Network attack defense method based on dns intelligent analysis system

Abstract

The invention provides a network attack defense method based on a DNS intelligent analysis system. The network attack defense method comprises the steps: collecting network service requests, and respectively distributing corresponding subdomain names for different network service requests; judging whether a subdomain name exists in an attack subdomain name blacklist database, if so, rejecting the network service request and if not, performing IP region analysis on the network service request to obtain the corresponding IP region; judging whether the IP region exists in an attack IP subdomain name blacklist database, if so, rejecting the network service request and if not, filtering the network service request to obtain the request information; judging whether the request information exists in an attack mode database; if so, determining that the request information is an attack request and rejecting the network service request; and if not, allowing normal operation of the network service request. The network attack defense method based on a DNS intelligent analysis system can individually analyze the attack request after completing quick distribution of attack and normal requests, and can reduce resource consumption for identification of request modes.

Description

technical field [0001] The invention relates to a network attack defense method, in particular to a network attack defense method based on a DNS intelligent resolution system. Background technique [0002] With the development of computer network technology, the popularity of computer network has increased rapidly, but it has also brought about network security problems while improving resource sharing. With the development of network attack technology, computer network security is also facing a great threat. For the main types of Dos denial of service attacks, program attacks, electronic spoofing attacks, and attacks on network protocol weaknesses, there are relatively mature network attack defense methods. However, the existing defense methods have relatively large disadvantages: [0003] 1. Different services often use the same domain name or even device port; [0004] 2. The network attack defense equipment has already consumed the access bandwidth when an attack is d...

AI Technical Summary

Problems solved by technology

[0005] 3. It is necessary to use expensive seventh-layer equipment to deeply analyze the data packets before distinguishing between attack requests and normal requests, which increases the cost of data cleaning;

[0006] 4. The difference between attack requests and normal requests often requires manual analysis, and the deployment of defenses takes a long time to take effect

Images