用DNS進行網絡度量和安全分析

{"type":"doc","content":[{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"背景"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"今天爲大家推薦由360網絡安全研究院-安全分析資深專家分享的議題《用DNS進行網絡度量和安全分析》，本課題簡要闡述了DNS協議的歷史和發展現狀，在此基礎上，結合360網絡安全研究院的多年分析DNS數據的經驗，介紹了我們利用DNS數據做過的一些關於大網方面的度量，並結合公司多維度的海量數據做的安全分析方面的一些工作。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"DNS概述"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"DNS協議對互聯網的從業者來說並不陌生，它是互聯網的最古老也是最基礎和最核心的協議之一。簡單來說的話，它最主要的功能是完成域名和IP地址的映射，即互聯網的電話簿。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"但DNS協議能夠完成的功能遠遠不止於完成域名和IP地址的映射，很多現代互聯網的基礎業務都要基於DNS協議才能夠完成，可以認爲跟域名相關的業務幾乎都和DNS協議有關。根據dns-camel項目[1]統計，截止到2019年6月，共有150篇標準，建議，最佳實踐方面的RFC，共有2637頁，非常龐雜的內容。所以DNS協議實際的複雜度超出了大多數人對其的理解。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"下圖顯示了DNS協議相關的RFC頁數從1984年到2019年的變化量，可以看到從1996年開始，幾乎以每四年500頁的速度在穩定增加。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.infoq.cn\/resource\/image\/90\/9c\/90bd21f78727c29e69768da8d42c2f9c.png","alt":null,"title":"","style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":"","fromPaste":false,"pastePass":false}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}}]}