DNS query DDOS flooding mitigation using legitimate FQDN matching

1 . A computer-implemented method in a network security device, for flood mitigation of domain name system (DNS) queries using legitimate fully qualified domain name (FQDN) matching, the method comprising:

monitoring DNS queries to a DNS server, wherein a DNS query comprises a request to translate an FQDN into an Internet Protocol (IP) address;

validating and aging an FQDN of the DNS queries using digs of the DNS server;

building a table of legitimate FQDNs that have passed validation for use during flood conditions;

detecting flood conditions from exceeding a rate of DNS queries to the DNS server; and

responsive to the detected flood conditions, checking an FQDN of each DNS query against the table of legitimate FQDNs and:

allowing DNS queries having FQDNs that are verified as legitimate queries to pass to the DNS server; and

blocking DNS queries having FQDNs not verified as legitimate queries from passing to the DNS server.

2 . The method of claim 1 , wherein validation comprises capturing the FQDN from the DNS query and validating FQDN “in-band”.

3 . The method of claim 1 , wherein validation comprises capturing the FQDN from the DNS query and validating FQDN “out-of-band”.

4 . The method of claim 1 , further comprising: detecting an end to the flood conditions, and responsive to the detected end of the flood conditions, discontinuing the checking for FQDN.

5 . The method of claim 1 , wherein the rate of DNS queries is updated.

6 . The method of claim 1 , wherein aging of FQDNs occur without access to a time to live TTL set by the DNS server.

7 . The method of claim 1 , wherein validation is determined from a DNS response of the DNS server to a DNS query.

8 . A non-transitory computer-readable medium in a network security device, on a data communication network, storing code that when executed, performs a method for flood mitigation of domain name system (DNS) queries using legitimate fully qualified domain name (FQDN) matching, the method comprising:

monitoring DNS queries to a DNS server, wherein a DNS query comprises a request to translate an FQDN into an Internet Protocol (IP) address;

validating and aging an FQDN of the DNS queries;

building a table of legitimate FQDNs that have passed validation for use during flood conditions;

detecting flood conditions from exceeding a rate of DNS queries to the DNS server; and

responsive to the detected flood conditions, checking an FQDN of each DNS query against the table of legitimate FQDNs and:

allowing DNS queries having FQDNs that are verified as legitimate queries to pass to the DNS server; and

blocking DNS queries having FQDNs not verified as legitimate queries from passing to the DNS server.

9 . A network security device, on a data communication network, for flood mitigation of domain name system (DNS) queries using legitimate fully qualified domain name (FQDN) matching, the network security device comprising:

a processor;

a network interface communicatively coupled to the processor and to a data communication network; and

a memory, communicatively coupled to the processor and storing:

a DNS monitor module to monitor DNS queries to a DNS server, wherein a DNS query comprises a request to translate an FQDN into an Internet Protocol (IP) address;

an FQDN validation module to validate and age an FQDN of the DNS queries;

a dynamic FQDN legitimacy module to build a table of legitimate FQDNs that have passed validation for use during flood conditions;

a flood detector to detect flood conditions from a rate of DNS queries to the DNS server; and

an FQDN blocker to, responsive to the detected flood conditions, check an FQDN of each DNS query against the table of legitimate FQDNs and:

allow DNS queries having FQDNs that are verified as legitimate queries to pass to the DNS server; and

block DNS queries having FQDNs not verified as legitimate queries from passing to the DNS server.