基于Sketch的重要DNS查询缓存方法

郝逸航; 刘紫千; 常力元; 佟欣哲; 杨成; 孙琦; 郭俊言

doi:10.11959/j.issn.2096-109x.2024069

您当前的位置：

首页 >

文章列表页 >

基于Sketch的重要DNS查询缓存方法

专题：互联网域名安全 | 更新时间：2024-12-20

- 基于Sketch的重要DNS查询缓存方法
- Sketch-based caching method for significant DNS queries
- 网络与信息安全学报 2024年10卷第5期页码：95-106
- 作者机构：
  
  1.中国电信股份有限公司，北京 100001
  2.天翼安全科技有限公司，江苏苏州 215131
- 作者简介：
  
  [ "郝逸航（1998- ），男，天津人，主要研究方向为网络流量安全、递归解析安全、机器学习。" ]
  [ "刘紫千（1979- ），男，湖南长沙人，博士，中国电信股份有限公司高级工程师，主要研究方向为路由安全、递归解析域名安全。" ]
  [ "常力元（1984- ），男，吉林吉林人，博士，中国电信股份有限公司高级工程师，主要研究方向为软件安全、递归解析域名安全、5G关键技术。" ]
  [ "佟欣哲（1981- ），男，辽宁沈阳人，中国电信股份有限公司副高级工程师，主要研究方向为流量安全、递归解析域名安全。" ]
  [ "杨成（1984- ），男，辽宁葫芦岛人，中国电信股份有限公司中级工程师，主要研究方向为网络流量编排、递归解析安全。" ]
  [ "孙琦（1985- ），男，山东淄博人，主要研究方向为递归解析安全、深度报文分析。" ]
  [ "郭俊言（1990- ），河北承德人，博士，主要研究方向为新型密码算法设计、隐私保护、国产密码算法应用、域名安全、天地一体网络。" ]
- 基金信息：
  
  国家重点研发计划(2022YFB3103004)
- DOI：10.11959/j.issn.2096-109x.2024069
  中图分类号： TP393
- 收稿：2024-05-09，
  
  修回：2024-08-16，
  
  纸质出版：2024-10-25
- 稿件说明：
移动端阅览
郝逸航, 刘紫千, 常力元, 等. 基于Sketch的重要DNS查询缓存方法[J]. 网络与信息安全学报, 2024, 10(5): 95-106.

Format: HAO Y H, LIU Z Q, CHANG L Y, et al. Sketch-based caching method for significant DNS queries[J]. Chinese Journal of Network and Information Security, 2024, 10(5): 95-106.
郝逸航, 刘紫千, 常力元, 等. 基于Sketch的重要DNS查询缓存方法[J]. 网络与信息安全学报, 2024, 10(5): 95-106. DOI： 10.11959/j.issn.2096-109x.2024069.

Format: HAO Y H, LIU Z Q, CHANG L Y, et al. Sketch-based caching method for significant DNS queries[J]. Chinese Journal of Network and Information Security, 2024, 10(5): 95-106. DOI： 10.11959/j.issn.2096-109x.2024069.

摘要

在网络信息技术快速发展背景下，域名系统作为互联网应用的入口，其性能和安全对网络服务的质量尤为关键。然而，从缓存的角度来看，当前域名解析器的域名缓存项管理机制尚不完善。为此，提出了一种基于Sketch技术的域名缓存管理方法，创新地引入了“重要度”评估指标，将网络测量方法应用于缓存管理，实现对缓存项的时间和频率两方面特征的综合度量，满足动态划定重要域名需求。实验结果表明，该缓存方法能够从真实网络环境产生的海量域名查询请求中，针对性地将重要域名添加到缓存予以保护，平均解析时间相比现有域名缓存解决方案减少超过18%。所提方法不仅能够对域名缓存实施更灵活的操作，提高域名系统的用户侧可用性和管理侧可维护性，更为域名缓存管理的研究提供了新的视角和解决方案。

Abstract

With the rapid advancement of networking technology

DNS (domain name system)

acting as the first step for most network behaviors

plays a vital role in assuring service quality through its capability and security. However

the current DNS resolvers lack effective mechanisms for cache item protection and eviction. Addressing this lacuna

a method for DNS cache oversight based on the principles of sketch technology was proposed. "Significance" was elegantly integrated as a novel evaluative indicator

and network measurement strategies were adopted into cache management. Consequently

a holistic benchmark that encapsulated both temporal and frequency characteristics for dynamically demarcating items’ significance was culminated. The experimental results

which were based on a substantial amount of real-world network traffic data

demonstrated that the proposed method offered protection for significant domain names

hastening their resolution by an average of 18% relative to conventional DNS paradigms. The usability for end-users was augmented by this strategy

as was the maintainability for Internet Service Providers (ISPs)

while the scope for ongoing research in the realm of DNS cache management was simultaneously expanded.

关键词

Keywords

references

胡宁 , 邓文平 , 姚苏 . 互联网DNS安全研究现状与挑战 [J ] . 网络与信息安全学报 , 2017 , 3 ( 3 ): 13 - 21 .

HU N , DENG W P , YAO S . Issues and challenges of internet DNS security [J ] . Chinese Journal of Network and Information Security , 2017 , 3 ( 3 ): 13 - 21 .

王文通，胡宁，刘波，等 . DNS安全防护技术研究综述 [J ] . 软件学报 , 2020 , 31 ( 7 ): 2205 - 2220 .

WANG W T , HU N , LIU B , et al . Survey on technology of security enhancement for DNS [J ] . Journal of Software , 2020 , 31 ( 7 ): 2205 - 2220 .

O’NEIL E J , O’NEIL P E , WEIKUM G . The LRU-K page replacement algorithm for database disk buffering [J ] . ACM SIGMOD Record , 1993 , 22 ( 2 ): 297 - 306 .

PERDISCI R , ANTO M , LUO X , et al . WSEC DNS: protecting recursive DNS resolvers from poisoning attacks [C ] // International Conference on Dependable Systems & Networks . IEEE/IFIP , 2009 : 3 - 12 .

戴冕 , 程光 . 基于Sketch的软件定义测量数据平面硬件模型 [J ] . 通信学报 , 2017 , 38 ( 10 ): 113 - 121 .

DAI M , CHENG G . Sketch-based data plane hardware model for software-defined measurement [J ] . Journal on Communications , 2017 , 38 ( 10 ): 113 - 121 .

冯辉 . 基于Sketch结构的网络流量测量方法研究 [D ] . 济南 : 山东大学 , 2021 .

FENG H . Research on network traffic measurement methods based on sketch structure [D ] . Jinan : Shandong University , 2021 .

COHEN E , KAPLAN H . Proactive caching of DNS records: addressing a performance bottleneck [J ] . Computer Networks , 2003 , 41 ( 6 ): 707 - 726 .

CHEN X , WANG H N , REN S , et al . DNScup: strong cache consistency protocol for DNS [C ] // Proceedings of the 26th IEEE Interna-tional Conference on Distributed Computing Systems . IEEE , 2006 : 40 - 49 .

CHEN C , MATSUMOTO S , PERRIG A . ECO-DNS: expected consistency optimization for DNS [C ] // Proceedings of the 35th International Conference on Distributed Computing Systems . IEEE , 2015 : 256 - 267 .

HAO S , WANG H N . Exploring domain name based features on the effectiveness of DNS caching [J ] . ACM SIGCOMM Computer Communication Review , 2017 , 47 ( 1 ): 36 - 42 .

Yu G , Zhang Y , Cui H , et al . Mitigating negative impacts on DNS caches caused by disposable domain names [C ] // Proceedings of the Symposium on Computers and Communications . IEEE , 2019 : 1 - 6 .

YAN Z , HU A , WANG W . A cache-splitting scheme for DNS recursive server [C ] // Proceedings of the 2nd International Conference on Cloud Computing and Intelligence Systems . IEEE , 2012 : 1267 - 1271 .

YU H S , LIU Y , DUAN L H , et al . Cache top-level domain locally: make DNS respond quickly in mobile network [C ] // Proceedings of the International Conference on Trust, Security and Privacy in Computing and Communications . IEEE , 2022 : 1205 - 1210 .

YANG T , JIANG J , LIU P , et al . Adaptive measurements using one elastic sketch [J ] . IEEE/ACM Transactions on Networking , 2019 , ( 99 ): 1 - 16 .

CORMODE G , MUTHUKRISHNAN S . An improved data stream summary: the count-min sketch and its applications [J ] . Journal of Algorithms , 2005 , 55 ( 1 ): 58 - 75 .

ZHONG Z , YAN S , LI Z , et al . BurstSketch: finding bursts in data streams [C ] // Proceedings of the International Conference on Management of Data . ACM , 2021 : 2375 - 2383 .

ZHOU Y , YANG T , JIANG J , et al . ColdFilter: a meta-framework for faster and more accurate stream processing [C ] // Proceedings of the International Conference on Management of Data . ACM , 2018 : 741 - 756 .

LI J , LI Z , XU Y , et al . WavingSketch: an unbiased and generic sketch for finding top-k items in data streams [C ] // Proceedings of the 26th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . ACM , 2020 : 1574 - 1584 .

CHENG S , YANG D , YANG T , et al . LTC: a fast algorithm to accurately find significant items in data streams [J ] . IEEE Transactions on Knowledge and Data Engineering , 2022 , 34 ( 9 ): 4342 - 4356 .

KUMAR A , SUNG M , XU J , et al . Data streaming algorithms for efficient and accurate estimation of flow size distribution [J ] . ACM SIGMETRICS Review , 2004 , 32 ( 1 ): 177 - 188 .

JAEYEON J , SIT E , BALAKRISHNAN H , et al . DNS performance and the effectiveness of caching [J ] . IEEE/ACM Trans-actions on Networking , 2002 , 10 ( 5 ): 589 - 603 .

YANG T , ZHANG H , YANG D , et al . Finding significant items in data streams [C ] // Proceedings of the 35th International Conference on Data Engineering . IEEE , 2019 : 1394 - 1405 .

STEIN E M , SHAKARCHI R . Princeton lectures in analysis [M ] . Princeton University Press Princeton , 2003 .

MAN K , QIAN Z , WANG Z , et al . DNS cache poisoning attack reloaded: revolutions with side channels [C ] // Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security . ACM , 2020 : 1337 - 1350 .

BARCELÓ-ARMADA R , CASTELL-UROZ I , BARLET-ROS P . Amazon Alexa traffic traces [J ] . Computer Networks , 2022 , 205 : 108782 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据