基于信息熵的DNS拒绝服务攻击的检测研究  

Research on Exploiting DoS Attack Against DNS Based on Information Entropy

作　　者：严芬[1] 丁超[1] 殷新春[1] 

机构地区：[1]扬州大学信息工程学院,扬州225127

出　　处：《计算机科学》2015年第3期140-143,共4页Computer Science

摘　　要：DNS服务器在Internet中具有至关重要的作用,对它进行攻击会影响网络向用户提供正常的服务。DNS Query Flood攻击是最为常见的一种攻击方式,它向DNS服务器发送大量伪造的域名解析请求,消耗DNS服务器的资源,造成拒绝服务。及时检测到此类攻击的存在至关重要。在研究DNS解析过程的基础上,总结DNS Query Flood攻击的特点;根据攻击的特点,结合信息熵来判断网络是否出现异常;利用滑动窗口机制来确定是否存在攻击。DNS server has a vital role in the Internet,and it will affect the network to provide normal services to users if DNS is attacked.DNS Query Flood attack sends a lot of fake DNS request to the DNS server,consumes the DNS server resources and causes denial of service.So it is very important to detect timely the attack.Based on the study of the DNS resolution process,we summed up the characteristics of the DNS Query Flood attack.According to the characteristics of attack,we combined the information entropy to determine whether a network abnormalities,and then used sliding window mechanism to determine whether there is any attack.

关 键 词：DNS QUERY Flood 拒绝服务 域名解析成功率 信息熵 滑动窗口 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]