Method and apparatus for defending against DNS attack, and storage medium

A method for defending against a DNS attack, the method being performed by an apparatus for defending against the DNS attack, the method comprising:

• receiving a DNS request;
• obtaining a domain name in the DNS request;
• calculating a characteristic value of the domain name;
• obtaining identifier information corresponding to the characteristic value, from an internal memory that stores the characteristic value;
• obtaining request record information and an unblocking time that correspond to the characteristic value, the request record information including a number of request times from the domain name in a predetermined period, based on the identifier information corresponding to the characteristic value being a detection identifier indicating an uncertainty of an existence of an attack risk in the DNS request;
• determining that the DNS request is an attack request and discarding the DNS request, based on the number of request times exceeding a preset request threshold;
• and
• determining that the DNS request is the attack request and discarding the DNS request, based on the number of request times not exceeding the preset request threshold and a current time not reaching a preset unblocking time,
• wherein the obtaining request record information and the unblocking time further comprises:
• saving information included in the DNS request as the request record information, based on the request record information corresponding to the characteristic value in the internal memory being null;
• updating a request time of the DNS request in the request record information to a request time of a current DNS request and resetting the number of request times in the request record information to zero, based on the request record information in the internal memory not being null and a duration from the request time of the DNS request recorded in the request record information to the request time of the current DNS request exceeding the predetermined period;
• and
• updating the request time of the DNS request in the request record information to the request time of the current DNS request and increasing the number of request times in the request record information by one, based on the request record information in the internal memory not being null and the duration from the request time of the DNS request recorded in the request record information to the request time of the current DNS request not exceeding the predetermined period.

An apparatus for defending against a DNS attack comprising:

• at least one memory configured to store computer program code;
• and
• at least one processor configured to access the at least one memory and operate according to the computer program code, and the computer program code comprising:
• request obtaining code configured to cause the at least one processor to receive a DNS request sent by a request source and obtain an IP address of the request source that sends the DNS request;
• characteristic value determining code configured to cause the at least one processor to calculate a characteristic value of the IP address;
• first query code configured to cause the at least one processor to search an internal memory for preset identifier information corresponding to the characteristic value;
• second query code configured to cause the at least one processor to, based on the preset identifier information corresponding to the characteristic value being a detection identifier indicating an uncertainty of an existence of an attack risk in the DNS request, obtain request record information and an unblocking time corresponding to the characteristic value, the request record information comprising a number of request times from the request source in a predetermined period;
• number of request times judgment code configured to cause the at least one processor to determine whether the number of request times exceeds a preset request threshold;
• attack judgment code configured to cause the at least one processor to:
• based on the number of request times exceeding the preset request threshold, determine that the DNS request is an attack request,
• based on the number of request times not exceeding the preset request threshold and a current time not reaching a preset unblocking time, determine that the DNS request is the attack request;
• and
• defense code configured to cause the at least one processor to discard the DNS request,
• wherein the internal memory further comprises:
• request record information update code configured to cause the at least one processor to:
• based on the request record information corresponding to the characteristic value in the internal memory being null, save information included in the DNS request as the request record information;
• based on the request record information corresponding to the characteristic value in the internal memory not being null and a duration from a request time of the DNS request recorded in the request record information to a request time of a current DNS request exceeding the predetermined period, update the request time of the DNS request in the request record information to the request time of the current DNS request and reset the number of request times in the request record information to zero;
• and
• based on the request record information corresponding to the characteristic value in the internal memory not being null and the duration from the request time of the DNS request recorded in the request record information to the request time of the current DNS request not exceeding the predetermined period, update the request time of the DNS request in the request record information to the request time of the current DNS request and increase the number of request times in the request record information by one.