WO2024045542A1

WO2024045542A1 - Method and apparatus for preventing erroneous blocking in distributed denial of service (ddos) attack

Info

Publication number: WO2024045542A1
Application number: PCT/CN2023/080099
Authority: WO
Inventors: 龙卫平
Original assignee: 华为云计算技术有限公司
Priority date: 2022-08-31
Filing date: 2023-03-07
Publication date: 2024-03-07
Also published as: CN117675248A

Abstract

Disclosed in the embodiments of the present application is a method for preventing erroneous blocking in a distributed denial of service (DDOS) attack, which is used for improving an erroneous blocking prevention effect in a DDOS attack. The method in the embodiments of the present application comprises: receiving a target domain name, which is configured by a user, wherein a resolution operation for the target domain name is executed by a target resolution server; allocating a cache unit to the target domain name according to an instruction from the user, wherein the cache unit is used for storing a reply message when the target resolution server is in a DDOS state, wherein the reply message is used for responding to a domain name resolution request for the target domain name; and responding to the domain name resolution request for the target domain name on the basis of the cache unit.

Description

An anti-accidental killing method and device for distributed denial-of-service attacks on DDOS

This application requests the priority of the Chinese patent application submitted to the China Patent Office on August 31, 2022, with the application number 202211055064.2 and the invention title "A method and device for preventing manslaughter of distributed denial-of-service attacks on DDOS", and its entire contents incorporated herein by reference.

Technical field

Embodiments of the present application relate to the field of computers, and in particular to a method and device for preventing accidental killing of distributed denial of service attacks on DDOS.

Background technique

Domain name system (DNS) is a positioning and scheduling system that important business access on the Internet relies on. Currently, there are a large number of pan-domain name attacks against DNS on the Internet. Pan-domain name attacks refer to large traffic with domain name prefix changes. Domain name resolution request, pan-domain name attack can be a distributed denial of service attack (DDOS).

Currently, when a DNS server faces a DDOS attack, the DNS server identifies the source IP address of the attack and blacklists the address to prevent attacks. In a cloud scenario, attackers can obtain a large number of virtual machines and corresponding IP addresses. Therefore, the DNS service in the cloud server blocks IPs with poor defense effect.

At the same time, the initiator of the DDOS attack may be a broiler server hijacked by hackers. The broiler server itself may be running normal business, that is, the DDOS attack traffic is mixed with the normal business traffic. The method of blocking IP will cause a large number of accidents to the normal business and cause business damage. .

Contents of the invention

The embodiment of the present application provides a method for preventing manslaughter from distributed denial of service attacks on DDOS, which is used to improve the anti-manslaughter effect of DDOS attacks.

The first aspect of the embodiments of this application provides a method for preventing manslaughter from distributed denial of service attacks on DDOS. This method can be executed by a cloud server or by components of the cloud server, such as the processor, chip or chip system of the cloud server. Execution can also be implemented by logic modules or software that can realize all or part of the cloud server functions. Taking cloud server execution as an example, the method provided by the first aspect includes the following steps: the cloud server receives the target domain name configured by the user, and the resolution operation of the target domain name is performed by the target resolution server. Specifically, the cloud server receives the domain name resolution request sent by the client, and the domain name resolution request is used to request the IP address corresponding to the target domain name. The cloud server allocates a cache unit for the target domain name according to the user's instructions. The cache unit includes a domain name resolution secure cache DSC. The cache unit is used to store a response message when the target resolution server is in a DDOS state, where the response message is used to respond to a domain name resolution request for the target domain name, and the response message includes the IP address corresponding to the target domain name. The cloud server is based on the cache unit and responds to the domain name resolution request for the target domain name. The response includes reading the IP address corresponding to the target domain name from the cache unit and sending a response message to the user side.

In the embodiment of this application, the cloud server can provide caching unit caching target parsing server parsing according to the user's instructions. After obtaining the IP address, when the target resolution server is in the DDOS state, the cloud server can obtain the IP address corresponding to the target domain name from the cache unit, thus improving the response speed of the domain name resolution request in the DDOS state and further improving the anti-accidental killing effect of DDOS.

In a possible implementation, the user's instruction includes specification information of the cache unit. Specifically, the cloud server receives the ordering request sent by the client, and the ordering request is used to obtain the cache unit. The specification information in the order request includes one or more of the following information: domain name suffix information for specifying anti-accidental killing, information on the number of domain names cached by DSC, cache refresh time in DSC, information about the VPC bound to DCS, and purchase duration of the anti-accidental killing service.

In the embodiment of this application, the cloud server can configure the domain name resolution security cache DSC according to the user's ordering request, thereby providing users with DDOS anti-accidental killing services and improving the convenience of the user side in obtaining DDOS anti-accidental killing services. At the same time, the user side can select multiple specifications of DCS, increasing the configuration types of cache units.

In a possible implementation, the cache unit stores the DDOS status of the target resolution server. Specifically, after the cloud server receives the client domain name resolution request, the cloud server queries the security status of the cloud server based on DSC. DCS is used to store the security status of the cloud server. The security status includes DDOS status and non-DDOS status. The cloud server can read the security status of the target resolution server from the cache unit and transparently transmit the domain name resolution request based on the security status of the target resolution server.

In the embodiment of this application, the cloud server can read the security status of the target resolution server from the cache unit DSC, and respond to the domain name resolution request according to the security status of the target resolution server, thereby improving the anti-accidental killing effect of DDOS.

In a possible implementation, in the process of the cloud server responding to the domain name resolution request for the target domain name based on the cache unit, when there is a response message for the target domain name in the cache unit, the response message is used to resolve the domain name. Request a response. Specifically, when the IP address corresponding to the target domain name is stored in the cache unit, the cache unit generates a response message based on the IP address and sends the response message to the user.

The secure cache provided by the cloud server in the embodiment of this application can cache the IP address corresponding to the target domain name, so that when the cloud server receives the user's resolution request corresponding to the target domain name, it directly generates a response message based on the IP address stored in the cache unit to respond to the domain name. parsing requests, thus improving the response efficiency of domain name resolution requests.

In a possible implementation, when the cloud server responds to the domain name resolution request for the target domain name based on the cache unit, when there is no response message for the target domain name in the cache unit, the cloud server sends the domain name resolution request to Target resolution server. Get the response message sent by the target resolution server. Respond to the domain name resolution request according to the response status information included in the response message.

In the embodiment of this application, when the IP address corresponding to the target domain name is not cached in the cache unit of the cloud server, the cloud server transparently transmits the domain name resolution request corresponding to the target domain name to the target resolution server. Compared with the method of directly blocking the IP address, Improved the anti-accidental killing effect of DDOS.

In one possible implementation, when the cache unit does not store a response message for the target domain name and the target resolution server is in a DDOS state, the domain name resolution request is rate-limited. Specifically, the cloud server adds the domain name resolution request corresponding to the target domain name to the rate limit queue, and the cloud server regularly sends the domain name resolution request to the target resolution server.

In the embodiment of this application, the cloud service can limit the rate of domain name resolution requests, thereby preventing the target resolution server from being unable to process the domain name resolution requests in DDOS state, thereby improving the effect of preventing DDOS accidental killing.

In a possible implementation, when the cloud server responds to the domain name resolution request based on the response status information included in the response message, when the cloud server determines that the response message is a correct response based on the response status information, the target resolution server The sent response message is stored in the cache unit. The response status information includes the IP address corresponding to the target domain name.

In the embodiment of this application, the cloud server can store the IP address corresponding to the target domain name that correctly responds to the domain name resolution request in the cache unit. When the cloud server receives another domain name resolution request for the target domain name, it can directly store the IP address in the cache unit based on the domain name resolution request. The IP address responds to domain name resolution requests, thereby improving the cloud server's response speed to domain name resolution requests.

In a possible implementation, when the cloud server responds to the domain name resolution request based on the response status information included in the response message, when the cloud server determines that the response message is an error response based on the response status information, it updates the target domain name The value in the parsing error counter corresponding to the domain name suffix. When the value in the resolution error counter for the target domain name is greater than or equal to the count threshold, it is determined that the target resolution server is in a DDOS state, and the DDOS state is written to the cache unit. The response status information includes error parameters, which are related parameters used to indicate domain name resolution failure.

The parsing error calculator of the cloud server in the embodiment of the present application can determine the number of domain name parsing failures corresponding to the domain name suffix, thereby determining whether the target parsing server is in a DDOS state based on the number of domain name parsing failures for the same domain name suffix, thereby improving the cloud server's identification of DDOS attacks. ability.

In a possible implementation, the DSC includes a domain name system security cache entrance DSC-ingress component, a domain name system security cache egress DSC-egress component, and a domain name system security cache map DSC-map component. The cloud server receives the domain name resolution request sent by the client. In the process, the cloud server receives the domain name resolution request sent by the client based on the DSC-ingress component. The DSC-egress component is used to obtain the domain name resolution record corresponding to the domain name resolution request. The domain name resolution record includes the IP address requested from the target resolution server. The DSC-map component is used to cache domain name resolution records and the security status of the target resolution server.

In the embodiment of the present application, the cache unit of the cloud server includes multiple DSC components, and the multiple DSC components jointly implement the functions in the cache unit, thereby improving the realizability of the solution.

In a possible implementation, when the target resolution server is in a non-DDOS state, the DSC-egress component stores the domain name resolution record to the DSC-map component. When the target resolution server is in a DDOS state, the DSC-map component imports domain name resolution records into the DSC-ingress component.

In the embodiment of this application, when the cloud server determines that the target resolution server is in a DDOS state, it can import the cached domain name resolution records in the DSC-map component into the DSC-ingress component, thereby improving the response speed of domain name resolution requests.

The second aspect of the embodiment of the present application provides an anti-accidental killing device for distributed denial of service attacks on DDOS. The device includes a transceiver module and a processing module. Among them, the transceiver module is used to receive the target domain name configured by the user, and the resolution operation of the target domain name is performed by the target resolution server. The processing module is used to allocate a cache unit to the target domain name according to the user's instructions. The cache unit is used to store the response message when the target resolution server is in the DDOS state, where the response message is used to respond to the domain name resolution request for the target domain name. The processing module is also used to respond to domain name resolution requests for the target domain name based on the cache unit.

In a possible implementation, the user's instruction includes specification information of the cache unit.

In a possible implementation, the cache unit stores the DDOS status of the target resolution server.

In a possible implementation, the processing module is specifically configured to use the response message to respond to the domain name resolution request when the cache unit stores a response message for the target domain name.

In a possible implementation, the processing module is specifically configured to send a domain name resolution request to the target resolution server when the cache unit does not store a response message for the target domain name. Get the response message sent by the target resolution server. Respond to the domain name resolution request according to the response status information included in the response message.

In a possible implementation, the processing module is also configured to limit the rate of the domain name resolution request when the cache unit does not store a response message for the target domain name.

In a possible implementation, when the cache unit does not store a response message for the target domain name, the processing module is specifically configured to determine, based on the response status information, that the response message is a correct response, and then store the response message sent by the target resolution server. The message is stored in the cache unit.

In a possible implementation, the processing module is specifically configured to update the value in the parsing error counter for the target domain name when it is determined that the response message is an error response based on the response status information. When the value in the resolution error counter for the target domain name is greater than or equal to the count threshold, it is determined that the target resolution server is in a DDOS state.

The third aspect of the embodiment of the present application provides a computer device cluster, including at least one computing device, each computing device includes a processor, and the processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, to The computing device cluster is caused to execute the method described in the above first aspect or any possible implementation manner of the first aspect.

The fourth aspect of the embodiments of the present application provides a computer-readable storage medium on which instructions are stored. When the instructions are executed, the computer executes the method described in the above-mentioned first aspect or any possible implementation manner of the first aspect. method.

The fifth aspect of the embodiments of the present application provides a computer program product. The computer program product includes instructions, which are characterized in that when the instructions are executed, the computer implements the first aspect or any possible implementation manner of the first aspect. method described.

It can be understood that the beneficial effects that can be achieved by any of the computer equipment clusters, computer readable media, or computer program products provided above can be referred to the beneficial effects in the corresponding methods, and will not be described again here.

Description of drawings

Figure 1a is a schematic system architecture diagram of a DDOS anti-accidental killing system provided by an embodiment of the present application;

Figure 1b is a schematic system architecture diagram of another DDOS anti-accidental killing system provided by an embodiment of the present application;

Figure 2 is a schematic flow chart of a DDOS anti-accidental killing method provided by an embodiment of the present application;

Figure 3 is a schematic flow chart of another DDOS anti-accidental killing method provided by an embodiment of the present application;

Figure 4 is a schematic flow chart of another DDOS anti-accidental killing method provided by an embodiment of the present application;

Figure 5 is a schematic flow chart of another DDOS anti-accidental killing method provided by an embodiment of the present application;

Figure 6 is a schematic flow chart of another DDOS anti-accidental killing method provided by an embodiment of the present application;

Figure 7 is a schematic structural diagram of a DDOS device provided by an embodiment of the present application;

Figure 8 is a schematic structural diagram of a computing device provided by an embodiment of the present application;

Figure 9 is a schematic structural diagram of a computing device cluster provided by an embodiment of the present application;

Figure 10 is a schematic structural diagram of another computing device cluster provided by an embodiment of the present application.

Detailed ways

Embodiments of the present application provide a method and device for preventing manslaughter of distributed denial of service attacks on DDOS, which are used to improve the anti-manslaughter effect of distributed denial of service attacks on DDOS.

The terms "first", "second", "third", "fourth", etc. (if present) in the description and claims of this application and the above-mentioned drawings are used to distinguish similar objects without necessarily using Used to describe a specific order or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances so that the embodiments described herein can be practiced in sequences other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, e.g., a process, method, system, product, or apparatus that encompasses a series of steps or units and need not be limited to those explicitly listed. Those steps or elements may instead include other steps or elements not expressly listed or inherent to the process, method, product or apparatus.

In the embodiments of this application, words such as "exemplary" or "for example" are used to represent examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "such as" in the embodiments of the application is not to be construed as preferred or advantageous over other embodiments or designs. Rather, use of the words "exemplary" or "such as" is intended to present the concept in a concrete manner.

First, the relevant terms involved in the embodiments of this application are introduced to facilitate those skilled in the art to understand the solution.

Domain name system (DNS) is a domain name resolution service system on the Internet. DNS is a distributed database that maps domain names and IP addresses to each other, enabling the client to obtain the IP address corresponding to the domain name based on DNS.

Pan-domain name attack, a large-traffic domain name resolution request with randomly changing prefixes.

A distributed denial of service (DDOS) attack refers to multiple attackers in different locations launching attacks against one or several targets at the same time, or an attacker controlling multiple machines in different locations and using these The machine attacks the victim simultaneously.

Extended Berkeley Packet Filter (eBPF) is a set of general execution engines that provides framework software that can efficiently and securely execute specific code based on system or program events.

Domain name system safe cache (DSC) is a software module provided by the embodiment of this application. It is deployed on a cloud server and can provide IP address caching, DDOS attack identification, and DDOS attack prevention for the DNS in the cloud server. Function.

A full-featured DNS server refers to a server that can provide both local DNS resolution capabilities and recursive DNS resolution capabilities.

The following describes the DDOS anti-accidental killing method and device provided by the embodiments of the present application with reference to the accompanying drawings.

Please refer to Figure 1a, which is a schematic system architecture diagram of a DDOS anti-accidental killing system provided by an embodiment of the present application. In the example shown in Figure 1a, the DDOS anti-accidental killing system 100 includes a cloud server 101 and a client 102. The server 101 is deployed with a domain name system security cache DSC module 1011 and a target resolution server 1012. The DSC module 1011 and target resolution server 1012 may be deployed on different servers.

The following is a detailed introduction to the functions of each part of the DDOS anti-manslaughter system.

The target resolution server 1012 in the cloud server 101 can provide domain name resolution services and obtain the corresponding IP address based on the target domain name in the domain name resolution request. The domain name resolution service includes a local domain name resolution service and a recursive domain name resolution service. The local domain name resolution service refers to the scenario where the target resolution server 1012 provides the domain name access resolution service. The recursive domain name resolution service refers to the scenario where the target resolution server 1012 provides the domain name resolution service through other resolution servers. Scenarios for performing recursive domain name resolution.

The DSC module 1011 in the cloud server 101 is used to provide the target resolution server 1012 with services such as identifying DDOS attacks, caching domain name data, and responding to domain name resolution requests. DSC module 1011 uses the eBPF architecture to quickly process domain name resolution requests in DDOS scenarios without going through the operating system kernel. It can quickly respond to legitimate domain name resolution requests in the early stages of a DDOS attack, limit the rate of suspicious domain name resolution requests, and continuously collect legitimate responses gradually. Reduce manslaughter.

Among them, the DSC module 1011 includes the domain name system security cache entry DSC-ingress component 1011a, the domain name system security cache egress DSC-egress component 1011b, the domain name system security cache map DSC-map component 1011c, and the domain name system security cache control DSC-control component. The DSC-map component 1011c may be a database external to the DSC module 1011.

The DSC-ingress component 1011a is used to process the process of receiving a domain name resolution request. Specifically, when the requested domain name of the domain name resolution request is hit in the cache, the domain name resolution request is responded to, and when the requested domain name is not hit in the cache, transparent transmission and speed limit are performed to the target resolution server 1012, and the transparent transmission process buffer (buffer) is Overflow packet loss and other functions.

The DSC-egress component 1011b is used to process the process of responding to domain name resolution requests. Specifically, it includes counting the number of domain name suffix resolution failures to identify the attack status, and caching the obtained domain name resolution record to the DSC-map component 1011c. The domain name resolution record includes the IP address corresponding to the domain name resolution request.

The DSC-map component 1011c is used to store the security status of the target resolution server 1012 and cache domain name resolution records. The security status of the target parsing server 1012 is used to indicate that the target parsing server 1012 is in a DDOS state or a non-DDOS state.

The DSC-control component 1011c is used to control the DSC-egress component 1011b to cache the acquired domain name resolution records to the DSC-map component 1011c.

The client 102 is used to send a domain name resolution request to the cloud server 101. The client 102 may be an independent user device or a virtual machine in a cloud server, and is not specifically limited.

Please refer to Figure 1b. Figure 1b is a schematic structural diagram of another DDOS anti-accidental system according to an embodiment of the present application. In the example shown in Figure 1b, the DSC module 1011 and the target parsing server 103 are deployed on different servers. For example, the DSC module 1011 is deployed on the cloud server 101, and the target parsing server 103 and the cloud server 101 are deployed on different servers. .

It can be understood that when the target resolution server 103 and the cloud server 101 are deployed on different servers, the DDOS anti-accidental service provided by the cloud server 101 and the domain name resolution service provided by the target resolution server 103 may be cloud services provided by different vendors.

The following is an introduction to the anti-accidental killing method and device for DDOS attacks provided by the embodiments of this application.

Please refer to Figure 2. Figure 2 is a schematic flow chart of a DDOS attack prevention method provided by an embodiment of the present application. figure 2 The steps shown include, but are not limited to, the following:

201. The cloud server receives the ordering request for the DDOS anti-accidental service sent by the client.

The cloud server receives the user's instructions. Specifically, the cloud server can receive the ordering request sent by the client, and the ordering request is used to obtain the anti-accidental killing service of DDOS. The ordering request includes one or more of the following specifications of the cache unit: domain name suffix information that specifies anti-accidental killing, quantity information of DSC cache domain names (that is, the storage capacity of DSC), cache refresh time in DSC, and VPC bound to the DCS. Information and manslaughter prevention service purchase duration.

202. The cloud server allocates cache units according to the order request.

The cloud server allocates the target domain name and cache unit according to the user's instructions. Specifically, the cloud server allocates a DSC based on the specification information in the order request sent by the user. The DSC is used to store the response message when the target resolution server is in the DDOS state, that is, to store the domain name resolution record corresponding to the target domain name. The domain name resolution record includes the target domain name. The IP address corresponding to the domain name.

It should be noted that when the order request sent by the user specifies an anti-accidental domain name or domain name suffix, the cloud server will allocate a DSC according to the user's instructions, and the DSC will perform DDOS on the domain name resolution request corresponding to the specified domain name or domain name suffix. Prevent manslaughter.

Please refer to Figure 3. Figure 3 is a schematic flow chart of ordering a DDOS anti-accidental service provided by an embodiment of the present application. In the example shown in Figure 3, the client requests to subscribe to the DDOS anti-accidental killing service from the cloud server. The user can specify the anti-accidental domain name suffix information, the client virtual machine that needs to be bound to DSC, and the time when the DSC service is required. When the user specifies the domain name suffix information to prevent accidental killing, the cloud service only performs accidental killing prevention on domain name resolution requests with the specified domain name suffix.

In the example shown in Figure 3, when the user does not specify the domain name suffix information to prevent accidental killing, the user needs to further set the number of domain names and IP addresses cached in the DSC, and set the automatic refresh time of the DSC cache. At this time, the DSC-egress component regularly refreshes the cached data in the DSC-map component based on the automatic refresh time. Moreover, when the number of cached domain names and IP addresses exceeds the number set by the user, the DSC-egress component will refresh the data according to the least recent Use algorithms to clean cached data.

203. The cloud server receives the domain name resolution request sent by the client.

The cloud server receives the domain name resolution request sent by the client. The domain name resolution request includes the target domain name. The domain name resolution request is used to request the IP address corresponding to the target domain name. After the cloud server receives the domain name resolution request, it queries the security status of the cloud server based on DSC. The security status includes DDOS status and non-DDOS status. Specifically, after the DSC-ingress component of the cloud server receives the domain name resolution request sent by the client, the DSC-ingress component obtains the security status of the cloud server from the DSC-map component, where the DSC-map component stores the security status of the cloud server.

Please refer to Figure 4, which is a schematic diagram of the processing flow of a cloud service receiving a domain name resolution request provided by an embodiment of the present application. In the example shown in Figure 4, after the cloud server receives the domain name resolution request through the network card, and before sending the domain name resolution request to the target resolution server, the DSC-ingress component first processes the domain name resolution request. For example, in steps 1 to 5, the DSC-ingress component reads the security status of the cloud server from the DSC-map component. When the target resolution server is in the DDOS state, the DSC-ingress component sends a domain name resolution request to the target resolution server. The target resolution server handles the domain name resolution request.

204. The cloud server responds to the domain name resolution request based on the cache unit.

The cloud server responds to domain name resolution requests based on the cache unit. When the cache unit stores a response message for the target domain name When sending a message, the cloud server uses the response message to respond to the domain name resolution request. When there is no response message for the target domain name in the cache unit, the cloud server sends the domain name resolution request to the target resolution server, obtains the response message sent by the target resolution server, and analyzes the domain name based on the response status information included in the response message. Parse the request and respond.

Among them, the response status information includes the IP address corresponding to the target domain name and error parameters. When the response status information is the IP address corresponding to the target domain name, the response message is a correct response, that is, the domain name resolution of the target resolution server is successful. When the response status information is an error parameter, the response message is an error response, that is, the target resolution server domain name resolution fails.

Specifically, after the DSC-ingress component obtains the security status of the cloud server, when the target resolution server is in a non-DDOS state, the DSC-ingress component transparently transmits the domain name resolution request to the target resolution server, and the target resolution server can obtain the target based on the domain name resolution request. The IP address corresponding to the domain name, or the target resolution server can obtain the resolution error parameter corresponding to the target domain name based on the domain name resolution request.

When the cloud server determines that the target resolution server is in the DDOS state based on the DSC-map component, the cloud server continues to query the DSC to see whether the IP address corresponding to the target domain name in the domain name resolution request is cached. The DSC is used to store the resolved domain name and the corresponding IP address. When the IP address corresponding to the target domain name does not exist in the DSC, the DSC adds the domain name resolution request to the rate limit queue and waits to send the domain name resolution request to the target resolution server.

In the embodiment of this application, when the target resolution server resolves the IP address corresponding to the target domain name, it can obtain the IP address corresponding to the target domain name based on the local domain name resolution service module, or it can also obtain the IP address based on the external DNS service module by making a recursive request or an iterative request. The IP address corresponding to the target domain name is not specifically limited.

Please continue to refer to Figure 4. In the example shown in Figure 4, for example, in steps 6, 7, 10 to 12, the DSC-ingress component reads the cached IP address in the DSC-map component. When the domain name is not cached in the DSC-map When parsing the IP address corresponding to the target domain name in the request, the DSC-ingress component adds the domain name resolution request to the rate limit queue. The DSC-ingress component regularly sends the domain name resolution request in the rate limit queue to the target resolution server, thereby handling the problem in a DDOS state. Domain name resolution requests that do not have cache records will be processed at a rate limit.

205. The cloud server sends the domain name resolution result corresponding to the target domain name to the client.

After the cloud server obtains the domain name resolution result corresponding to the target domain name, it sends the domain name resolution result corresponding to the target domain name to the client. The domain name resolution result includes the IP address corresponding to the target domain name or the parsing error parameter. For example, when the cloud server determines that the IP address corresponding to the target domain name exists in the domain name system security cache DSC, the cloud server reads the IP address corresponding to the target domain name cached in the DSC and sends the IP address corresponding to the target domain name to the user.

When the cloud server determines that the IP address corresponding to the target domain name does not exist in the domain name system security cache DSC, and waits until the cloud server obtains the IP address corresponding to the target domain name sent by the target resolution server, it sends the IP address corresponding to the target domain name to the client.

Please continue to refer to Figure 4. In the example shown in Figure 4, for example, in steps 7 to 9, when the DSC caches the IP address corresponding to the target domain name in the domain name resolution request, the IP address corresponding to the target domain name cached in the DSC is read. address, and sends the IP address corresponding to the target domain name to the client.

In the embodiment of this application, when the cloud server determines that the response message is an error response based on the response status information, it updates the value in the parsing error counter for the target domain name. When the value in the resolution error counter for the target domain name is greater than or equal to the counting threshold, it is determined that the target resolution server is in the DDOS state, that is, the cloud server determines the security status of the cloud server based on the domain name resolution result of the domain name resolution request. Specifically, when multiple domain names corresponding to the same domain name suffix are resolved, please When the number of failed resolutions exceeds the count threshold, the cloud server determines the security status as DDOS and caches the security status of the target resolution server in the DSC-map component.

Please refer to Figure 5. Figure 5 is a schematic flow chart of a cloud server responding to a domain name resolution request provided by an embodiment of the present application. In the example shown in Figure 5, after the DSC-ingress component of the cloud server transparently transmits the domain name resolution request to the target resolution server, the target resolution server responds to the domain name resolution request and sends the response result of the domain name resolution request to the DSC-egress component. . The DSC-egress component reads the security status stored in the DSC-map component. If the target resolution server is in a non-DDOS state and the IP address requested by the domain name resolution request is resolved successfully, the DSC-egress component will resolve the IP address requested by the domain name resolution request. Sent to client.

In the example in Figure 5, after the DSC-egress component reads the security status stored in the DSC-map component, the cloud server further determines whether the domain name resolution request is resolved successfully. If the IP address requested by the domain name resolution request fails to resolve, the cloud server The server adds 1 to the domain name suffix resolution failure counter for the number of domain name suffix resolution failures corresponding to the resolution request. When the number of failed resolutions for multiple domain name resolution requests corresponding to the same domain name suffix exceeds the preset threshold, the cloud server writes the DDOS status to the DSC-map component and notifies the DSC-control component to send the correct IP address corresponding to the domain name resolution request. Written into the DSC-map component, the correct IP address corresponding to the domain name resolution request is also called authoritative data in this application.

In the embodiment of this application, when the cloud server determines that the response message is a correct response based on the response status information, it stores the response message sent by the target resolution server in the cache unit. That is, the cloud server can store the obtained domain name resolution record in the DSC. Specifically, after the DSC-egress component of the cloud server obtains the correctly parsed domain name data record, it stores the domain name resolution record in the DSC-map component.

In the embodiment of the present application, the caching unit caches the response message when the target resolution server is in the DDOS state. That is, the cloud server can obtain the IP address corresponding to the target domain name and store it in the DSC when the target resolution server is in the DDOS state. The cloud server enables caching of response messages when the target resolution server is in a DDOS state, thereby saving the cache space of the DSC.

Please continue to refer to Figure 5. In the example shown in Figure 5, the DSC-egress component reads the security status stored in the DSC-map component. If the target resolution server is in the DDOS state and the IP address requested by the domain name resolution request is resolved successfully, Then the DSC-egress component reads whether the IP address is cached in the DSC-map component. If the IP address is not cached in the DSC-map component, the DSC-egress component writes the IP address corresponding to the domain name resolution request in the DSC-map component. .

In the embodiment of this application, after the security state of the cloud server switches from the non-DDOS state to the DDOS state, the cloud server controls the DSC-map component to import the cached domain name data records into the DSC-ingress component. At this time, the cloud server can import based on the DSC-ingress component. The domain name data record responds to the domain name unload request from the user end. The domain name data record has local domain name data records and recursive domain name data records.

Please refer to Figure 6, which is a schematic diagram of the deployment architecture of a DSC in different scenarios provided by an embodiment of the present application. In the example shown in Figure 6, DSC and the target resolution server can be deployed on different nodes, and at the same time, DSC-map can be an external database with DSC. In a non-DDOS scenario, the DSC-ingress component receives the domain name resolution request and sends it to the target resolution server. The target resolution server returns the result corresponding to the domain name resolution request to the DSC-egress component. The DSC-egress component collects all domain name data records and stores them in the DSC-map component.

In a DDOS scenario, the server controls the DSC-map component to import cached domain name data records into the DSC-ingress component. After receiving the domain name resolution request, the DSC-ingress component directly imports the domain name data record query domain based on the DSC-map component. The IP address corresponding to the name resolution request does not need to be queried from the DSC-map component again, which improves the cloud server's response speed to domain name resolution requests.

In the embodiment of this application, when the target resolution server is in the DDOS state, the cloud server can obtain the IP address corresponding to the target domain name from the cache unit, thereby improving the response speed of the domain name resolution request in the DDOS state and further improving the anti-accidental killing effect of DDOS.

The above has introduced the DDOS anti-accidental killing method provided by the embodiment of the present application. The device provided by the embodiment of the present application will be introduced below with reference to the accompanying drawings.

Please refer to FIG. 7 , which is a schematic structural diagram of a DDOS anti-accidental killing device provided by an embodiment of the present application. This device is used to implement various steps performed by the cloud server in the above embodiments. As shown in Figure 7, the DDOS anti-accidental killing device 700 includes a transceiver module 701 and a processing module 702.

Among them, the transceiver module 701 is used to receive the target domain name configured by the user, and the resolution operation of the target domain name is performed by the target resolution server. The processing module 702 is used to allocate a cache unit to the target domain name according to the user's instructions. The cache unit is used to store the response message when the target resolution server is in the DDOS state, wherein the response message is used to respond to the domain name resolution request for the target domain name. . The processing module 702 is also configured to respond to the domain name resolution request for the target domain name based on the cache unit.

In one possible implementation, the processing module 702 is specifically configured to use the response message to respond to the domain name resolution request when the cache unit stores a response message for the target domain name.

In one possible implementation, the processing module 702 is specifically configured to send a domain name resolution request to the target resolution server when the cache unit does not store a response message for the target domain name. Get the response message sent by the target resolution server. Respond to the domain name resolution request according to the response status information included in the response message.

In one possible implementation, the processing module 702 is also configured to limit the rate of the domain name resolution request when there is no response message for the target domain name in the cache unit.

In a possible implementation, when there is no response message for the target domain name in the cache unit, the processing module 702 is specifically configured to determine based on the response status information that the response message is a correct response, and then send the response message sent by the target resolution server. The response message is stored in the cache unit.

In one possible implementation, the processing module 702 is specifically configured to update the value in the parsing error counter for the target domain name when it is determined that the response message is an error response based on the response status information. When the value in the resolution error counter for the target domain name is greater than or equal to the count threshold, it is determined that the target resolution server is in a DDOS state.

It should be understood that the division of units in the above device is only a division of logical functions. In actual implementation, all or part of the units may be integrated into a physical entity or physically separated. And the units in the device can all be implemented in the form of software calling through processing components; they can also all be implemented in the form of hardware; some units can also be implemented in the form of software calling through processing components, and some units can be implemented in the form of hardware. For example, each unit can be a separate processing element, or it can be integrated and implemented in a certain chip of the device. In addition, it can also be stored in the memory in the form of a program, and a certain processing element of the device can call and execute the unit. Function. In addition, all or part of these units can be integrated Together, they can also be achieved independently. The processing element described here can also be a processor, which can be an integrated circuit with signal processing capabilities. During the implementation process, each step of the above method or each unit above can be implemented by an integrated logic circuit of hardware in the processor element or implemented in the form of software calling through the processing element.

It is worth noting that for the above method embodiments, for the sake of simple description, they are all expressed as a series of action combinations. However, those skilled in the art should know that the present invention is not limited by the described action sequence. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily necessary for the present application.

Based on the above description, those skilled in the art can think of other reasonable step combinations, which also fall within the protection scope of the present invention. Secondly, those skilled in the art should also be familiar with the fact that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily necessary for the present application.

Please refer to FIG. 8 , which is a schematic structural diagram of a computing device provided by an embodiment of the present application. As shown in Figure 8, the computing device 800 includes: a processor 801, a memory 802, a communication interface 803 and a bus 804. The processor 801, the memory 802 and the communication interface 803 are coupled through a bus (not labeled in the figure). The memory 802 stores instructions. When the execution instructions in the memory 802 are executed, the computing device 800 executes the method executed by the cloud server in the above method embodiment.

The computing device 800 may be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASICs), or one or more microprocessors (digital signal processors) , DSP), or, one or more field programmable gate arrays (FPGA), or a combination of at least two of these integrated circuit forms. For another example, when the unit in the device can be implemented in the form of a processing element scheduler, the processing element can be a general processor, such as a central processing unit (Central Processing Unit, CPU) or other processors that can call programs. For another example, these units can be integrated together and implemented in the form of a system-on-a-chip (SOC).

The processor 801 can be a central processing unit (CPU), or other general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), or an on-site processor. Field programmable gate array (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. A general-purpose processor can be a microprocessor or any conventional processor.

Memory 802 may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Among them, the non-volatile memory can be read-only memory (ROM), programmable ROM (PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically removable memory. Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory. Volatile memory may be random access memory (RAM), which is used as an external cache. By way of illustration, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), Double data rate synchronous dynamic random access memory (double data date SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synchlink DRAM, SLDRAM) and direct Memory bus random access memory (direct rambus RAM, DR RAM).

The memory 802 stores executable program code, and the processor 801 executes the executable program code to respectively realize the functions of the aforementioned transceiver module, adaptive module and transcoding module, thereby realizing the above-mentioned live transcoding method. That is, the memory 802 stores instructions for executing the above-mentioned live transcoding method.

The communication interface 803 uses transceiver modules such as, but not limited to, network interface cards and transceivers to implement communication between the computing device 800 and other devices or communication networks.

In addition to the data bus, the bus 804 may also include a power bus, a control bus, a status signal bus, etc. The bus can be a peripheral component interconnect express (PCIe) bus, an extended industry standard architecture (EISA) bus, a unified bus (unified bus, Ubus or UB), or a computer quick link (compute express link (CXL), cache coherent interconnect for accelerators (CCIX), etc. The bus can be divided into address bus, data bus, control bus, etc.

Please refer to FIG. 9 , which is a schematic diagram of a computing device cluster provided by an embodiment of the present application. As shown in FIG. 9 , the computing device cluster 900 includes at least one computing device 800 . The computing device 800 may be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device 800 may also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

As shown in FIG. 9 , the computing device cluster 900 includes at least one computing device 800 . The memory 802 in one or more computing devices 800 in the computing device cluster 900 may store the same instructions for performing the above live transcoding method.

In some possible implementations, the memory 802 of one or more computing devices 800 in the computing device cluster 900 may also store part of the instructions for executing the above live transcoding method. In other words, a combination of one or more computing devices 800 may jointly execute instructions for performing the above-described live transcoding method.

It should be noted that the memories 802 in different computing devices 800 in the computing device cluster 900 can store different instructions, which are respectively used to execute some functions of the above-mentioned live transcoding device. That is, the instructions stored in the memory 802 in different computing devices 800 can implement the functions of one or more modules in the transceiver module and the processing module.

In some possible implementations, one or more computing devices 800 in the computing device cluster 900 may be connected through a network. Wherein, the network may be a wide area network or a local area network, etc.

Please refer to FIG. 10 , which is a schematic diagram of computer devices in a computer cluster being connected through a network according to an embodiment of the present application. As shown in Figure 10, two computing devices 800A and 800B are connected through a network. Specifically, the connection to the network is made through a communication interface in each computing device.

In a possible implementation, the memory in the computing device 800A stores instructions for performing the functions of the transceiver module. At the same time, instructions for performing the functions of the processing module are stored in memory in computing device 800B.

It should be understood that the functions of computing device 800A shown in FIG. 10 may also be performed by multiple computing devices. Likewise, the functions of computing device 800B may also be performed by multiple computing devices.

In another embodiment of the present application, a computer-readable storage medium is also provided. Computer-executable instructions are stored in the computer-readable storage medium. When the processor of the device executes the computer-executed instructions, the device executes the above method embodiment. The method executed by the cloud server.

In another embodiment of the present application, a computer program product is also provided. The computer program product includes a computer program. Computer-executed instructions are stored in a computer-readable storage medium. When the processor of the device executes the computer execution instruction, the device executes the method executed by the cloud server in the above method embodiment.

Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be described again here.

In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit. The above integrated units can be implemented in the form of hardware or software functional units.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), magnetic disk or optical disk and other media that can store program code. .

Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention, but not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that it can still be used Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent substitutions are made to some of the technical features; however, these modifications or substitutions do not cause the essence of the corresponding technical solutions to depart from the protection scope of the technical solutions of the various embodiments of the present invention.

Claims

An anti-accidental killing method for distributed denial-of-service attacks on DDOS, which is characterized by including:

Receive the target domain name configured by the user, and the resolution operation of the target domain name is performed by the target resolution server;

According to the user's instructions, a cache unit is allocated to the target domain name. The cache unit is used to store a response message when the target resolution server is in a DDOS state. The response message is used to respond to the request for the target domain name. Domain name resolution request for the target domain name;

Based on the cache unit, respond to the domain name resolution request for the target domain name.
The method of claim 1, wherein the user's instruction includes specification information of the cache unit.
The method according to claim 1 or 2, characterized in that, the method further includes:

The cache unit stores the DDOS status of the target parsing server.
The method according to claims 1 to 3, characterized in that, based on the cache unit, responding to a domain name resolution request for the target domain name includes:

When the cache unit stores a response message for the target domain name, the response message is used to respond to the domain name resolution request.
The method according to claims 1 to 3, characterized in that, based on the cache unit, responding to a domain name resolution request for the target domain name includes:

When the cache unit does not store a response message for the target domain name, send the domain name resolution request to the target resolution server;

Obtain the response message sent by the target resolution server;

Respond to the domain name resolution request according to the response status information included in the response message.
The method of claim 5, further comprising:

Rate-limit the domain name resolution request.
The method according to claim 5 or 6, characterized in that, responding to the domain name resolution request according to the response status information included in the response message includes:

According to the response status information, when it is determined that the response message is a correct response, the response message sent by the target parsing server is stored in the cache unit.
The method according to claim 5 or 6, characterized in that, responding to the domain name resolution request according to the response status information included in the response message includes:

According to the response status information, when it is determined that the response message is an error response, update the value in the parsing error counter for the target domain name;

When the value in the parsing error counter for the target domain name is greater than or equal to the counting threshold, it is determined that the target parsing server is in a DDOS state.
An anti-accidental killing device for distributed denial-of-service attacks on DDOS, which is characterized by including:

The transceiver module is used to receive the target domain name configured by the user, and the resolution operation of the target domain name is performed by the target resolution server;

A processing module, configured to allocate a cache unit to the target domain name according to the user's instruction, the cache unit Used to store a response message when the target resolution server is in a DDOS state, wherein the response message is used to respond to a domain name resolution request for the target domain name;

The processing module is also configured to respond to a domain name resolution request for the target domain name based on the cache unit.
The device according to claim 9, wherein the user's instruction includes specification information of the cache unit.
The device according to claim 9 or 10, characterized in that the cache unit stores the DDOS status of the target resolution server.
The device according to claims 9 to 11, characterized in that the processing module is specifically used for:

When the cache unit stores a response message for the target domain name, the response message is used to respond to the domain name resolution request.
The device according to claims 9 to 11, characterized in that the processing module is specifically used for:

When the cache unit does not store a response message for the target domain name, send the domain name resolution request to the target resolution server;

Obtain the response message sent by the target resolution server;

Respond to the domain name resolution request according to the response status information included in the response message.
The device according to claim 13, characterized in that the processing module is also used to:

Rate-limit the domain name resolution request.
The device according to claim 13 or 14, characterized in that the processing module is specifically used for:

According to the response status information, when it is determined that the response message is a correct response, the response message sent by the target parsing server is stored in the cache unit.
The device according to claim 13 or 14, characterized in that the processing module is specifically used for:

According to the response status information, when it is determined that the response message is an error response, update the value in the parsing error counter for the target domain name;

When the value in the parsing error counter for the target domain name is greater than or equal to the counting threshold, it is determined that the target parsing server is in a DDOS state.
A computer device cluster, characterized in that it includes at least one computing device, each computing device includes a processor, the processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, such that The cluster of computing devices performs a method as claimed in any one of claims 1 to 8.
A computer-readable storage medium with instructions stored thereon, characterized in that when the instructions are executed, the computer executes the method described in any one of claims 1 to 8.
A computer program product, the computer program product includes instructions, characterized in that when the instructions are executed, the computer implements the method according to any one of claims 1 to 8.