域名系统(domain name system,DNS)是互联网的核心基础设施,其解析可靠性直接影响网络服务的可用性与用户体验。然而,随着DNS的功能扩展与体系结构复杂度的增加,DNS解析失败日益频发。现有针对DNS解析失败的研究较为碎片化,缺乏系统性...域名系统(domain name system,DNS)是互联网的核心基础设施,其解析可靠性直接影响网络服务的可用性与用户体验。然而,随着DNS的功能扩展与体系结构复杂度的增加,DNS解析失败日益频发。现有针对DNS解析失败的研究较为碎片化,缺乏系统性的归纳与方法论支撑。鉴于此,从协议实施缺陷、配置错误、域名滥用、网络与管理问题4个维度提出分类归因框架,系统地刻画了DNS解析失败的成因与特征。基于该框架,结合互联网工程任务组发布的请求评议标准与典型案例,提出了协议一致性测试、自动化配置校验、域名信誉评分、高可用部署架构等缓解思路,为DNS故障诊断和防护提供系统化的分析视角与实践参考。展开更多
With the widespread adoption of encrypted Domain Name System(DNS)technologies such as DNS over Hyper Text Transfer Protocol Secure(HTTPS),traditional port and protocol-based traffic analysis methods have become ineffe...With the widespread adoption of encrypted Domain Name System(DNS)technologies such as DNS over Hyper Text Transfer Protocol Secure(HTTPS),traditional port and protocol-based traffic analysis methods have become ineffective.Although encrypted DNS enhances user privacy protection,it also provides concealed communication channels for malicious software,compelling detection technologies to shift towards statistical featurebased and machine learning approaches.However,these methods still face challenges in real-time performance and privacy protection.This paper proposes a real-time identification technology for encrypted DNS traffic with privacy protection.Firstly,a hierarchical architecture of cloud-edge-end collaboration is designed,incorporating task offloading strategies to balance privacy protection and identification efficiency.Secondly,a privacy-preserving federated learning mechanismbased on Federated Robust Aggregation(FedRA)is proposed,utilizingMedoid aggregation and differential privacy techniques to ensure data privacy and enhance identification accuracy.Finally,an edge offloading strategy based on a dynamic priority scheduling algorithm(DPSA)is designed to alleviate terminal burden and reduce latency.Simulation results demonstrate that the proposed technology significantly improves the accuracy and realtime performance of encrypted DNS traffic identification while protecting privacy,making it suitable for various network environments.展开更多
Domain name system(DNS)tunneling attacks can bypass firewalls,which typically“trust”DNS transmissions by concealing malicious traffic in the packets trusted to convey legitimate ones,thereby making detection using c...Domain name system(DNS)tunneling attacks can bypass firewalls,which typically“trust”DNS transmissions by concealing malicious traffic in the packets trusted to convey legitimate ones,thereby making detection using conventional security techniques challenging.To address this issue,we propose a Lebesgue-2 regularized multilayer perceptron(L2R-MLP)algorithm for detecting DNS tunneling attacks.The DNS dataset was carefully curated from a publicly available repository,and relevant features,such as packet size and count,were selected using the recusive feature elimination technique.L2 regularization in the MLP classifier's hidden layers enhances pattern recognition during training,effectively countering the risk of overfitting.When evaluated against a benchmark MLP model,L2R-MLP demonstrated superior performance with 99.46%accuracy,97.00%precision,97.00%F1-score,99.95%recall,and an AUC of 89.00%.In comparison,the benchmark MLP achieved 92.53%accuracy,96.00%precision,97.00%F1-score,99.95%recall,and an AUC of 87.00%.This highlights the effectiveness of L2 regularization in improving predictive capabilities and model generalization for unseen instances.展开更多
域名系统(Domain Name System,DNS)是互联网中用于将域名解析为IP地址的重要服务,DNS覆盖了绝大多数网络活动场景。关键信息基础设施涉及国家安全和社会稳定,其网络服务的正常运行依赖于DNS解析的完整性。DNS攻击不仅会导致服务中断,还...域名系统(Domain Name System,DNS)是互联网中用于将域名解析为IP地址的重要服务,DNS覆盖了绝大多数网络活动场景。关键信息基础设施涉及国家安全和社会稳定,其网络服务的正常运行依赖于DNS解析的完整性。DNS攻击不仅会导致服务中断,还可能窃取敏感信息,严重威胁关键信息基础设施的安全。因此,研究关键信息基础设施面临的DNS攻击威胁及其防范措施十分必要。文章梳理了DNS攻击的类型及其危害,深入分析了DNS攻击对关键信息基础设施的威胁,并提出了技术与管理协同的纵深防御体系,以期为保障关键信息基础设施的安全稳定运行提供参考。展开更多
域名解析系统(Domain Name System,DNS)是互联网的核心组成部分,负责将域名转化为对应的IP地址。根、顶级域等权威服务器和本地域名服务器(Local DNS,LDNS)共同组成了DNS服务系统,其稳定运行直接关系到全球网络服务的可用性与安全性。基...域名解析系统(Domain Name System,DNS)是互联网的核心组成部分,负责将域名转化为对应的IP地址。根、顶级域等权威服务器和本地域名服务器(Local DNS,LDNS)共同组成了DNS服务系统,其稳定运行直接关系到全球网络服务的可用性与安全性。基于20多年的运维经验,笔者提出构建新型域名解析运营体系,理顺域名所有者、运营者和秩序管理者的责权利关系,以期更好地支撑新型互联网业务的创新发展和网络的稳定运行。展开更多
文摘域名系统(domain name system,DNS)是互联网的核心基础设施,其解析可靠性直接影响网络服务的可用性与用户体验。然而,随着DNS的功能扩展与体系结构复杂度的增加,DNS解析失败日益频发。现有针对DNS解析失败的研究较为碎片化,缺乏系统性的归纳与方法论支撑。鉴于此,从协议实施缺陷、配置错误、域名滥用、网络与管理问题4个维度提出分类归因框架,系统地刻画了DNS解析失败的成因与特征。基于该框架,结合互联网工程任务组发布的请求评议标准与典型案例,提出了协议一致性测试、自动化配置校验、域名信誉评分、高可用部署架构等缓解思路,为DNS故障诊断和防护提供系统化的分析视角与实践参考。
文摘With the widespread adoption of encrypted Domain Name System(DNS)technologies such as DNS over Hyper Text Transfer Protocol Secure(HTTPS),traditional port and protocol-based traffic analysis methods have become ineffective.Although encrypted DNS enhances user privacy protection,it also provides concealed communication channels for malicious software,compelling detection technologies to shift towards statistical featurebased and machine learning approaches.However,these methods still face challenges in real-time performance and privacy protection.This paper proposes a real-time identification technology for encrypted DNS traffic with privacy protection.Firstly,a hierarchical architecture of cloud-edge-end collaboration is designed,incorporating task offloading strategies to balance privacy protection and identification efficiency.Secondly,a privacy-preserving federated learning mechanismbased on Federated Robust Aggregation(FedRA)is proposed,utilizingMedoid aggregation and differential privacy techniques to ensure data privacy and enhance identification accuracy.Finally,an edge offloading strategy based on a dynamic priority scheduling algorithm(DPSA)is designed to alleviate terminal burden and reduce latency.Simulation results demonstrate that the proposed technology significantly improves the accuracy and realtime performance of encrypted DNS traffic identification while protecting privacy,making it suitable for various network environments.
文摘Domain name system(DNS)tunneling attacks can bypass firewalls,which typically“trust”DNS transmissions by concealing malicious traffic in the packets trusted to convey legitimate ones,thereby making detection using conventional security techniques challenging.To address this issue,we propose a Lebesgue-2 regularized multilayer perceptron(L2R-MLP)algorithm for detecting DNS tunneling attacks.The DNS dataset was carefully curated from a publicly available repository,and relevant features,such as packet size and count,were selected using the recusive feature elimination technique.L2 regularization in the MLP classifier's hidden layers enhances pattern recognition during training,effectively countering the risk of overfitting.When evaluated against a benchmark MLP model,L2R-MLP demonstrated superior performance with 99.46%accuracy,97.00%precision,97.00%F1-score,99.95%recall,and an AUC of 89.00%.In comparison,the benchmark MLP achieved 92.53%accuracy,96.00%precision,97.00%F1-score,99.95%recall,and an AUC of 87.00%.This highlights the effectiveness of L2 regularization in improving predictive capabilities and model generalization for unseen instances.
文摘域名系统(Domain Name System,DNS)是互联网中用于将域名解析为IP地址的重要服务,DNS覆盖了绝大多数网络活动场景。关键信息基础设施涉及国家安全和社会稳定,其网络服务的正常运行依赖于DNS解析的完整性。DNS攻击不仅会导致服务中断,还可能窃取敏感信息,严重威胁关键信息基础设施的安全。因此,研究关键信息基础设施面临的DNS攻击威胁及其防范措施十分必要。文章梳理了DNS攻击的类型及其危害,深入分析了DNS攻击对关键信息基础设施的威胁,并提出了技术与管理协同的纵深防御体系,以期为保障关键信息基础设施的安全稳定运行提供参考。
文摘域名解析系统(Domain Name System,DNS)是互联网的核心组成部分,负责将域名转化为对应的IP地址。根、顶级域等权威服务器和本地域名服务器(Local DNS,LDNS)共同组成了DNS服务系统,其稳定运行直接关系到全球网络服务的可用性与安全性。基于20多年的运维经验,笔者提出构建新型域名解析运营体系,理顺域名所有者、运营者和秩序管理者的责权利关系,以期更好地支撑新型互联网业务的创新发展和网络的稳定运行。
