WO2018121331A1 - Attack request determination method, apparatus and server - Google Patents

Abstract

Provided in the present application are an attack request determination method, apparatus and server, the method comprising: receiving an access request; extracting first request information from the access request, and matching the first request information to information in multiple types of prearranged blacklist which support multiple matching parameters; when there is a successful match with information in any type of blacklist, determining that the access request is an attack request. Technical solutions of the present invention solve problems in the prior art of determining at attack request solely by means of frequency of access of an IP address, including not being applicable to a CC attack type having low IP address access frequency, not being able to accurately distinguish different types of CC attack, and having a high false positive rate; the present invention can make a decision on an access request on the basis of multiple types of matching parameter, said decision has broader dimensionality, the decision mode is more flexible, and decision results are more accurate.

Description

Method, device and server for determining attack request

The present application claims priority to Chinese Patent Application Serial No. No. No. No. No. No. No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No

Technical field

The present application relates to the field of Internet security technologies, and in particular, to a method, an apparatus, and a server for determining an attack request.

Background technique

With the continuous development of Internet services, the pages of websites are becoming more and more complex, and the processing of requests by websites requires more and more resources. In this case, the more users access, the higher the load on the system. The website is vulnerable to CC (Challenge Collapsar) attacks. CC attacks can cause huge resource consumption, which causes the page to open very slowly. If the CPU (Central Processing Unit) or bandwidth resources are consumed. As a result, there may be cases where the service is unavailable, which affects the user's access to the network, and the user experience is poor.

In the prior art, a CC attack is determined by performing statistics on an IP (Internet Protocol) address. If an IP address exceeds a threshold in a certain period of time, the IP address is obtained. Blacklisted and blocked based on IP address.

This method can detect CC attacks in the case of large-scale access using the same IP, but cannot accurately identify CC attacks such as random URI (Uniform Resource Identifiers) attack type and random domain name type, and only through IP. The angle is statistically simple and not flexible enough. The attacker can gradually reduce the number of attacks according to the rules of IP statistics, and then create malicious attacks whose access times do not exceed the set threshold. If the threshold is adjusted to a small value, the rate of killing will increase. Especially in the case of wireless network and network address translation (NAT), there are many users who use the same egress IP. Easy to cause manslaughter.

Summary of the invention

The present invention provides a method and a device for determining an attack request, so as to solve the problem that the attack request is determined only by the number of accesses of the IP address in the prior art, and the type of the CC attack with a low IP address access frequency is not applicable, and various types cannot be accurately identified. CC attack, high killing rate and other issues.

According to the first aspect of the embodiments of the present application, a method for determining an attack request, which is applied to a server, includes:

Receiving an access request;

Extracting the first request information in the access request, and matching the first request information with information in a preset blacklist of various types that support multiple matching parameters;

When the information in any type of blacklist is successfully matched, the access request is determined to be an attack request.

According to a second aspect of the embodiments of the present application, a device for determining an attack request, which is applied to a server, includes:

a receiving unit, configured to receive an access request;

a matching unit, configured to extract first request information in the access request, and match the first request information with information in a preset blacklist of various types that support multiple matching parameters;

The first determining unit is configured to determine that the access request is an attack request when the information in the blacklist of any type is successfully matched.

According to a third aspect of the embodiments of the present application, a server is provided, including:

a transceiver module, configured to receive an access request, and extract the first request information in the access request;

a blocking module, coupled to the execution module, for matching the first request information with pre-set information in various types of blacklists supporting multiple matching parameters, and in any type of black When the information in the list matches successfully, it is determined that the access request is an attack request.

According to a fourth aspect of the embodiments of the present application, there is provided an apparatus for determining an attack request, the apparatus being a server, comprising: a processor; a memory for storing the processor executable instructions; wherein the processor is Configured as:

Receiving an access request;

Extracting the first request information in the access request, and matching the first request information with information in a preset blacklist of various types that support multiple matching parameters;

When the information in any type of blacklist is successfully matched, the access request is determined to be an attack request.

According to a fifth aspect of the embodiments of the present application, a computer storage medium is provided, where the program medium is stored, and the instructions include:

Receiving an access request;

Extracting the first request information in the access request, and matching the first request information with information in a preset blacklist of various types that support multiple matching parameters;

When the information in any type of blacklist is successfully matched, the access request is determined to be an attack request.

It can be seen from the foregoing technical solutions that various types of blacklists supporting multiple matching parameters are set in the server in the embodiment of the present application, so that not only the number of accesses of the IP address can be determined, but also based on types such as header, cookie, and args. The judgment of the CC attack can make more accurate judgments on the attack request and avoid misjudgment; the judgment dimension is wider, the judgment mode is more flexible, and the judgment result is more accurate.

DRAWINGS

1 is a schematic diagram of a scenario of a method for determining an attack request of the present application;

2 is a flow chart of an embodiment of a method for determining an attack request of the present application;

3 is a hardware structure diagram of a device where the determining device of the attack request of the present application is located;

4 is a hardware structural diagram of an apparatus for determining an attack request according to the present application;

FIG. 5 is a block diagram of an embodiment of a determining apparatus for an attack request according to the present application.

detailed description

The terminology used in the present application is for the purpose of describing particular embodiments, and is not intended to be limiting. The singular forms "a", "the" and "the" It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

It should be understood that although the terms first, second, third, etc. may be used to describe various information in this application, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, the first information may also be referred to as the second information without departing from the scope of the present application. Similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "when" or "when" or "in response to a determination."

In the prior art, when a website is attacked by a CC, an IP address is usually determined based on the received request, and then the amount of access of the IP address in a certain period of time is counted. If the amount of access exceeds a set threshold, the IP is generated based on the IP address. IP blacklist to block requests from this IP address. This mode can only block CC attacks that are frequently accessed by the same IP address, but the attacker can attack the number of times less than the set threshold. In this way, the type of CC attack that does not have a high IP address access frequency is not. Applicable, for example, frequent access to the URI of a large file, using a small number of attacks to fill the server's egress bandwidth, affecting user access, in this case only blocking according to the IP address, most likely to access The IP address of other URIs causes misjudgment. For example, a domain name attack request for a CDN (Content Delivery Network) node may cause a CDN node to frequently query a DNS (Domain Name System), so that even if the amount of access (attack amount) is small, DNS may be caused. The server hangs. For example, for a random URI attack on a CDN node, such an attack that is not directly related to the amount of access to the IP address causes the request to penetrate to the source station each time, resulting in a service exception. For example, it simulates some very time-consuming operations when a user visits a website, such as an order operation on an e-commerce website. Such an attack may cause the website to be embarrassed even if the amount of the visit is small. In summary, the way in which the IP address based access is identified does not accurately determine the various CC attacks described above.

An embodiment of the present application provides a method and apparatus for determining a new attack request, and determining various types of blacklists by using a preset expression and request information and response information in a set time period, and receiving based on the blacklist The request is judged and blocked. This method can configure a number of targeted expressions according to the characteristics of the attack type, so as to achieve effective defense against various types of CC attacks. The embodiment of the present application may be applied to a server, where the server may be a physical or logical server, or may be a physical or logical server that shares two or more different responsibilities, and cooperate with each other to implement the server in the embodiment of the present application. Various functions. The embodiments of the present application do not limit the types of servers, the types and protocols of communication networks between servers, and the like.

FIG. 1 is a schematic diagram of a scenario for determining an attack request according to an embodiment of the present application:

1 includes: a server, n computers, respectively a first computer, a second computer up to an Nth computer, and the server receives a request from n computers.

The process of determining the attack request applied to the server is as shown in FIG. 2, and includes the following steps:

Step 201: Receive an access request.

In the embodiment of the present application, the request may include an application layer request such as a http (Hyper Text Transfer Protocol) request, a rrt request, and an mp request, and the requested content may include a request for a webpage, a video, a live broadcast, and the like. In the embodiment of the present application, the http request is taken as an example for description.

Step 202: Extract the first request information in the access request, and match the first request information with information in various types of blacklists that support multiple matching parameters.

In the step of the application, the server parses the received access request, and the obtained first request information may include any one or more of the following parameters, but is not limited to the following parameters:

Count, which indicates the number of accesses of the corresponding blacklist key (the blacklist key value, which can be understood as the above matching parameter). For example, the filtering information in the blacklist is IP=111.1.1.1, then count can represent the address of the IP=111.1.1.1. Number of visits.

Uri_num indicates the number of times a URI is accessed, for example, uri_num/a and uri_num/b are different URIs.

Status_count indicates the number of times a status code is returned in the request. It needs to take parameters, such as status_count|404, to indicate the number of times the status code 404 is returned in the request.

Status_ratio, which indicates the ratio of the number of times a status code is returned in the request to the total number of accesses. It needs to take parameters, such as status_ratio|404, indicating the number of times the status code 404 is returned in the request as a percentage of the total number of accesses. Among them, the total number of visits refers to the number of visits within the set time interval.

Arg_num, which means that the number of args carried in the request, with parameters, can be represented by arg_num|x, such as /a? x=1 and /a? x=2 means that the visit was 2 times.

None_arg_ratio, which means that the ratio of requests that do not carry an arg to the total number of requests needs to be parameterized, such as none_arg_ratio|x, that is, the ratio of requests that do not carry arg to x to the total number of requests. The total number of requests indicates the total number of requests received within the set time interval during the validity period of the blacklist.

Cookie_num, which indicates the number of cookies in the request, which needs to be parameterized. For example, cookie_num|x indicates the number of cookies in the request.

None_cookie_ratio, which means that the ratio of requests that do not carry a cookie to the total number of requests needs to be parameterized, for example, none_cookie_ratio|x, which means that the number of requests that do not carry the cookie x is the ratio of the total number of requests.

Req_header_num, which indicates the number of headers carried in the request. It needs to take parameters, such as req_header_num|x, to indicate that the number of headers in the request is x.

None_req_header_ratio indicates that the number of requests that do not carry a header accounts for the total number of requests. For example, none_header_ratio|x indicates that the number of requests that do not carry the header x is the ratio of the total number of requests.

Resp_header_num, which indicates the number of headers carried in the response. It needs to take parameters. For example, the number of headers x is in the response of resp_header_num|x.

None_req_header_ratio indicates the ratio of the response that does not carry a header to the total number of requests. It needs to take parameters, such as none_header_ratio|x, to indicate that the response of the header is not the proportion of the total number of requests.

Method_ratio, which indicates the ratio of the number of requests submitted in a certain way to the total number of requests, and needs to take parameters, such as method_ratio|POST, indicating the proportion of requests submitted in post mode to the total number of accesses. The request can also be The get mode submission, the delete submission, the header submission, and the put submission can all calculate the proportion of the corresponding requests to the total number of requests.

Method_count represents the number of requests submitted in a certain way, with parameters, such as method_count|POST, indicating the number of requests submitted in POST.

Req_traffic, which indicates the total traffic value of the request, that is, the total traffic value consumed by the request received during the blacklist validity period.

Resp_traafic, which represents the total traffic value of the response, that is, the total traffic value consumed by the response sent during the blacklist validity period.

In the embodiment of the present application, the server may preset a blacklist that supports multiple matching parameters, and the blacklist includes multiple types, instead of the type only for the IP address as in the prior art, setting the blacklist includes the following steps (figure Not shown in 2):

Step 301: Parse the access request and/or the sent response received within the set time period, and obtain the second request information and/or the response information respectively.

In the step of the present application, the set time period may be a time period separated by an execution time interval of an expression for indicating an attack condition, for example, the execution time interval is 10 s, and the set time period is 10 s before the current time. segment. The second request information and the response information may be any one or more of the parameters listed in step 202 above.

Step 302: Extract information corresponding to the variable from the second request information and/or the response information based on the variable in the preset expression.

In the embodiment of the present application, an expression may be preset, which is composed of a variable and an operator, and is used to indicate an attack condition. In the embodiment of the present application, multiple types of expressions may be set based on various types and characteristics of the CC attack, so that Subsequent generation of blacklists covering multiple CC attack types can be generated. In this step, information of the variable corresponding to the expression in the second request information and/or the response information is extracted.

Among them, operators can include but are not limited to the following:

brackets:()

Greater than: >

Less than: <

Or operator: ||

And operator: &&

Through the above-mentioned setting expression, the flexibility of statistics is increased, and the expression can be adjusted in time according to the type and actual situation of the attack, thereby facilitating accurate judgment on various attacks, thereby expanding the coverage of the attack, and simultaneously The status code, header, and flow information are combined to determine the dimension and the judgment result is more accurate.

Step 303: Perform the operation by substituting the extracted information as an input into a variable of the expression.

After extracting the information of all the variables corresponding to the expression, the server substitutes the extracted information into the variable of the expression to perform an operation.

Step 304: When the operation result is that the attack condition is met, the blacklist is generated based on the type of the parameter in the expression.

Since the expression indicates an attack condition, when the operation result is true, it indicates that the information substituted into the expression variable conforms to the attack condition, and the access request corresponding to the information is most likely an attack request. Therefore, when the operation result is YES, a blacklist can be generated. When the operation result is negative (false), it indicates that the information substituted into the expression variable does not meet the attack condition, and the access request corresponding to the information is usually not an attack request.

As can be seen from the above description, the blacklist is pre-generated, and the statistics and the blacklist are generated after the request is received. The process of determining is relatively simple, and only determining whether the information in the access request exists in the blacklist. That way, this method is quick and does not prolong the response time of the access, especially suitable for high-concurrency scenarios, and is especially suitable for distributed environment, all the http information of the whole distributed environment is counted, and the coverage is wider. .

Specifically, in the embodiment of the present application, the blacklist is classified into four types, and the blacklist type corresponds to the matching parameter, that is, the blacklist supports four matching parameters: including: IP, header_x, cookie_x, and arg_x.

For example, IP=111.1.1.1 indicates that the IP address is used as the type and the blacklist with the IP address 111.1.1.1 is generated.

Header_host=ww.cdn.com, which indicates that the host (the domain name and port number of the specified request server) in the header (header) that generated the request is the blacklist of ww.cdn.com.

Cookie_unc=test, which indicates the blacklist of unc=test in the cookie that generated the request.

Arg_user=admin, which means that the blacklist of user=admin in the request parameter is generated.

Then, in this step, it is necessary to determine the blacklist type to which the variable of the expression whose operation result is YES, and then generate a blacklist of the corresponding type according to the blacklist type and the information to be substituted.

For example, for the expression: "none_cookie_ratio|t">0.5, when the result of the information in the expression is YES, according to the variable none_cookie_ratio corresponding to the expression, it can be determined that the blacklist type belongs to cookie_x, then it can generate " The blacklist of unc=test in the cookie.

For another example, for a CC attack against a random domain name and a random URI, the expression is:

("status_ratio|404">0.6&&"uri_num">5&&"count">50000)||("status_ratio|502">0.6&&"count">100)||("status_ratio|504">0.6&&"count ">500)||("status_ratio|503">0.6&&"count">500), which combines the status code, the number of requested URIs and the number of requests to comprehensively determine whether there is a CC attack. The more matching parameters, the more flexible the judgment method and the more accurate the judgment result.

In the step of the present application, since there are multiple blacklist types and there are multiple variables in the expression, there may be cases where the variables of one expression belong to different blacklist types, that is, the black corresponding to an expression. There are two or more types of lists. In this case, you can set the priority of the blacklist type and generate only the blacklist of the highest priority type. Or you can specify, for example, only generate a blacklist of IPs, or just generate a blacklist for the header.

In the step of this application, if there are multiple expressions set, the number of blacklists may be more. When the first request information is matched with the information in the preset blacklist, if the number of blacklists is less than the set threshold, the first request information may be sequentially and information in each blacklist. If the number of blacklists is large, the efficiency of traversing each blacklist is relatively low. In this case, a blacklisted binary tree can be generated based on the blacklist type.

Step 203: When the information in the blacklist of any type is successfully matched, determine that the access request is an attack request.

When the first request information is successfully matched with the information in the blacklist, the corresponding access request can be determined as an attack request. For example, in the blacklist, IP=111.1.1.1, and the IP of the first request information is also 111.1.1.1, then the match is successful. For example, in the blacklist, user=admin, and the user in the first request information is also admin, then the matching is successful, and the corresponding access request is determined to be an attack request.

In an embodiment, as shown in FIG. 1,

The server pre-sets the blacklist: the server parses the access request and/or the response received during the set time period, and extracts the second request information and/or response information, where the second request information and the response information are It is any of the above matching parameters. The server then reads the pre-set expression, which consists of variables and operators. For example, if the expression is method_count|POST>5, then the number of requests submitted in POST as indicated in the formula needs to be from the second. Request information extracted from the information. Then the server takes the extracted second request information and/or response information as input into the variable of the expression for calculation, and still takes the above expression as an example, if the second request information extracted by the server is 7, due to 7>5 , the operation result is yes, the representation is established, and the operation result is in accordance with the attack condition, so the server generates a blacklist based on the type of the parameter in the expression. The expression is of type header, thus generating a blacklist of type header, and the matching parameters in the blacklist include method_count.

After receiving the blacklist, the server receives the http access request from the computer, and the server extracts the first request information in the http access request, including count, uri_num, status_count, etc., and separately extracts the extracted information. The information in the various types of blacklists set is matched, wherein the blacklist supports multiple matching parameters, and the matching parameters correspond to the information extracted in the access request. When the first request information is successfully matched with the information in any type of blacklist, the access request is determined to be an attack request.

For example, the extracted first request information includes: count, none_cookie_ratio|t, status_ratio| 404. And an expression is:

("count">1000&&"none_cookie_ratio|t">0.5)||("count">100&&"status_ratio|404">0.8)

If the total number of accesses of an IP in the first request message is greater than 1000, and the proportion of the cookie that does not contain t is greater than 0.5 or the total number of requests accessed is greater than 100, and the status code of the returned 404 is greater than 0.8, The IP address matching parameters including count, none_cookie_ratio, and status_ratio are successfully matched, thereby determining that the access request is an attack request.

After the attack request is determined, the method provided by the embodiment of the present application may further include the following steps:

The corresponding blocking scheme is determined based on the blacklist of the matching success, and then the attack request is blocked based on the determined blocking scheme.

In the server, each type of blacklist is stored with a blocking scheme corresponding to different blocking responses for different types of CC attacks.

In the embodiment of the present application, the blocking scheme may include but is not limited to the following:

Login: indicates the jump login page;

Wait: indicates the jump waiting page;

Challenge: indicates the jump to the human machine challenge page;

Chaptcha: indicates the jump verification code page;

Deny: indicates that the rejection page is returned;

Close: indicates that the connection is directly disconnected.

The embodiments of the present application adopt different blocking schemes instead of the direct disconnection in the prior art, so as to be applicable to different service scenarios and attack scenarios. For example, if the current attack request seriously affects the current service, you can directly disconnect. If a suspected attack occurs, you can jump to the verification code page.

The expression has an execution time interval, that is, the expression generates a blacklist every execution interval. Then, in the embodiment of the present application, the first time length of the statistical expression from the last execution time; when the first time length reaches the first set time length, that is, when the time interval is executed, a new blacklist is generated based on the expression; Overwrite the current blacklist with the new blacklist.

Among them, the blacklist has an expiration_time, that is, the generated blacklist is valid only during the validity period. Then, in the embodiment of the present application, each blacklist is counted from the time of generation to the second time length from the time of generation; and when the second time length reaches the second set time length, it will be black. The list is set to invalid. The blacklist is usually valid for a longer period of time than the expression, so that the current blacklist is not valid and the new blacklist has not yet been generated.

In the above manner, it is ensured that the blacklist is always generated based on the latest request information and response information, and the blacklist is adjusted according to the current service situation and the attack situation, thereby ensuring the timeliness of the blacklist and ensuring more accurate determination. Attack requests, improve anti-attack efficiency and reduce the rate of missed attacks.

It can be seen from the prior art that the manner of determining the attack request only by the number of accesses of the IP address is not applicable to the CC attack type with a low IP address access frequency, and the killing rate is high. The present application not only judges the number of accesses of the IP address, but also judges the CC attack based on the header, the cookie, and the args, thereby enabling more accurate judgment of the attack request. It can also be judged based on the status code/flow information/method, so that the dimension is wider, the judgment mode is more flexible, and the judgment result is more accurate.

FIG. 3 is a schematic diagram of a module of a server according to an embodiment of the present disclosure. FIG. 3 includes: a transceiver module 11, a statistics module 12, a configuration module 13, an execution module 14, and a blocking module 15.

The transceiver module 11 is configured to receive an access request, and send a response based on the access request, for example, receiving an http access request and sending an http response, and recording and reporting the request information and the response information. The transceiver module 11 is typically set up based on nginx or Squid software.

The statistics module 12 is connected to the transceiver module 11 and configured to receive the request information and the response information reported by the transceiver module 11, and collect statistics on the variables corresponding to the expression from the request information and the response information according to a preset expression, and The result is reported to the execution module 14.

The configuration module 13 is connected to the execution module 14 for providing a dynamic expression configuration interface, and delivers an expression for indicating an attack condition to the execution module 14 in real time.

The execution module 14 is configured to parse the expression, and generate a blacklist according to the expression and the statistical result of the statistics module 12. Specifically, the information of the statistical module 12 is brought into the variable of the expression to perform an operation. If the result of the operation is YES, the blacklist of the corresponding type is generated by the blacklist type to which the variable according to the expression belongs.

The blocking module 15 is connected to the execution module 14 for matching the access request received by the transceiver module 11 according to the blacklist generated by the execution module 14, and blocking the access request matching the blacklist.

Corresponding to the embodiment of the determining method of the attack request of the present application, the present application also provides an embodiment of the determining device for the attack request.

An embodiment of the determining device of the attack request of the present application can be applied to a server. The device embodiment may be implemented by software, or may be implemented by hardware or a combination of hardware and software. Taking the software implementation as an example, as a logical means, the processor of the device in which it is located reads the corresponding computer program instructions in the non-volatile memory into the memory. From the hardware level, as shown in FIG. 4, a hardware structure diagram of the device where the determining device of the attack request is located, except for the processor, the memory, the network interface, and the non-volatile memory shown in FIG. In addition, the device in which the device is located in the embodiment may also include other hardware according to the actual function of the device, which is not shown in FIG. 4 .

Referring to FIG. 5, it is a block diagram of an embodiment of a determining apparatus for an attack request according to the present application. The apparatus may be applied to a server, and the apparatus includes: a receiving unit 510, a matching unit 520, and a first determining unit 530.

The receiving unit 510 is configured to receive an access request.

The matching unit 520 is configured to extract the first request information in the access request, and match the first request information with information in a preset blacklist of various types that support multiple matching parameters.

The first determining unit 530 is configured to determine that the access request is an attack request when the information in the blacklist of any type is successfully matched.

In an alternative implementation, the apparatus may also include (not shown in Figure 5):

The parsing unit is configured to parse the access request received in the set time period, obtain the second request information, and/or parse the response sent in the set time period to obtain response information;

An extracting unit, configured to extract information corresponding to the variable from the second request information and/or the response information based on a preset variable in an expression for indicating an attack condition;

An operation unit, configured to substitute the extracted information as an input into a variable of the expression to perform an operation;

The first generating unit is configured to generate a blacklist of the corresponding type based on the blacklist type to which the variable of the expression belongs when the operation result is that the attack condition is met.

In another optional implementation, the first generating unit may include (not shown in FIG. 5):

a first determining subunit, configured to determine a variable in an expression that meets the attack condition;

a second determining subunit, configured to search for a preset blacklist type, and determine a blacklist type to which the variable belongs;

And generating a sub-unit, configured to generate a blacklist of a corresponding type according to the blacklist type, where the blacklist type corresponds to the matching parameter.

In another optional implementation, the blacklist type includes: an internet protocol address, header_x, cookie_x, and arg_x.

In another alternative implementation, the apparatus may also include (not shown in FIG. 5):

A storage unit is configured to store different types of blacklists and blocking schemes.

In another optional implementation, the apparatus further includes (not shown in FIG. 5):

a second determining unit, configured to determine a corresponding blocking scheme based on the blacklist matching the success;

And a blocking unit, configured to block the determined attack request based on the blocking scheme.

In another optional implementation, the blocking scheme includes any one of a jump page, a return rejection page, and a disconnection.

In another optional implementation, the apparatus further includes (not shown in FIG. 5):

a statistical unit for counting the length of time the expression is from the last execution time;

a second generating unit, configured to generate a new blacklist based on the expression when the first time length reaches a first set time length;

Coverage unit for overwriting the current blacklist with the new blacklist.

The implementation process of the function and the function of each unit in the foregoing device is specifically described in the implementation process of the corresponding steps in the foregoing method, and details are not described herein again.

For the device embodiment, since it basically corresponds to the method embodiment, reference may be made to the partial description of the method embodiment. The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, ie may be located A place, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the objectives of the present application. Those of ordinary skill in the art can understand and implement without any creative effort.

It can be seen from the above embodiment that the server adds a file task in the file task table, and sets a field including a service time period and a file generation time in the file task, and uses the sql logic statement to perform data storage time and file generation time. Contrast, it can ensure the complementarity and non-repetition of the found normal data and missing data, and can summarize the missing data effectively, timely, complete and accurate, and timely feedback to the fund company, greatly improving the operational efficiency.

Other embodiments of the present application will be readily apparent to those skilled in the <RTIgt; The application is intended to cover any variations, uses, or adaptations of the application, which are in accordance with the general principles of the application and include common general knowledge or common technical means in the art that are not disclosed herein. . The specification and examples are to be regarded as illustrative only,

It is to be understood that the invention is not limited to the details of the details and The scope of the present application is limited only by the accompanying claims.

Claims (23)

A method for determining an attack request, which is applied to a server, and includes: Receiving an access request; Extracting the first request information in the access request, and matching the first request information with information in a preset blacklist of various types that support multiple matching parameters; When the information in any type of blacklist is successfully matched, the access request is determined to be an attack request. The method of claim 1 further comprising: Parsing the access request received in the set time period, obtaining the second request information, and/or parsing the response sent within the set time period to obtain response information; Extracting information corresponding to the variable from the second request information and/or the response information based on a pre-set variable in an expression representing an attack condition; Substituting the extracted information as an input into a variable of the expression for operation; When the operation result is that the attack condition is met, a blacklist of the corresponding type is generated based on the blacklist type to which the variable of the expression belongs. The method of claim 2, wherein the blacklist based on the variable to which the expression belongs is generated by a blacklist of a corresponding type, including: Determining variables in the expression that match the attack condition; Find a pre-set blacklist type and determine the blacklist type to which the variable belongs. Generating a blacklist of a corresponding type based on the blacklist type, where the blacklist type corresponds to the matching parameter. The method according to claim 3, wherein the blacklist type comprises: an internet protocol address, a header, a cookie, a status code, traffic information, and parameters. The method of claim 3, wherein the method further comprises: Store different types of blacklists and blocking schemes. The method of claim 5, wherein the method further comprises: Determining a corresponding blocking scheme based on the blacklist of successful matching; The determined attack request is blocked based on the blocking scheme. The method according to claim 6, wherein the blocking scheme comprises: jumping a page, returning a rejection page, disconnecting any one of the connections. The method according to any one of claims 2-7, wherein the method further comprises: Counting the first length of time from the last execution time of the expression; Generating a new blacklist based on the expression when the first time length reaches a first set time length; Overwrite the current blacklist with the new blacklist. The method according to any one of claims 1 to 7, wherein the method further comprises: Counting the second time length of the blacklist from the time of generation; When the second time length reaches the second set time length, the blacklist is set to be invalid. An apparatus for determining an attack request, which is applied to a server, and includes: a receiving unit, configured to receive an access request; a matching unit, configured to extract first request information in the access request, and match the first request information with information in a preset blacklist of various types that support multiple matching parameters; The first determining unit is configured to determine that the access request is an attack request when the information in the blacklist of any type is successfully matched. The device according to claim 10, wherein the device further comprises: The parsing unit is configured to parse the access request received in the set time period, obtain the second request information, and/or parse the response sent in the set time period to obtain response information; An extracting unit, configured to extract information corresponding to the variable from the second request information and/or the response information based on a preset variable in an expression for indicating an attack condition; An operation unit, configured to substitute the extracted information as an input into a variable of the expression to perform an operation; The first generating unit is configured to generate a blacklist of the corresponding type based on the blacklist type to which the variable of the expression belongs when the operation result is that the attack condition is met. The apparatus according to claim 11, wherein the first generating unit comprises: a first determining subunit, configured to determine a variable in an expression that meets the attack condition; a second determining subunit, configured to search for a preset blacklist type, and determine a blacklist type to which the variable belongs; And generating a sub-unit, configured to generate a blacklist of a corresponding type according to the blacklist type, where the blacklist type corresponds to the matching parameter. The apparatus according to claim 12, wherein the blacklist type comprises: an internet protocol address, a header, a cookie, a status code, traffic information, and parameters. The device of claim 12, wherein the device further comprises: A storage unit is configured to store different types of blacklists and blocking schemes. The device according to claim 14, wherein the device further comprises: a second determining unit, configured to determine a corresponding blocking scheme based on the blacklist matching the success; And a blocking unit, configured to block the determined attack request based on the blocking scheme. The apparatus according to claim 15, wherein the blocking scheme comprises any one of a jump page, a return rejection page, and a disconnection. The device according to any one of claims 11 to 16, wherein the device further comprises: a statistical unit, configured to count the first time length of the expression from the last execution time; a second generating unit, configured to generate a new blacklist based on the expression when the first time length reaches a first set time length; Coverage unit for overwriting the current blacklist with the new blacklist. A server, comprising: a transceiver module, configured to receive an access request, and extract the first request information in the access request; a blocking module, configured to match the first request information with pre-set information in various types of blacklists supporting multiple matching parameters, and when the information in any type of blacklist matches successfully Determining that the access request is an attack request. The server according to claim 18, wherein the transceiver module is further configured to parse an access request received within a set time period, obtain second request information, and/or set the time The response sent in the segment is parsed to obtain response information; The server further includes: The statistics module is connected to the transceiver module, and is configured to receive the request information and the response information reported by the transceiver module, and the statistics corresponding to the expression are sent from the request information and the response information according to a preset expression for indicating an attack condition. The information of the variable and report the statistical result to the execution module; a configuration module, connected to the execution module, configured to provide an expression configuration interface, and deliver the expression to the execution module; The execution module is connected to the blocking module, and is configured to parse the received expression, and generate various types of blacklists according to the expression and the statistical result of the statistical module. The server according to claim 19, wherein said execution module is configured to: Substituting information of the statistics module as input into a variable of the expression for operation; When the operation result is that the attack condition is met, a blacklist of the corresponding type is generated based on the blacklist type to which the variable of the expression belongs. The server according to claim 18, wherein said blocking module is further configured to block said attack request. An apparatus for determining an attack request, wherein the apparatus is a server, comprising: a processor; a memory for storing the processor-executable instructions; wherein the processor is configured to: Receiving an access request; Extracting the first request information in the access request, and matching the first request information with information in a preset blacklist of various types that support multiple matching parameters; When the information in any type of blacklist is successfully matched, the access request is determined to be an attack request. A computer storage medium storing program instructions in the storage medium, wherein the instructions include: Receiving an access request; Extracting the first request information in the access request, and matching the first request information with information in a preset blacklist of various types that support multiple matching parameters; When the information in any type of blacklist is successfully matched, the access request is determined to be an attack request.

Images