resolves the target domain name to the IP address of the high-defense server at least after the business server is attacked.
  • the high-defense server will perform traffic cleaning on all received data and retain the real business request data.
  • the attack traffic data is cleaned, and the cleaned data is sent to the business server to reduce the load on the network bandwidth of the business server.
  • the client of the terminal is configured to send a domain name resolution request to the backup DNS server when an error occurs when the terminal accesses the service server (for example, access timeout, or 404 error code, etc.).
  • the service server for example, access timeout, or 404 error code, etc.
  • the business end determines whether the business server is under attack, and the business end notifies the backup DNS server to set the resolution result of the target domain name as the IP address of the high defense server.
  • the backup DNS server backs up the domain name resolution data of the primary DNS server in real time, and periodically synchronizes it with the primary DNS server. After the business server is attacked, the business end notifies the backup DNS server to change the relevant domain name of the business server ( At least including the target domain name) the resolved IP address is changed to the IP address of the high-defense server.
  • the TTL time of the backup DNS server can be set to a shorter period, for example, 3 seconds, thereby reducing the waiting time for the backup DNS server to modify the IP address.
  • the resolution record is used to resolve the target domain name (or a related domain name including the target domain name) to the IP address of the anti-defense server, and give priority to the resolution record.
  • the level is set higher than the priority of the original resolution record (resolving the target domain name to the IP address of the business server), so that the resolution request for the target domain name sent to the backup DNS server is resolved to the IP address of the high defense server first.
  • the business end after the business end notifies the backup DNS server to set the resolution result of the target domain name as the IP address of the anti-defense server, if the business end determines that the backup DNS server has set the resolution result of the target domain name as the IP address of the anti-defense server, Then the business end notifies the operator of the primary DNS server, so that the operator of the primary DNS server notifies the primary DNS server to block the IP address of the business server.
  • the IP address of the business server in the main DNS server is blacked out, other terminals cannot query the IP address of the business server when requesting to resolve the target domain name from the main DNS server, and cannot find the business server corresponding to the target domain name. Establishing a connection with the business server will not occupy the upstream bandwidth of the business server.
  • the corresponding terminal will also trigger access to the backup DNS server, request the backup DNS server to resolve the target domain name, and obtain the IP address of the high defense server.
  • the business side determines that the business server stops being attacked by DDOS
  • the business side informs the operator of the primary DNS server so that the operator of the primary DNS server informs the primary DNS server to unblock the IP address of the business server.
  • the blackout is lifted, other terminals that send resolution requests to the main DNS server will obtain the IP address of the service server, and the terminal can exchange service data with the service server, so that the service server gradually resumes its normal working state.
  • a trigger mechanism for changing the DNS server is set in the client terminal of the terminal in advance, and when the terminal senses an error in accessing the target domain name, it triggers a request for the backup DNS server to resolve the target domain name.
  • the backup DNS server resolves the IP address corresponding to the domain name to the IP address of the high defense server
  • the terminal sends the service request data expected to be sent to the service server to the high defense server, and the high defense server cleans the service request data sent by the terminal.
  • the cleaned data is forwarded to the service server, and the service server sends the service response data for the cleaned data to the high defense server, and the high defense server forwards it to the terminal to realize normal business logic.
  • the trigger mechanism for changing the DNS server can be executed by the client-integrated SDK function installed in the terminal.
  • a client integrated with the SDK function is installed in the terminal.
  • the client is used to access the target domain name.
  • the client can be an application.
  • browser APPs and video apps based on the Android system the client is integrated with SDK functions, since the SDK functions can be integrated in different clients to facilitate the implementation of the embodiments of the present application.
  • the SDK function is used to configure the terminal to send a resolution request containing the target domain name to the backup DNS server when it is determined that there is an error in accessing the business server.
  • the SDK encapsulates the domain name, terminal identification, access error code and other information in the protocol information format, and sends the encapsulated resolution request to the backup DNS server.
  • the backup DNS server does not complete the operation of modifying the IP address at this time, and still resolves the IP address corresponding to the target domain name to the IP address of the business server, the client will still fail to access the business server, and the client is integrated
  • the SDK function continues to send the resolution request to the backup DNS server until the backup DNS server resolves the target domain name to the IP address of the high defense server.
  • the backup DNS server can quickly switch the IP address, and the terminal does not request the primary DNS server to resolve the target domain name, so there is no need to wait for the long TTL time of the primary DNS server.
  • the business side detects the attack within 1 second; the business side informs the backup DNS server to switch to the high defense server's IP address within 2 seconds; the main DNS server blocks the business server's IP address within 3 seconds.
  • the perception time of the terminal ranges from slow or failed access to the business server, to the timeout waiting for access to trigger the backup DNS mechanism, to receiving the resolved IP address of the high-defense server to access the high-defense server, so as to access the business normally. After testing the entire process of the terminal From 2 to 10 minutes or even longer time is shortened to less than 12 seconds.
  • the method for the business side to notify the backup DNS server can be any of the following: 1
  • the business side can only notify the backup DNS server that the domain name that resolves the IP address needs to be modified, and the backup DNS server is pre-configured with the IP address of the high defense server ;
  • 2After the service server is attacked the business side informs the backup DNS server that the domain name of the IP address and the IP address of the high defense server need to be modified; or, the business side enables the IP of the high defense server pre-configured in the backup DNS server
  • the mapping between the address and the target domain name, etc. is not specifically limited in the embodiment of the present application, and can be configured according to actual conditions.
  • FIG. 4 is a schematic diagram of the application scenario of another optional distributed denial-of-service DDOS attack protection system provided by an embodiment of the application, compared with the distributed denial-of-service DDOS attack protection system provided in Embodiment 1.
  • a dispatch terminal is added on the cloud side, as shown in Figure 4.
  • the dispatch terminal is used as the dispatch center of the backup DNS server.
  • the business terminal detects that the export bandwidth of the business server is occupied, it will notify the dispatch terminal, and the dispatch terminal will notify the backup DNS server to change the resolution IP address of the domain name to the IP of the high defense server. address.
  • the dispatcher can determine whether the backup DNS server has set the resolution result of the target domain name to the IP address of the anti-defense server. Optionally, on the dispatcher, make sure that the backup DNS server has set the resolution result of the target domain name to the IP address of the anti-defense server. After that, the dispatcher informs the operator of the main DNS server, so that the operator of the main DNS server informs the main DNS server to black out the IP address of the business server, as shown in the communication link shown in Figure 4; alternatively, the dispatcher The service end informs the service end, and then the service end informs the operator of the primary DNS server to black out (the corresponding communication link is not shown in Fig. 4).
  • the service end can notify the dispatch end, and the dispatch end notifies the operator of the primary DNS server to unblock the IP address of the service server.
  • the dispatcher can manage the backup DNS server to continue to synchronize the resolution records from the primary DNS server, so that the resolution records in the backup DNS server can be resolved with the primary DNS server.
  • the records are kept in sync.
  • FIG. 5 is a schematic diagram of the application scenario of another optional distributed denial-of-service DDOS attack protection system provided by an embodiment of the application, compared with the distributed denial-of-service DDOS attack protection system provided in Embodiment 2.
  • a local protection platform is added to the local service side.
  • the service side determines that the upstream bandwidth of the network outlet on the local service side (the link direction sent by the terminal to the service server is upstream) occupies a threshold less than
  • switch to high-defense server cleaning traffic After the upstream bandwidth is higher than the preset threshold, switch to high-defense server cleaning traffic.
  • the system provided in this embodiment can prevent frequent switching of high-defense servers, reduce the number of switching to high-defense servers, and thereby reduce the number of service interruptions.
  • the preset threshold is configured to be 80% of the bandwidth at the service end (optionally, the percentage of the preset threshold to the bandwidth can also be configured to be adjusted according to the actual current situation). If the preset bandwidth threshold is not reached, it is considered that the attack has not reached the endurance of the local bandwidth, and there is no need to switch to a high-defense server. Within the preset threshold, protection can be performed locally.
  • the distributed denial-of-service DDOS attack protection system may also include an authoritative DNS server for the target domain name, and the authoritative DNS server for the target domain name may be set on the local business side, and the target domain name
  • the authoritative DNS server for the target domain name is used to provide authoritative resolution for the target domain name.
  • the authoritative DNS server for the target domain name can also be used to provide authoritative resolution for other domain names, for example, other domain names corresponding to the business server of the target domain name, or other services The domain name corresponding to the server, etc.
  • the backup DNS server is synchronized, the analysis record is not synchronized from the primary DNS server, but from the authoritative DNS server. In the case of an attack on the service server, at least modify the resolution IP address of the target domain name in the backup DNS server to the IP address of the high-defense server.
  • the terminal may be a mobile terminal such as a mobile phone or a tablet computer, and a client may be installed in the terminal.
  • the terminal side may also include an attack terminal, which may be carried in devices such as computers, cloud hosts, and IoT (The Internet of Things) devices.
  • the local business side can be the data center of the enterprise, and the enterprise can build its own computer room or lease the computer room, and deploy its own network equipment, security equipment, and business.
  • Servers and application systems, etc. in order to provide services to users, users can access the data center of the enterprise via the Internet through the terminal.
  • an enterprise can have multiple data centers.
  • the backup DNS server since the backup DNS server is deployed on the cloud side, it can ensure that the backup DNS server and the terminal are under attack when the local service side is attacked and the uplink bandwidth is occupied. Stable communication.
  • the embodiment of the present application also provides a protection method for a distributed denial of service DDOS attack, which can be executed by the distributed denial of service DDOS attack protection system provided by the embodiment of the present application.
  • a protection method for a distributed denial of service DDOS attack which can be executed by the distributed denial of service DDOS attack protection system provided by the embodiment of the present application.
  • an embodiment of the present application provides a sequence diagram of a protection method for distributed denial of service DDOS attacks as shown in FIG. 6, which specifically includes the following steps:
  • Step 101 The terminal receives an operation request for accessing the target domain name
  • Step 102 The terminal sends a resolution request of the target domain name to the primary DNS server;
  • Step 103 The main DNS server returns the IP address of the service server to the terminal;
  • Step 104 The terminal sends service request data to the service server;
  • Step 105 When the service server is attacked by DDOS, the terminal access error; the direction of step 105 in FIG. 5 indicates that when the service server is attacked by DDOS, the service end may not respond to the terminal, or the response time is slow.
  • Step 106 The terminal sends a resolution request of the target domain name to the alternate DNS server.
  • the business end will perform step 201 on the business server in real time in a preset period: real-time detection of whether the business server is attacked;
  • Step 202 the business end detects that the business server is attacked
  • step 203 after detecting the attack, the business end notifies the backup DNS server to set to resolve the target domain name to the IP address of the high defense server.
  • step 106 and step 203 the backup DNS server executes step 107 and returns the IP address of the high defense server to the terminal;
  • Step 108 The terminal sends service request data to the IP address of the high defense server
  • Step 109 The high defense server performs traffic cleaning on the service request data
  • Step 110 The high defense server sends the cleaned data to the business server;
  • Step 111 The service server returns service response data to the high defense server
  • Step 112 The service server forwards the service response data to the terminal.
  • step 204 the backup DNS server executes step 204 to notify the service side that the setting is successful.
  • step 205 the business end notifies the operator of the primary DNS server, and the primary DNS server operator informs the primary DNS server to block the IP address of the business server in the primary DNS server.
  • step 206 the main DNS server operator notifies the main DNS server to block the IP address of the service server.
  • Step 207 since the service end detects whether the attack is in real time, the service end can detect the attack when the attack stops.
  • step 208 the business end notifies the operator of the primary DNS server, and the primary DNS server operator notifies the primary DNS server to unblock the IP address of the business server.
  • Step 209 The operator of the primary DNS server notifies the primary DNS server to remove the blackout.
  • the stop of the attack detected in step 207 may also be manually judged.
  • an embodiment of the present application provides a sequence diagram of a method for protecting against distributed denial of service DDOS attacks as shown in FIG. 7. Since the system provided in embodiment 2 adds a scheduling terminal compared to the system provided in embodiment 1, this embodiment is different from the method provided in embodiment 4 in steps 203, 204, 205, and 208, and Step 207' is added: the business end notifies the dispatch end of the attack to stop. In step 203, after detecting the attack, the service end notifies the dispatch end, and the dispatch end notifies the backup DNS server to modify the resolved IP address. In step 204, step 205, and step 208, what is executed by the service end is changed to be executed by the dispatch end.
  • an embodiment of the present application provides a method for protecting against distributed denial of service DDOS attacks.
  • the sequence diagram is shown in FIG. 8. Since the system provided in embodiment 3 has added local protection compared to the system provided in embodiment 2, after performing step 201 on the service side to detect whether the service server is attacked in real time, steps 2011 and 2012 are added to the method provided in embodiment 4. If the business end detects that the upstream traffic is less than the preset threshold, the local protection will perform traffic cleaning on the incoming traffic. After the business end detects that the upstream traffic is higher than the preset threshold, it is determined that the business server is under attack.
  • the embodiment of the application also provides a domain name access method applied to the above-mentioned terminal in a distributed denial of service DDOS attack.
  • the method provided in this embodiment may include the following steps:
  • Step 301 Determine that an operation request to access the business server corresponding to the target domain name is received
  • Step 302 Send the resolution request of the target domain name to the primary DNS server
  • Step 303 Obtain the IP address of the business server corresponding to the target domain name obtained by the primary DNS server parsing the target domain name;
  • Step 304 Send the service request data to the IP address of the service server
  • Step 305 It is determined that an error occurred when accessing the service server
  • Step 306 Send the resolution request of the target domain name to the backup DNS server;
  • Step 307 Obtain the IP address of the high defense server obtained by the backup DNS server analyzing the target domain name;
  • Step 308 Send the service request data to the IP address of the high defense server.
  • step 302 when performing step 302 to send the resolution request of the target domain name to the backup DNS server, call the integrated target SDK function to perform the following steps: encapsulate the information including the target domain name in the target information format to obtain the resolution request; send the resolution request To the backup DNS server.
  • the information carried in the analysis request further includes the identification of the terminal and/or the error code returned by the IP address of the access service server.
  • the method further includes:
  • Step 3071 Obtain the IP address of the business server obtained by the backup DNS server parsing the target domain name, where the backup DNS server sets the IP address resolved for the target domain name as the IP address of the business server before determining that the business server is attacked by DDOS;
  • Step 3072 Send the service request data to the IP address of the service server
  • Step 3073 In the case of determining that there is an error in accessing the service server, retry sending the resolution request of the target domain name to the backup DNS server.
  • the access to the target domain name can be executed by the client installed in the terminal.
  • step 308 to send the service request data to the IP address of the high defense server
  • the client of the terminal is not closed, if it is determined to receive the service again
  • the resolution request of the target domain name is sent to the backup DNS server to prevent the terminal from interrupting the service due to the IP address switch, and improve the user experience; the case of restarting after the terminal client is closed
  • the resolution request of the target domain name is sent to the main DNS server, so that it can be switched to the business server when the DDOS attack on the business server has stopped IP address for the interaction of business data.
  • the embodiment of the present application also provides an embodiment of a method for protecting against a distributed denial of service DDOS attack applied to the business end.
  • the method provided in this embodiment includes the following steps:
  • Step 601 Determine that the business server corresponding to the target domain name is attacked by DDOS;
  • Step 602 Notify the backup DNS server to set the resolution result of the target domain name as the IP address of the anti-defense server, so that the resolution request for the target domain name sent to the backup DNS server is resolved to the IP address of the anti-defense server.
  • the backup DNS server is used to back up the domain name resolution data of the primary DNS server in a preset period
  • the high defense server is used to perform traffic cleaning on the service request data sent by the terminal, forward the cleaned data to the service server, and transfer the service server The service response data in response to the cleaned data is forwarded to the corresponding terminal.
  • the operator of the primary DNS server can also be notified, so that the operator of the primary DNS server informs the primary DNS server to block the service The IP address of the server.
  • the method further includes:
  • Step 6011 Determine that the service server stops being attacked by DDOS
  • step 6012 the operator of the main DNS server is notified, so that the operator of the main DNS server informs the main DNS server to unblock the IP address of the service server.
  • the business end shares the network exit with the business server.
  • the operation from the business end to the main DNS server can be set
  • the communication priority of the blackout message and the notification message for removing blackout sent by the merchant is at least higher than the communication priority of the service server and the terminal. Even when the export bandwidth of the service server is congested, the communication priority between the service terminal and the main DNS server Communication messages can also be transmitted preferentially.
  • an optional implementation manner in which the backup DNS server is notified to set the resolution result of the target domain name as the IP address of the high-defense server In order to notify the dispatcher, the dispatcher informs the backup DNS server to change the resolution IP address of the domain name to the IP address of the high-defense server.
  • the dispatcher is used to notify the backup DNS server of the resolution result of the target domain name according to the preset configuration information. Set to the IP address of the high-defense server, where the preset configuration information includes the IP address of the high-defense server.
  • the business end may send information such as the attacked domain name, attacked IP, attack type, attack time and other information to the dispatch end.
  • the dispatcher will notify the backup DNS server to set the resolution result of the target domain name to the IP address of the high-defense server according to the preset configuration information.
  • the method may further include the following steps:
  • Step 701 The dispatcher determines that the backup DNS server has set the resolution result of the target domain name as the IP address of the high defense server;
  • step 702 the dispatching terminal notifies the operator of the main DNS server, and the dispatching terminal is notified by the operator of the main DNS server to notify the main DNS server to block the IP address of the service server.
  • an optional specific implementation manner for the backup DNS server to set the IP address of the high defense server is to perform the following steps after notifying the backup DNS server to set the resolution result of the target domain name to the IP address of the high defense server:
  • Step 801 Back up the resolution record of the newly added target domain name of the DNS server and the IP address of the high defense server;
  • Step 802 The backup DNS server sets the priority of the newly added resolution record higher than the resolution record backed up from the primary DNS server.
  • Fig. 9 is a schematic block diagram of an optional domain name access device for distributed denial of service DDOS attacks according to an embodiment of the present application. It should be understood that the device can execute the method embodiment provided in Embodiment 7 and the steps in the optional implementation manners thereof, and can be applied to the terminal of the foregoing system embodiment. In order to avoid repetition, it will not be described in detail here.
  • the domain name access device for distributed denial of service DDOS attacks as shown in FIG. 9 includes: a receiving module 11, a first sending module 12, a second sending module 13, a determining module 14, a third sending module 15 and a fourth sending module 16 .
  • the receiving module is used to receive an operation request to access the business server corresponding to the target domain name; the first sending module is used to send a resolution request containing the target domain name to the main DNS server in response to the operation request; the second sending module uses According to the IP address of the business server corresponding to the target domain name fed back by the main DNS server, the business request data is sent to the business server; the determining module is used to determine that there is an error in accessing the business server when the business server is attacked by DDOS; the third sending module , Used to send the resolution request containing the target domain name to the backup DNS server; the fourth sending module, used to send the service request data to the high defense server according to the IP address of the high defense server corresponding to the target domain name fed back by the backup DNS server; where When the business server is attacked by DDOS, the backup DNS server is configured to resolve the target domain name to the IP address of the high defense server.
  • the trigger mechanism set in the terminal triggers the request for the resolution of the backup DNS server when an access error is sensed, without requesting the resolution of the primary DNS server, so there is no need to wait for the aging time of the DNS cache server, which enables the terminal to be able to
  • the effect of quickly obtaining the IP address of the high-defense server solves the technical problem of long service interruption time when switching the high-defense server in the prior art.
  • the device further includes: a configuration module, configured to configure the terminal to send a resolution request containing the target domain name to the backup DNS server in the case of an error in accessing the service server.
  • the resolution request containing the target domain name is sent to the backup DNS server.
  • the configuration module is a client-side integrated SDK function installed in the terminal.
  • the encapsulated SDK function is used to execute the trigger mechanism of the backup DNS server, which facilitates the integration of the SDK function into other applications.
  • the configuration module includes: an encapsulation unit, configured to encapsulate the information of the target domain name in a target information format to obtain a resolution request sent to the backup DNS server.
  • the information carried in the analysis request further includes the identification of the terminal and/or the error code returned by the IP address of the access service server.
  • the resolution request received by the backup DNS server contains more information, which can be used for subsequent analysis.
  • the device further includes: a fifth sending module, configured to send the resolution request containing the target domain name to the backup DNS server, and then perform the high-definition system corresponding to the target domain name resolved by the backup DNS server after sending the resolution request containing the target domain name to the backup DNS server.
  • a fifth sending module configured to send the resolution request containing the target domain name to the backup DNS server, and then perform the high-definition system corresponding to the target domain name resolved by the backup DNS server after sending the resolution request containing the target domain name to the backup DNS server.
  • a fifth sending module configured to send the resolution request containing the target domain name to the backup DNS server, and then perform the high-definition system corresponding to the target domain name resolved by the backup DNS server after sending the resolution request containing the target domain name to the backup DNS server.
  • the resolution address of the domain name is set to the IP address of the business server, and if the resolution address for the target domain name is not successfully set to the IP address of the high defense server, the IP address of the business server is fed back to the terminal; the sixth sending module uses In the case where it is determined that there is an error in accessing the business server, the resolution request containing the target domain name is sent to the backup DNS server.
  • the terminal sends a resolution request to the backup DNS server, but the backup DNS server does not switch the IP address of the high-defense server before retrying to send the resolution request to the backup DNS server, which improves the access success rate .
  • the access to the target domain name is executed by a client installed in the terminal, and the device further includes: a seventh sending module, configured to send service request data to the high defense server without closing the client
  • a seventh sending module configured to send service request data to the high defense server without closing the client
  • the resolution request containing the target domain name is sent to the backup DNS server.
  • the access to the target domain name is executed by a client installed in the terminal, and the device further includes: an eighth sending module, configured to send service request data to the high defense server and after the client is closed In the case of restarting, if an operation request to access the target domain name is received, the resolution request containing the target domain name is sent to the primary DNS server that contains the resolution request of the target domain name.
  • domain name access device for the distributed denial of service DDOS attack provided in the foregoing embodiment is embodied in the form of a functional module or a functional unit.
  • the term "unit” or “module” herein can be implemented in the form of software and/or hardware, and there is no specific limitation on this.
  • “unit” or “module” can be a software program, a hardware circuit, or a combination of the two that realize the above-mentioned functions.
  • Hardware circuits may include application specific integrated circuits (ASICs), electronic circuits, and processors used to execute one or more software or firmware programs (such as shared processors, proprietary processors, or group processors, etc.) And memory, merging logic circuits, and/or other suitable components that support the described functions.
  • ASICs application specific integrated circuits
  • electronic circuits electronic circuits
  • processors used to execute one or more software or firmware programs (such as shared processors, proprietary processors, or group processors, etc.)
  • memory merging logic circuits, and/or other suitable components that support the described functions.
  • the units of the examples described in the embodiments of the present application can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered as going beyond the scope of the embodiments of the present application.
  • Fig. 10 is a schematic block diagram of an optional device for protecting against distributed denial of service DDOS attacks according to an embodiment of the present application. It should be understood that the device can execute each step in the method embodiment provided in Embodiment 8 and its optional implementation manners, and in order to avoid repetition, details are not described herein again.
  • the protection device against distributed denial of service DDOS attacks as shown in FIG. 10 includes a determination module 21 and a first notification module 22.
  • the determining module is used to determine that the business server corresponding to the target domain name in the resolution request sent by the terminal to the primary DNS server is attacked by DDOS; the first notification module is used to notify the backup DNS server to resolve the target domain name to the IP of the high defense server Address, so that the terminal that sends a resolution request containing the target domain name to the primary DNS server, after sending a resolution request containing the target domain name to the backup DNS server instead, obtains the security server's information that is resolved by the backup DNS server and corresponds to the target domain name. IP address.
  • a backup DNS server is added.
  • the backup DNS server modifies the IP address, so that the terminal triggers a request for resolution of the backup DNS server when it senses an access error. There is no need to request the main DNS server to resolve, so there is no need to wait for the aging time of the DNS cache server, which realizes the effect that the terminal can quickly obtain the IP address of the high-defense server, and solves the long service interruption time when switching the high-defense server in the existing technology Technical issues.
  • the determining module includes: a determining unit, configured to determine that the uplink bandwidth of the service server exceeds a preset threshold.
  • the device further includes: a second notification module, configured to notify the operator of the primary DNS server after notifying the backup DNS server to resolve the target domain name to the IP address of the high defense server
  • the operator of the primary DNS server informs the primary DNS server to block the IP address of the business server.
  • the device further includes: a third notification module, configured to notify the operator of the main DNS server when the DDOS attack on the service server has stopped, so that the operation of the main DNS server The provider informs the main DNS server to unblock the IP address of the business server.
  • a third notification module configured to notify the operator of the main DNS server when the DDOS attack on the service server has stopped, so that the operation of the main DNS server The provider informs the main DNS server to unblock the IP address of the business server.
  • the business end and the business server share the network exit, and the communication priority of the notification message sent by the business end to the operator of the primary DNS server is configured to be at least higher than the communication priority of the business server and the terminal.
  • the first notification module includes: a notification unit, configured to use the dispatch terminal to make the dispatch terminal notify the backup DNS server to resolve the target domain name into the IP address of the high defense server.
  • a notification unit configured to use the dispatch terminal to make the dispatch terminal notify the backup DNS server to resolve the target domain name into the IP address of the high defense server.
  • the protection device against distributed denial of service DDOS attacks is embodied in the form of functional modules or functional units.
  • the term “unit” or “module” herein can be implemented in the form of software and/or hardware, and there is no specific limitation on this.
  • “unit” or “module” can be a software program, a hardware circuit, or a combination of the two that realize the above-mentioned functions.
  • Hardware circuits may include application specific integrated circuits (ASICs), electronic circuits, and processors used to execute one or more software or firmware programs (such as shared processors, proprietary processors, or group processors, etc.) And memory, merging logic circuits, and/or other suitable components that support the described functions.
  • the units of the examples described in the embodiments of the present application can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered as going beyond the scope of the embodiments of the present application.
  • the embodiment of the present application also provides a communication device.
  • the domain name access method for distributed denial of service DDOS attack applied to the terminal provided in the embodiment of the present application can be executed by the communication device provided in the eleventh embodiment.
  • Fig. 11 is a schematic structural diagram of an optional communication device.
  • the communication device shown in FIG. 11 may be a communication device such as a mobile phone and a tablet computer.
  • the communication device 900 includes a processor 910 and a transceiver 920.
  • the communication device 900 may further include a memory 930.
  • the processor 910, the transceiver 920, and the memory 930 can communicate with each other through an internal connection path to transfer control and/or data signals.
  • the memory 930 is used to store computer programs, and the processor 910 is used to download from the memory 930. Call and run the computer program.
  • the communication device 900 may further include an antenna 940 for transmitting the wireless signal output by the transceiver 920.
  • the above-mentioned processor 910 and the memory 930 may be integrated into a processing device, and more commonly, are components independent of each other.
  • the processor 910 is configured to execute the program code stored in the memory 930 to implement the above-mentioned functions.
  • the memory 930 may also be integrated in the processor 910, or independent of the processor 910.
  • the communication device 900 may also include one or more of an input unit 960, a display unit 970, an audio circuit 980, a camera 990, and a sensor 901.
  • the circuit may also include a speaker 982, a microphone 984, and so on.
  • the display unit 970 may include a display screen, and the display screen may be a touch-sensitive display screen, and the touch-sensitive display screen may receive a touch operation to determine whether an operation request to access the target domain name is received.
  • the aforementioned communication device 900 may further include a power supply 950 for providing power to various devices or circuits in the communication device.
  • the communication device 900 shown in FIG. 11 can implement each process of the method provided in Embodiment 7.
  • the operations and/or functions of the various modules in the communication device 900 are respectively intended to implement the corresponding processes in the foregoing method embodiments.
  • processor 910 in the communication device 900 shown in FIG. 11 may be a system-on-chip SOC, and the processor 910 may include a central processing unit (Central Processing Unit; hereinafter referred to as: CPU), and may further include other types of Processor, for example: Graphics Processing Unit (hereinafter referred to as GPU), etc.
  • CPU Central Processing Unit
  • GPU Graphics Processing Unit
  • each part of the processor or processing unit inside the processor 910 can cooperate to implement the previous method flow, and the corresponding software program of each part of the processor or processing unit can be stored in the memory 930.
  • the embodiment of the present application also provides a communication device.
  • the method for protecting against distributed denial of service DDOS attacks applied to the business end provided in the embodiment of the present application can be executed by the communication device provided in the twelfth embodiment.
  • FIG. 12 is a schematic structural diagram of an optional communication device.
  • the communication device 1200 includes: one or more processors 1202; a memory 1203; a communication module 1201; and one or more computer programs 1204.
  • the above-mentioned devices may be connected through one or more communication buses 1005.
  • the aforementioned one or more computer programs 1204 are stored in the aforementioned memory 1203 and are configured to be executed by the one or more processors 1202, and the one or more computer programs 1204 include instructions, and the aforementioned instructions can be used to execute the aforementioned Each step performed by the smart home device in the embodiment should be followed.
  • the communication device 1200 shown in FIG. 12 may be a communication device such as a computer, a personal computer, a workstation, and a server.
  • the communication device 1200 shown in FIG. 12 can implement each process of the method provided in Embodiment 8.
  • the operation and/or function of each module in the communication device 1200 is to implement the corresponding process in the foregoing method embodiment.
  • the embodiments of the present application also provide a computer-readable storage medium in which a computer program is stored, and when the computer program is run on a computer, the computer executes the method described in the above-mentioned embodiment.
  • embodiments of the present application also provide a computer program product, which includes a computer program, which when running on a computer, causes the computer to execute the method described in the foregoing embodiment.
  • the computer may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it can be implemented in the form of a computer program product in whole or in part.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例提供一种分布式拒绝服务DDOS攻击的防护方法、装置及系统，该分布式拒绝服务DDOS攻击的防护方法包括：在终端访问目标域名的业务服务器出错的情况下，终端由向主DNS服务器发送包含目标域名的解析请求，改为向备份DNS服务器发送包含目标域名的解析请求，其中，备份DNS服务器被配置为在业务服务器受到DDOS攻击的情况下，将目标域名的解析地址设置为高防服务器的IP地址。通过配置备份DNS服务器，可以快速的将域名设置为高防服务器的IP地址，解决了已有技术中切换高防服务器时业务中断时间较长的技术问题。

Description

分布式拒绝服务DDOS攻击的防护方法、装置及系统 技术领域
本申请实施例涉及软件防护技术领域，特别涉及一种分布式拒绝服务DDOS攻击的防
护方法、装置及系统。
背景技术
Internet的普及为社会的发展带来了巨大的推动力，但同时也产生了大量的网络安全问题，作为网络服务的提供者，企业经常被各种DDOS攻击事件困扰，DDOS攻击由于其易获得性，且攻击效果明显，因此受到很多攻击者的青睐，给企业运营带来广泛危害。会导致拥塞网络带宽、耗尽有状态设备(防火墙、负载均衡器等)的会话资源、耗尽服务器的处理能力，从而影响正常用户的访问，导致客户对企业运营能力怀疑；DNS缓存服务器被DDOS攻击瘫痪，导致整网的internet访问受到影响；频繁的DDOS攻击长期占用着企业的带宽，导致企业不得不进行扩容，增加了投资压力。
已有技术中，针对大流量DDOS攻击，企业网络出口的带宽相对较小，无法抵御大流量DDOS攻击，因此需要考虑采用高防方案，但是，每次切换至高防服务器都需要消耗较长时间，会引起业务服务器提供的业务中断较长时间(几分钟)，如何能快速切换高防，减少业务中断时间，是目前亟需解决的问题。
申请内容
本申请实施例提供了一种分布式拒绝服务DDOS攻击的防护方法、装置及系统，以解决已有技术中切换高防时业务中断时间较长的技术问题。
第一方面，本申请实施例提供了一种分布式拒绝服务DDOS攻击的防护方法，该方法包括：终端将包含目标域名的解析请求发送至主域名解析系统DNS服务器；终端根据主DNS服务器反馈的目标域名对应的业务服务器的互联网协议IP地址，向业务服务器发送业务请求数据；在业务服务器受到DDOS攻击的情况下，终端访问业务服务器出错；终端将包含目标域名的解析请求发送至备份DNS服务器；备份DNS服务器将目标域名解析为高防服务器的IP地址；其中，在业务服务器受到DDOS攻击的情况下，业务端通知备份DNS服务器将针对目标域名的解析地址设置为高防服务器的IP地址；终端根据备份DNS服务器反馈的高防服务器的IP地址，向高防服务器发送业务请求数据。
通过本实施例提供的方案，新增了备份DNS服务器，在受到攻击需要切换高防服务器的IP地址时，备份DNS服务器修改IP地址，并利用终端设置的触发机制，在感知到访问错误时触发请求备份DNS服务器解析，不需要请求主DNS服务器解析，因此无需等待DNS缓存服务器的老化时间，实现了终端能够快速获取高防服务器的IP地址的效果，解决了已有技术中切换高防服务器时业务中断时间较长的技术问题。
在一种可能的设计中，在终端向高防服务器该业务请求数据之后，该方法还包括：高防服务器对终端发送的业务请求数据执行流量清洗，将清洗后的数据转发至业务服务 器，并将业务服务器反馈的业务响应数据转发至终端。通过高防服务器的清洗，减轻了业务服务器压力，确保正常发送业务请求数据的用户能够接收到正常的反馈数据。
在一种可能的设计中，访问目标域名由终端中安装的客户端执行，在终端向高防服务器发送业务请求数据之后，该方法还包括：在客户端未关闭的情况下，如果终端接收到访问目标域名的操作请求，终端将包含目标域名的解析请求发送至备份DNS服务器。通过本实施例提供的方案，在终端的客户端未关闭的情况下，如果终端再次接收到访问目标域名对应的业务服务器的操作请求，终端仍然将目标域名的解析请求发送至备份DNS服务器，防止终端由于IP地址切换出现业务中断，提高用户的体验。
在一种可能的设计中，访问目标域名由终端中安装的客户端执行，在终端向高防服务器发送业务请求数据之后，该方法还包括：在客户端关闭后再次启动的情况下，如果终端接收到访问目标域名的操作请求，终端将包含目标域名的解析请求发送至主DNS服务器。通过本实施例提供的方案，在终端的客户端关闭后再重启的情况下，默认将目标域名的解析请求发送至主DNS服务器，以在业务服务器受到的DDOS攻击已停止的情况下，能够切换至向主DNS服务器获取目标域名的解析地址。
在一种可能的设计中，在业务端通知备份DNS服务器将针对目标域名的解析地址设置为高防服务器的IP地址之后，该方法还包括：业务端确定备份DNS服务器已将针对目标域名的解析地址设置为高防服务器的IP地址；业务端通知主DNS服务器的运营商，指示主DNS服务器的运营商通知主DNS服务器将业务服务器的IP地址拉黑。通过本实施例提供的方案，使业务服务器在被攻击之后IP地址被拉黑，防止终端向业务服务器发送业务请求数据继续占用带宽，能够节约业务服务器的出口带宽。
在一种可能的设计中，在业务服务器受到的DDOS攻击已停止的情况下，该方法还包括：业务端通知主DNS服务器的运营商，指示主DNS服务器的运营商通知主DNS服务器将业务服务器的IP地址解除拉黑。通过本实施例提供的方案，在被主DNS服务器解除拉黑之后，其它终端在向主DNS服务器发送目标域名的解析请求时，能够获取到业务服务器的IP地址，使业务服务器在受到的攻击停止之后能够恢复正常的使用。
第二方面，本申请实施例提供一种分布式拒绝服务DDOS攻击的防护系统，该系统包括：终端，用于将包含目标域名的解析请求发送至主DNS服务器，根据主DNS服务器反馈的目标域名对应的业务服务器的IP地址，向业务服务器发送业务请求数据；在访问业务服务器出错的情况下，将包含目标域名的解析请求发送至备份DNS服务器；根据备份DNS服务器反馈的高防服务器的IP地址，向高防服务器发送业务请求数据；业务端，用于在业务服务器受到DDOS攻击的情况下，通知备份DNS服务器将针对目标域名的解析地址设置为高防服务器的IP地址；备份DNS服务器，用于在接收到业务端的通知之后，将针对目标域名的解析地址设置为高防服务器的IP地址；在将针对目标域名的解析地址设置为高防服务器的IP地址之后，针对终端发送的包含目标域名的解析请求解析为高防服务器的IP地址反馈给终端。通过本实施例提供的方案，新增了备份DNS服务器，在受到攻击需要切换高防服务器的IP地址时，备份DNS服务器修改IP地址，并利用终端设置的触发机制，在感知到访问错误时触发请求备份DNS服务器解析，不需要请求主DNS服务器解析，因此无需等待DNS缓存服务器的老化时间，实现了终端能够快速获取高防服务器的IP地址的效果，解决了已有技术中切换高防服务器时业务中断时间较长的技术问题。
在一种可能的设计中，该系统还包括高防服务器，用于对终端发送的业务请求数据执行流量清洗，将清洗后的数据转发至业务服务器，并将业务服务器反馈的业务响应数据转发至终端。
第三方面，本申请实施例提供一种针对分布式拒绝服务DDOS攻击的域名访问方法，该方法应用于终端，该方法包括接收到访问目标域名对应的业务服务器的操作请求；响应于操作请求，向主DNS服务器发送包含目标域名的解析请求；根据主DNS服务器反馈的目标域名对应的业务服务器的IP地址，向业务服务器发送业务请求数据；在业务服务器受到DDOS攻击的情况下，确定访问业务服务器出错；将包含目标域名的解析请求发送至备份DNS服务器；根据备份DNS服务器反馈的目标域名对应的高防服务器的IP地址，向高防服务器发送业务请求数据；其中，在业务服务器受到DDOS攻击的情况下，备份DNS服务器被配置为将目标域名解析为高防服务器的IP地址。通过本实施例提供的方案，在终端设置的触发机制，在感知到访问错误时触发请求备份DNS服务器解析，不需要请求主DNS服务器解析，因此无需等待DNS缓存服务器的老化时间，实现了终端能够快速获取高防服务器的IP地址的效果，解决了已有技术中切换高防服务器时业务中断时间较长的技术问题。
在一种可能的设计中，终端安装有集成SDK函数的客户端；SDK函数用于配置终端在确定访问业务服务器出错的情况下，将包含目标域名的解析请求发送至备份DNS服务器包含目标域名的解析请求。通过本实施例提供的方案，利用集成的SDK函数执行备份DNS服务器的触发机制，便于将SDK函数集成在其他应用程序中。
在一种可能的设计中，SDK函数用于以目标信息格式封装目标域名的信息，得到发送至备份DNS服务器的解析请求。
在一种可能的设计中，解析请求携带的信息还包括终端的标识和/或访问业务服务器的IP地址返回的错误代码。通过本实施例提供的方案，备份DNS服务器接收到的解析请求中包含更多的信息，可以用于后续的分析。
在一种可能的设计中，在将包含目标域名的解析请求发送至备份DNS服务器之后，在根据备份DNS服务器解析的目标域名对应的高防服务器的IP地址之前，该方法还包括：根据备份DNS服务器解析目标域名得到的业务服务器的IP地址，向业务服务器发送业务请求数据；其中，备份DNS服务器用于在业务服务器未受到DDOS攻击的情况下，将针对目标域名的解析地址设置为业务服务器的IP地址，并在未成功将针对目标域名的解析地址设置为高防服务器的IP地址的情况下，向终端反馈业务服务器的IP地址；在确定访问业务服务器出错的情况下，将包含目标域名的解析请求发送至备份DNS服务器。通过本实施例提供的方案，在终端将解析请求发送至备份DNS服务器，但备份DNS服务器却未将切换高防服务器的IP地址之前，仍重试向备份DNS服务器发送解析请求，提高访问成功率。
在一种可能的设计中，访问目标域名由终端中安装的客户端执行，在向高防服务器发送业务请求数据之后，该方法还包括：在客户端未关闭的情况下，如果接收到访问目标域名的操作请求，将包含目标域名的解析请求发送至备份DNS服务器。通过本实施例提供的方案，在终端的客户端未关闭的情况下，如果终端再次接收到访问目标域名对应的业务服务器的操作请求，终端仍然将目标域名的解析请求发送至备份DNS服务器，防止终端由于IP地址切换出现业务中断，提高用户的体验。
在一种可能的设计中，访问目标域名由终端中安装的客户端执行，在向高防服务器发送业务请求数据之后，该方法还包括：在客户端关闭之后再次启动的情况下，如果接收到访问目标域名的操作请求，将包含目标域名的解析请求发送至主DNS服务器包含目标域名的解析请求。
第四方面，本申请实施例提供一种分布式拒绝服务DDOS攻击的防护方法，该方法应用于业务端，该方法包括：确定终端向主DNS服务器发送的解析请求中的目标域名对应的业务服务器受到DDOS攻击；通知备份DNS服务器将目标域名解析为高防服务器的IP地址，以使得向主DNS服务器发送包含目标域名的解析请求的终端在改为向备份DNS服务器发送包含目标域名的解析请求之后，获取到备份DNS服务器解析出的、目标域名对应的高防服务器的IP地址。通过本实施例提供的方案，新增了备份DNS服务器，在受到攻击需要切换高防服务器的IP地址时，由备份DNS服务器修改IP地址，使终端在感知到访问错误时触发请求备份DNS服务器解析，不需要请求主DNS服务器解析，因此无需等待DNS缓存服务器的老化时间，实现了终端能够快速获取高防服务器的IP地址的效果，解决了已有技术中切换高防服务器时业务中断时间较长的技术问题。
在一种可能的设计中，确定业务服务器受到DDOS攻击，包括：确定业务服务器的上行带宽超过预设阈值。通过本实施例提供的方案，能够快捷的监测业务服务器是否受到DDOS攻击。
在一种可能的设计中，在通知备份DNS服务器将目标域名解析为高防服务器的IP地址之后，该方法还包括：通知主DNS服务器的运营商，指示主DNS服务器的运营商通知主DNS服务器将业务服务器的IP地址拉黑。通过本实施例提供的方案，使业务服务器在被攻击之后IP地址被拉黑，防止终端向业务服务器发送业务请求数据继续占用带宽，能够节约业务服务器的出口带宽。
在一种可能的设计中，在业务服务器受到的DDOS攻击已停止的情况下，该方法还包括：通知主DNS服务器的运营商，指示主DNS服务器的运营商通知主DNS服务器将业务服务器的IP地址解除拉黑。通过本实施例提供的方案，使其它未感知到访问错误的终端能够正常访问业务服务器，逐渐将业务数据流量从高防服务器牵引回业务服务器。
在一种可能的设计中，业务端与业务服务器共享网络出口，业务端向主DNS服务器的运营商发送的通知报文的通讯优先级被配置为至少高于业务服务器与终端的通讯优先级。通知报文为业务端通知主DNS服务器的运营商通知主DNS服务器拉黑或解除拉黑的报文。通过本实施例提供的方案，即使在业务服务器的出口带宽拥塞的情况下，业务端与主DNS服务器的通信消息也可以优先的传输。
在一种可能的设计中，通知备份DNS服务器将目标域名解析为高防服务器的IP地址，包括：通过调度端指示调度端通知备份DNS服务器将目标域名解析为高防服务器的IP地址。通过本实施例提供的方案，新增了调度端以通知备份DNS服务器，使得备份DNS服务器可以被部署在云端，提高了系统架构部署的灵活性。
第五方面，本申请实施例提供一种针对分布式拒绝服务DDOS攻击的域名访问装置，该装置应用于终端，该装置包括：接收模块，用于接收到访问目标域名对应的业务服务器的操作请求；第一发送模块，用于响应于操作请求，向主DNS服务器发送包含目标域名的解析请求；第二发送模块，用于根据主DNS服务器反馈的目标域名对应的业务服务器的 IP地址，向业务服务器发送业务请求数据；确定模块，用于在业务服务器受到DDOS攻击的情况下，确定访问业务服务器出错；第三发送模块，用于将包含目标域名的解析请求发送至备份DNS服务器；第四发送模块，用于根据备份DNS服务器反馈的目标域名对应的高防服务器的IP地址，向高防服务器发送业务请求数据；其中，在业务服务器受到DDOS攻击的情况下，备份DNS服务器被配置为将目标域名解析为高防服务器的IP地址。通过本实施例提供的方案，在终端设置的触发机制，在感知到访问错误时触发请求备份DNS服务器解析，不需要请求主DNS服务器解析，因此无需等待DNS缓存服务器的老化时间，实现了终端能够快速获取高防服务器的IP地址的效果，解决了已有技术中切换高防服务器时业务中断时间较长的技术问题。
在一种可能的设计中，该装置还包括：配置模块，用于配置终端在确定访问业务服务器出错的情况下，将包含目标域名的解析请求发送至备份DNS服务器包含目标域名的解析请求，其中，配置模块为终端中安装的客户端集成的SDK函数。通过本实施例提供的方案，利用封装的SDK函数执行备份DNS服务器的触发机制，便于将SDK函数集成在其他应用程序中。
在一种可能的设计中，配置模块包括：封装单元，用于以目标信息格式封装目标域名的信息，得到发送至备份DNS服务器的解析请求。
在一种可能的设计中，解析请求携带的信息还包括终端的标识和/或访问业务服务器的IP地址返回的错误代码。通过本实施例提供的方案，备份DNS服务器接收到的解析请求中包含更多的信息，可以用于后续的分析。
在一种可能的设计中，该装置还包括：第五发送模块，用于在将包含目标域名的解析请求发送至备份DNS服务器之后，在根据备份DNS服务器解析的目标域名对应的高防服务器的IP地址之前，根据备份DNS服务器解析目标域名得到的业务服务器的IP地址，向业务服务器发送业务请求数据；其中，备份DNS服务器用于在业务服务器未受到DDOS攻击的情况下，将针对目标域名的解析地址设置为业务服务器的IP地址，并在未成功将针对目标域名的解析地址设置为高防服务器的IP地址的情况下，向终端反馈业务服务器的IP地址；第六发送模块，用于在确定访问业务服务器出错的情况下，将包含目标域名的解析请求发送至备份DNS服务器。通过本实施例提供的方案，在终端将解析请求发送至备份DNS服务器，但备份DNS服务器却未将切换高防服务器的IP地址之前，仍重试向备份DNS服务器发送解析请求，提高访问成功率。
在一种可能的设计中，访问目标域名由终端中安装的客户端执行，该装置还包括：第七发送模块，用于在向高防服务器发送业务请求数据之后，在客户端未关闭的情况下，如果接收到访问目标域名的操作请求，将包含目标域名的解析请求发送至备份DNS服务器。通过本实施例提供的方案，在终端的客户端未关闭的情况下，如果终端再次接收到访问目标域名对应的业务服务器的操作请求，终端仍然将目标域名的解析请求发送至备份DNS服务器，防止终端由于IP地址切换出现业务中断，提高用户的体验。
在一种可能的设计中，访问目标域名由终端中安装的客户端执行，该装置还包括：第八发送模块，用于在向高防服务器发送业务请求数据之后，在客户端关闭之后再次启动的情况下，如果接收到访问目标域名的操作请求，将包含目标域名的解析请求发送至主DNS服务器包含目标域名的解析请求。
第六方面，本申请实施例提供一种针对分布式拒绝服务DDOS攻击的防护装置，该装置应用于业务端，该装置包括：确定模块，用于确定终端向主DNS服务器发送的解析请求中的目标域名对应的业务服务器受到DDOS攻击；第一通知模块，用于通知备份DNS服务器将目标域名解析为高防服务器的IP地址，以使得向主DNS服务器发送包含目标域名的解析请求的终端在改为向备份DNS服务器发送包含目标域名的解析请求之后，获取到备份DNS服务器解析出的、目标域名对应的高防服务器的IP地址。通过本实施例提供的方案，新增了备份DNS服务器，在受到攻击需要切换高防服务器的IP地址时，由备份DNS服务器修改IP地址，使终端在感知到访问错误时触发请求备份DNS服务器解析，不需要请求主DNS服务器解析，因此无需等待DNS缓存服务器的老化时间，实现了终端能够快速获取高防服务器的IP地址的效果，解决了已有技术中切换高防服务器时业务中断时间较长的技术问题。
在一种可能的设计中，确定模块包括：确定单元，用于确定业务服务器的上行带宽超过预设阈值。通过本实施例提供的方案，能够快捷的监测业务服务器是否受到DDOS攻击。
在一种可能的设计中，该装置还包括：第二通知模块，用于在通知备份DNS服务器将目标域名解析为高防服务器的IP地址之后，通知主DNS服务器的运营商，指示主DNS服务器的运营商通知主DNS服务器将业务服务器的IP地址拉黑。通过本实施例提供的方案，使业务服务器在被攻击之后IP地址被拉黑，防止终端向业务服务器发送业务请求数据继续占用带宽，能够节约业务服务器的出口带宽。
在一种可能的设计中，该装置还包括：第三通知模块，用于在业务服务器受到的DDOS攻击已停止的情况下，通知主DNS服务器的运营商，指示主DNS服务器的运营商通知主DNS服务器将业务服务器的IP地址解除拉黑。通过本实施例提供的方案，使其它未感知到访问错误的终端能够正常访问业务服务器，逐渐将业务数据流量从高防服务器牵引回业务服务器。
在一种可能的设计中，业务端与业务服务器共享网络出口，业务端向主DNS服务器的运营商发送的通知报文的通讯优先级被配置为至少高于业务服务器与终端的通讯优先级。通过本实施例提供的方案，即使在业务服务器的出口带宽拥塞的情况下，业务端与主DNS服务器的通信消息也可以优先的传输。
在一种可能的设计中，第一通知模块包括：通知单元，用于通过调度端指示调度端通知备份DNS服务器将目标域名解析为高防服务器的IP地址。通过本实施例提供的方案，新增了调度端以通知备份DNS服务器，使得备份DNS服务器可以被部署在云端，提高了系统架构部署的灵活性。
第七方面，本申请实施例提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机程序，当其在计算机上运行时，使得计算机执行如第三方面所述的方法。
第八方面，本申请实施例提供一种通信设备，包括：处理器；存储器；应用程序；其中，应用程序被存储在存储器中，应用程序包括指令，当指令被设备执行时，使得设备执行如第三方面所述的方法。
第九方面，本申请实施例提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机程序，当其在计算机上运行时，使得计算机执行如第四方面所述的方法。
第十方面，本申请实施例提供一种通信设备，包括：处理器；存储器；应用程序；其中，应用程序被存储在存储器中，应用程序包括指令，当指令被设备执行时，使得设备执行如第四发明所述的方法。
附图说明
图1为已有技术的一种可选的分布式拒绝服务DDOS攻击的防护系统的架构示意图；
图2为已有技术的一种可选的分布式拒绝服务DDOS攻击的防护方法的示意图；
图3为本申请实施例提供的一种可选的分布式拒绝服务DDOS攻击的防护系统的示意图；
图4为本申请实施例提供的另一种可选的分布式拒绝服务DDOS攻击的防护系统的示意图；
图5为本申请实施例提供的另一种可选的分布式拒绝服务DDOS攻击的防护系统的示意图；
图6为本申请实施例提供的一种可选的分布式拒绝服务DDOS攻击的防护方法的时序示意图；
图7为本申请实施例提供的另一种可选的分布式拒绝服务DDOS攻击的防护方法的时序示意图；
图8为本申请实施例提供的另一种可选的分布式拒绝服务DDOS攻击的防护方法的时序示意图；
图9为本申请实施例提供的一种可选的分布式拒绝服务DDOS攻击的域名访问装置的示意图；
图10为本申请实施例提供的一种可选的分布式拒绝服务DDOS攻击的防护装置的示意图；
图11为本申请实施例提供的一种可选的通信设备的示意图；
图12为本申请实施例提供的另一种可选的通信设备的示意图。
具体实施方式
本申请的实施方式部分使用的术语仅用于对本申请的具体实施例进行解释，而非旨在限定本申请。
下面对本申请实施例中出现的部分术语进行说明性而非限定性的解释如下：
DDOS，分布式拒绝服务，Distributed Denial of Service的简称，分布式拒绝服务攻击是指处于不同位置的多个攻击者同时向一个或数个目标发动攻击，或者一个攻击者控制了位于不同位置的多台机器并利用这些机器对目标同时实施攻击。由于攻击的发出点是分布在不同地方的，这类攻击称为分布式拒绝服务攻击，其中的攻击者可以有多个。分布式拒绝服务攻击DDOS是一种基于DOS(全称Denial of Service，拒绝服务)的特殊形式的拒绝服务攻击，是一种分布的、协同的大规模攻击方式。单一的DOS攻击一般是采用一对一方式的，它利用网络协议和操作系统的一些缺陷，采用欺骗和伪装的策略来进行网络攻击，使网站服务器充斥大量要求回复的信息，消耗网络带宽或系统资源，导致网络或系统不胜负荷以至于瘫痪而停止提供正常的网络服务。与DOS攻击由单台主机发起攻击相比 较，分布式拒绝服务攻击DDOS是借助数百、甚至数千台被入侵后安装了攻击进程的主机同时发起的集团行为。
DN，又称域名、网域，Domain Name的简称，是由一串用字符“.”分隔的字符串，是Internet(也即互联网)上某一台计算机或计算机组的名称，用于在数据传输时标识计算机的电子方位(有时也指地理位置)。例如，www.wikipedia.org是一个域名。
DNS，域名系统，Domain Name System的简称，DNS是互联网的一项服务。它是将域名和IP(全称Internet Protocol，网络协议)地址相互映射的一个分布式数据库，能够使人更方便地访问互联网。DNS使用TCP和UDP端口53。简单来说，DNS就是一个将域名翻译成IP地址的系统，IP地址是Internet主机的作为路由寻址用的数字体标识，人不容易记忆，因而产生了域名这一种字符型标识。例如，www.wikipedia.org是一个域名，和IP地址208.80.152.2相对应。DNS就像是一个自动的电话号码簿，我们可以直接拨打wikipedia的名字(域名)来代替电话号码(IP地址)，DNS就会将便于人类使用的名字(如域名：www.wikipedia.org)转化成机器能够识别的IP地址(如IP地址：208.80.152.2)。
TTL，生存时间值，Time To Live，域名解析在DNS服务器中存留时间生存时间，就是一条域名解析记录在DNS服务器中的存留时间。当各地的DNS服务器接受到解析请求时，就会向域名指定的NS服务器(权威域名服务器)发出解析请求从而获得解析记录。在获得这个解析记录之后，记录会在DNS服务器(各地的缓存服务器，也叫递归域名服务器)中保存一段时间，这段时间内如果再接到这个域名的解析请求，DNS服务器将不再向NS服务器发出请求，而是直接返回刚才获得进而缓存在本地的记录；而这个记录在DNS服务器上保留的时间是有限的，这个保留时间就是TTL。通常来讲，TTL的时间较长。
APP，应用程序，Application的简称，也可以叫做应用。
客户端，Client，或称为用户端，是指与服务器相对应，为客户在终端提供本地服务的应用程序，需要与服务端互相配合运行。
SDK，软件开发工具包，Software Development Kit的简称，利用SDK软件可以扩展应用程序的功能，并可以通过接口方便的集成到不同的应用程序中。
DC，数据中心，Data Center的简称，一个数据中心的主要目的是运行应用来处理商业和运作的组织(如企业)的数据，这样的系统属于并由组织内部开发，或者从企业软件供应商那里买。
CNAME，Canonical name的简称，规范名字，也称别名记录。这种记录允许将多个名字映射到同一台计算机。
高防服务器，可以为单个客户提供安全维护，简单来说，就是能够帮助网站拒绝服务攻击的服务器类型，都可定义为高防服务器。高防服务器的带宽较大，可以抵御大流量攻击。
流量清洗，Flow cleaning，流量清洗是对进入数据中心DC的数据流量进行实时监控，及时发现包括DOS攻击在内的异常流量。在不影响正常业务的前提下，清洗掉异常流量的处理方式。流量清洗服务可以由软件运营商提供给使用数据中心的客户。
本申请实施例中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以 表示：单独存在A，同时存在A和B，单独存在B的情况，其中A,B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。
已有技术中，针对DDOS攻击，一般采用CNAME机制将域名解析的IP地址由业务服务器的IP地址修改为高防服务器的IP地址。图1为已有技术的一种可选的分布式拒绝服务DDOS攻击的防护系统的架构示意图，如图1所示，该系统的架构包括DNS侧、本地业务侧、高防服务器和终端。其中，DNS侧包括DNS服务器运营商和受DNS服务器运营商管理的DNS服务器。业务侧包括业务端和受业务端管理的业务服务器。
需要说明的是，运营商是指提供相应的服务器业务的服务商，运营商可以管理和维护对应的服务器，本申请实施例中所述的DNS服务器运营商，是指用于管理DNS服务器的软件管理平台，该软件平台可以搭载在所管理的DNS服务器上，也可以搭载在其它能够与所管理的DNS服务器进行通讯的硬件设备上。本申请实施例中所述的业务端，是指用于管理业务服务器的软件管理平台，业务端可以搭载在业务服务器上，也可以搭载在能够与业务服务器通讯的硬件设备上。此外，本申请实施例中所述的服务器，可以是一个服务器或包括多个服务器的服务器集群，本申请实施例对此不作具体限定。
如图1所示，在业务服务器未受到攻击的情况下，终端与业务服务器可以通过虚线所示的通讯链路进行通讯。例如，某用户打开手机内安装的浏览器APP，输入或点击需要访问的网址(也即域名)“www.xxxx.com”,该浏览器APP会将携带域名的域名解析请求发送至DNS服务器，DNS服务器响应请求向用户的手机返回该域名对应的业务服务器(也即，提供网址“www.xxxx.com”对应内容的服务器)的IP地址，浏览器APP基于IP地址可以直接连接该域名对应的业务服务器，请求访问该域名，业务服务器会查找业务服务器中该域名对应的内容反馈至用户的手机，使得用户的手机能够展示出该域名的内容。
如果该域名对应的业务服务器受到DDOS攻击，则业务侧的网络出口的上行带宽(也即，从终端向业务服务器通讯方向的带宽)会被大量占用，攻击流量最大可以达到T(全称Terabyte，简称T或TB，太，1TB＝1000GB)级，导致业务服务器对终端的响应较慢或停止响应，从而使正常用户无法访问业务，造成企业在声誉、经济上的损失。在业务服务器受到攻击时，维护人员可以通知DNS服务器运营商，以使DNS服务器运营商将业务服务器对应的多个域名的解析IP地址修改为高防服务器的IP地址，从而使终端在向DNS服务器请求解析域名时，得到高防服务器的IP，进而与高防服务器交互数据业务，以将用户终端访问业务服务器的业务流量引到高防服务器(或高防服务器集群/高防机房)。由于攻击者可以通过控制终端对业务服务器进行攻击，在DNS服务器解析返回的IP地址变为高防服务器之后，攻击者通过对DNS服务器返回的数据抓包，也可以感知到IP地址已经切换至高防服务器的IP地址，进而可能会继续对高防服务器进行攻击，发送大量攻击流量数据占用高防服务器的带宽。此时正常用户流量和攻击流量都会被引到高防服务器。
由于高防服务器具备大带宽，可以容纳大流量的攻击，并且，可以对流量执行近源清洗等流量清洗的处理方法，以保留接收到的数据中的真实业务数据，清洗掉攻击数据。在执行流量清洗之后，将真实业务数据发送至业务服务器。此时，由于流量已经被牵引至 高防服务器，业务服务器的上行带宽已经被解除占用，可以对高防服务器提供的真实的业务数据进行处理和响应，将响应的数据反馈至高防服务器，由高防服务器分发给终端。业务服务器受攻击后的通讯链路如图1中的实线所示。在人为判断攻击结束之后，业务侧再通知DNS服务器运营商，将DNS服务器中的域名解析切换回业务服务器的IP地址。
在DNS服务器中更改域名对应的IP地址时，可以采用CANME机制。需要预先配置如下信息：
1)在DNS服务器配置CNAME(别名记录)：业务侧的域名可能有多个，使用同一个业务服务器的IP地址，为了在更改IP地址时操作更便捷，采用CNAME机制，将业务侧的相关域名的解析结果都指向一个域名A，并将域名A指向业务服务器的IP地址，以使得相关域名都间接的指向业务服务器的IP地址。
2)管理人员在业务侧配置高防服务器的IP地址、业务服务器的IP地址和域名A。
在图1的架构中，业务服务器在受到攻击之后通知DNS服务器更改IP地址的过程如图2所示，结合图2对上述过程说明如下：
步骤1001，终端接收访问目标域名的操作请求。
步骤1002，终端向DNS服务器发送目标域名的解析请求。
步骤1003，DNS服务器向终端返回业务服务器的IP地址。
步骤1004，终端根据业务服务器的IP地址向业务服务器发送业务请求数据。
步骤1005，在业务服务器受到DDOS攻击的情况下，终端访问出错，可能是访问超时或访问失败。
业务端是管理业务服务器的软件管理平台，可以执行步骤2001，实时检测业务服务器是否被攻击。
步骤2002，在业务服务器受到DDOS攻击的情况下，业务端检测到业务服务器被攻击。
步骤2003，业务端通知DNS服务器的运营商，让DNS服务器的运营商通知DNS服务器将DNS服务器上的域名A的解析IP地址修改为高防服务器的IP地址。
步骤2004，DNS服务器运营商通知DNS服务器将业务侧的相关域名的解析IP地址都修改为高防服务器的IP地址。
在DNS服务器将域名A的IP地址修改为高防服务器的IP地址之后，所有终端在请求DNS服务器解析域名时，得到的IP地址为高防服务器的IP地址，所有终端发送的流量都被引到高防服务器，由高防服务器进行流量清洗。
但是，由于DNS服务器运营商通常会设置较长的TTL时间，在TTL更新周期内DNS服务器都不会刷新IP地址，也即，DNS服务器中的域名对应的解析IP地址的更新时间较长，例如，2～10分钟，如果是互联网服务提供商，TTL时间可能会更长，达到一小时甚至一两天，在DNS服务器中的域名解析IP地址的切换时间太慢，导致业务服务器长时间中断向终端提供业务服务。
因此，在TTL时间内，如果有终端请求访问域名，则如图2所示，步骤1006，终端向DNS服务器发送目标域名的解析请求，此时，DNS服务器中缓存的IP地址仍然为业务服务器的IP地址，执行步骤1007，DNS服务器返回业务服务器的IP地址，终端仍然访问业务服务器，结果仍然是访问错误。只有在等待TTL时间之后，DNS服务器中针对域名A的解析记录失效后，才会将域名A的解析地址更新为高防服务器的IP地址，如图2所示 的步骤1010和步骤1011。进而，终端将业务请求数据发送至高防服务器，由高防服务器对业务请求数据执行流量清洗，转发至业务服务器，并将业务服务器返回的业务响应数据转发至终端，如图2所示的步骤1012～1016。因此，由于DNS服务器切换至高防服务器的IP地址的时间较长，受运营商设置的TTL时间制约，会造成终端的业务长时间中断，用户体验较差。
针对上述的问题，本申请实施例提供了一种分布式拒绝服务DDOS攻击的防护系统，至少包括终端和业务端。对分布式拒绝服务DDOS攻击的防护系统的几种可选的实施例进行说明如下。
实施例1
如图3所示为本申请实施例提供的一种可选的分布式拒绝服务DDOS攻击的防护系统的应用场景示意图，在图3所示的应用场景中，分为主DNS侧(包括主DNS服务器运营商和主DNS服务器)、本地业务侧(包括业务端和业务服务器)、终端侧(包括终端)、云侧(包括备份DNS服务器)、高防服务器侧(包括高防服务器)。需要说明的是，图3仅提供了一种示例性的系统架构，在其它应用场景中，可以配置相比于图3所示的分布式拒绝服务DDOS攻击的防护系统更多或更少的组成部分，和/或其中一部分可以以组合或分开的形式实现。可以理解的是，处于技术或商业的考虑，某些厂商提供的分布式拒绝服务DDOS攻击的防护系统仅包括上述的业务端和终端，可选的，另外一些厂商提供的分布式拒绝服务DDOS攻击的防护系统除了业务端和终端外，还可以包括以上至少一种服务器：即备份DNS服务器、业务服务器、高防服务器。
终端侧包括终端，可选的，还可以包括其它终端。终端可以是手机、平板电脑等具有通信功能的终端设备。
主DNS侧包括主DNS服务器(或主DNS服务器集群)，主DNS服务器是终端默认使用的DNS服务器，可选的，也可以是由用户设置或终端设置的DNS服务器。主DNS服务器可以由主DNS服务器运营商管理和维护。主DNS服务器运营商可以是搭载客户端的终端设备所在网络的本地互联网服务提供商(例如，移动、电信等运营商)。需要说明的是，本申请实施例中所述的主DNS服务器运营商，可以是指指管理主DNS服务器的软件管理平台、或者搭载有该软件管理平台的设备，该软件管理平台可以搭载在平台所管理的主DNS服务器上，也可以搭载在其它能够与平台所管理的主DNS服务器进行通讯的硬件设备上，主DNS服务器运营商可以用于配置主DNS服务器。主DNS服务器用于响应终端发送的解析目标域名的请求，解析目标域名得到业务服务器的IP地址，并反馈给终端。进而，终端的客户端可以基于IP地址访问业务服务器。例如，终端请求访问域名“www.xxxx.com”,主DNS服务器解析域名得到业务服务器对应的IP地址为“111.11.1.111”，将解析的IP地址发送给终端。在本实施例中，主DNS服务器可以用作业务服务器在未受到DDOS攻击的正常工作情况下，终端请求域名解析的域名服务器。
本地业务侧可以是政府/企业的数据中心DC，包括业务端、业务服务器(或业务服务器集群)。业务端用于管理业务服务器，可以是搭载在业务服务器或其它能够与业务服务器通讯的终端设备上的软件管理平台。业务服务器用于与终端交互业务数据，在业务服务器未受到DDOS攻击、可以正常响应的情况下，如图3中虚线所示的数据交互路径，业务服务器接收终端发送的业务请求数据，并向终端反馈业务响应数据。例如，终端在接收到 主DNS服务器反馈的业务服务器的IP地址之后，可以基于IP地址与业务服务器通讯，请求访问业务服务器中域名所在目录的内容。
如果业务服务器受到DDOS攻击，本地业务侧的网络出口的上行带宽会被大量占用，攻击流量最大可以达到TB的级别，导致业务服务器对终端的响应较慢或停止响应，从而使正常用户无法访问业务。检测业务服务器是否受到DDOS攻击的方法，可以业务端根据本地业务侧的状态参数(如出口带宽)的检测结果判断的。其中，本地业务侧共用网络出口，本地业务侧除业务端和业务服务器之外，还可以部署带宽检测设备(图2中未示出)，由带宽检测设备通过分光的方式全流量镜像网络出口的入流量，能实时感知到网络出口的入带宽(上行带宽)，业务端可以根据带宽检测设备检测得到的状态参数，判断业务服务器是否受到DDOS攻击，如果上行带宽超过阈值，则确定业务服务器受到DDOS攻击。
为了解决上述问题，相对于图1所示的已有技术提供的系统架构，本申请实施例新增了备份DNS服务器，备份DNS服务器设置在云侧，备份DNS服务器可以是企业自己配置的一个云端服务器(或服务器集群)，备份DNS服务器至少在业务服务器受到攻击之后，将目标域名解析至高防服务器的IP地址，高防服务器会对接收到的所有数据进行流量清洗，保留真实的业务请求数据，清洗掉攻击流量数据，将清洗后的数据发送至业务服务器，以减轻业务服务器的网络带宽的负载。
相配合的，在终端的客户端进行了配置，在终端访问业务服务器出错(例如，访问超时、或出现404错误代码等)的情况下，改为向备份DNS服务器发送域名解析请求。
可选的，由业务端确定业务服务器是否受到攻击，并由业务端通知备份DNS服务器将目标域名的解析结果设置为高防服务器的IP地址。一种可选的实施方式为，备份DNS服务器实时的备份主DNS服务器的域名解析数据，与主DNS服务器周期同步，在业务服务器受到攻击之后，业务端通知备份DNS服务器将业务服务器的相关域名(至少包括目标域名)的解析IP地址更改为高防服务器的IP地址。可选的，可以将备份DNS服务器的TTL时间设置为较短的周期，例如，3秒，从而减少备份DNS服务器修改IP地址的等待时间。或者，可选的，可以直接在备份DNS服务器新增一条解析记录，该解析记录用于将目标域名(或者包括目标域名的相关域名)解析至高防服务器的IP地址，并将该解析记录的优先级设置为高于原解析记录(将目标域名解析至业务服务器的IP地址)的优先级，使得发送至备份DNS服务器的针对目标域名的解析请求优先被解析至高防服务器的IP地址。
可选的，业务端在通知备份DNS服务器将目标域名的解析结果设置为高防服务器的IP地址之后，如果业务端确定备份DNS服务器已将目标域名的解析结果设置为高防服务器的IP地址，则业务端通知主DNS服务器的运营商，以使主DNS服务器的运营商通知主DNS服务器拉黑业务服务器的IP地址。在主DNS服务器中的业务服务器的IP地址被拉黑之后，其它终端在向主DNS服务器请求解析目标域名时，查询不到业务服务器的IP地址，无法找到目标域名对应的业务服务器，进而也无法与业务服务器建立连接，不会占用业务服务器的上行带宽，使得受到DDOS攻击的业务服务器在IP地址被主DNS服务器拉黑的期间，没有终端发送至业务服务器的流量接入，使业务服务器能够恢复正常的业务处理。相应的，在终端一侧，由于无法找到业务服务器，出现访问错误，对应的终端也会触发访问备份DNS服务器，向备份DNS服务器请求解析目标域名，得到高防服务器的IP地址。
相应的，业务端在确定业务服务器停止受到DDOS攻击的情况下，由业务端通知主DNS服务器的运营商，以使主DNS服务器的运营商通知主DNS服务器解除拉黑业务服务器的IP地址。在解除拉黑之后，其它向主DNS服务器发送解析请求的终端会得到业务服务器的IP地址，终端可以与业务服务器交互业务数据，使得业务服务器逐渐恢复正常工作状态。
针对终端一侧，预先在终端的客户端设置变更DNS服务器的触发机制，在终端感知到访问目标域名错误时，触发请求备份DNS服务器解析目标域名。在备份DNS服务器将域名对应的IP地址解析为高防服务器的IP地址的情况下，终端将期望发送至业务服务器的业务请求数据发送至高防服务器，由高防服务器清洗终端发送的业务请求数据，并将清洗后的数据转发至业务服务器，业务服务器将针对清洗后的数据的业务响应数据发送给高防服务器，由高防服务器转发给终端，以实现正常业务逻辑。
变更DNS服务器的触发机制可以是由终端中安装的客户端集成的SDK函数执行的，终端中安装有集成SDK函数的客户端，客户端用于访问目标域名，例如，客户端可以是应用程序，如基于Android系统的浏览器APP、视频类APP等，客户端中集成有SDK函数，由于SDK函数可以集成在不同的客户端中，以便于本申请实施例的实施。
SDK函数用于配置终端在确定访问业务服务器出错的情况下，将包含目标域名的解析请求发送至备份DNS服务器包含目标域名的解析请求。SDK将域名、终端标识、访问错误码等信息以协议的信息格式封装，将封装好的解析请求发送至备份DNS服务器。
需要说明的是，如果此时备份DNS服务器未完成修改IP地址的操作，仍将目标域名对应的IP地址解析为业务服务器的IP地址，则客户端访问业务服务器仍然会失败，客户端中集成的SDK函数继续将解析请求发送至备份DNS服务器，直至备份DNS服务器将目标域名解析至高防服务器的IP地址。
由于在业务服务器受到攻击之后，备份DNS服务器可以很快的切换IP地址，且终端不请求主DNS服务器解析目标域名，因此无需等待主DNS服务器的较长的TTL时间，终端在访问错误之后，可以快速的获取高防服务器的IP地址，解决了已有技术中切换高防服务器时业务中断时间较长的技术问题。其中，业务端对攻击的检测在1秒以内；由业务端通知备份DNS服务器切换为高防服务器的IP地址在2秒以内；主DNS服务器拉黑业务服务器的IP地址的时间在3秒以内。而终端的感知时间从业务服务器的访问缓慢或失败、至访问等待超时触发备份DNS机制、至接收到解析的高防服务器的IP地址访问高防服务器，从而正常访问业务，经测试终端的整个过程由2～10分钟甚至更长的时间缩短至12秒以内。
可选的，业务端通知备份DNS服务器的方法可以是以下任意一种：①业务端可以仅通知备份DNS服务器需要修改解析IP地址的域名，在备份DNS服务器中预先配置有高防服务器的IP地址；或者，②业务端在业务服务器受到攻击之后，通知备份DNS服务器需要修改IP地址的域名以及高防服务器的IP地址；或者，③业务端启用预先配置在备份DNS服务器中的高防服务器的IP地址与目标域名的映射，等等，本申请实施例对此不作具体限定，可以根据实际情况配置。
实施例2
如图4所示为本申请实施例提供的另一种可选的分布式拒绝服务DDOS攻击的防护系统的应用场景示意图，相比于实施例1所提供的分布式拒绝服务DDOS攻击的防护系统，本实施例在云侧增设一个调度端，如图4所示。
调度端用于作为备份DNS服务器的调度中心，业务端在检测到业务服务器的出口带宽占用较多时，通知调度端，由调度端通知备份DNS服务器将域名的解析IP地址修改为高防服务器的IP地址。
调度端可以确定备份DNS服务器是否已将目标域名的解析结果设置为高防服务器的IP地址，可选的，在调度端确定备份DNS服务器已将目标域名的解析结果设置为高防服务器的IP地址之后，由调度端通知主DNS服务器的运营商，以使主DNS服务器的运营商通知主DNS服务器将业务服务器的IP地址拉黑，如图4所示的通讯链路；或者，也可以由调度端通知业务端，进而由业务端通知主DNS服务器的运营商拉黑(相应的通讯链路图4中未示出)。
相应的，业务端在确定业务服务器停止受到DDOS攻击的情况下，可以通知调度端，并由调度端通知主DNS服务器的运营商将业务服务器的IP地址解除拉黑。
可选的，调度端在备份DNS服务器一段时间之后没有访问流量之后，调度端可以管理备份DNS服务器继续从主DNS服务器同步解析记录，以使得备份DNS服务器中的解析记录与主DNS服务器中的解析记录保持同步。
应理解，针对本实施例未详述的部分，可以参考实施例1中对应部分的内容。
实施例3
如图5所示为本申请实施例提供的另一种可选的分布式拒绝服务DDOS攻击的防护系统的应用场景示意图，相比于实施例2所提供的分布式拒绝服务DDOS攻击的防护系统，本实施例在本地业务侧增加一个本地防护平台，如图5所示，业务端在确定本地业务侧网络出口的上行带宽(由终端发送至业务服务器的链路方向为上行)占用的阈值小于预设阈值的情况下，通知本地防护对流量进行清洗，数据交互的线路如图5中的点划线示出的方向：终端<＝＝>本地防护<＝＝>业务服务器。在上行带宽高于预设阈值之后，切换至高防服务器清洗流量。本实施例提供的系统可以防止频繁地切换高防服务器，减少切换至高防服务器的次数，进而减少业务中断的次数。
例如，在业务端配置预设阈值为带宽的80％(可选的，预设阈值占带宽的百分比也可以配置为根据实际现状调节)。如果没有达到预设的带宽阈值，则认为攻击还未到达本地带宽的承受能力，不用切换至高防服务器，在预设阈值范围之内，可以在本地进行防护。
应理解，针对本实施例未详述的部分，可以参考实施例1中对应部分的内容。
可选的，上述任一可选的实施例提供的分布式拒绝服务DDOS攻击的防护系统中，还可以包括目标域名的权威DNS服务器，目标域名的权威DNS服务器可以设置在本地业务侧，目标域名的权威DNS服务器用于提供针对目标域名的权威解析，此外，目标域名的权威DNS服务器还可以用于提供针对其它域名的权威解析，例如，目标域名的业务服务器对应的其它域名，或者，其它业务服务器对应的域名，等等。相应的，在备份DNS服务器同步时，不是从主DNS服务器中同步解析记录，而是从权威DNS服务器中同步解析记录。在业 务服务器受到攻击的情况下，至少将备份DNS服务器中针对目标域名的解析IP地址修改为高防服务器的IP地址。
上述任一可选的实施例提供的分布式拒绝服务DDOS攻击的防护系统中，终端可以是手机、平板电脑等移动终端，终端中可以安装有客户端。此外，终端侧还可以包括攻击端，攻击端可以搭载在电脑、云主机、IOT(The Internet of Things，物联网)设备等设备中。
上述任一可选的实施例提供的分布式拒绝服务DDOS攻击的防护系统中，本地业务侧可以是企业的数据中心，企业可以自建机房或租赁机房，部署自己的网络设备、安全设备、业务服务器和应用系统等，以对用户提供服务，用户可以通过终端经互联网Internet访问企业的数据中心。可选的，企业的数据中心可以有多个。
上述任一可选的实施例提供的分布式拒绝服务DDOS攻击的防护系统，由于备份DNS服务器部署在云侧，可以在本地业务侧受到攻击、上行带宽被占用时，保证备份DNS服务器与终端的稳定通信。
本申请实施例还提供了一种分布式拒绝服务DDOS攻击的防护方法，可以由本申请实施例提供的分布式拒绝服务DDOS攻击的防护系统执行。以下对几种可选的方法实施例进行说明。
实施例4
针对实施例1所提供的分布式拒绝服务DDOS攻击的防护系统，本申请实施例提供了一种分布式拒绝服务DDOS攻击的防护方法的时序图如图6所示，具体包括如下步骤：
步骤101，终端接收访问目标域名的操作请求；
步骤102，终端发送目标域名的解析请求至主DNS服务器；
步骤103，主DNS服务器返回业务服务器的IP地址至终端；
步骤104，终端发送业务请求数据至业务服务器；
步骤105，在业务服务器受到DDOS攻击时，终端访问错误；图5中步骤105的方向表示在业务服务器受到DDOS攻击时，业务端可能不会响应终端，或者响应时间缓慢。
步骤106，终端发送目标域名的解析请求至备用DNS服务器。
其中，业务端会以预设周期实时的对业务服务器执行步骤201：实时检测业务服务器是否被攻击；
步骤202，业务端检测到业务服务器被攻击；
步骤203，业务端检测到攻击后，通知备份DNS服务器设置将目标域名解析为高防服务器的IP地址。
进而，在步骤106和步骤203之后，备份DNS服务器执行步骤107，向终端返回高防服务器的IP地址；
步骤108，终端向高防服务器的IP地址发送业务请求数据；
步骤109，高防服务器对业务请求数据进行流量清洗；
步骤110，高防服务器发送清洗后的数据至业务服务器；
步骤111，业务服务器向高防服务器返回业务响应数据；
步骤112，业务服务器转发业务响应数据至终端。
其中，在业务端执行步骤203之后，备份DNS服务器执行步骤204，通知业务端设置成功。
步骤205，业务端通知主DNS服务器的运营商，让主DNS服务器运营商通知主DNS服务器将主DNS服务器中业务服务器的IP地址拉黑。
步骤206，主DNS服务器运营商通知主DNS服务器拉黑业务服务器的IP地址。
步骤207，由于业务端实时检测是否攻击，在攻击停止的情况下，业务端可以检测到。
步骤208，业务端通知主DNS服务器的运营商，让主DNS服务器运营商通知主DNS服务器解除拉黑业务服务器的IP地址。
步骤209，主DNS服务器运营商通知主DNS服务器解除拉黑。
可选的，步骤207检测到攻击停止也可以是由人工判断的。
应理解，针对本实施例未详述的部分，可以参考实施例1中对应部分的内容。
实施例5
针对实施例2所提供的分布式拒绝服务DDOS攻击的防护系统，本申请实施例提供了一种分布式拒绝服务DDOS攻击的防护方法的时序图如图7所示。由于实施例2提供的系统相对于实施例1提供的系统增加了调度端，本实施例相对于实施例4所提供的方法，在步骤203、步骤204、步骤205、步骤208上有不同，并增加了步骤207’：业务端通知调度端攻击停止。在步骤203中，业务端检测到攻击后，通知调度端，调度端通知备份DNS服务器修改解析IP地址。在步骤204、步骤205、步骤208中，由业务端执行的改为由调度端执行。
应理解，针对本实施例未详述的部分，可以参考实施例4中对应部分的内容。
实施例6
针对实施例3所提供的分布式拒绝服务DDOS攻击的防护系统，本申请实施例提供了一种分布式拒绝服务DDOS攻击的防护方法，时序图如图8所示。由于实施例3提供的系统相对于实施例2提供的系统增加了本地防护，在执行步骤201业务端实时检测业务服务器是否被攻击之后，相对于实施例4提供的方法增加了步骤2011和2012，如果业务端检测到上行的流量小于预设阈值，是由本地防护对入流量进行流量清洗，在业务端检测到上行的流量高于预设阈值之后，确定业务服务器受到攻击。
应理解，针对本实施例未详述的部分，可以参考实施例4中对应部分的内容。
应理解，上述举例说明是为了帮助本领域技术人员理解本申请实施例，而非要将本申请实施例限于所例示的具体数值或具体场景。本领域技术人员根据所给出的上述举例说明，显然可以进行各种等价的修改或变化，这样的修改或变化也落入本申请实施例的范围内。
实施例7
本申请实施例还提供了一种应用于上述终端的分布式拒绝服务DDOS攻击的域名访问方法，本实施例提供的方法可以包括如下步骤：
步骤301，确定接收到访问目标域名对应的业务服务器的操作请求；
步骤302，将目标域名的解析请求发送至主DNS服务器；
步骤303，获取主DNS服务器解析目标域名得到的目标域名对应的业务服务器的IP地址；
步骤304，向业务服务器的IP地址发送业务请求数据；
步骤305，确定访问业务服务器出错；
步骤306，将目标域名的解析请求发送至备份DNS服务器；
步骤307，获取备份DNS服务器解析目标域名得到的高防服务器的IP地址；
步骤308，向高防服务器的IP地址发送业务请求数据。
可选的，在执行步骤302将目标域名的解析请求发送至备份DNS服务器时，调用集成的目标SDK函数执行以下步骤：以目标信息格式封装包括目标域名的信息，得到解析请求；将解析请求发送至备份DNS服务器。
可选的，解析请求携带的信息还包括终端的标识和/或访问业务服务器的IP地址返回的错误代码。
在执行步骤307获取备份DNS服务器解析目标域名得到的高防服务器的IP地址之前，该方法还包括：
步骤3071，获取备份DNS服务器解析目标域名得到的业务服务器的IP地址，其中，备份DNS服务器在确定业务服务器受到DDOS攻击之前，针对目标域名解析的IP地址设置为业务服务器的IP地址；
步骤3072，向业务服务器的IP地址发送业务请求数据；
步骤3073，在确定访问业务服务器出错的情况下，重试将目标域名的解析请求发送至备份DNS服务器。
可选的，访问目标域名可以由终端中安装的客户端执行，在执行步骤308向高防服务器的IP地址发送业务请求数据之后，在终端的客户端未关闭的情况下，如果确定再次接收到访问目标域名对应的业务服务器的操作请求，则将目标域名的解析请求发送至备份DNS服务器，防止终端由于IP地址切换出现业务中断，提高用户的体验；在终端的客户端关闭后再次启动的情况下，如果确定接收到访问目标域名对应的业务服务器的操作请求，则将目标域名的解析请求发送至主DNS服务器，以便于在业务服务器受到的DDOS攻击已停止的情况下，能够切换至业务服务器的IP地址进行业务数据的交互。
应理解，上述实施例说明是为了帮助本领域技术人员理解本申请实施例，而非要将本申请实施例限于所例示的步骤。本领域技术人员根据所给出的上述说明，显然可以对各个步骤或者步骤之间的关系进行各种等价的修改或变化，这样的修改或变化也落入本申请实施例的范围内。
实施例8
本申请实施例还提供了一种应用于上述业务端的分布式拒绝服务DDOS攻击的防护方法的实施例，本实施例提供的方法包括如下步骤：
步骤601，确定目标域名对应的业务服务器受到DDOS攻击；
步骤602，通知备份DNS服务器将目标域名的解析结果设置为高防服务器的IP地址，以使发送至备份DNS服务器的针对目标域名的解析请求解析为高防服务器的IP地址，
其中，备份DNS服务器用于以预设周期备份主DNS服务器的域名解析数据，高防服务器用于对终端发送的业务请求数据执行流量清洗，将清洗后的数据转发至业务服务器，以及将业务服务器针对清洗后的数据响应的业务响应数据转发至对应的终端。
可选的，在通知备份DNS服务器将目标域名的解析结果设置为高防服务器的IP地址之后，还可以通知主DNS服务器的运营商，以使主DNS服务器的运营商通知主DNS服务器拉黑业务服务器的IP地址。
可选的，在通知主DNS服务器的运营商之后，该方法还包括：
步骤6011，确定业务服务器停止受到DDOS攻击；
步骤6012，通知主DNS服务器的运营商，以使主DNS服务器的运营商通知主DNS服务器将业务服务器的IP地址解除拉黑。
可选的，业务端与业务服务器共享网络出口，为了使业务端通知拉黑和通知解除拉黑的通知信息能够及时的传输到主DNS服务器的运营商，可以设置业务端向主DNS服务器的运营商发送的拉黑报文及解除拉黑的通知报文的通讯优先级至少高于业务服务器与终端的通讯优先级，即使在业务服务器的出口带宽拥塞的情况下，业务端与主DNS服务器的通信消息也可以优先的传输。
可选的，在采用实施例2或3提供的分布式拒绝服务DDOS攻击的防护系统时，通知备份DNS服务器将目标域名的解析结果设置为高防服务器的IP地址的一种可选的实施方式为，通知调度端，由调度端通知备份DNS服务器将域名的解析IP地址修改为高防服务器的IP地址，其中，调度端用于根据预设配置信息，通知备份DNS服务器将目标域名的解析结果设置为高防服务器的IP地址，其中，预设配置信息包括高防服务器的IP地址。可选的，业务端可以把被攻击的域名、被攻击的IP、攻击类型、攻击时间等信息发送给调度端。
进一步的，在采用实施例2或3提供的分布式拒绝服务DDOS攻击的防护系统时，在调度端根据预设配置信息，通知备份DNS服务器将目标域名的解析结果设置为高防服务器的IP地址之后，该方法还可以包括如下步骤：
步骤701，调度端确定备份DNS服务器已将目标域名的解析结果设置为高防服务器的IP地址；
步骤702，调度端通知主DNS服务器的运营商，通知调度端，由主DNS服务器的运营商通知主DNS服务器将业务服务器的IP地址拉黑。
可选的，备份DNS服务器设置高防服务器的IP地址的一种可选的具体实施方式为，在通知备份DNS服务器将目标域名的解析结果设置为高防服务器的IP地址之后，执行如下步骤：
步骤801，备份DNS服务器新增目标域名与高防服务器的IP地址的解析记录；
步骤802，备份DNS服务器将新增的解析记录的优先级设置为高于从主DNS服务器备份的解析记录。
实施例9
图9是本申请实施例的一种可选的针对分布式拒绝服务DDOS攻击的域名访问装置的示意性框图。应理解，该装置能够执行实施例7所提供的方法实施例及其可选的实施方式中的各个步骤，可以应用于上述系统实施例的终端，为了避免重复，此处不再详述。如图9所示的针对分布式拒绝服务DDOS攻击的域名访问装置包括：接收模块11，第一发送模块12，第二发送模块13，确定模块14，第三发送模块15和第四发送模块16。
其中，接收模块，用于接收到访问目标域名对应的业务服务器的操作请求；第一发送模块，用于响应于操作请求，向主DNS服务器发送包含目标域名的解析请求；第二发送模块，用于根据主DNS服务器反馈的目标域名对应的业务服务器的IP地址，向业务服务器发送业务请求数据；确定模块，用于在业务服务器受到DDOS攻击的情况下，确定访问业务服务器出错；第三发送模块，用于将包含目标域名的解析请求发送至备份DNS服务器；第四发送模块，用于根据备份DNS服务器反馈的目标域名对应的高防服务器的IP地址，向高防服务器发送业务请求数据；其中，在业务服务器受到DDOS攻击的情况下，备份DNS服务器被配置为将目标域名解析为高防服务器的IP地址。通过本实施例提供的方案，在终端设置的触发机制，在感知到访问错误时触发请求备份DNS服务器解析，不需要请求主DNS服务器解析，因此无需等待DNS缓存服务器的老化时间，实现了终端能够快速获取高防服务器的IP地址的效果，解决了已有技术中切换高防服务器时业务中断时间较长的技术问题。
在一种可选的实施例中，该装置还包括：配置模块，用于配置终端在确定访问业务服务器出错的情况下，将包含目标域名的解析请求发送至备份DNS服务器包含目标域名的解析请求，其中，配置模块为终端中安装的客户端集成的SDK函数。通过本实施例提供的方案，利用封装的SDK函数执行备份DNS服务器的触发机制，便于将SDK函数集成在其他应用程序中。
一种可选的示例为，配置模块包括：封装单元，用于以目标信息格式封装目标域名的信息，得到发送至备份DNS服务器的解析请求。
可选的，解析请求携带的信息还包括终端的标识和/或访问业务服务器的IP地址返回的错误代码。通过本实施例提供的方案，备份DNS服务器接收到的解析请求中包含更多的信息，可以用于后续的分析。
在一种可选的实施例中，该装置还包括：第五发送模块，用于在将包含目标域名的解析请求发送至备份DNS服务器之后，在根据备份DNS服务器解析的目标域名对应的高防服务器的IP地址之前，根据备份DNS服务器解析目标域名得到的业务服务器的IP地址，向业务服务器发送业务请求数据；其中，备份DNS服务器用于在业务服务器未受到DDOS攻击的情况下，将针对目标域名的解析地址设置为业务服务器的IP地址，并在未成功将针对目标域名的解析地址设置为高防服务器的IP地址的情况下，向终端反馈业务服务器的IP地址；第六发送模块，用于在确定访问业务服务器出错的情况下，将包含目标域名的解析请求发送至备份DNS服务器。通过本实施例提供的方案，在终端将解析请求发送至备份DNS服务器，但备份DNS服务器却未将切换高防服务器的IP地址之前，仍重试向备份DNS服务器发送解析请求，提高访问成功率。
在一种可选的实施例中，访问目标域名由终端中安装的客户端执行，该装置还包括：第七发送模块，用于在向高防服务器发送业务请求数据之后，在客户端未关闭的情况下， 如果接收到访问目标域名的操作请求，将包含目标域名的解析请求发送至备份DNS服务器。通过本实施例提供的方案，在终端的客户端未关闭的情况下，如果终端再次接收到访问目标域名对应的业务服务器的操作请求，终端仍然将目标域名的解析请求发送至备份DNS服务器，防止终端由于IP地址切换出现业务中断，提高用户的体验。
在一种可选的实施例中，访问目标域名由终端中安装的客户端执行，该装置还包括：第八发送模块，用于在向高防服务器发送业务请求数据之后，在客户端关闭之后再次启动的情况下，如果接收到访问目标域名的操作请求，将包含目标域名的解析请求发送至主DNS服务器包含目标域名的解析请求。
应理解，上述实施例提供的针对分布式拒绝服务DDOS攻击的域名访问装置以功能模块或功能单元的形式体现。这里的术语“单元”或“模块”可以通过软件和/或硬件形式实现，对此不作具体限定。例如，“单元”或“模块”可以是实现上述功能的软件程序、硬件电路或二者结合。硬件电路可能包括应用特有集成电路(application specific integrated circuit，ASIC)、电子电路、用于执行一个或多个软件或固件程序的处理器(例如共享处理器、专有处理器或组处理器等)和存储器、合并逻辑电路和/或其它支持所描述的功能的合适组件。
因此，在本申请的实施例中描述的各示例的单元，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请实施例的范围。
实施例10
图10是本申请实施例的一种可选的针对分布式拒绝服务DDOS攻击的防护装置的示意性框图。应理解，该装置能够执行实施例8所提供的方法实施例及其可选的实施方式中的各个步骤，为了避免重复，此处不再详述。如图10所示的针对分布式拒绝服务DDOS攻击的防护装置包括确定模块21和第一通知模块22。
其中，确定模块，用于确定终端向主DNS服务器发送的解析请求中的目标域名对应的业务服务器受到DDOS攻击；第一通知模块，用于通知备份DNS服务器将目标域名解析为高防服务器的IP地址，以使得向主DNS服务器发送包含目标域名的解析请求的终端在改为向备份DNS服务器发送包含目标域名的解析请求之后，获取到备份DNS服务器解析出的、目标域名对应的高防服务器的IP地址。通过本实施例提供的方案，新增了备份DNS服务器，在受到攻击需要切换高防服务器的IP地址时，由备份DNS服务器修改IP地址，使终端在感知到访问错误时触发请求备份DNS服务器解析，不需要请求主DNS服务器解析，因此无需等待DNS缓存服务器的老化时间，实现了终端能够快速获取高防服务器的IP地址的效果，解决了已有技术中切换高防服务器时业务中断时间较长的技术问题。
一种可选的示例为，确定模块包括：确定单元，用于确定业务服务器的上行带宽超过预设阈值。通过本实施例提供的方案，能够快捷的监测业务服务器是否受到DDOS攻击。
在一种可选的实施例中，该装置还包括：第二通知模块，用于在通知备份DNS服务器将目标域名解析为高防服务器的IP地址之后，通知主DNS服务器的运营商，以使主DNS服务器的运营商通知主DNS服务器将业务服务器的IP地址拉黑。通过本实施例提供的方 案，使业务服务器在被攻击之后IP地址被拉黑，防止终端向业务服务器发送业务请求数据继续占用带宽，能够节约业务服务器的出口带宽。
在一种可选的实施例中，该装置还包括：第三通知模块，用于在业务服务器受到的DDOS攻击已停止的情况下，通知主DNS服务器的运营商，以使主DNS服务器的运营商通知主DNS服务器将业务服务器的IP地址解除拉黑。通过本实施例提供的方案，使其它未感知到访问错误的终端能够正常访问业务服务器，逐渐将业务数据流量从高防服务器牵引回业务服务器。
可选的，业务端与业务服务器共享网络出口，业务端向主DNS服务器的运营商发送的通知报文的通讯优先级被配置为至少高于业务服务器与终端的通讯优先级。通过本实施例提供的方案，即使在业务服务器的出口带宽拥塞的情况下，业务端与主DNS服务器的通信消息也可以优先的传输。
一种可选的示例为，第一通知模块包括：通知单元，用于通过调度端，以使调度端通知备份DNS服务器将目标域名解析为高防服务器的IP地址。通过本实施例提供的方案，新增了调度端以通知备份DNS服务器，使得备份DNS服务器可以被部署在云端，提高了系统架构部署的灵活性。
应理解，上述实施例提供的针对分布式拒绝服务DDOS攻击的防护装置以功能模块或功能单元的形式体现。这里的术语“单元”或“模块”可以通过软件和/或硬件形式实现，对此不作具体限定。例如，“单元”或“模块”可以是实现上述功能的软件程序、硬件电路或二者结合。硬件电路可能包括应用特有集成电路(application specific integrated circuit，ASIC)、电子电路、用于执行一个或多个软件或固件程序的处理器(例如共享处理器、专有处理器或组处理器等)和存储器、合并逻辑电路和/或其它支持所描述的功能的合适组件。
因此，在本申请的实施例中描述的各示例的单元，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请实施例的范围。
实施例11
本申请实施例还提供了一种通信设备，本申请实施例提供的应用于终端的分布式拒绝服务DDOS攻击的域名访问方法，可以由实施例11提供的通信设备执行。
如图11所示为一种可选的通信设备的结构示意图。图11所示的通信设备可以是手机、平板电脑等通信设备。
如图11所示，通信设备900包括处理器910和收发器920。可选地，该通信设备900还可以包括存储器930。其中，处理器910、收发器920和存储器930之间可以通过内部连接通路互相通信，传递控制和/或数据信号，该存储器930用于存储计算机程序，该处理器910用于从该存储器930中调用并运行该计算机程序。
可选地，通信设备900还可以包括天线940，用于将收发器920输出的无线信号发送出去。
上述处理器910可以和存储器930可以合成一个处理装置，更常见的是彼此独立的部件，处理器910用于执行存储器930中存储的程序代码来实现上述功能。具体实现时，该存储器930也可以集成在处理器910中，或者，独立于处理器910。
除此之外，为了使得通信设备900的功能更加完善，该通信设备900还可以包括输入单元960、显示单元970、音频电路980、摄像头990和传感器901等中的一个或多个，所述音频电路还可以包括扬声器982、麦克风984等。其中，显示单元970可以包括显示屏，该显示屏可以是触控显示屏，触控显示屏可以接收触摸操作，以确定是否接收到访问目标域名的操作请求。
可选地，上述通信设备900还可以包括电源950，用于给通信设备中的各种器件或电路提供电源。
应理解，图11所示的通信设备900能够实现实施例7提供的方法的各个过程。通信设备900中的各个模块的操作和/或功能，分别为了实现上述方法实施例中的相应流程。具体可参见实施例7中的描述，为避免重复，此处适当省略详细描述。
应理解，图11所示的通信设备900中的处理器910可以是片上系统SOC，该处理器910中可以包括中央处理器(Central Processing Unit；以下简称：CPU)，还可以进一步包括其他类型的处理器，例如：图像处理器(Graphics Processing Unit；以下简称：GPU)等。
总之，处理器910内部的各部分处理器或处理单元可以共同配合实现之前的方法流程，且各部分处理器或处理单元相应的软件程序可存储在存储器930中。
实施例12
本申请实施例还提供了一种通信设备，本申请实施例提供的应用于上述业务端的分布式拒绝服务DDOS攻击的防护方法，可以由实施例12提供的通信设备执行。
如图12所示为一种可选的通信设备的结构示意图，通信设备1200包括：一个或多个处理器1202；存储器1203；通信模块1201；以及一个或多个计算机程序1204。上述各器件可以通过一个或多个通信总线1005连接。其中，上述一个或多个计算机程序1204被存储在上述存储器1203中并被配置为被该一个或多个处理器1202执行，该一个或多个计算机程序1204包括指令，上述指令可以用于执行上述应实施例中智能家居设备执行的各个步骤。图12所示的通信设备1200可以是计算机、个人电脑、工作站、服务器等通信设备。
应理解，图12所示的通信设备1200能够实现实施例8提供的方法的各个过程。通信设备1200中的各个模块的操作和/或功能，分别为了实现上述方法实施例中的相应流程。具体可参见实施例8中的描述，为避免重复，此处适当省略详细描述。
本申请实施例还提供了一种计算机可读存储介质，该计算机可读存储介质中存储有计算机程序，当其在计算机上运行时，使得计算机执行上述实施例所述的方法。
此外，本申请实施例还提供一种计算机程序产品，该计算机程序产品包括计算机程序，当其在计算机上运行时，使得计算机执行上述实施例所述的方法。
可以理解的是，上述实施例中的部分或全部步骤或操作仅是示例，本申请实施例还可以执行其它操作或者各种操作的变形。此外，各个步骤可以按照上述实施例呈现的不同的顺序来执行，并且有可能并非要执行上述实施例中的全部操作。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线)或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk)等。

Claims (38)

  1. 一种分布式拒绝服务DDOS攻击的防护方法，其特征在于，所述方法包括：
    终端将包含目标域名的解析请求发送至主域名解析系统DNS服务器；
    所述终端根据所述主DNS服务器反馈的所述目标域名对应的业务服务器的互联网协议IP地址，向所述业务服务器发送业务请求数据；
    在所述业务服务器受到DDOS攻击的情况下，所述终端访问所述业务服务器出错；
    所述终端将包含所述目标域名的解析请求发送至备份DNS服务器；
    所述备份DNS服务器将所述目标域名解析为高防服务器的IP地址；其中，在所述业务服务器受到DDOS攻击的情况下，业务端通知所述备份DNS服务器将针对所述目标域名的解析地址设置为所述高防服务器的IP地址；
    所述终端根据所述备份DNS服务器反馈的所述高防服务器的IP地址，向所述高防服务器发送所述业务请求数据。
  2. 如权利要求1所述的方法，其特征在于，在所述终端向所述高防服务器发送所述业务请求数据之后，所述方法还包括：
    所述高防服务器对所述终端发送的所述业务请求数据执行流量清洗，将清洗后的数据转发至所述业务服务器，并将所述业务服务器反馈的业务响应数据转发至所述终端。
  3. 如权利要求1所述的方法，其特征在于，访问所述目标域名由所述终端中安装的客户端执行，在所述终端向所述高防服务器发送所述业务请求数据之后，所述方法还包括：
    在所述客户端未关闭的情况下，如果所述终端接收到访问所述目标域名的操作请求，所述终端将包含所述目标域名的解析请求发送至所述备份DNS服务器。
  4. 如权利要求1所述的方法，其特征在于，访问所述目标域名由所述终端中安装的客户端执行，在所述终端向所述高防服务器发送所述业务请求数据之后，所述方法还包括：
    在所述客户端关闭后再次启动的情况下，如果所述终端接收到访问所述目标域名的操作请求，所述终端将包含所述目标域名的解析请求发送至所述主DNS服务器。
  5. 如权利要求1所述的方法，其特征在于，
    在所述业务端通知所述备份DNS服务器将针对所述目标域名的解析地址设置为所述高防服务器的IP地址之后，所述方法还包括：
    所述业务端确定所述备份DNS服务器已将针对所述目标域名的解析地址设置为所述高防服务器的IP地址；
    所述业务端通知所述主DNS服务器的运营商，指示所述主DNS服务器的运营商通知所述主DNS服务器将所述业务服务器的IP地址拉黑。
  6. 如权利要求5所述的方法，其特征在于，
    在所述业务服务器受到的所述DDOS攻击已停止的情况下，所述方法还包括：
    所述业务端通知所述主DNS服务器的运营商，指示所述主DNS服务器的运营商通知所述主DNS服务器将所述业务服务器的IP地址解除拉黑。
  7. 一种分布式拒绝服务DDOS攻击的防护系统，其特征在于，所述系统包括：
    终端，用于将包含目标域名的解析请求发送至主DNS服务器，根据所述主DNS服务器反馈的所述目标域名对应的业务服务器的IP地址，向所述业务服务器发送业务请求数据；在访问所述业务服务器出错的情况下，将包含所述目标域名的解析请求发送至备份DNS服务器；根据所述备份DNS服务器反馈的所述高防服务器的IP地址，向所述高防服务器发送所述业务请求数据；
    业务端，用于在所述业务服务器受到DDOS攻击的情况下，通知所述备份DNS服务器将针对所述目标域名的解析地址设置为所述高防服务器的IP地址；
    所述备份DNS服务器，用于在接收到所述业务端的通知之后，将针对所述目标域名的解析地址设置为所述高防服务器的IP地址；在将针对所述目标域名的解析地址设置为所述高防服务器的IP地址之后，针对所述终端发送的包含所述目标域名的解析请求解析为所述高防服务器的IP地址反馈给所述终端。
  8. 如权利要求7所述的系统，其特征在于，所述系统还包括所述高防服务器，用于对所述终端发送的所述业务请求数据执行流量清洗，将清洗后的数据转发至所述业务服务器，并将所述业务服务器反馈的业务响应数据转发至所述终端。
  9. 一种针对分布式拒绝服务DDOS攻击的域名访问方法，所述方法应用于终端，其特征在于，所述方法包括：
    接收到访问目标域名对应的业务服务器的操作请求；
    响应于所述操作请求，向主DNS服务器发送包含所述目标域名的解析请求；
    根据所述主DNS服务器反馈的所述目标域名对应的业务服务器的IP地址，向所述业务服务器发送业务请求数据；
    在所述业务服务器受到DDOS攻击的情况下，确定访问所述业务服务器出错；
    将包含所述目标域名的解析请求发送至备份DNS服务器；
    根据所述备份DNS服务器反馈的所述目标域名对应的高防服务器的IP地址，向所述高防服务器发送所述业务请求数据；其中，在所述业务服务器受到DDOS攻击的情况下，所述备份DNS服务器被配置为将所述目标域名解析为所述高防服务器的IP地址。
  10. 如权利要求9所述的方法，其特征在于，所述终端安装有集成SDK函数的客户端；所述SDK函数用于配置所述终端在确定访问所述业务服务器出错的情况下，将包含所述目标域名的解析请求发送至所述备份DNS服务器包含所述目标域名的解析请求。
  11. 如权利要求10所述的方法，其特征在于，所述SDK函数用于以目标信息格式封装所述目标域名的信息，得到发送至所述备份DNS服务器的所述解析请求。
  12. 如权利要求9-11任一项所述的方法，其特征在于，所述解析请求携带的信息还包括所述终端的标识和/或访问所述业务服务器的IP地址返回的错误代码。
  13. 如权利要求9所述的方法，其特征在于，在将包含所述目标域名的解析请求发送至备份DNS服务器之后，在根据所述备份DNS服务器解析的所述目标域名对应的高防服务器的IP地址之前，所述方法还包括：
    根据所述备份DNS服务器解析所述目标域名得到的所述业务服务器的IP地址，向所述业务服务器发送所述业务请求数据；其中，所述备份DNS服务器用于在所述业务服务器未受到DDOS攻击的情况下，将针对所述目标域名的解析地址设置为所述业务服务器的IP 地址，并在未成功将针对所述目标域名的解析地址设置为所述高防服务器的IP地址的情况下，向所述终端反馈所述业务服务器的IP地址；
    在确定访问所述业务服务器出错的情况下，将包含所述目标域名的解析请求发送至所述备份DNS服务器。
  14. 如权利要求9至13任一项所述的方法，其特征在于，访问所述目标域名由所述终端中安装的客户端执行，在向所述高防服务器发送所述业务请求数据之后，所述方法还包括：
    在所述客户端未关闭的情况下，如果接收到访问所述目标域名的操作请求，将包含所述目标域名的解析请求发送至所述备份DNS服务器。
  15. 如权利要求9至13任一项所述的方法，其特征在于，访问所述目标域名由所述终端中安装的客户端执行，在向所述高防服务器发送所述业务请求数据之后，所述方法还包括：
    在所述客户端关闭之后再次启动的情况下，如果接收到访问所述目标域名的操作请求，将包含所述目标域名的解析请求发送至所述主DNS服务器包含所述目标域名的解析请求。
  16. 一种分布式拒绝服务DDOS攻击的防护方法，所述方法应用于业务端，其特征在于，所述方法包括：
    确定终端向主DNS服务器发送的解析请求中的目标域名对应的业务服务器受到所述DDOS攻击；
    通知备份DNS服务器将所述目标域名解析为高防服务器的IP地址，以使得向所述主DNS服务器发送包含所述目标域名的解析请求的终端在改为向所述备份DNS服务器发送包含所述目标域名的解析请求之后，获取到所述备份DNS服务器解析出的、所述目标域名对应的所述高防服务器的IP地址。
  17. 如权利要求16所述的方法，其特征在于，所述确定所述业务服务器受到所述DDOS攻击，包括：
    确定所述业务服务器的上行带宽超过预设阈值。
  18. 如权利要求16或17所述的方法，其特征在于，在通知备份DNS服务器将所述目标域名解析为高防服务器的IP地址之后，所述方法还包括：
    通知所述主DNS服务器的运营商，指示所述主DNS服务器的运营商通知所述主DNS服务器将所述业务服务器的IP地址拉黑。
  19. 如权利要求18所述的方法，其特征在于，在所述业务服务器受到的所述DDOS攻击已停止的情况下，所述方法还包括：
    通知所述主DNS服务器的运营商，指示所述主DNS服务器的运营商通知所述主DNS服务器将所述业务服务器的IP地址解除拉黑。
  20. 如权利要求18所述的方法，其特征在于，所述业务端与所述业务服务器共享网络出口，所述业务端向所述主DNS服务器的运营商发送的通知报文的通讯优先级被配置为至少高于所述业务服务器与所述终端的通讯优先级。
  21. 如权利要求14所述的方法，其特征在于，通知备份DNS服务器将所述目标域名解析为高防服务器的IP地址，包括：
    通过调度端指示所述调度端通知所述备份DNS服务器将所述目标域名解析为所述高防服务器的IP地址。
  22. 一种针对分布式拒绝服务DDOS攻击的域名访问装置，所述装置应用于终端，其特征在于，所述装置包括：
    接收模块，用于接收到访问目标域名对应的业务服务器的操作请求；
    第一发送模块，用于响应于所述操作请求，向主DNS服务器发送包含所述目标域名的解析请求；
    第二发送模块，用于根据所述主DNS服务器反馈的所述目标域名对应的业务服务器的IP地址，向所述业务服务器发送业务请求数据；
    确定模块，用于在所述业务服务器受到DDOS攻击的情况下，确定访问所述业务服务器出错；
    第三发送模块，用于将包含所述目标域名的解析请求发送至备份DNS服务器；
    第四发送模块，用于根据所述备份DNS服务器反馈的所述目标域名对应的高防服务器的IP地址，向所述高防服务器发送所述业务请求数据；其中，在所述业务服务器受到DDOS攻击的情况下，所述备份DNS服务器被配置为将所述目标域名解析为所述高防服务器的IP地址。
  23. 如权利要求22所述的装置，其特征在于，所述装置还包括：
    配置模块，用于配置所述终端在确定访问所述业务服务器出错的情况下，将包含所述目标域名的解析请求发送至所述备份DNS服务器包含所述目标域名的解析请求，其中，所述配置模块为所述终端中安装的客户端集成的SDK函数。
  24. 如权利要求23所述的装置，其特征在于，所述配置模块包括：
    封装单元，用于以目标信息格式封装所述目标域名的信息，得到发送至所述备份DNS服务器的所述解析请求。
  25. 如权利要求22-24任一项所述的装置，其特征在于，所述解析请求携带的信息还包括所述终端的标识和/或访问所述业务服务器的IP地址返回的错误代码。
  26. 如权利要求22所述的装置，其特征在于，所述装置还包括：
    第五发送模块，用于在将包含所述目标域名的解析请求发送至备份DNS服务器之后，在根据所述备份DNS服务器解析的所述目标域名对应的高防服务器的IP地址之前，根据所述备份DNS服务器解析所述目标域名得到的所述业务服务器的IP地址，向所述业务服务器发送所述业务请求数据；其中，所述备份DNS服务器用于在所述业务服务器未受到DDOS攻击的情况下，将针对所述目标域名的解析地址设置为所述业务服务器的IP地址，并在未成功将针对所述目标域名的解析地址设置为所述高防服务器的IP地址的情况下，向所述终端反馈所述业务服务器的IP地址；
    第六发送模块，用于在确定访问所述业务服务器出错的情况下，将包含所述目标域名的解析请求发送至所述备份DNS服务器。
  27. 如权利要求22至26任一项所述的装置，其特征在于，访问所述目标域名由所述终端中安装的客户端执行，所述装置还包括：
    第七发送模块，用于在向所述高防服务器发送所述业务请求数据之后，在所述客户端未关闭的情况下，如果接收到访问所述目标域名的操作请求，将包含所述目标域名的解析请求发送至所述备份DNS服务器。
  28. 如权利要求22至26任一项所述的装置，其特征在于，访问所述目标域名由所述终端中安装的客户端执行，所述装置还包括：
    第八发送模块，用于在向所述高防服务器发送所述业务请求数据之后，在所述客户端关闭之后再次启动的情况下，如果接收到访问所述目标域名的操作请求，将包含所述目标域名的解析请求发送至所述主DNS服务器包含所述目标域名的解析请求。
  29. 一种分布式拒绝服务DDOS攻击的防护装置，所述装置应用于业务端，其特征在于，所述装置包括：
    确定模块，用于确定终端向主DNS服务器发送的解析请求中的目标域名对应的业务服务器受到所述DDOS攻击；
    第一通知模块，用于通知备份DNS服务器将所述目标域名解析为高防服务器的IP地址，以使得向所述主DNS服务器发送包含所述目标域名的解析请求的终端在改为向所述备份DNS服务器发送包含所述目标域名的解析请求之后，获取到所述备份DNS服务器解析出的、所述目标域名对应的所述高防服务器的IP地址。
  30. 如权利要求29所述的装置，其特征在于，所述确定模块包括：
    确定单元，用于确定所述业务服务器的上行带宽超过预设阈值。
  31. 如权利要求29或30所述的装置，其特征在于，所述装置还包括：
    第二通知模块，用于在通知备份DNS服务器将所述目标域名解析为高防服务器的IP地址之后，通知所述主DNS服务器的运营商，指示所述主DNS服务器的运营商通知所述主DNS服务器将所述业务服务器的IP地址拉黑。
  32. 如权利要求31所述的装置，其特征在于，所述装置还包括：
    第三通知模块，用于在所述业务服务器受到的所述DDOS攻击已停止的情况下，通知所述主DNS服务器的运营商，指示所述主DNS服务器的运营商通知所述主DNS服务器将所述业务服务器的IP地址解除拉黑。
  33. 如权利要求31所述的装置，其特征在于，所述业务端与所述业务服务器共享网络出口，所述业务端向所述主DNS服务器的运营商发送的通知报文的通讯优先级被配置为至少高于所述业务服务器与所述终端的通讯优先级。
  34. 如权利要求29所述的装置，其特征在于，所述第一通知模块包括：
    通知单元，用于通过调度端指示所述调度端通知所述备份DNS服务器将所述目标域名解析为所述高防服务器的IP地址。
  35. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机程序，当其在计算机上运行时，使得计算机执行如权利要求9-15任一项所述的方法。
  36. 一种通信设备，其特征在于，所述通信设备包括：处理器；存储器；应用程序；其中，所述应用程序被存储在所述存储器中，所述应用程序包括指令，当所述指令被所述设备执行时，使得所述设备执行如权利要求9-15任一项所述的方法。
  37. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机程序，当其在计算机上运行时，使得计算机执行如权利要求16-21任一项所述的方法。
  38. 一种通信设备，其特征在于，所述通信设备包括：处理器；存储器；应用程序；其中，所述应用程序被存储在所述存储器中，所述应用程序包括指令，当所述指令被所述设备执行时，使得所述设备执行如权利要求16-21任一项所述的方法。
PCT/CN2020/102076 2019-10-24 2020-07-15 分布式拒绝服务ddos攻击的防护方法、装置及系统 WO2021077811A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911019057.5 2019-10-24
CN201911019057.5A CN110855633B (zh) 2019-10-24 2019-10-24 Ddos攻击的防护方法、装置、系统、通信设备和存储介质

Publications (1)

Publication Number Publication Date
WO2021077811A1 true WO2021077811A1 (zh) 2021-04-29

Family

ID=69597936

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/102076 WO2021077811A1 (zh) 2019-10-24 2020-07-15 分布式拒绝服务ddos攻击的防护方法、装置及系统

Country Status (2)

Country Link
CN (1) CN110855633B (zh)
WO (1) WO2021077811A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113285953A (zh) * 2021-05-31 2021-08-20 西安交通大学 可用于DDoS攻击的DNS反射器检测方法、系统、设备及可读存储介质
CN113904866A (zh) * 2021-10-29 2022-01-07 中国电信股份有限公司 Sd-wan业务流量安全处置引流方法、设备、系统以及介质
CN114338630A (zh) * 2021-12-13 2022-04-12 海尔优家智能科技（北京）有限公司 域名访问方法、装置、电子设备、存储介质及程序产品
CN116155545A (zh) * 2022-12-21 2023-05-23 广东天耘科技有限公司 使用多叉树和蜜罐系统构架的动态DDos防御方法和系统
WO2024149022A1 (zh) * 2023-01-09 2024-07-18 中国银联股份有限公司 数据中心及域名的切换方法、装置、设备及介质

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110855633B (zh) * 2019-10-24 2021-10-15 华为终端有限公司 Ddos攻击的防护方法、装置、系统、通信设备和存储介质
CN113301001B (zh) * 2020-04-07 2023-05-23 阿里巴巴集团控股有限公司 攻击者确定方法、装置、计算设备和介质
CN112804230B (zh) * 2020-05-12 2023-01-24 上海有孚智数云创数字科技有限公司 分布式拒绝服务攻击的监控方法、系统、设备及存储介质
CN112073409A (zh) * 2020-09-04 2020-12-11 杭州安恒信息技术股份有限公司 攻击流量清洗方法、装置、设备及计算机可读存储介质
CN114257566B (zh) * 2020-09-11 2024-07-09 北京金山云网络技术有限公司 域名访问方法、装置和电子设备
CN112351012A (zh) * 2020-10-28 2021-02-09 杭州安恒信息技术股份有限公司 一种网络安全防护方法、装置及系统
CN113114682A (zh) * 2021-04-14 2021-07-13 杭州安恒信息技术股份有限公司 基于DDoS攻击的信息传输方法、装置、设备及介质
CN117675248A (zh) * 2022-08-31 2024-03-08 华为云计算技术有限公司 一种分布式拒绝服务攻击ddos的防误杀方法及装置
CN116319676B (zh) * 2023-05-23 2023-10-20 阿里云计算有限公司 域名解析方法、设备、存储介质和系统
CN116827684B (zh) * 2023-08-25 2023-11-21 卓望数码技术（深圳）有限公司 DDoS攻击防御方法、系统、设备及存储介质
CN118353704A (zh) * 2024-05-11 2024-07-16 深圳市润迅通投资有限公司 一种网络攻击防御系统及其控制方法
CN118377219B (zh) * 2024-06-24 2024-08-30 国网浙江省电力有限公司丽水供电公司 一种抵御有界fdi攻击的温控负荷安全控制方法及系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140130152A1 (en) * 2012-11-07 2014-05-08 Trusteer Ltd. Defense against dns dos attack
CN107426230A (zh) * 2017-08-03 2017-12-01 上海优刻得信息科技有限公司 服务器调度方法、装置、系统、存储介质及设备
CN108809910A (zh) * 2017-05-04 2018-11-13 贵州白山云科技有限公司 一种域名系统服务器调度方法和系统
CN109617932A (zh) * 2019-02-21 2019-04-12 北京百度网讯科技有限公司 用于处理数据的方法和装置
CN110324295A (zh) * 2018-03-30 2019-10-11 阿里巴巴集团控股有限公司 一种域名系统泛洪攻击的防御方法和装置
CN110855633A (zh) * 2019-10-24 2020-02-28 华为终端有限公司 分布式拒绝服务ddos攻击的防护方法、装置及系统

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103023924B (zh) * 2012-12-31 2015-10-14 网宿科技股份有限公司 基于内容分发网络的云分发平台的DDoS攻击防护方法和系统
CN106302313B (zh) * 2015-05-14 2019-10-08 阿里巴巴集团控股有限公司 基于调度系统的DDoS防御方法和DDoS防御系统
US20190280963A1 (en) * 2017-01-31 2019-09-12 The Mode Group High performance software-defined core network
CN108366077B (zh) * 2018-04-23 2023-07-04 沈康 裂变式防攻击网络接入系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140130152A1 (en) * 2012-11-07 2014-05-08 Trusteer Ltd. Defense against dns dos attack
CN108809910A (zh) * 2017-05-04 2018-11-13 贵州白山云科技有限公司 一种域名系统服务器调度方法和系统
CN107426230A (zh) * 2017-08-03 2017-12-01 上海优刻得信息科技有限公司 服务器调度方法、装置、系统、存储介质及设备
CN110324295A (zh) * 2018-03-30 2019-10-11 阿里巴巴集团控股有限公司 一种域名系统泛洪攻击的防御方法和装置
CN109617932A (zh) * 2019-02-21 2019-04-12 北京百度网讯科技有限公司 用于处理数据的方法和装置
CN110855633A (zh) * 2019-10-24 2020-02-28 华为终端有限公司 分布式拒绝服务ddos攻击的防护方法、装置及系统

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113285953A (zh) * 2021-05-31 2021-08-20 西安交通大学 可用于DDoS攻击的DNS反射器检测方法、系统、设备及可读存储介质
CN113904866A (zh) * 2021-10-29 2022-01-07 中国电信股份有限公司 Sd-wan业务流量安全处置引流方法、设备、系统以及介质
CN113904866B (zh) * 2021-10-29 2024-02-09 中国电信股份有限公司 Sd-wan业务流量安全处置引流方法、设备、系统以及介质
CN114338630A (zh) * 2021-12-13 2022-04-12 海尔优家智能科技（北京）有限公司 域名访问方法、装置、电子设备、存储介质及程序产品
CN114338630B (zh) * 2021-12-13 2024-04-19 海尔优家智能科技（北京）有限公司 域名访问方法、装置、电子设备、存储介质及程序产品
CN116155545A (zh) * 2022-12-21 2023-05-23 广东天耘科技有限公司 使用多叉树和蜜罐系统构架的动态DDos防御方法和系统
CN116155545B (zh) * 2022-12-21 2023-08-04 广东天耘科技有限公司 使用多叉树和蜜罐系统构架的动态DDos防御方法和系统
WO2024149022A1 (zh) * 2023-01-09 2024-07-18 中国银联股份有限公司 数据中心及域名的切换方法、装置、设备及介质

Also Published As

Publication number Publication date
CN110855633B (zh) 2021-10-15
CN110855633A (zh) 2020-02-28

Similar Documents

Publication Publication Date Title
WO2021077811A1 (zh) 分布式拒绝服务ddos攻击的防护方法、装置及系统
US10834049B2 (en) Systems and methods for dynamically registering endpoints in a network
US11172023B2 (en) Data synchronization method and system
CA2699314C (en) Failover in a host concurrently supporting multiple virtual ip addresses across multiple adapters
CN102025798B (zh) 地址分配处理方法、装置和系统
US9154557B2 (en) Automatic proxy registration and discovery in a multi-proxy communication system
US11516177B1 (en) Detecting and remediating non-responsive customer premise equipment
EP3544232B1 (en) Processing method, device and system for nf component abnormality
CN111970362B (zh) 基于lvs的车联网网关集群方法及系统
US20030105801A1 (en) Method, system and agent for connecting event consumers to event producers in a distributed event management system
US10931529B2 (en) Terminal device management method, server, and terminal device for managing terminal devices in local area network
CN103825868B (zh) 一种本地语音逃生的方法、本地网关及系统
WO2020057445A1 (zh) 一种通信系统、方法及装置
US11057475B2 (en) Methods, apparatus and systems for resuming transmission link
CN108833149A (zh) 一种快递柜网络可用性监控与自愈的方法及系统
CN114640633B (zh) 负载均衡器及其实现方法、负载均衡的方法、网关系统
CN108989420A (zh) 注册服务的方法及系统、调用服务的方法及系统
US20190036793A1 (en) Network service implementation method, service controller, and communications system
WO2013159492A1 (zh) 信息上报与下载的方法及系统
CN111817953A (zh) 基于虚拟路由器冗余协议vrrp的主设备选举方法及装置
CN113824595B (zh) 链路切换控制方法、装置和网关设备
CN115174528A (zh) 一种设备地址管控方法、装置及系统
CN114025010A (zh) 建立连接的方法和网络设备
CN105610619A (zh) 一种网元设备管理方法和装置
WO2022037049A1 (zh) 用户端保活的方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20879877

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20879877

Country of ref document: EP

Kind code of ref document: A1

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 07/10/2022)

122 Ep: pct application non-entry in european phase

Ref document number: 20879877

Country of ref document: EP

Kind code of ref document: A1