Method, device and system for processing DNS behavior

1. A method for processing Domain Name System (DNS) behavior, comprising:

parsing a received network data packet;

determining a DNS behavior type corresponding to the network data packet according to a parse result;

determining a processing body according to the DNS behavior type, wherein the processing body comprises at least one of a kernel and an application layer;

transferring the network data packet to the determined processing body;

processing the network data packet by the determined processing body, wherein the processing the network data packet by the determined processing body further comprises: when the determined processing body is the kernel,

detecting the network data packet and filtering a DNS attack behavior carried in the network data packet by the kernel, and

transferring the filtered network data packet to the application layer for processing;

wherein the method further comprises following steps to determine that the DNS attack behavior is carried in the network data packet:

calculating a feature code of the network data packet;

judging whether the feature code is a feature code of the DNS attack behavior;

if yes, then determining that the DNS attack behavior is carried in the network data packet; and

if not, then determining that the DNS attack behavior is not carried in the network data packet.

2. The method according to claim 1 , wherein the step of determining a processing body according to the DNS behavior type, comprises:

when the DNS behavior type is an attack behavior, determining the processing body to be the kernel; and

when the DNS behavior type is a domain name resolution behavior, determining the processing body to be the application layer.

3. The method according to claim 1 , wherein the feature code comprises:

a number of received network data packets from one IP within a designated period; and

a number of received network data packets from one domain name within a designated period.

4. The method according to claim 1 , wherein after the transferring the filtered network data packet to the application layer for processing, the method further comprises:

when a root node or other corresponding domain name resolution is abnormal, constructing a virtual root system by an authorization database through a BGP Anycast mode, and guiding all visits to a root domain name server to a virtual root domain node server to externally provide DNS resolution services.

5. The method according to claim 4 , wherein when a DNS server fails and is unable to be repaired in time, the DNS of a user is repaired onto a resolvable safe DNS, so as to ensure that the user on network is able to use the network; and

after the failure of the DNS server is repaired, the DNS configuration of the user is restored onto the DNS server.

6. A computing device, comprising:

a memory having instructions stored thereon;

a processor configured to execute the instructions to perform operations for processing Domain Name System (DNS) behavior, the operations comprising:

parsing a received network data packet;

determining a DNS behavior type corresponding to the network data packet according to a parse result;

determining a processing body according to the DNS behavior type, wherein the processing body comprises at least one of a kernel and an application layer;

transferring the network data packet to the determined processing body;

processing the network data packet by the determined processing body;

wherein the processor is further configured to execute instructions to perform following operations so as to determine that a DNS attack behavior is carried in the network data packet:

calculating a feature code of the network data packet;

judging whether the feature code is a feature code of the DNS attack behavior;

if yes, then determining that the DNS attack behavior is carried in the network data packet; and

if not, then determining that the DNS attack behavior is not carried in the network data packet.

7. The computing device according claim 6 , wherein the determining a processing body according to the DNS behavior type further comprises:

when the DNS behavior type is an attack behavior, determining the processing body to be kernel; and

when the DNS behavior type is a domain name resolution behavior, determining the processing body to be the application layer.

8. The computing device according claim 7 , wherein the feature code comprises:

a number of received network data packets from one IP within a designated period; and

a number of received network data packets from one domain name within a designated period.

9. A non-transitory computer readable medium having computer programs stored thereon that, when executed by one or more processors of a computing device, cause the computing device to perform:

parsing a received network data packet;

determining a Domain Name System (DNS) behavior type corresponding to the network data packet according to a parse result;

determining a processing body according to the DNS behavior type, wherein the processing body comprises at least one of a kernel and an application layer;

transferring the network data packet to the determined processing body;

processing the network data packet by the determined processing body, wherein the processing the network data packet by the determined processing body further comprises: when the determined processing body is the kernel,

detecting the network data packet and filtering a DNS attack behavior carried in the network data packet by the kernel, and

transferring the filtered network data packet to the application layer for processing;

wherein the non-transitory computer readable medium further comprises computer programs stored thereon that, when executed by one or more processors of a computing device, cause the computing device to perform following steps to determine that the DNS attack behavior is carried in the network data packet:

calculating a feature code of the network data packet;

judging whether the feature code is a feature code of the DNS attack behavior;

if yes, then determining that the DNS attack behavior is carried in the network data packet; and

if not, then determining that the DNS attack behavior is not carried in the network data packet.

10. The non-transitory computer readable medium according to claim 9 , wherein the determining a processing body according to the DNS behavior type, comprises:

when the DNS behavior type is an attack behavior, determining the processing body to be the kernel; and

when the DNS behavior type is a domain name resolution behavior, determining the processing body to be the application layer.

11. The non-transitory computer readable medium according to claim 9 , wherein the feature code comprises:

a number of received network data packets from one IP within a designated period; and

a number of received network data packets from one domain name within a designated period.

12. The non-transitory computer readable medium according to claim 9 , wherein after the transferring the filtered network data packet to the application layer for processing, the computing device is further caused to perform:

when a root node or other corresponding domain name resolution is abnormal, constructing a virtual root system by an authorization database through a BGP Anycast mode, and guiding all visits to a root domain name server to a virtual root domain node server to externally provide DNS resolution services.

13. The non-transitory computer readable medium according to claim 12 , wherein when a DNS server fails and is unable to be repaired in time, the DNS of a user is repaired onto a resolvable safe DNS, so as to ensure that the user on network is able to use the network; and

after the failure of the DNS server is repaired, the DNS configuration of the user is restored onto the DNS server.