<commit_before>  This implements a mitigation of random subdomain attack
against DNS resolver using bloomfilter.

  When DNS resolver operators suffers from random subdomain attack
they often block all queries for victim.com at their resolvers.
It mitigates attack effectively but the resolver no longer
resolves victim.com. 

  This patch for unbound adds a new blocking mode "softblock".
It learns QNAMEs resulted in NOERROR using bloomfilter at all time, and
if you applied a domain to softblock and unbound receives queries
for this domain it accepts only QNAMEs whose result was NOERROR in past.
So it will effectively refuses only bad random queries
(result will be cache miss and NXDOMAIN).

# To Enabe softblock bloomfilter learning

  set these options in unbound.conf:

`softblock-bf-size`

  Size of bloomfilter's bitfield (in bytes). You need 9.6 bits
  per one NOERROR QNAMEs under 1% false positive.
  i.e. 1 billion (1,000,000,000) QNAMEs needs 1.2g

`softblock-interval`

  BF is reset every this interval (in seconds).
  
## unbound.conf example
    server:
      softblock-bf-size: 1024m
      softblock-interval: 86400


# Protecting unbound from damage caused by random subdomain attack

    $ unbound-control local_zone victim.com softblock
  
  victim.com is a domain which is under random subdomain attack.
<commit_msg>explained detail of softblock<commit_after>  This implements a mitigation of random subdomain attack
against DNS resolver using bloomfilter.

  When DNS resolver operators suffers from random subdomain attack
they often block all queries for victim.com at their resolvers.
It mitigates attack effectively but the resolver no longer
resolves victim.com. 

  This patch for unbound adds a new blocking mode "softblock".
It learns QNAMEs resulted in NOERROR using bloomfilter at all time, and
if you applied a domain to softblock and unbound receives queries
for this domain, it accepts only QNAMEs whose result was NOERROR in past.
So it will effectively refuses only bad random queries
(result will be cache miss and NXDOMAIN).

# To Enable softblock bloomfilter learning

  set these options in unbound.conf:

`softblock-bf-size`

  Size of bloomfilter's bitfield (in bytes). You need 9.6 bits
  per one NOERROR QNAMEs under 1% false positive.
  i.e. 1 billion (1,000,000,000) QNAMEs needs 1.2g

`softblock-interval`

  BF is reset every this interval (in seconds).
  
## unbound.conf example
    server:
      softblock-bf-size: 1024m
      softblock-interval: 86400


# Protecting unbound from damage caused by random subdomain attack

    $ unbound-control local_zone victim.com softblock
  
  victim.com is a domain which is under random subdomain attack.

{'fraction_non_alphanumeric': 0.04404145077720207, 'fraction_numerical': 0.018504811250925242, 'mean_word_length': 4.0241635687732344, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4342867', 'n_tokens_mistral': 802, 'n_tokens_neox': 723, 'n_words': 365}