CN115174243A - Malicious IP address blocking processing method, device, equipment and storage medium - Google Patents

Abstract

The invention relates to the technical field of computer networks, and discloses a method, device, equipment and storage medium for blocking malicious IP addresses. The method for blocking malicious IP addresses includes: establishing an IP address information base, and configuring a blocking strategy; when receiving an access request, acquiring the real IP address of the client where the access request comes from; The real IP address is blocked. The present invention blocks the real client IP address, and can flexibly configure the blocking strategy, so as to avoid the situation that the IP address of the proxy server is blocked and a large area cannot be accessed.

Description

Method, device, device and storage medium for blocking malicious IP address

technical field

The present invention relates to the field of computer networks, and in particular, to a method, device, device and storage medium for blocking malicious IP addresses.

Background technique

With the rapid development of the Internet, the scale of the Internet has become increasingly large, and Internet security issues have become increasingly complex. Large-scale website systems are often illegally attacked, and a large number of malicious IP addresses are accessed, occupying server resources or attacking computer network bandwidth and connectivity. normal access. In order to quickly cut off the impact of illegal attacks on the network, it is necessary to promptly prohibit illegal users or the source of illegal attacks from accessing the network. IP address blocking is to block specific IP addresses through network technology, deny their access, and achieve the purpose of resisting attacks.

In the prior art, the Web server runs at the application layer in the network, and the existing automatic blocking device for malicious IP addresses of the application layer is mainly based on the access behavior of the IP address or the threat intelligence database for blocking. When the access behavior of an IP address triggers high-frequency security rules, it will be blocked by the blocking device; or a malicious IP address imported into the threat intelligence database will be blocked by the blocking device directly. The existing security rules of this blocking device need to be manually created by security personnel after analyzing network traffic, logs and other information, and subsequent rules also need to be manually maintained and updated by personnel; at the same time, the threat intelligence database also needs to be updated frequently to obtain the latest malicious IP. address information, and directly adopt the same blocking strategy for different malicious IP addresses, the false blocking rate is too high. At the same time, most of the existing blocking devices block malicious IP addresses at the network layer, which is not flexible enough, and if the Web server There is an agent in front, which can easily cause a large area to be unable to access the Web server and affect the business.

SUMMARY OF THE INVENTION

The main purpose of the present invention is to provide a method, device, device and storage medium for blocking malicious IP addresses, aiming to solve the technical problem that the blocking strategy of the malicious IP blocking device in the prior art is single and easy to be blocked by mistake.

A first aspect of the present invention provides a method for blocking malicious IP addresses, including:

Establish an IP address information base and configure blocking policies;

When receiving the access request, obtain the real IP address of the source client of the access request;

Based on the blocking policy, blocking processing is performed on the real IP address.

Optionally, in a first implementation manner of the first aspect of the present invention, the establishing an IP address information base includes:

Obtain various labels and their corresponding IP address information, wherein the label categories include one or more of address, ISP, IDC, anycast, threat intelligence, and customization;

An IP address information base is established based on each of the tags and each of the IP address information.

Optionally, in a second implementation manner of the first aspect of the present invention, the configuring the blocking strategy includes:

Obtain the IP address information of the matching object;

Based on the IP address information of the matching object, count the number of requests that the matching object accesses a certain path within a preset number of cycles;

Acquire a matching action, and configure a blocking strategy for executing the matching action when the number of requests for the matching object satisfies a preset blocking condition.

Optionally, in a third implementation manner of the first aspect of the present invention, the configuring the blocking strategy further includes:

When multiple blocking strategies are configured, the priority of each blocking strategy is configured.

Optionally, in a fourth implementation manner of the first aspect of the present invention, the blocking processing on the real IP address based on the blocking policy includes:

Based on the priority of each blocking strategy, determine whether the real IP address satisfies each of the preset blocking conditions in order from high priority to low priority;

When the real IP address satisfies a certain preset blocking condition, a corresponding matching action is performed, and the judgment on each subsequent preset blocking condition is stopped.

Optionally, in a fifth implementation manner of the first aspect of the present invention, when an access request is received, acquiring the real IP address of the client from which the access request is received includes:

When an access request is received, determine whether there is a proxy server in front of the application layer;

If there is no proxy server in front of the application layer, the IP address of the peer that establishes the link will be taken as the real IP address;

If there is a proxy server in front of the application layer, the preset resolution method is used to obtain the real IP address.

Optionally, in the sixth implementation manner of the first aspect of the present invention, if there is a proxy server in front of the application layer, applying the preset resolution method to obtain the real IP address includes:

Determine whether the peer IP address of the established link is a trusted IP;

If the peer IP address for establishing the link is an untrusted IP, the peer IP address for establishing the link is used as the real IP address;

If the peer IP address of the established link is a trusted IP, then determine whether the proxy server is a network layer proxy server;

If the proxy server is a network layer proxy server, obtain the real IP address from the TCP message;

If the proxy server is a non-network layer proxy server, then determine whether the header field of the access request is a custom header field;

If the header field of the access request is a custom header field, then take the information in the header field as the real IP address;

If the header field of the access request is a non-customized header field, the value of the X-Forwarded-For field in the header field of the access request is taken as the real IP address.

A second aspect of the present invention provides a device for blocking malicious IP addresses, including:

The configuration module is used to establish the IP address information base and configure the blocking strategy;

a processing module, configured to obtain the real IP address of the source client of the access request when receiving the access request;

A blocking module, configured to perform blocking processing on the real IP address based on the blocking strategy.

Optionally, in the first implementation manner of the second aspect of the present invention, the configuration module is specifically configured to:

Obtain various labels and their corresponding IP address information, wherein the label categories include one or more of address, ISP, IDC, anycast, threat intelligence, and customization;

An IP address information base is established based on each of the tags and each of the IP address information.

Optionally, in the second implementation manner of the second aspect of the present invention, the configuration module is further specifically used for:

Obtain the IP address information of the matching object;

Based on the IP address information of the matching object, count the number of requests that the matching object accesses a certain path within a preset number of cycles;

Acquire a matching action, and configure a blocking strategy for executing the matching action when the number of requests for the matching object satisfies a preset blocking condition.

Optionally, in a third implementation manner of the second aspect of the present invention, the configuration module is further specifically configured to:

When multiple blocking strategies are configured, the priority of each blocking strategy is configured.

Optionally, in a fourth implementation manner of the second aspect of the present invention, the blocking module is specifically used for:

Based on the priority of each blocking strategy, determine whether the real IP address satisfies each of the preset blocking conditions in order from high priority to low priority;

When the real IP address satisfies a certain preset blocking condition, a corresponding matching action is performed, and the judgment on each subsequent preset blocking condition is stopped.

Optionally, in a fifth implementation manner of the second aspect of the present invention, the processing module includes:

a judging unit for judging whether there is a proxy server in front of the application layer when an access request is received;

The processing unit is used to set the peer IP address of the link as the real IP address if there is no proxy server in front of the application layer;

The parsing unit is used to obtain the real IP address by applying the preset parsing method if there is a proxy server in front of the application layer.

Optionally, in a sixth implementation manner of the second aspect of the present invention, the parsing unit is specifically configured to:

Determine whether the peer IP address of the established link is a trusted IP;

If the peer IP address for establishing the link is an untrusted IP, the peer IP address for establishing the link is used as the real IP address;

If the peer IP address of the established link is a trusted IP, then determine whether the proxy server is a network layer proxy server;

If the proxy server is a network layer proxy server, obtain the real IP address from the TCP message;

If the proxy server is a non-network layer proxy server, then determine whether the header field of the access request is a custom header field;

If the header field of the access request is a custom header field, then take the information in the header field as the real IP address;

If the header field of the access request is a non-customized header field, the value of the X-Forwarded-For field in the header field of the access request is taken as the real IP address.

A third aspect of the present invention provides an electronic device, comprising: a memory and at least one processor, wherein instructions are stored in the memory; the at least one processor invokes the instructions in the memory to make the electronic device The device executes the above-mentioned method for blocking malicious IP addresses.

A fourth aspect of the present invention provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, when the computer-readable storage medium runs on a computer, the computer executes the above-mentioned method for blocking malicious IP addresses.

In the technical scheme provided by the present invention, an IP address information base is established, and a blocking strategy is configured; when an access request is received, the real IP address of the source client of the access request is obtained; The IP address is blocked. The invention automatically obtains the real client IP address, and blocks the real client IP address, so as to avoid blocking the IP address of the proxy server and cause a large area of inaccessibility, and at the same time, it can be flexibly configured according to multi-dimensional information Blocking strategy, to solve the insufficiency of existing blocking devices that only block based on a single IP address.

Description of drawings

1 is a schematic diagram of an embodiment of a method for blocking malicious IP addresses in an embodiment of the present invention;

2 is a schematic diagram of another embodiment of a method for blocking malicious IP addresses in an embodiment of the present invention;

3 is a schematic diagram of an embodiment of an apparatus for blocking malicious IP addresses in an embodiment of the present invention;

FIG. 4 is a schematic diagram of an embodiment of an electronic device in an embodiment of the present invention.

Detailed ways

The embodiments of the present invention provide a method, device, device and storage medium for blocking malicious IP addresses, which can automatically obtain the real client IP address and block the real client IP address to avoid blocking The IP address of the proxy server causes a large area of inaccessibility. At the same time, the blocking strategy can be flexibly configured according to multi-dimensional information, and the existing blocking device can only block the insufficiency of a single information based on the IP address.

The terms "first", "second", "third", "fourth", etc. (if present) in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It is to be understood that data so used may be interchanged under appropriate circumstances so that the embodiments described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" or "having" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those expressly listed steps or units, but may include other steps or units not expressly listed or inherent to these processes, methods, products or devices.

For ease of understanding, the following describes the specific process of the embodiment of the present invention, referring to FIG. 1 , an embodiment of the method for blocking malicious IP addresses in the embodiment of the present invention includes:

101. Establish an IP address information base and configure a blocking strategy;

It can be understood that the execution subject of the present invention may be a device for blocking malicious IP addresses, and may also be a terminal or a server, which is not specifically limited here. The embodiments of the present invention are described by taking a server as an execution subject as an example.

In this embodiment, IP (Internet Protocol, Internet Protocol) is a network layer protocol in the TCP/IP (Transmission Control Protocol/Internet Protocol, Transmission Control Protocol/Internet Protocol) address system, and IP specifies that all devices on the network are There must be a unique IP address. The IP address information database is a basic IP address information database pre-established according to GeoIP, ISP, IDC and other labels, and stores various predefined labels and their corresponding IP address information; blocking strategy Refers to blocking specific IP addresses and restricting their access.

Optionally, in an embodiment, the establishing the IP address information base includes:

Obtain various labels and their corresponding IP address information, wherein the label categories include one or more of address, ISP, IDC, anycast, threat intelligence, and customization;

An IP address information base is established based on each of the tags and each of the IP address information.

Specifically, the IP address information refers to a certain IP address or a class of IP addresses; the GeoIP label contains the address information of the IP address, including latitude and longitude, city, province/state, country, country code, city code, and zip code; ISP (Internet Service Provider) , Internet Service Provider) label refers to China Telecom, China Mobile, Great Wall Broadband and other telecommunications operators that provide Internet access services to the public; IDC (Internet Data Center, Internet Data Center) refers to the use of existing Internet communication by telecommunications departments or enterprises. Line and bandwidth resources, establish a standardized telecommunications professional-grade computer room environment, and provide enterprises and governments with a central platform for server hosting, leasing and related value-added services, such as UCED Ulanqab Data Center, Beijing Dr. Peng Data centers, etc.; anycast identifies a group of hosts that provide a specific service through an Anycast address on the IP network, and the service visitor does not care which host provides the service. The packets accessing this address can be transmitted by the IP network. Routing to any host in this group of targets, most of these IP addresses are server IP addresses, and seldom actively access externally; threat intelligence labels include but are not limited to scanners, zombie hosts, home broadband, host operating systems , host services and other labels, where the scanner uses this type of IP address and uses programming languages or tools to automatically send TCP packets to detect hosts in the Internet network, record the host's open ports, and sometimes detect the operating system. information, application layer protocol information of a port, application layer service information, operating system or service vulnerability information, etc.; bots refer to computer equipment infected with bot virus and thus controlled by hacker programs, and the computer equipment can be terminal equipment , it can also be a cloud device, which can launch a denial of service (DoS, Denial of Service) attack or send spam information at any time according to the hacker's command and control instructions, so that the computer or network cannot provide normal services; home broadband refers to the ISP provided The IP address given to individual and home users, these users can use these IP addresses to access the Internet; the host operating system refers to many hosts on the Internet, and these hosts will have operating systems installed, especially those belonging to IDC, and different operating systems will open some fixed The port or other characteristics of the host can be used to judge the operating system installed on the host according to this information, such as scanning the host to obtain port information, or according to the different points of different operating systems processing TCP packets, the operating system of a host can be judged, such as Windows, Linux etc.; Host service means that the host belonging to the IDC is generally used as the server of a service, usually scans its port information, or sends different types of TCP packets to a certain port of the host according to the commonly used port information, and judges based on the returned information. The service provided by the host, the IP address of the server host is rarely actively accessed externally; the custom label is user-defined Defined labels, such as the exit IP address of the Shenzhen branch office area, the exit IP address of the Shanghai branch office area, etc., you can also set a custom label according to the trigger rule of a certain IP address, you can search for a certain label, and give The IP address under this tab sets other tabs.

Specifically, various labels and their corresponding IP address information are obtained, merged, and a database corresponding to the association between labels and IP address information, that is, an IP address information database is established.

Optionally, in an embodiment, the configuring the blocking strategy includes:

Obtain the IP address information of the matching object;

Based on the IP address information of the matching object, count the number of requests that the matching object accesses a certain path within a preset number of cycles;

Acquire a matching action, and configure a blocking strategy for executing the matching action when the number of requests for the matching object satisfies a preset blocking condition.

Specifically, the matching object is an object that matches the current blocking policy, and the action corresponding to the current blocking policy needs to be executed. The matching object includes a single IP address, a CIDR (Classless Inter-Domain Routing, Classless Inter-Domain Routing) block that belongs to the same The IP address below, the IP address with a certain label; a single IP address N ₁ .N ₂ .N ₃ .N ₄ , where N ₁ , N ₂ , N ₃ , N ₄ can be any between 0-255 Number; both belong to the IP under a CIDR block ABCD/N, where A, B, C, and D cannot be set and represent an IP address in decimal notation. N can be any number from 0 to 32, indicating the network identifier in ABCD. The number of digits in which the prefix is converted into a binary number. For example, 192.168.10.1/16 indicates that the prefix identifying the network has 16 bits, that is, 192.168 is the prefix, and 10.1 is the address of the specific host in this network. When N is 0, it can match all IPs. address, which is equivalent to a single IP address when it is 32.

Specifically, count the number of requests that the matching object accesses/attacks a certain path or file within N M seconds. For example, the number of requests that the matching object accesses a certain path or file in three consecutive 60-second periods is: 5 times, 3 times, 5 times; or count the number of requests that the matching object accesses/attacks a certain path or file in a period of N M seconds and the HTTP header field is equal to/contains/regularly matches a certain string, such as matching The object accesses a certain path or file in three consecutive 60-second periods, and the header field of these access requests contains a specific From field (set the email address of the user who sent the request), and the number of requests is 5, 2 times, 5 times.

Specifically, matching actions include, but are not limited to, intercepting such requests, enabling verification codes, limiting request rates, returning custom response codes and custom response content, not processing, and only recording logs; matching actions also include direct ban, when the matching object When the matching action is direct ban, there is no need to count the number of requests for the matching object. The matching action can also add additional actions, such as: additionally intercept the matching object and the IP address under the same CIDR block A.B.C.D/N, and add a certain label to the matching object (and the IP address under the same CIDR block A.B.C.D/N). (eg: scanner IP, IDC room IP, crawler pool IP).

Optionally, in an embodiment, the configuring the blocking strategy further includes:

When multiple blocking strategies are configured, the priority of each blocking strategy is configured.

Specifically, different blocking time and blocking method can be set for different blocking strategies, and network segments can also be blocked as required, multiple blocking strategies can be configured at the same time, and the priority of each blocking strategy can be configured, starting from high priority. Priority to low priority for blocking treatment.

102. When receiving the access request, obtain the real IP address of the source client of the access request;

In this embodiment, the real IP address of the source client of the access request is obtained according to the header information of the access request.

103. Perform blocking processing on the real IP address based on the blocking policy.

In this embodiment, based on the configured blocking policies, the number of requests for access requests is counted, and it is determined whether blocking processing is required, and if so, a corresponding matching action is performed to block.

In the embodiment of the present invention, an IP address information base is established, and a blocking strategy is configured; when an access request is received, the real IP address of the source client of the access request is obtained; based on the blocking strategy, the real IP address is Perform blocking treatment. The invention automatically obtains the real client IP address, and blocks the real client IP address, so as to avoid blocking the IP address of the proxy server and cause a large area of inaccessibility, and at the same time, it can be flexibly configured according to multi-dimensional information Blocking strategy, to solve the insufficiency of existing blocking devices that only block based on a single IP address.

Referring to FIG. 2, another embodiment of the method for blocking malicious IP addresses in the embodiment of the present invention includes:

201. Establish an IP address information base, and configure a blocking strategy;

Optionally, in an embodiment, a black and white list label is established, the IP address of the white list label is directly released without being subjected to blocking detection, and the IP address of the black list label is directly blocked.

Optionally, in one embodiment, when updating the IP address information base, remove the blocked IP address information base that has a certain label in the pre-updated IP address information base, but does not have a label in the updated IP address information base. IP address with that label.

202. When an access request is received, determine whether there is a proxy server in front of the application layer;

In this embodiment, the application layer is the highest layer in the network OSI reference model, provides services for users, has the user interface function of network transmission, and is mainly responsible for the communication between users and applications or between applications and applications on the network, The application layer is the entry point for users or application program interfaces and protocols to access the network. The proxy server is a server that acts as a proxy for network users to obtain network information. It is an intermediate agency between personal networks and Internet service providers, responsible for forwarding legitimate network information. , to control and register the forwarding.

203. If there is no proxy server in front of the application layer, the peer IP address of the established link is taken as the real IP address;

In this embodiment, if there is no proxy server before the application layer, the IP address of the peer for establishing the connection is the real IP address of the host sending the access request.

204. If there is a proxy server in front of the application layer, apply the preset parsing method to obtain the real IP address;

Optionally, in an embodiment, the foregoing step 204 includes:

Determine whether the peer IP address of the established link is a trusted IP;

If the peer IP address for establishing the link is an untrusted IP, the peer IP address for establishing the link is used as the real IP address;

If the peer IP address of the established link is a trusted IP, then determine whether the proxy server is a network layer proxy server;

If the proxy server is a network layer proxy server, obtain the real IP address from the TCP message;

If the proxy server is a non-network layer proxy server, then determine whether the header field of the access request is a custom header field;

If the header field of the access request is a custom header field, then take the information in the header field as the real IP address;

If the header field of the access request is a non-customized header field, the value of the X-Forwarded-For field in the header field of the access request is taken as the real IP address.

Specifically, in order to prevent malicious IP address requests from being counterfeited, a trusted IP address list can be configured. Only the IP addresses in the trusted IP address list can extract the transmitted information to obtain the real IP address of the client, and the IP addresses that are not in the trusted IP address list can be obtained. The address is always regarded as the real IP address of the client.

Specifically, for the IP addresses in the trusted IP address list, it is determined whether the proxy server is a network layer proxy server. The method in the option field of the last data packet in the specified 3-way handshake process) to obtain the real IP address of the client; otherwise (the proxy server is not a network layer proxy server) to determine whether the header field of the access request contains a custom transmission The request header field of the IP address. If it is included, the IP address in the field of the custom-delivered IP address in the header field is taken as the real IP address. If not included, the X-Forwarded- in the header field of the access request is taken. The value of the For field is used as the real IP address, where X-Forwarded-For (XFF) is an HTTP request header field used to identify the original IP address of the client connecting to the Web server through HTTP proxy or load balancing.

205. Perform blocking processing on the real IP address based on the blocking policy.

Optionally, in an embodiment, corresponding adjustments are made based on the load situation of the host, and coarse-grained blocking is performed when the load is too large. For example, when the load of the host is greater than a preset threshold, the matching objects are expanded to the same group. The IP addresses under a certain CIDR block A.B.C.D/N block malicious IP addresses to the greatest extent, reduce host resource consumption, and restore the original blocking policy when the host load is normal.

Optionally, in an embodiment, the blocked malicious IP address is synchronized to the network layer firewall or the front proxy server, and requests are intercepted at the network layer to reduce resource consumption.

Optionally, in an embodiment, the foregoing step 205 includes:

Based on the priority of each blocking strategy, determine whether the real IP address satisfies each of the preset blocking conditions in order from high priority to low priority;

When the real IP address satisfies a certain preset blocking condition, a corresponding matching action is performed, and the judgment on each subsequent preset blocking condition is stopped.

For ease of understanding, the following example illustrates the plugging process:

In this embodiment, the following four blocking strategies are configured, and their priorities are ①>②>③>④:

①In the GeoIP tag of the banned IP address information database, the country information is the IP address of the United States;

②When any IP address is accessed 100 times within a 60-second period, the IP address will be automatically blocked for 1 hour;

③ If any IP address is triggered more than 10 times in a 10-second period, all IP addresses under the CIDR block A.B.C.D/24 to which the IP address belongs will be automatically blocked for 24 hours;

④If any IP address is accessed less than 10 times in three consecutive 60-second periods, the IP address will be automatically blocked for 1 hour and the IP address will be added to the scanner label.

At this time, if an IP address (1.1.1.1) accesses the application, first query the GeoIP of the IP address. If the country information of the IP address is found to be the United States, it will be considered as triggering the blocking strategy ① and block it, and stop Continue to judge the blocking strategies ②, ③, ④; otherwise, count the access of the IP address:

If the IP address is accessed 110 times within 60 seconds, there are 20 attacks, and the attack behavior is 1 time in 3 seconds (matching the blocking policy ②), then the IP address 1.1.1.1 will be regarded by the blocking device as a triggering rule ② while blocking for 1 hour;

If the IP address has been accessed 100 times within 60 seconds, among which there are 10 attacks, and the attacks are within 10 consecutive seconds (matching blocking policies ② and ③), then the IP address 1.1.1.1 will be viewed by the blocking device. Blocking for 1 hour in order to trigger rule ② (blocking strategy ② has a higher priority, and the corresponding matching action is executed after judging that blocking strategy ② is satisfied, and there is no need to judge blocking strategies ③ and ④);

If the IP address is accessed 50 times within 10 seconds, and there are 10 attacks, the CIDR block 1.1.1.0/24 to which the IP address belongs will be considered by the blocking device as triggering the rule ③ and blocked for 24 hours ;

If the changed IP address is accessed 5 times within 1 minute, 1 visit within the following 1 minute, and 5 visits within the next 1 minute, the IP address 1.1.1.1 will be blocked by the blocking device as a triggering rule ④ Block for 1 hour and the IP address will be added to the scanner tag.

In the embodiment of the present invention, an IP address information base is established, and a blocking policy is configured; when an access request is received, it is judged whether there is a proxy server in front of the application layer; if there is no proxy server in front of the application layer, the link pair will be established The terminal IP address is used as the real IP address; if there is a proxy server in front of the application layer, a preset parsing method is used to obtain the real IP address; based on the blocking strategy, the real IP address is blocked. The present invention obtains the real client IP address through a preset analysis method, and blocks the real client IP address, so as to avoid blocking the IP address of the proxy server and cause a large area of inaccessibility. The access behavior is blocked, and the access requests with excessive or insufficient IP addresses can be counted. Compared with the existing blocking device, the IP addresses with less traffic than normal access can be blocked, so that the slowness of a large number of IP addresses can be resisted. Speed CC attack, you can also count various HTTP header fields of IP address access requests and count the number and proportion of response codes, so as to automatically block malicious IPs with abnormal access behaviors, and flexibly configure the blocking according to multi-dimensional information. The plugging strategy can also be used for coarse-grained plugging to improve efficiency.

The method for blocking and processing malicious IP addresses in the embodiment of the present invention has been described above. The following describes the device for blocking and processing malicious IP addresses in the embodiment of the present invention. Please refer to FIG. 3 . An embodiment of the blockage treatment device includes:

A configuration module 301 is used to establish an IP address information base and configure a blocking strategy;

a processing module 302, configured to obtain the real IP address of the client from the source of the access request when the access request is received;

The blocking module 303 is configured to perform blocking processing on the real IP address based on the blocking strategy.

Optionally, the configuration module 301 is specifically used for:

Obtain various labels and their corresponding IP address information, wherein the label categories include one or more of address, ISP, IDC, anycast, threat intelligence, and customization;

An IP address information base is established based on each of the tags and each of the IP address information.

Optionally, the configuration module 301 can also be specifically used for:

Obtain the IP address information of the matching object;

Based on the IP address information of the matching object, count the number of requests that the matching object accesses a certain path within a preset number of cycles;

Acquire a matching action, and configure a blocking strategy for executing the matching action when the number of requests for the matching object satisfies a preset blocking condition.

Optionally, the configuration module 301 can also be specifically used for:

When multiple blocking strategies are configured, the priority of each blocking strategy is configured.

Optionally, the blocking module 303 is specifically used for:

Based on the priority of each blocking strategy, determine whether the real IP address satisfies each of the preset blocking conditions in order from high priority to low priority;

When the real IP address satisfies a certain preset blocking condition, a corresponding matching action is performed, and the judgment on each subsequent preset blocking condition is stopped.

Optionally, the processing module 302 includes:

The judgment unit 3021 is used to judge whether there is a proxy server before the application layer when the access request is received;

The processing unit 3022 is used for, if there is no proxy server before the application layer, the peer IP address for establishing the link is used as the real IP address;

The parsing unit 3023 is configured to obtain a real IP address by applying a preset parsing method if there is a proxy server in front of the application layer.

Optionally, the parsing unit 3023 is specifically used for:

Determine whether the peer IP address of the established link is a trusted IP;

If the peer IP address for establishing the link is an untrusted IP, the peer IP address for establishing the link is used as the real IP address;

If the peer IP address of the established link is a trusted IP, then determine whether the proxy server is a network layer proxy server;

If the proxy server is a network layer proxy server, obtain the real IP address from the TCP message;

If the proxy server is a non-network layer proxy server, then determine whether the header field of the access request is a custom header field;

If the header field of the access request is a custom header field, then take the information in the header field as the real IP address;

If the header field of the access request is a non-customized header field, the value of the X-Forwarded-For field in the header field of the access request is taken as the real IP address.

In the embodiment of the present invention, an IP address information base is established, and a blocking strategy is configured; when an access request is received, the real IP address of the source client of the access request is obtained; based on the blocking strategy, the real IP address is Perform blocking treatment. The invention automatically obtains the real client IP address, and blocks the real client IP address, so as to avoid blocking the IP address of the proxy server and cause a large area of inaccessibility, and at the same time, it can be flexibly configured according to multi-dimensional information Blocking strategy, to solve the insufficiency of existing blocking devices that only block based on a single IP address.

FIG. 3 above describes the device for blocking malicious IP addresses in the embodiment of the present invention in detail from the perspective of modular functional entities, and the electronic device in the embodiment of the present invention is described in detail below from the perspective of hardware processing.

FIG. 4 is a schematic structural diagram of an electronic device provided by an embodiment of the present invention. The electronic device 500 may vary greatly due to different configurations or performances, and may include one or more processors (central processing units, CPU) 510 ( For example, one or more processors) and memory 520, one or more storage media 530 (eg, one or more mass storage devices) storing applications 533 or data 532. Among them, the memory 520 and the storage medium 530 may be short-term storage or persistent storage. The program stored in the storage medium 530 may include one or more modules (not shown in the figure), and each module may include a series of instructions to operate on the electronic device 500 . Furthermore, the processor 510 may be configured to communicate with the storage medium 530 to execute a series of instruction operations in the storage medium 530 on the electronic device 500 .

The electronic device 500 may also include one or more power supplies 540, one or more wired or wireless network interfaces 550, one or more input and output interfaces 560, and/or, one or more operating systems 531, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD and many more. Those skilled in the art can understand that the structure of the electronic device shown in FIG. 4 does not constitute a limitation on the electronic device, and may include more or less components than the one shown, or combine some components, or arrange different components.

The present invention also provides an electronic device, the electronic device includes a memory and a processor, the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, causes the processor to execute the above-mentioned various embodiments. Steps of the method for blocking malicious IP addresses.

The present invention also provides a computer-readable storage medium. The computer-readable storage medium may be a non-volatile computer-readable storage medium. The computer-readable storage medium may also be a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium, and when the instructions are executed on the computer, make the computer execute the steps of the method for blocking the malicious IP address.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system, device and unit described above may refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

The integrated unit, if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium. Based on such understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: U disk, removable hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes .

As mentioned above, the above embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand: The technical solutions described in the embodiments are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (10)

1. a method for blocking and processing a malicious IP address, wherein the blocking processing for the malicious IP address comprises: Establish an IP address information base and configure blocking policies; When receiving the access request, obtain the real IP address of the source client of the access request; Based on the blocking policy, blocking processing is performed on the real IP address. 2. the blocking processing method of malicious IP address according to claim 1, is characterized in that, described establishing IP address information base comprises: Obtain various labels and their corresponding IP address information, wherein the label categories include one or more of address, ISP, IDC, anycast, threat intelligence, and customization; An IP address information base is established based on each of the tags and each of the IP address information. 3. The method for blocking malicious IP addresses according to claim 1, wherein the configuration blocking strategy comprises: Obtain the IP address information of the matching object; Based on the IP address information of the matching object, count the number of requests that the matching object accesses a certain path within a preset number of cycles; Acquire a matching action, and configure a blocking strategy for executing the matching action when the number of requests for the matching object satisfies a preset blocking condition. 4. The method for blocking malicious IP addresses according to claim 3, wherein the configuration blocking strategy further comprises: When multiple blocking strategies are configured, the priority of each blocking strategy is configured. 5. The method for blocking and processing malicious IP addresses according to claim 4, wherein the blocking processing on the real IP address based on the blocking strategy comprises: Based on the priority of each blocking strategy, determine whether the real IP address satisfies each of the preset blocking conditions in order from high priority to low priority; When the real IP address satisfies a certain preset blocking condition, a corresponding matching action is performed, and the judgment on each subsequent preset blocking condition is stopped. 6. The method for blocking malicious IP addresses according to claim 1, wherein when an access request is received, acquiring the real IP address of the access request source client comprises: When an access request is received, determine whether there is a proxy server in front of the application layer; If there is no proxy server in front of the application layer, the IP address of the peer that establishes the link will be taken as the real IP address; If there is a proxy server in front of the application layer, the preset resolution method is used to obtain the real IP address. 7. the blocking processing method of malicious IP address according to claim 6, is characterized in that, described if there is proxy server in front of application layer, then applying preset analysis method to obtain real IP address comprises: Determine whether the peer IP address of the established link is a trusted IP; If the peer IP address for establishing the link is an untrusted IP, the peer IP address for establishing the link is used as the real IP address; If the peer IP address of the established link is a trusted IP, then determine whether the proxy server is a network layer proxy server; If the proxy server is a network layer proxy server, obtain the real IP address from the TCP message; If the proxy server is a non-network layer proxy server, then determine whether the header field of the access request is a custom header field; If the header field of the access request is a custom header field, then take the information in the header field as the real IP address; If the header field of the access request is a non-customized header field, the value of the X-Forwarded-For field in the header field of the access request is taken as the real IP address. 8. An apparatus for blocking and processing malicious IP addresses, wherein the apparatus for blocking and processing malicious IP addresses comprises: The configuration module is used to establish the IP address information base and configure the blocking strategy; a processing module, configured to obtain the real IP address of the source client of the access request when receiving the access request; A blocking module, configured to perform blocking processing on the real IP address based on the blocking strategy. 9. An electronic device, characterized in that the electronic device comprises: a memory and at least one processor, wherein instructions are stored in the memory; The at least one processor invokes the instructions in the memory, so that the electronic device executes the method for blocking malicious IP addresses according to any one of claims 1-7. 10. A computer-readable storage medium on which instructions are stored, wherein when the instructions are executed by a processor, the malicious IP according to any one of claims 1-7 is implemented Address blocking method.

Images