DNS (Domain Name Server) safety monitoring system and method

Abstract

The invention discloses a DNS (Domain Name Server) safety monitoring system and method of a domain name resolution system. The DNS safety monitoring system comprises a data acquisition module and an event analysis module, wherein the data acquisition module is used for acquiring the network data of a DNS and providing the network data to the event analysis module; and the event analysis module isused for analyzing the network data and generating a monitoring result. The system and the method can be used for preventing network attacks such as domain name hijacks, site phishing, zombie attacks, and the like and improving the running stability and reliability of the DNS.

Description

technical field [0001] The invention relates to the technical field of data services, in particular to a DNS security monitoring system and method. Background technique [0002] Domain Name System (DNS, Domain Name System) is a key component of the Internet (Internet) architecture, and its performance and security are crucial to the application of the Internet. How to improve the security level of DNS server on the premise of ensuring its performance has become a key issue. [0003] As far as DNS security is concerned, traditional means only consider the security protection of the DNS server itself, such as using a firewall or an Intrusion Prevention System (Intrusion Prevention System, IPS) to protect the DNS. However, the firewall does not have the function of checking and filtering the application layer protocol, and cannot respond to DNS attacks. In other words, since the firewall does not have a deep packet inspection mechanism, it is useless to DNS attacks. Furtherm...

AI Technical Summary

Problems solved by technology

However, the firewall does not have the function of checking and filtering the application layer protocol, and cannot respond to DNS attacks

In other words, since the firewall does not have a deep packet inspection mechanism, it is useless to DNS attacks

Furthermore, the current IPS attack prevention method is mainly to defend against attack intrusion and distributed denial of service (Distribution Denial of service, DDOS) attacks by querying the attack signature database, but most IPSs do not include the DNS attack signature database

In other words, traditional firewalls / IPS are not fully suitable for protecting the security of the DNS architecture

[0004] In addition, the DNS server itself will also pose certain security risks, such as buffer pool pollution, data tampering and user requests being directed to phishing websites, etc., and these problems are more hidden

Without a third-party detection method, the DNS server cannot judge whether its own resolution result is correct

[0005] It can be seen that if we want to ensure that DNS becomes a stable part of the Internet architecture, the current security protection for DNS is not enough

Images