METHOD, DEVICE AND SYSTEM FOR PROCESSING DNS BEHAVIOR

• US 20170118232A1
• Filed: 03/19/2015
• Published: 04/27/2017
• Est. Priority Date: 04/04/2014
• Status: Active Grant

• Current Assignee: Beijing Qihu Technology Co. Ltd. (360 Security Technology, Inc.)
• Original Assignee: Beijing Qihu Technology Co. Ltd. (360 Security Technology, Inc.)
• Inventors: ZHOU, Hongyi, PU, Can, TAN, Xiaosheng
• Granted Patent: US 9,967,269 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

The invention provides a method, device and system for processing DNS behavior. The method comprises: resolving received network data packet; judging a DNS behavior type corresponding to the network data packet according to the resolution result; determining a processing body according to the DNS behavior type, wherein the processing body comprises a kernel and/or an application layer; and transferring the network data packet to the determined processing body, and processing the network data packet by the determined processing body. The method in the disclosure can improve the DNS defense capability, while improving the service processing capability of a single machine.

Claims

1. A method for processing DNS behavior, comprising:

resolving a received network data packet;

judging a DNS behavior type corresponding to the network data packet according to the resolution result;

determining a processing body according to the DNS behavior type, wherein the processing body comprises at least one of a kernel and an application layer; and

transferring the network data packet to the determined processing body, and processing the network data packet by the determined processing body.

2. The method according to claim 1, wherein the step of determining a processing body according to the DNS behavior type, comprises:

when the DNS behavior type is an attack behavior, determining the processing body to be the kernel; and

when the DNS behavior type is a domain name resolution behavior, determining the processing body to be the application layer.

3. The method according to claim 1, wherein the step of processing the network data packet by the determined processing body, comprises:

when the processing body is the kernel,

detecting the network data packet and filtering the DNS attack behavior carried in the network data packet by the kernel; and

transferring the filtered network data packet to the application layer for processing.

4. The method according to claim 3, wherein following steps are used to judge that the DNS attack behavior is carried in the network data packet:

calculating a feature code of the network data packet;

judging whether the feature code is a feature code of the DNS attack behavior;

if yes, then determining that the DNS attack behavior is carried in the network data packet; and

if not, then determining that the DNS attack behavior is not carried in the network data packet.

5. The method according to claim 4, wherein the feature code comprises:

a number of received network data packets from one IP within a designated period; and

a number of received network data packets from one domain name within a designated period.

6. The method according to claim 3, wherein after the step of transferring the filtered network data packet to the application layer for processing, the method further comprises:

when a root node or other corresponding domain name resolution is abnormal, constructing a virtual root system by an authorization database through a BGP Anycast mode, and guiding all visits to a root domain name server to a virtual root domain node server to externally provide DNS resolution services.

7. The method according to claim 6, wherein when a DNS server fails and is unable to be repaired in time, the DNS of a user is repaired onto a resolvable safe DNS, so as to ensure that the user on network is able to use the network;

and

after the failure of the DNS server is repaired, the DNS configuration of the user is restored onto the DNS server.

8. A computing device, comprising:

a memory having instructions stored thereon;

a processor configured to execute the instructions to perform operations for processing DNS behavior, the operations comprising;

resolving a received network data packet;

judging a DNS behavior type corresponding to the network data packet according to the resolution result;

determining a processing body according to the DNS behavior type, wherein the processing body comprises at least one of a kernel and an application layer; and

transferring the network data packet to the determined processing body to process the network data packet by the determined processing body.

9. The computing device according claim 8, wherein the determining a processing body according to the DNS behavior type further comprises:

when the DNS behavior type is an attack behavior, determining the processing body to be kernel; and

when the DNS behavior type is a domain name resolution behavior, determining the processing body to be the application layer.

10. The computing device according claim 8, wherein the following steps are used to judge that the DNS attack behavior is carried in the network data packet:

calculating a feature code of the network data packet;

judging whether the feature code is a feature code of DNS attack behavior;

if yes, then determining that the DNS attack behavior is carried in the network data packet; and

if not, then determining that the DNS attack behavior is not carried in the network data packet.

11. The computing device according claim 10, wherein the feature code comprises:

a number of received network data packets from one IP within a designated period; and

a number of received network data packets from one domain name within a designated period.

12-15. -15. (canceled)

16. A non-transitory computer readable medium having computer programs stored thereon that, when executed by one or more processors of a computing device, cause the computing device to perform:

resolving a received network data packet;

judging a DNS behavior type corresponding to the network data packet according to the resolution result;

determining a processing body according to the DNS behavior type, wherein the processing body comprises at least one of a kernel and an application layer; and

transferring the network data packet to the determined processing body, and processing the network data packet by the determined processing body.

17. The non-transitory computer readable medium according to claim 16, wherein the determining a processing body according to the DNS behavior type, comprises:

when the DNS behavior type is an attack behavior, determining the processing body to be the kernel; and

when the DNS behavior type is a domain name resolution behavior, determining the processing body to be the application layer.

18. The non-transitory computer readable medium according to claim 16, wherein the processing the network data packet by the determined processing body comprises:

when the processing body is the kernel,

detecting the network data packet and filtering the DNS attack behavior carried in the network data packet by the kernel; and

transferring the filtered network data packet to the application layer for processing.

19. The non-transitory computer readable medium according to claim 18, wherein following steps are used to judge that the DNS attack behavior is carried in the network data packet:

calculating a feature code of the network data packet;

judging whether the feature code is a feature code of the DNS attack behavior;

if yes, then determining that the DNS attack behavior is carried in the network data packet; and

if not, then determining that the DNS attack behavior is not carried in the network data packet.

20. The non-transitory computer readable medium according to claim 19, wherein the feature code comprises:

a number of received network data packets from one IP within a designated period; and

a number of received network data packets from one domain name within a designated period.

21. The non-transitory computer readable medium according to claim 16, wherein after the transferring the filtered network data packet to the application layer for processing, the computing device is further caused to perform:

when a root node or other corresponding domain name resolution is abnormal, constructing a virtual root system by an authorization database through a BGP Anycast mode, and guiding all visits to a root domain name server to a virtual root domain node server to externally provide DNS resolution services.

22. The non-transitory computer readable medium according to claim 21, wherein when a DNS server fails and is unable to be repaired in time, the DNS of a user is repaired onto a resolvable safe DNS, so as to ensure that the user on network is able to use the network;

and

after the failure of the DNS server is repaired, the DNS configuration of the user is restored onto the DNS server.