中国IDC产业度大典DNS安全防护新技术下课件

DNS平安防护新技术GuoQing5.19DNSISSUEHighlight域名解析效劳器所在IDC出口拥塞域名解析效劳器向上递归栈拥塞域名解析效劳器解析太多CPU高客户端后台进程不断查询导致性能慢免费DNSPOD>>60

江苏省常州市电信>>8

广西南宁市电信IDC机房>>

天津市网通>>60

江苏省常州市电信>>

天津市网通>>8

广西南宁市电信IDC机房BaoFengClientDNS

QueryCTDNSCacheBaofengQueryStatistics重点看display占比，这就是包含baofeng的包占总访问量的比例DNSrecursionDNS统计查询的采样–公众即可BindDNS的默认配置,支持1000并发递归扩内存可到10000递归需要翻开网络无续不存在域名查询sdsa.qqsdadsae.qqsadsa3232.qq发送的时候随机生成,攻击者要形成一个僵尸网络1个正常域名DNS查询所占用的Cache空间大概是4k议程DNS四大威胁DNS平安架构DNS5.19案例DNS专业防护DNS防护流程GlobalExceptionListPerMitigationBlack/WhiteListZombieRemovalTCPSYNAuthenticationDNSAuthenticationPayloadRegexFilteringBaselineEnforcementDNSMalformed(payloadcheckonly)SIPmalformed(payloadcheckonly)RateLimitingDNS平安白皮书DNS毒化防护原理DNS查询与回应统计DNS基线学习与查询统计排名DNSAuthenticationUsedtoblockrandomizedUDPDNSfloodsOnlyUDPrequestsonport53areinspectedDropsthefirstDNSrequest.Ifthehostre-transmitstherequest,theTMSmarksthehostasvalidandletstherequestthrough.Oncevalidated,allsubsequentDNSrequestsfromthathostpassthroughuntilnoDNSrequestsareseenfromthathostfortheauthenticationtimeoutperiod.Thetimeoutperiodisadjustable.Thedefaultis60seconds.Noblacklistingisdonewiththiscountermeasure.EnablingMalformedDNSSelectthischeckboxifyouwantthemitigationdevice(s)toautomaticallyfiltermalformedDNSrequestsMitigation-ThreatManagement-AddMitigationDNS攻击清洗专业DNS防护总结1.DNS查询源地址与域名统计与排名；RDNandFQDNReports:RequestTypeReport:FilteringDNSPackets2.DNS毒化独特DNS防御机制；3.DNS劫持指纹/ATF匹配技术；4.DNSRegularExpressions(RegEx)制定域名过滤；5.DNS认证与防欺骗Active/Passive模式；6.DNS查询限速