CN105812378A - Access request processing method and device - Google Patents

Abstract

The disclosure relates to an access request processing method and device, and belongs to the field of network technology. The method includes: after receiving an access request initiated by a user terminal, counting the number of times the user terminal submits an access request within a first preset time period; The number of access requests determines the possibility feature value of the access request, and the possibility feature value is used to characterize the probability that the access request is a malicious request; according to the possibility feature value of the access request, the access request The request is processed. The disclosure realizes the purpose of judging whether an access request is initiated by a malicious user and performing response processing based on the number of user submissions, and can effectively prevent malicious users from submitting automated programs without affecting user experience.

Description

Access request processing method and device

technical field

The present disclosure relates to the field of network technology, in particular to a method and device for processing an access request.

Background technique

Today, with the continuous development of Internet technology, the network is full of a large number of security risks. For example, in order to steal the user's personal privacy information, some malicious users often send access requests to the website through automated procedures for data submission, such as through Repeatedly submitting data in an attempt to crack other people's website login passwords; for e-commerce websites that support cash on delivery, repeatedly placing cash on delivery orders without shopping intentions, etc. In order to prevent the above-mentioned hidden dangers from causing adverse effects on users' property safety or personal safety, various large and medium-sized websites have introduced information security technology when processing access requests.

In related technologies, when processing a user's access request, in order to avoid programmatically and automatically submitting the access request to the website, various large and medium-sized websites are provided with verification codes. Only after the user enters the correct verification code can he submit an access request to the website. For example, the 12306 ticketing website of the Ministry of Railways adopts a verification code-based submission method.

Contents of the invention

In order to overcome the problems existing in related technologies, the present disclosure provides a method and device for processing an access request.

According to a first aspect of an embodiment of the present disclosure, a method for processing an access request is provided, the method including:

After receiving an access request initiated by the user terminal, counting the number of times the user terminal submits the access request within the first preset duration;

Determine the possibility characteristic value of the access request according to the number of times the user terminal submits the access request within the first preset time period, and the possibility characteristic value is used to represent the probability that the access request is a malicious request;

The access request is processed according to the possibility feature value of the access request.

In another embodiment, after receiving the access request, the method further includes:

Record the identification information of the user who submitted the access request in the log;

The counting the number of access requests submitted by the user terminal within the first preset time period includes:

counting the number of access requests recorded in the log that are consistent with the identification information and within the first preset time length, and determining the number as the number submitted by the user terminal within the first preset time length The number of access requests.

In another embodiment, the processing the access request according to the possibility feature value of the access request includes:

If the magnitude of the possibility feature value does not exceed the preset threshold, the access request is processed after receiving the access request for a second preset duration, and a request response is returned.

In another embodiment, the processing the access request according to the possibility feature value of the access request includes:

If the magnitude of the possibility characteristic value exceeds the preset threshold, the access request is discarded.

In another embodiment, before determining the possibility feature value of the access request according to the number of times the user terminal submits the access request within the first preset time period, the method further includes:

Set the correspondence between the number of submissions and the size of the possibility feature value;

The determining the possibility feature value of the access request according to the number of times the user terminal submits the access request within the first preset time period includes:

A search is performed in the corresponding relationship according to the number of submissions, and a value matching the number of submissions is determined as the possibility feature value of the access request.

According to a second aspect of an embodiment of the present disclosure, an access request processing device is provided, the device comprising:

The statistical module is configured to, after receiving an access request initiated by the user terminal, count the number of times the user terminal submits the access request within the first preset duration;

A determination module, configured to determine the possibility feature value of the access request according to the number of times the user terminal submits the access request within the first preset time period, and the possibility feature value is used to characterize the access request The probability of being a malicious request;

The processing module is configured to process the access request according to the possibility characteristic value of the access request.

In another embodiment, the device also includes:

a recording module configured to record the identification information of the user who submitted the access request in a log;

The statistical module is configured to count the number of access requests recorded in the log that are consistent with the identification information and within the first preset time length, and determine the number as the number of access requests recorded by the user terminal in the The number of times the access request is submitted within the first preset time period.

In another embodiment, the processing module is configured to, if the magnitude of the possibility characteristic value does not exceed a preset threshold, perform an operation on the access request after receiving the access request for a second preset duration. Process, and return a request response.

In another embodiment, the processing module is configured to discard the access request if the magnitude of the possibility characteristic value exceeds the preset threshold.

In another embodiment, the device also includes:

A setting module configured to set the corresponding relationship between the number of submissions and the magnitude of the possibility feature value;

The determination module is configured to search in the corresponding relationship according to the number of submissions, and determine a numerical value matching the number of submissions as the possibility feature value of the access request.

According to a third aspect of the embodiments of the present disclosure, an access request processing device is provided, including:

processor;

memory for storing processor-executable instructions;

Wherein, the processor is configured to: after receiving an access request initiated by the user terminal, count the number of times the user terminal submits the access request within a first preset time length; The number of times an access request is submitted within a preset period of time determines the possibility characteristic value of the access request, and the possibility characteristic value is used to characterize the probability that the access request is a malicious request; according to the possibility characteristic value of the access request , to process the access request.

The technical solutions provided by the embodiments of the present disclosure may include the following beneficial effects:

Each access request submitted by the user will be recorded in the log, and based on the user's identification information, the number of submissions of the access request with the same user attribute within a certain period of time will be counted, and then the access request will be judged as malicious based on the number of submissions The probability of the request, and finally process the access request based on this probability, so the purpose of judging whether the access request is initiated by a malicious user based on the number of user submissions and whether to respond to it is realized, without affecting the user experience. , effectively preventing malicious users from submitting automated programs.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure.

Description of drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and together with the description serve to explain the principles of the invention.

Fig. 1 is a flowchart showing a method for processing an access request according to an exemplary embodiment.

Fig. 2 is a flowchart showing a method for processing an access request according to an exemplary embodiment.

Fig. 3 is a block diagram of an access request processing device according to an exemplary embodiment.

Fig. 4 is a block diagram of an access request processing apparatus according to an exemplary embodiment.

Fig. 5 is a block diagram of an access request processing apparatus according to an exemplary embodiment.

Fig. 6 is a block diagram of an access request processing apparatus according to an exemplary embodiment.

detailed description

Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, the same numerals in different drawings refer to the same or similar elements unless otherwise indicated. The implementations described in the following exemplary examples do not represent all implementations consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with aspects of the invention as recited in the appended claims.

Fig. 1 is a flowchart of a method for processing an access request according to an exemplary embodiment. As shown in Fig. 1, the method is used in a server and includes the following steps.

In step 101, after receiving an access request initiated by the user terminal, the number of times the user terminal submits the access request within a first preset time period is counted.

In step 102, the possibility feature value of the access request is determined according to the number of times the user terminal submits the access request within the first preset time period.

Among them, the possibility feature value is used to represent the probability that the access request is a malicious request;

In step 103, the access request is processed according to the possibility feature value of the access request.

In the method provided by the embodiment of the present disclosure, each access request submitted by a user will be recorded through a log, and the number of submissions of access requests with the same user attribute within a certain period of time will be counted based on the user's identification information, and then based on the number of submissions Determine the probability that this access request is a malicious request, and finally process the access request based on this probability, so the purpose of judging whether the access request is initiated by a malicious user based on the number of user submissions and whether to respond to it is realized. Effectively prevent malicious users from submitting automated programs without affecting user experience.

In another embodiment, after receiving the access request, the method further includes:

Record the identification information of the user who submitted the access request in the log;

The counting the number of access requests submitted by the user terminal within the first preset time period includes:

counting the number of access requests recorded in the log that are consistent with the identification information and within the first preset time length, and determining the number as the number submitted by the user terminal within the first preset time length The number of access requests.

In another embodiment, the processing the access request according to the possibility feature value of the access request includes:

If the magnitude of the possibility feature value does not exceed the preset threshold, the access request is processed after receiving the access request for a second preset duration, and a request response is returned.

In another embodiment, the processing the access request according to the possibility feature value of the access request includes:

If the magnitude of the possibility characteristic value exceeds the preset threshold, the access request is discarded.

In another embodiment, before determining the possibility feature value of the access request according to the number of times the user terminal submits the access request within the first preset time period, the method further includes:

Set the correspondence between the number of submissions and the size of the possibility feature value;

The determining the possibility feature value of the access request according to the number of times the user terminal submits the access request within the first preset time period includes:

A search is performed in the corresponding relationship according to the number of submissions, and a value matching the number of submissions is determined as the possibility feature value of the access request.

All the above optional technical solutions may be combined in any way to form optional embodiments of the present disclosure, which will not be repeated here.

Fig. 2 is a flow chart showing a method for processing an access request according to an exemplary embodiment. As shown in Fig. 2, the method is used in a server and includes the following steps.

In step 201, the corresponding relationship between the number of submissions and the magnitude of the possibility feature value is set.

In the embodiment of the present disclosure, in order to prevent malicious users from submitting data through automated programs, thereby stealing users' personal privacy information, etc., a method of setting a malicious index for access requests according to the number of submissions by users within a certain period of time is proposed. , so that the server can process the submitted access request according to the malicious index. The number of submissions may be the number of times the same user sends access requests to the server within 30 seconds or 1 minute, which is not specifically limited in this embodiment of the present disclosure. Wherein, the possibility feature value is used to describe the probability that the access request is a malicious request, that is, the malicious index. Taking the score with the possibility characteristic value between 0 and 100 as an example, the corresponding relationship between the number of submissions and the possibility characteristic value can be shown in Table 1 below:

Table 1

Commits/min malicious index More than 30 times 100 points 20～30 90 marks 20～10 80 points ... ... less than 5 times 0 marks

Of course, in addition to the form of characterizing the possibility feature value with a score between 0 and 100, the possibility feature value can also be characterized in the form of one star to five stars, and in the form of a percentage between 0 and 100%. The embodiment does not specifically limit this. After the above corresponding relationship is set, the above corresponding relationship is stored in a storage medium such as memory or flash memory, so that the subsequent process can be used after receiving the access request initiated by the user.

In step 202, after receiving an access request initiated by the user terminal, record the identification information of the user submitting the access request in the log, and count the number of times the user terminal submits the access request within the first preset time period.

For each data submission by the user terminal, the server will record the user-related information of the access request in the log. Wherein, the identification information of the user may be an IP (Internet Protocol, Internet Protocol) address of the user terminal, a user ID, a phone number of the user, or a mailbox of the user, etc., which are not specifically limited in the embodiments of the present disclosure.

In the embodiment of the present disclosure, after recording the current access request, the server also performs real-time statistics on the log, so as to count the number of times the user terminal submits the access request within the first preset time period. Wherein, the first preset duration may be 30 seconds or 1 minute, etc., which is not specifically limited in the embodiment of the present disclosure, and may be consistent with the setting in Table 1 or may be adjusted according to different service types. When counting the number of times the user terminal submits access requests within the first preset time period, the following methods can be adopted:

Count the number of access requests recorded in the log that are consistent with the identification information of the access request received this time and within the first preset time length, and determine the number as the number of access requests submitted by the user terminal within the first preset time length. number of requests. Of course, the number of times the user terminal submits access requests within the first preset time period includes the access requests received this time. That is, real-time data is pulled from the log to count the number of access requests submitted by users using the same IP address, the same user ID, the same phone number or the same user mailbox within the first preset time period. Wherein, the submitted access request may be the same access request repeatedly submitted due to submission failure, or may be a different access request, which is not specifically limited in this embodiment of the present disclosure.

In step 203, the possibility feature value of the access request is determined according to the number of times the user terminal submits the access request within the first preset time period and the above-mentioned corresponding relationship.

After obtaining the number of access requests submitted by the user within the first preset time period, search the corresponding relationship shown in the above table 1 according to the number of submissions, and then obtain the numerical value that will match the number of submissions, and determine it Likelihood characteristic value requested for this access. The purpose of scoring the malicious degree of the received access request according to the number of submissions and obtaining the malicious index is realized. And the more access requests with the same user attribute are submitted within the first preset time period, the higher the malicious index.

In step 204, the access request is processed according to the possibility feature value of the access request.

In the embodiment of the present disclosure, according to the different magnitudes of the possibility feature value of the access request, that is, the level of the malicious index of the access request, the following two methods are mainly adopted to process the access request:

In the first manner, if the value of the possibility characteristic value does not exceed the preset threshold, the access request is processed after receiving the access request for a second preset duration, and a request response is returned.

Wherein, the form of the preset threshold is associated with the form of the possibility feature value. If the possibility feature value is characterized by a score between 0 and 100, then the preset threshold can be 50 points or 60 points; if the possibility feature value is represented by a percentage between 0 and 100%, Then the preset threshold can be 50% or 60% etc.; if the possibility characteristic value is characterized by the form of one star to five stars, then the preset threshold can be three stars, etc.; There are no specific limitations and can be set according to actual business.

For the first method, if the possibility feature value of the access request does not exceed the preset threshold, it indicates that the malicious degree of the access request is not high, and it may be made by ordinary users due to poor network conditions or misoperation. For multiple submission operations, in order to prevent accidental injury to normal users, the server will still respond to the access request in this case, but the response time for the access request is extended backwards compared to the normal access request. Wherein, the second preset duration may be 1 minute or 2 minutes, etc., which is not specifically limited in this embodiment of the present disclosure.

In the second manner, if the value of the possibility feature exceeds a preset threshold, the access request is discarded.

For the second method, if the possibility feature value of the access request exceeds the preset threshold, it indicates that the access request is highly malicious, and it is likely that a malicious user is submitting an automated program through a machine, so the server rejects it. Respond to the access request and directly discard the access request.

Through the above two methods of processing access requests, the server can more intelligently block malicious programmatic submissions without affecting normal users' physical examinations. It solves the defect that all users need to enter the verification code brought by the verification code scheme, and at the same time, the simple verification code cannot avoid the programmatic submission through the machine, and the complex verification code seriously damages the user experience.

In the method provided by the embodiment of the present disclosure, each access request submitted by a user will be recorded through a log, and the number of submissions of access requests with the same user attribute within a certain period of time will be counted based on the user's identification information, and then based on the number of submissions Determine the probability that this access request is a malicious request, and finally process the access request based on this probability, so the purpose of judging whether the access request is initiated by a malicious user based on the number of user submissions and whether to respond to it is realized. Effectively prevent malicious users from submitting automated programs without affecting user experience.

Fig. 3 is a block diagram of an access request processing device according to an exemplary embodiment. Referring to FIG. 3 , the device includes a statistics module 301 , a determination module 302 and a processing module 303 .

The statistics module 301 is configured to, after receiving an access request initiated by a user terminal, count the number of times the user terminal submits an access request within a first preset time period;

The determination module 302 is configured to determine the possibility feature value of the access request according to the number of times the user terminal submits the access request within the first preset time period, and the possibility feature value is used to represent the access request The probability that the request is malicious;

The processing module 303 is configured to process the access request according to the possibility feature value of the access request.

In another embodiment, referring to Fig. 4, the device further includes:

A recording module 304 configured to record the identification information of the user who submitted the access request in a log;

The statistical module 301 is configured to count the number of access requests recorded in the log that are consistent with the identification information and within the first preset time length, and determine the number as the number of access requests recorded by the user terminal in The number of times access requests are submitted within the first preset time period.

In another embodiment, the processing module 303 is configured to process the access request after receiving the access request for a second preset duration if the value of the possibility characteristic value does not exceed a preset threshold. Process and return a request response.

In another embodiment, the processing module 303 is configured to discard the access request if the magnitude of the possibility characteristic value exceeds the preset threshold.

In another embodiment, referring to Fig. 5, the device further includes:

The setting module 305 is configured to set the corresponding relationship between the number of submissions and the magnitude of the possibility feature value;

The determination module 302 is configured to search in the corresponding relationship according to the number of submissions, and determine a value matching the number of submissions as the possibility feature value of the access request.

The device provided by the embodiment of the present disclosure will record each access request submitted by the user through a log, and count the number of submissions of access requests with the same user attributes within a certain period of time based on the user's identification information, and then based on the number of submissions Determine the probability that this access request is a malicious request, and finally process the access request based on this probability, so the purpose of judging whether the access request is initiated by a malicious user based on the number of user submissions and whether to respond to it is realized. Effectively prevent malicious users from submitting automated programs without affecting user experience.

Regarding the apparatus in the foregoing embodiments, the specific manner in which each module executes operations has been described in detail in the embodiments related to the method, and will not be described in detail here.

Fig. 6 is a block diagram of an access request processing apparatus 600 according to an exemplary embodiment. For example, the apparatus 600 may be provided as a server. Referring to FIG. 6 , apparatus 600 includes processing component 622 , which further includes one or more processors, and a memory resource represented by memory 632 for storing instructions executable by processing component 622 , such as application programs. The application program stored in memory 632 may include one or more modules each corresponding to a set of instructions. In addition, the processing component 622 is configured to execute instructions to perform the above access request processing method.

Device 600 may also include a power component 626 configured to perform power management of device 600 , a wired or wireless network interface 650 configured to connect device 600 to a network, and an input-output (I/O) interface 658 . The apparatus 600 can operate based on an operating system stored in the memory 632, such as WindowsServer ^™ , MacOSX ^™ , Unix ^™ , Linux ^™ , FreeBSD ^™ or the like.

Other embodiments of the invention will be readily apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any modification, use or adaptation of the present invention, these modifications, uses or adaptations follow the general principles of the present invention and include common knowledge or conventional technical means in the technical field not disclosed in this disclosure . The specification and examples are to be considered exemplary only, with a true scope and spirit of the invention being indicated by the following claims.

It should be understood that the present invention is not limited to the precise constructions which have been described above and shown in the accompanying drawings, and various modifications and changes may be made without departing from the scope thereof. The scope of the invention is limited only by the appended claims.

Claims (11)

1. an access request processing method, it is characterised in that described method includes:

After receiving the access request that user terminal is initiated, add up described user terminal in the first preset duration, submit the number of times of access request to；

Submitting the number of times of access request in described first preset duration to according to described user terminal, it is determined that the probability eigenvalue of described access request, described probability eigenvalue is for characterizing the probability that described access request is malicious requests；

Probability eigenvalue according to described access request, processes described access request.

2. method according to claim 1, it is characterised in that described in receive access request after, described method also includes:

In daily record, the identification information of the user of described access request submitted in record；

The described user terminal of described statistics submits the number of times of access request in the first preset duration, including:

Add up the consistent with described identification information of described log recording and be positioned at the number of access request of described first preset duration, described number being defined as described user terminal in described first preset duration, submits the number of times of access request to.

3. method according to claim 1, it is characterised in that the described probability eigenvalue according to described access request, processes described access request, including:

If the size of described probability eigenvalue is without departing from predetermined threshold value, then after receiving described access request the second preset duration, described access request is processed, and return request response.

4. method according to claim 1, it is characterised in that the described probability eigenvalue according to described access request, processes described access request, including:

If the size of described probability eigenvalue exceeds described predetermined threshold value, then abandon described access request.

5. method according to claim 2, it is characterised in that the described number of times submitting access request according to described user terminal in described first preset duration to, it is determined that before the probability eigenvalue of described access request, described method also includes:

The corresponding relation submitted between number of times and probability eigenvalue size is set；

The described number of times submitting access request according to described user terminal in described first preset duration to, it is determined that the probability eigenvalue of described access request, including:

Make a look up in described corresponding relation according to described submission number of times, the numerical values recited mated with described submission number of times is defined as the probability eigenvalue of described access request.

6. an access request processes device, it is characterised in that described device includes:

Statistical module, is configured to, after receiving the access request that user terminal is initiated, add up described user terminal and submit the number of times of access request in the first preset duration to；

Determining module, be configured to submit in described first preset duration according to described user terminal the number of times of access request, it is determined that the probability eigenvalue of described access request, described probability eigenvalue is for characterizing the probability that described access request is malicious requests；

Processing module, is configured to the probability eigenvalue according to described access request, described access request is processed.

7. device according to claim 6, it is characterised in that described device also includes:

Logging modle, is configured in daily record the identification information that the user of described access request submitted in record；

Described statistical module, it is configured to add up the consistent with described identification information of described log recording and is positioned at the number of access request of described first preset duration, described number being defined as described user terminal in described first preset duration, submits the number of times of access request to.

8. device according to claim 6, it is characterized in that, described processing module, if being configured to the size of described probability eigenvalue without departing from predetermined threshold value, then after receiving described access request the second preset duration, described access request is processed, and return request response.

9. device according to claim 6, it is characterised in that described processing module, if the size being configured to described probability eigenvalue exceeds described predetermined threshold value, then abandons described access request.

10. device according to claim 7, it is characterised in that described device also includes:

Module is set, is configured to arrange the corresponding relation submitted between number of times and probability eigenvalue size；

Described determine module, be configured to make a look up in described corresponding relation according to described submission number of times, the numerical values recited mated with described submission number of times is defined as the probability eigenvalue of described access request.

11. an access request processes device, it is characterised in that including:

Processor；

For storing the memorizer of processor executable；

Wherein, described processor is configured to: after receiving the access request that user terminal is initiated, adds up described user terminal and submits the number of times of access request in the first preset duration to；Submitting the number of times of access request in described first preset duration to according to described user terminal, it is determined that the probability eigenvalue of described access request, described probability eigenvalue is for characterizing the probability that described access request is malicious requests；Probability eigenvalue according to described access request, processes described access request.