CN108270755A - A kind of method and apparatus of the adaptive anti-DDOS attack of domain name grade - Google Patents

Abstract

An embodiment of the present invention provides a kind of method and apparatus of the adaptive anti-DDOS attack of domain name grade, this method includes：The access request of designated domain name is received, and determines the request visitation frequency of the designated domain name in the specified period；Threshold value is accessed according to the request of the request visitation frequency of the designated domain name and the designated domain name, determines the attacks results decision result of the designated domain name；According to the attacks results decision as a result, determining the parsing period of the designated domain name, the parsing period refers to parse the time that the designated domain name is needed to wait for；According to the parsing period, resolution response is carried out to the access request of the designated domain name, is realized to being alleviated by the parsing of attack domain name, while ensure the normal parsing of non-attack domain name.

Description

A Domain-level Adaptive Anti-DDOS Attack Method and Device

technical field

The present invention relates to the field of communication technology, in particular to a method and device for adaptively resisting DDOS (Distributed Denial of Service) attacks at the domain level in a CDN (Content Delivery Network, Content Distribution Network) system.

Background technique

The full name of CDN is Content Delivery Network, that is, content distribution network. Referring to Figure 1, the content distribution network can distribute the content in the source server to distributed service nodes (edge nodes), and supports diversified traffic scheduling technology, which can automatically point user requests to the globally optimal network according to the specified strategy. An edge node, which provides data services to users nearby. The core of CDN technology is that by placing node servers all over the network, it is possible to redirect user requests to the service closest to the user based on comprehensive information such as network traffic, connection of each node, load status, distance to the user, and response time in real time. on the node. Its purpose is to enable users to obtain the required content nearby, solve the congestion situation of the Internet network, and improve the response speed of users' access to websites.

On the one hand, CDN disperses user access requests and distributes user access to each service node, but on the other hand, since each service node sends the scheduling request to the CDN dispatching center for processing, the scheduling task of CDN is very heavy. Capability failure will have a serious impact and may cause the entire CDN system to be paralyzed.

The CDN service processing flow is described as follows. There are the following two types of business processes for parsing and scheduling in the CDN.

Method 1: DNS CNAME (alias), as shown in Figure 2.

(1) The terminal access URL is http://icp.com/Web/main.html, initiate icp.com domain name resolution to Local DNS

(2) Local DNS recursively authorizes the DNS server of the origin site to resolve the domain name icp.com;

(3) The website authorizes the DNS to return the reconstructed business domain name (icp.com.cmcdn.com) in the form of CNAME;

(4) Local DNS initiates a request to the global dispatch center to resolve icp.com.cmcdn.com;

(5) The scheduling control center selects the optimal edge node and returns it to the Local DNS according to the address and scheduling strategy of the Local DNS;

(6) The Local DNS returns the corresponding DNS Response to the terminal, which carries the IP address of the edge node of the content network.

Method 2: DNS Forward, as shown in Figure 3.

(1) Configure icp.com in the Forward First list in Local DNS;

(2) The terminal access URL is http://icp.com/Web/main.html, and the domain name resolution of icp.com is initiated to Local DNS;

(3) LocalDNS matches the Forward list, finds that the match is consistent, initiates a DNS request to the global dispatch center, and resolves icp.com;

(4) The scheduling control subsystem selects an optimal edge node to return to the Local DNS according to the address matching scheduling strategy of the Local DNS;

(5) The LocalDNS returns a corresponding DNS Response to the terminal, which carries the IP address of the edge node of the content network.

It is not difficult to see from the above two methods that no matter which method is adopted by the CDN system, the user request needs to be located on a certain edge node server (such as a.b.c.d) through the global dispatch center, and the DNS only needs to forward the user request. The global dispatch center needs to analyze the domain name, check the resource occupancy of all edge nodes that provide services, and determine which server to dispatch to through an algorithm. This work is very heavy in the entire process.

Therefore, the focus of DDOS attacks against CDN has gradually shifted from the original DNS attacks and server traffic access attacks to attacks against the dispatch center.

There are three types of existing DDOS protection schemes.

The first category: self-built anti-DDOS equipment in the computer room

The current mainstream anti-DDOS equipment can protect against various denial-of-service attacks based on the network layer, transport layer, and application layer (such as SYN Flood, UDP Flood, UDP DNS Query Flood, (M)Stream Flood, ICMP Flood, HTTPGet Flood, and connection consumption. wait). Anti-DDOS devices are generally deployed inside the router, and cooperate with the router to discover attacks and clean traffic.

The second category: reverse proxy (cloud protection/acceleration method). The cloud protection/acceleration method uses a dedicated cloud platform to realize the ability to detect and filter DDOS attacks. When the system finds abnormal traffic, it actively transfers the traffic to the cloud acceleration server, and the cloud protection device cleans it and then re-injects it into the router of the business system. .

The third category: anti-DDOS linkage processing. The method of joint disposal is to build a separate system to analyze the data such as attack alarms issued by different anti-DDOS devices, and coordinate the disposal.

The above three technologies have their own advantages in the protection of a single computer room and the overall network, but they cannot play an effective role in the protection of CDN systems. Major prior art:

Precise control cannot be achieved. Generally speaking, the scheduling requirements for the CDN system are only a small number of domain names (usually dozens to hundreds). Once an attack is launched on a domain name, the scheduling may fail, so that all domain names cached in the CDN cannot be accessed. .

Contents of the invention

In view of the above technical problems, embodiments of the present invention provide a method and device for adaptively resisting DDOS attacks at the domain name level, so as to alleviate the resolution of attacked domain names and ensure the normal resolution of non-attack domain names.

According to the first aspect of the embodiments of the present invention, a domain name-level adaptive anti-DDOS attack method is provided, including:

Receive the access request of the specified domain name, and determine the request access frequency of the specified domain name within the specified period;

determining the attack judgment result of the specified domain name according to the access frequency of the specified domain name and the access request threshold of the specified domain name;

Determine the resolution cycle of the specified domain name according to the attack determination result, where the resolution cycle refers to the waiting time for resolving the specified domain name;

According to the resolution period, a resolution response is made to the access request of the specified domain name.

Optionally, the determining the resolution cycle of the specified domain name according to the attack determination result includes:

If the requested access frequency of the specified domain name is greater than or equal to the requested access threshold of the specified domain name, the attack determination result is a suspected attack, and the first resolution cycle of the specified domain name is determined;

If the requested access frequency of the specified domain name is less than the requested access threshold value of the specified domain name, the attack determination result is normal access, and the second resolution cycle of the specified domain name is determined.

Optionally, the determining the first resolution period of the specified domain name includes:

Calculate the attack strength of the specified domain name according to the requested access frequency of the specified domain name, the statistical value of the normal access frequency of the specified domain name, and the peak multiple of the normal access frequency of the specified domain name;

Calculate the attack mitigation factor of the specified domain name according to the attack strength of the specified domain name, the statistical value of the normal access frequency of the specified domain name, and the peak multiple of the normal access frequency of the specified domain name;

The first resolution period of the specified domain name is determined according to the attack mitigation factor.

Optionally, the attack strength of the specified domain name is calculated according to the request visit frequency of the specified domain name, the statistical value of the normal visit frequency of the specified domain name, and the peak multiple of the normal visit frequency of the specified domain name, include:

Calculate the attack strength of the specified domain name according to the following formula;

Formula I=Fre/NormalFre×N

Among them, I represents the attack intensity;

Fre represents the request access frequency of the specified domain name;

NormalFre represents the statistical value of the normal access frequency of the specified domain name;

N represents the peak multiple of the normal access frequency of the specified domain name.

Optionally, the calculation of the attack mitigation factor of the specified domain name according to the attack strength of the specified domain name, the statistical value of the normal access frequency of the specified domain name, and the peak multiple of the normal access frequency of the specified domain name includes :

Calculate the attack mitigation factor of the specified domain name according to the following formula;

Formula REL＝NormalFre×N×Ratio×Z ^I×Adj

Among them, F represents the attack mitigation factor;

NormalFre represents the statistical value of the normal access frequency of the specified domain name;

N represents the peak multiple of the normal access frequency of the specified domain name;

Ratio represents a fixed coefficient;

Z represents the base of the exponential function;

I represents the attack intensity of the specified domain name;

Adj represents an adjustment parameter for index weight adjustment.

Optionally, the determining the first resolution period of the specified domain name according to the attack mitigation factor includes:

Calculate the first resolution cycle of the specified domain name according to the following formula;

Formula Interval＝Q×I

Among them, Interval represents the analysis cycle;

Q represents a predetermined interval time value;

I represents the attack mitigation factor.

Optionally, the method also includes:

For the access requests of each domain name in the normal business request state, statistics are made according to the domain name access frequency statistics cycle, and an access threshold configuration list including all cached domain names is obtained. The access threshold configuration list records the domain name’s normal access frequency statistics and The peak multiple of normal access frequency of the domain name.

According to the second aspect of the embodiment of the present invention, there is also provided a domain name-level adaptive anti-DDOS attack device, including:

A domain name access frequency statistics module, configured to receive an access request for a specified domain name, and determine the requested access frequency of the specified domain name within a specified period;

An attack analysis module, configured to determine the attack determination result of the specified domain name according to the requested access frequency of the specified domain name and the requested access threshold value of the specified domain name; determine the attack determination result of the specified domain name according to the attack determination result analysis cycle;

The global parsing and dispatching module is used for parsing and responding to the access request of the specified domain name according to the parsing period.

Optionally, the attack analysis module includes:

The attack determination submodule is used to determine the attack determination result of the specified domain name according to the access frequency of the specified domain name and the access request threshold value of the specified domain name;

The attack mitigation sub-module is used to determine the first resolution cycle of the specified domain name if the frequency of requested access of the specified domain name is greater than or equal to the requested access threshold of the specified domain name, and the attack determination result is a suspected attack; If the requested access frequency of the specified domain name is less than the requested access threshold value of the specified domain name, the attack determination result is normal access, and the second resolution cycle of the specified domain name is determined.

Optionally, the attack determination submodule includes:

An attack strength calculation unit, configured to calculate the attack strength of the designated domain name according to the request visit frequency of the designated domain name, the statistical value of the normal visit frequency of the designated domain name, and the peak multiple of the normal visit frequency of the designated domain name ;

The attack mitigation factor calculation unit calculates the attack mitigation factor of the specified domain name according to the attack strength of the specified domain name, the statistical value of the normal access frequency of the specified domain name, and the peak multiple of the normal access frequency of the specified domain name;

A resolution cycle calculation unit, configured to determine the first resolution cycle of the specified domain name according to the attack mitigation factor.

Optionally, the attack strength calculation unit is further used for:

Calculate the attack strength of the specified domain name according to the following formula;

Formula I=Fre/NormalFre×N

Among them, I represents the attack intensity;

Fre represents the request access frequency of the specified domain name;

NormalFre represents the statistical value of the normal access frequency of the specified domain name;

N represents the peak multiple of the normal access frequency of the specified domain name.

Optionally, the attack mitigation factor calculation unit is further used for:

Calculate the attack mitigation factor of the specified domain name according to the following formula;

Formula F＝NormalFre×N×P×Z ^I×b

Among them, F represents the attack mitigation factor;

NormalFre represents the statistical value of the normal access frequency of the specified domain name;

N represents the peak multiple of the normal access frequency of the specified domain name;

P represents the fixed coefficient;

Z represents the base of the exponential function;

I represents the attack intensity of the specified domain name;

b represents the adjustment parameter for index weight adjustment.

Optionally, the analysis cycle calculation unit is further used for:

Calculate the first resolution cycle of the specified domain name according to the following formula;

Formula Interval=Q×I

Among them, Interval represents the analysis cycle;

Q represents a predetermined interval time value;

I represents the attack mitigation factor.

Optionally, the attack analysis module also includes:

The log analysis sub-module is used to make statistics on the access requests of each domain name in the normal business request state according to the domain name access frequency statistics cycle, and obtain the access threshold configuration list including all cached domain names, and the access threshold configuration list records the domain names in the access threshold configuration list The statistical value of normal visit frequency and the peak multiple of normal visit frequency of the domain name.

One of the technical solutions above has the following advantages or beneficial effects: for possible attacks, set the request access threshold (or traffic threshold) based on the domain name, and then based on the request access frequency and request of the specified domain name access threshold, determine the attack judgment result, and then determine the resolution cycle of the specified domain name based on the attack judgment result, and mitigate the resolution of the specified domain name based on the resolution cycle, so as to alleviate the resolution of the attacked domain name and ensure that non- The normal resolution of the attack domain name can cooperate with the timeout mechanism of the edge node DNS to limit the frequency of user resolution requests for the attacked website.

Description of drawings

FIG. 1 is a schematic diagram of an existing CDN structure;

Figure 2 is a schematic diagram of the DNS CNAME method;

Fig. 3 is a schematic diagram of DNS Forward mode;

FIG. 4 is a flow chart of a method for adaptively resisting DDOS attacks at the domain name level in Embodiment 1 of the present invention;

5 is a flow chart of the analysis cycle of a designated domain name whose attack determination result is a suspected attack in Embodiment 1 of the present invention;

FIG. 6 is a block diagram of an adaptive anti-DDOS attack device at the domain name level in Embodiment 2 of the present invention;

FIG. 7 is a flow chart of the implementation of the domain-level adaptive anti-DDOS attack device in the second embodiment of the invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

Those skilled in the art know that the embodiments of the present invention can be implemented as a system, device, device, method or computer program product. Therefore, the embodiments of the present invention can be implemented in the following forms: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

Embodiment one

Referring to Fig. 4, a kind of adaptive anti-DDOS attack method of domain name level is shown in the figure, and concrete steps are as follows:

Step 401: Receive an access request for a specified domain name, and determine the requested access frequency of the specified domain name within a specified period;

In this embodiment, the domain name resolution requests accessed can be counted according to a specified period T, and a dynamic domain name access frequency list can be generated. The specified period T is a fixed period for domain name access frequency statistics. The specified period T can be configured, for example, It is 1 minute, 15 minutes or 1 hour, and of course it is not limited thereto.

Step 402: Determine the attack determination result of the specified domain name according to the access frequency of the specified domain name and the access request threshold of the specified domain name;

The above attack determination result is used to indicate whether the specified domain name has the possibility of being attacked.

For example: if the request access frequency of the specified domain name is greater than or equal to the request access threshold value of the specified domain name, the attack determination result is a suspected attack. If the requested access frequency of the specified domain name is less than the requested access threshold value of the specified domain name, the attack determination result is normal access.

Step 403: Determine the resolution cycle of the specified domain name according to the attack determination result;

The above-mentioned resolution period refers to the waiting time for resolving the specified domain name.

For example: if the request access frequency of the specified domain name is greater than or equal to the request access threshold value of the specified domain name, the attack determination result is a suspected attack, and the first resolution cycle of the specified domain name is determined, for example, the first resolution period can be a value greater than zero;

If the requested access frequency of the specified domain name is less than the requested access threshold value of the specified domain name, the attack determination result is normal access, and the second resolution cycle of the specified domain name is determined, for example, the second resolution cycle can be zero .

Step 404: Perform a resolution response to the access request of the specified domain name according to the resolution period.

If the resolution period of the specified domain name is a value greater than zero, the resolution period needs to be interrupted before the access request of the specified domain name can be resolved, and then the resolution response is fed back to Local DNS.

If the resolution period of the specified domain name is zero, the specified domain name will be resolved normally and the resolution response will be sent to Local DNS

In this embodiment, for possible attacks, set the request access threshold (or traffic threshold) with the domain name as the granularity, and then determine the attack judgment result based on the request access frequency and request access threshold of the specified domain name , and then determine the resolution cycle of the specified domain name according to the attack judgment result, and mitigate the resolution of the specified domain name based on the resolution cycle, so as to alleviate the resolution of the attacked domain name and ensure the normal resolution of the non-attack domain name, which can cooperate with the edge The timeout mechanism of the node DNS limits the frequency of user resolution requests to the attacked website.

In this embodiment, the resolution cycle of a specified domain name whose attack determination result is a suspected attack can be determined according to the following process, see FIG. 5 .

Step 501: Calculate the attack strength of the specified domain name according to the requested access frequency of the specified domain name, the statistical value of the normal access frequency of the specified domain name, and the peak multiple of the normal access frequency of the specified domain name;

Calculate the attack strength of the specified domain name according to the following formula;

Formula I=Fre/NormalFre×N

Among them, I represents the attack intensity;

Fre represents the request access frequency of the specified domain name;

NormalFre represents the statistical value of the normal access frequency of the specified domain name;

N represents the peak multiple of the normal access frequency of the specified domain name.

For example, taking the domain name AA as an example, assuming NormalFre_AA=3000, N=3, FreAA=10000, I_AA=1.11 can be calculated.

Step 502: Calculate the attack mitigation factor of the specified domain name according to the attack strength of the specified domain name, the statistical value of the normal access frequency of the specified domain name, and the peak multiple of the normal access frequency of the specified domain name;

Calculate the attack mitigation factor of the specified domain name according to the following formula;

Formula REL＝NormalFre×N×Ratio×Z ^I×Adj

Among them, REL represents the attack mitigation factor;

NormalFre represents the statistical value of the normal access frequency of the specified domain name;

N represents the peak multiple of the normal access frequency of the specified domain name;

Ratio represents a fixed coefficient, which is related to the capacity and processing capability of the system, for example, Ratio=0.0001;

Z represents the base number of the exponential function, for example Z=2;

I represents the attack intensity of the specified domain name;

Adj represents an adjustment parameter used for index weight adjustment, for example Adj=2.

For example, taking the domain name AA as an example, REL=F(NormalFre_AA, N, I_AA), where the F function is an attack mitigation algorithm, which can be customized. In this embodiment, it is defined as an exponential function based on actual experience.

Assume NormalFre_AA=3000, N=3, I_AA=1.11.

It can be calculated: REL=3000×3×0.0001×2 ^1.11×2 =3.78.

Step 503. Determine the first resolution period of the specified domain name according to the attack mitigation factor.

Calculate the first resolution cycle of the specified domain name according to the following formula;

Formula Interval＝Q×REL

Among them, Interval represents the analysis cycle;

Q represents a predetermined interval time value, for example Q=1 second;

REL stands for attack mitigation factor.

For example, taking the domain name AA as an example, REL_AA=3.78, assuming the default Q=1 second, then Interval_AA=3.78 seconds.

In this embodiment, the method also includes:

For the access requests of each domain name in the normal business request state, statistics are made according to the domain name access frequency statistics cycle, and an access threshold configuration list including all cached domain names is obtained. The access threshold configuration list records the domain name’s normal access frequency statistics and The peak multiple of normal access frequency of the domain name.

Embodiment two

Referring to Fig. 6, a kind of adaptive anti-DDOS attack device of domain name level is shown in the figure, and this device (for example called global dispatch center) comprises:

A domain name access frequency statistics module 601, configured to receive an access request for a specified domain name, and determine the requested access frequency of the specified domain name within a specified period;

The attack analysis module 602 is configured to determine the attack judgment result of the designated domain name according to the requested access frequency of the designated domain name and the requested access threshold value of the designated domain name; determine the designated domain name according to the attack judgment result analysis cycle;

The global parsing and dispatching module 603 is used for parsing and responding to the access request of the specified domain name according to the parsing period.

In this embodiment, the domain name access frequency statistics module 601 can count the domain name resolution requests accessed according to the specified period T, and generate a dynamic domain name access frequency list. The specified period T is a fixed period for domain name access frequency statistics. The specified period T is configurable, for example, it can be 1 minute, 15 minutes or 1 hour, but of course it is not limited thereto.

The attack analysis module 602 includes:

The attack determination sub-module 6021 is configured to determine the attack determination result of the specified domain name according to the access frequency of the specified domain name and the access request threshold of the specified domain name;

The attack mitigation sub-module 6022 is configured to determine the first resolution period of the specified domain name if the frequency of access requests of the specified domain name is greater than or equal to the threshold value of the request access of the specified domain name, the attack determination result is a suspected attack ; If the requested access frequency of the specified domain name is less than the requested access threshold value of the specified domain name, the attack determination result is normal access, and the second resolution cycle of the specified domain name is determined.

In this embodiment, optionally, the attack analysis module 602 further includes:

The log analysis sub-module 6023 is used to make statistics on the access requests of each domain name in the normal business request state according to the domain name access frequency statistics cycle, and obtain the access threshold configuration list including all cached domain names, and the access threshold configuration list records domain names The statistical value of the normal visit frequency of the domain name and the peak multiple of the normal visit frequency of the domain name.

In this embodiment, optionally, the attack determination submodule includes:

An attack strength calculation unit, configured to calculate the attack strength of the designated domain name according to the request visit frequency of the designated domain name, the statistical value of the normal visit frequency of the designated domain name, and the peak multiple of the normal visit frequency of the designated domain name ;

The attack mitigation factor calculation unit calculates the attack mitigation factor of the specified domain name according to the attack strength of the specified domain name, the statistical value of the normal access frequency of the specified domain name, and the peak multiple of the normal access frequency of the specified domain name;

A resolution cycle calculation unit, configured to determine the first resolution cycle of the specified domain name according to the attack mitigation factor.

In this embodiment, optionally, the attack strength calculation unit is further used for:

Calculate the attack strength of the specified domain name according to the following formula;

Formula I=Fre/NormalFre×N

Among them, I represents the attack intensity;

Fre represents the request access frequency of the specified domain name;

NormalFre represents the statistical value of the normal access frequency of the specified domain name;

N represents the peak multiple of the normal access frequency of the specified domain name.

In this embodiment, optionally, the attack mitigation factor calculation unit is further used for:

Calculate the attack mitigation factor of the specified domain name according to the following formula;

Formula F＝NormalFre×N×P×Z ^I×b

Among them, F represents the attack mitigation factor;

NormalFre represents the statistical value of the normal access frequency of the specified domain name;

N represents the peak multiple of the normal access frequency of the specified domain name;

P represents the fixed coefficient;

Z represents the base of the exponential function;

I represents the attack intensity of the specified domain name;

b represents the adjustment parameter for index weight adjustment.

In this embodiment, optionally, the analysis cycle calculation unit is further used for:

Calculate the first resolution cycle of the specified domain name according to the following formula;

Formula Interval＝Q×I

Among them, Interval represents the analysis cycle;

Q represents a predetermined interval time value;

I represents the attack mitigation factor.

Take the domain name AA as an example:

When the Local DNS (local DNS) submits the access request of the domain name AA, the domain name access frequency statistical module 601 calculates the access frequency FreAA of the domain name AA according to the access frequency of the specified period T, and generates request information Request=(AA, FreAA ) is sent to the attack analysis module 602.

The log analysis sub-module 6023 conducts periodic statistics on the access requests of each domain name under the normal service request state, and analyzes and counts each cached domain name configuration column (DomainList) according to the domain name access frequency statistics period T (for example, 1 minute).

After a period of study and statistics, the statistical results of normal access frequency are calculated, and an access threshold configuration list (DomainFreList) including all cached domain names is formed.

domain name NormalFre(times/T) N AAA 3000 3 BB 6000 3 CC 200 2 … … …

The above-mentioned AA, BB, and CC are example domain names.

The above N means: the peak multiple of the normal access frequency, and N can be configured differently according to the fluctuation of access to different domain names.

In this embodiment, the attack determination submodule 6021 receives the request information sent by the domain name access frequency statistics module 601, and according to the request information Request=(AA, FreAA), whether the access frequency FreAA of the specified domain name AA exceeds the limited access frequency, if If the access frequency exceeds the limit, send a suspected attack request message to the attack mitigation sub-module 6022. The suspected attack request message includes the attack strength of the specified domain name, the statistical value of the normal access frequency of the specified domain name, and the peak multiple of the normal access frequency of the specified domain name ; If the access frequency does not exceed the limited access frequency, it is determined to be a normal access, and the determination result is directly fed back to the global analysis and scheduling module 603 .

for example:

If FreAA>=NormalFre_AA×N_AA, it is determined to be an attack, and the attack strength is calculated as I_AA=FreAA/NormalFre×N_AA, where I_AA represents the attack strength of the domain name AA, NormalFre_AA represents the statistical value of the normal access frequency of the domain name AA, and N_AA represents the normal frequency of the domain name AA The peak multiple of access frequency.

Assuming NormalFre_AA=3000, N=3, FreAA=10000, I_AA=1.11 can be calculated, and the suspected attack request message Request_ATT=(AA, FreAA, N, I_AA) is sent to the attack mitigation submodule.

If FreAA<NormalFre_AA×N_AA, it is determined to be a normal access, and the result of the determination is directly fed back to the global analysis and scheduling module 603, for example, the determination result Result=(AA, 0), where "0" indicates that the global analysis and scheduling module 603 resolves the domain name AA The time to wait is 0 seconds.

The attack mitigation sub-module 6022 is configured to calculate according to the attack strength of the specified domain name, the statistical value of the normal access frequency of the specified domain name and the peak multiple of the normal access frequency of the specified domain name after receiving the suspected attack request message The attack mitigation factor of the specified domain name.

for example:

When the attack link sub-module 6022 receives the suspected attack request message Request_ATT=(AA, NormalFre_AA, N, I_AA), it executes the attack mitigation factor calculation REL=F(NormalFre_AA, N, I_AA).

The above REL means: attack mitigation factor, the default is 0.

The above F() function is an attack mitigation algorithm, which can be customized. In an embodiment, the F() function is defined as an exponential function based on actual experience.

F＝NormalFre_AA×N×Ratio×Z ^I_AA×Adj

Ratio is a fixed coefficient, which is related to the capacity and processing capacity of the system, such as 0.0001;

Z: the base of the exponential function, for example Z=2;

Adj: an adjustment parameter, used for index weight adjustment, for example Adj=2.

for example:

REL＝3000×3×0.0001×2 ^1.11×2 ＝3.78

In this embodiment, the attack mitigation submodule 6022 sends the analysis result of the specified domain name to the feedback global analysis and scheduling module 603, and the analysis result includes the attack mitigation factor of the specified domain name, for example, the attack mitigation submodule 6022 sends the specified domain name AA The analysis result Result=(AA, 3.78) is sent to the feedback global analysis and scheduling module 603 .

In this embodiment, the global parsing and scheduling module 603 performs parsing and scheduling according to the analysis results sent by the attack analysis module 602 .

If REL=0 in the analysis result Result, the analysis will be performed normally and the Response will be fed back to the Local DNS;

If the REL is not 0, it means that there is an attack, and the parsing response is performed after a certain parsing period Interval_AA=Interval×REL. The above Interval: the default parsing interval period, which is configurable.

For example, for Result_AA=(AA, 3.78), assuming the default Interval=1 second, then Interval_AA=3.78 seconds.

Below in conjunction with Fig. 6 and Fig. 7, introduce in detail the self-adaptive anti-DDOS attack process of domain name level in the present embodiment, concrete steps are as follows:

Step 701, Local DNS sends an access request for a specified domain name;

Step 702, the domain name visit frequency statistics module calculates the designated domain name visit frequency;

Step 703, the attack determination sub-module performs access frequency comparison, if it exceeds the threshold, enter step 704; otherwise, step 711;

Step 704, the attack mitigation sub-module calculates the mitigation factor, and feeds the information back to the access frequency statistics module;

Step 705, execute the parsing request to the global parsing and scheduling module;

Step 706, perform analysis according to the domain name and mitigation factor, and then enter step 707, or enter step 710;

Step 707, storing scheduling logs;

Step 708, log analysis;

Step 709, access the threshold configuration list, and then return to step 703;

Step 710, Feedback the analysis result of the access frequency statistics module;

Step 711, feeding back the Local DNS resolution result.

With this scheme, fine-grained control can be carried out for different domain names. For example, when there is an attack on the AA domain name, Result_AA=(AA, 1.944); and at this time, if there is no attack on the BB website, then Result_BB=(AA, 0) .

From the user's point of view, after the user sends a request for AA to Local DNS, it takes 1.944 seconds (excluding network delay) to receive the feedback; when the user accesses BB, the user receives the resolution feedback in real time.

It can be seen from the above that adopting this technology can effectively prevent DDOS attacks against the CDN system, and can realize fine-grained control of different cache websites of the CDN, and can ensure the normal operation of the CDN as much as possible.

It should be understood that reference throughout this specification to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic related to the embodiment is included in at least one embodiment of the present invention. Thus, appearances of "in one embodiment" or "in an embodiment" in various places throughout the specification are not necessarily referring to the same embodiment. Furthermore, the particular features, structures or characteristics may be combined in any suitable manner in one or more embodiments.

In various embodiments of the present invention, it should be understood that the sequence numbers of the above-mentioned processes do not mean the order of execution, and the execution order of each process should be determined by its functions and internal logic, rather than by the embodiment of the present invention. The implementation process constitutes any limitation

Additionally, the terms "system" and "network" are often used interchangeably herein.

It should be understood that the term "and/or" in this article is only an association relationship describing associated objects, which means that there may be three relationships, for example, A and/or B may mean: A exists alone, and A and B exist at the same time , there are three cases of B alone. In addition, the character "/" in this article generally indicates that the contextual objects are an "or" relationship.

In the embodiments provided in the present application, it should be understood that "B corresponding to A" means that B is associated with A, and B can be determined according to A. However, it should also be understood that determining B according to A does not mean determining B only according to A, and B may also be determined according to A and/or other information.

In the several embodiments provided in this application, it should be understood that the disclosed methods and devices may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, each unit may be physically included separately, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware, or in the form of hardware plus software functional units.

The above-mentioned integrated units implemented in the form of software functional units may be stored in a computer-readable storage medium. The above-mentioned software functional units are stored in a storage medium, and include several instructions to enable a computer device (which may be a personal computer, server, or network device, etc.) to execute some steps of the sending and receiving methods described in various embodiments of the present invention. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM for short), random access memory (Random Access Memory, RAM for short), magnetic disk or optical disk, etc., which can store program codes. medium.

What has been described above is a preferred embodiment of the present invention. It should be pointed out that for those skilled in the art, some improvements and modifications can be made without departing from the principles described in the present invention. These improvements and modifications are also described in within the protection scope of the present invention.

Claims (14)

1. a kind of method of the adaptive anti-DDOS attack of domain name grade, which is characterized in that including：

The access request of designated domain name is received, and determines the request visitation frequency of the designated domain name in the specified period；

Threshold value is accessed according to the request of the request visitation frequency of the designated domain name and the designated domain name, is determined described specified The attacks results decision result of domain name；

According to the attacks results decision as a result, determining the parsing period of the designated domain name, the parsing period refers to described in parsing The time that designated domain name is needed to wait for；

According to the parsing period, resolution response is carried out to the access request of the designated domain name.

2. according to the method described in claim 1, it is characterized in that, it is described according to the attacks results decision as a result, determine the finger The parsing period of localization name, including：

If the request that the request visitation frequency of the designated domain name is greater than or equal to the designated domain name accesses threshold value, described to attack It is doubtful attack to hit judgement result, determines the first parsing period of the designated domain name；

If the request that the request visitation frequency of the designated domain name is less than the designated domain name accesses threshold value, the attacks results decision As a result it is accessed to be normal, determines the second parsing period of the designated domain name.

3. according to the method described in claim 2, it is characterized in that, it is described determine the designated domain name first parsing the period, Including：

According to the request visitation frequency of the designated domain name, the statistical value of normal visitation frequency of the designated domain name and described The peak value multiple of the normal visitation frequency of designated domain name calculates the attack strength of the designated domain name；

According to the attack strength of the designated domain name, the statistical value of the normal visitation frequency of the designated domain name and described specified The peak value multiple of the normal visitation frequency of domain name calculates the attack relief factor of the designated domain name；

The first parsing period of the designated domain name is determined according to the attack relief factor.

4. according to the method described in claim 3, it is characterized in that, the request visitation frequency according to the designated domain name, The peak value multiple of the statistical value of the normal visitation frequency of the designated domain name and the normal visitation frequency of the designated domain name, meter The attack strength of the designated domain name is calculated, including：

The attack strength of the designated domain name is calculated according to the following formula；

Formula I=Fre/NormalFre × N

Wherein, I represents attack strength；

Fre represents the request visitation frequency of the designated domain name；

NormalFre represents the statistical value of the normal visitation frequency of the designated domain name；

N represents the peak value multiple of the normal visitation frequency of the designated domain name.

It is 5. according to the method described in claim 3, it is characterized in that, the attack strength according to the designated domain name, described The peak value multiple of the statistical value of the normal visitation frequency of designated domain name and the normal visitation frequency of the designated domain name calculates The attack relief factor of the designated domain name, including：

The attack relief factor of the designated domain name is calculated according to the following formula；

Formula REL=NormalFre × N × Ratio × Z^I×Adj

Wherein, F represents attack relief factor；

NormalFre represents the statistical value of the normal visitation frequency of the designated domain name；

N represents the peak value multiple of the normal visitation frequency of the designated domain name；

Ratio represents fixed coefficient；

Z represents the truth of a matter of exponential function；

I represents the attack strength of the designated domain name；

Adj represents the adjustment parameter adjusted for index weight.

6. according to the method described in claim 3, it is characterized in that, described determine described specify according to the attack relief factor The first parsing period of domain name, including：

The first parsing period of the designated domain name is calculated according to the following formula；

Formula Interval=Q × I

Wherein, Interval represents the parsing period；

Q represents scheduled interval time value；

I represents attack relief factor.

7. according to the method described in claim 3, it is characterized in that, the method further includes：

To the access request of each domain name of regular traffic solicited status, counted according to the domain name access frequency statistics period, Obtain including the access thresholds configured list of all caching domain names, record has the normal of domain name in the access thresholds configured list The peak value multiple of the statistical value of visitation frequency and the normal visitation frequency of domain name.

8. a kind of device of the adaptive anti-DDOS attack of domain name grade, which is characterized in that including：

Domain name access frequency statistics module for receiving the access request of designated domain name, and determines described specified in the specified period The request visitation frequency of domain name；

Attack analysis module, for according to the request visitation frequency of the designated domain name and the request access door of the designated domain name Limit value determines the attacks results decision result of the designated domain name；According to the attacks results decision as a result, determining the solution of the designated domain name Analyse the period；

Global parsing and scheduler module, for according to the parsing period, being parsed to the access request of the designated domain name Response.

9. device according to claim 8, which is characterized in that the attack analysis module includes：

Attacks results decision submodule accesses for the request visitation frequency according to the designated domain name and the request of the designated domain name Threshold value determines the attacks results decision result of the designated domain name；

Submodule is alleviated in attack, if the request visitation frequency for the designated domain name is greater than or equal to asking for the designated domain name Access threshold value is sought, the attacks results decision result is doubtful attack, determines the first parsing period of the designated domain name；It is if described The request that the request visitation frequency of designated domain name is less than the designated domain name accesses threshold value, and the attacks results decision result is normal It accesses, determines the second parsing period of the designated domain name.

10. device according to claim 9, which is characterized in that the attacks results decision submodule includes：

Attack strength computing unit, for the positive frequentation of request visitation frequency, the designated domain name according to the designated domain name It asks the peak value multiple of the statistical value of the frequency and the normal visitation frequency of the designated domain name, calculates attacking for the designated domain name Hit intensity；

Relief factor computing unit is attacked, frequency is accessed according to the attack strength of the designated domain name, the normal of the designated domain name Secondary statistical value and the peak value multiple of the normal visitation frequency of the designated domain name, the attack for calculating the designated domain name are delayed Solve the factor；

Computation of Period unit is parsed, for determining the first parsing period of the designated domain name according to the attack relief factor.

11. device according to claim 10, which is characterized in that the attack strength computing unit is further used for：

The attack strength of the designated domain name is calculated according to the following formula；

Formula I=Fre/NormalFre × N

Wherein, I represents attack strength；

Fre represents the request visitation frequency of the designated domain name；

NormalFre represents the statistical value of the normal visitation frequency of the designated domain name；

N represents the peak value multiple of the normal visitation frequency of the designated domain name.

12. device according to claim 10, which is characterized in that the attack relief factor computing unit is further used In：

The attack relief factor of the designated domain name is calculated according to the following formula；

Formula F=NormalFre × N × P × Z^I×b

Wherein, F represents attack relief factor；

NormalFre represents the statistical value of the normal visitation frequency of the designated domain name；

N represents the peak value multiple of the normal visitation frequency of the designated domain name；

P represents fixed coefficient；

Z represents the truth of a matter of exponential function；

I represents the attack strength of the designated domain name；

B represents the adjustment parameter adjusted for index weight.

13. device according to claim 10, which is characterized in that the parsing computation of Period unit is further used for：

The first parsing period of the designated domain name is calculated according to the following formula；

Formula Interval=Q × I

Wherein, Interval represents the parsing period；

Q represents scheduled interval time value；

I represents attack relief factor.

14. device according to claim 9, which is characterized in that the attack analysis module further includes：

Log analysis submodule, for the access request of each domain name to regular traffic solicited status, according to domain name access frequency Secondary measurement period is counted, and obtains including the access thresholds configured list of all caching domain names, the access thresholds configuration row Record has the peak value multiple of the statistical value of the normal visitation frequency of domain name and the normal visitation frequency of domain name in table.