基于层次分析法的域名系统安全状况评估

域名系统是互联网基础信息设施中的重要组成部分.但是,近年来利用域名系统的脆弱环节来进行攻击的事件层出不穷.因此,准确评估域名系统的运行情况和安全状况对互联网的安全保护工作至关重要.第二届关于 DNS (Domain Name System) 安全性、稳定性和弹性的讨论会报告已经指出了 DNS 健康的一些关键指标.在此基础上,MeNSa (Measuring the Naming System) 项目又对这些指标进行了补充,并且提出了得到 DNS 健康指标的评估框架,但是他们没有给出通过监控项的值计算健康指标的可行权重设置算法.因此本文提出了使用 AHP 算法 (Analytic Hierarchy Process)来设置健康指标的权重,通过实验验证发现该算法很好的试用于该应用,并且当监控项增加时算法仍有效,具有良好的扩展性.

Measuring the Health of Domain Name System Based on Analytic Hierarchy Process

Domain Name System (DNS) is the foundation of modern cyber-world. Recently, the attacks that taken advantage of the weaknesses of DNS posed serious problems on DNS health and security. Measuring the health and security is significantly important. A first official discussion on indexes to measure DNS SSR is contained in the report of the 2nd Symposium on DNS SSR. The meeting proposed five key indexes to determine if the DNS is healthy. The MeNSa (Measuring the Naming System) project proposed a framework to quantify the key indexes of DNS health and security and defined of a set of health and security metrics. However, how to decide the weights of the metrics is an unsolved key issue for the DNS security evaluation. In this paper, we propose an AHP based scheme to calculate the weights and present the corresponding experimental results.