CN112202878B

CN112202878B - Session processing method, device, server and machine-readable storage medium

Info

Publication number: CN112202878B
Application number: CN202011050934.8A
Authority: CN
Inventors: 王健
Original assignee: New H3C Security Technologies Co Ltd
Current assignee: New H3C Security Technologies Co Ltd
Priority date: 2020-09-29
Filing date: 2020-09-29
Publication date: 2022-03-22
Anticipated expiration: 2040-09-29
Also published as: CN112202878A

Abstract

The embodiment of the disclosure provides a session processing method, a session processing device, a server and a machine-readable storage medium, which are used for acquiring a request interval sequence containing time intervals of a plurality of requests sent by opposite terminals in a preset session period, and setting a session as invalid if the time intervals in the request interval sequence are periodic. The request interval sequence records time intervals of a plurality of requests sent by the opposite terminal in the preset session period, if the time intervals are periodic, the opposite terminal initiates the requests in a polling mode, under the condition, the server can judge that the opposite terminal does not perform any operation in the preset session period, the session is set to be invalid, and the condition that the session is still valid under the condition that the opposite terminal does not operate in the preset session period is avoided, so that the system safety is improved.

Description

Session processing method, device, server and machine-readable storage medium

Technical Field

The present disclosure relates to the field of communications technologies, and in particular, to a session processing method, an apparatus, a server, and a machine-readable storage medium.

Background

In a C/S (client/Server) system, when a client accesses a Server, a request is sent to the Server. The client initiates a request for the first time, establishes connection with the server and successfully logs in, and then the server generates a session in order to avoid logging in every access, when the client initiates the request to the server again, the server firstly verifies whether the session is valid, and if so, the server responds to the request. If the client does not initiate the request for a long time, setting the session to be invalid, and if the client initiates the request again and the server finds that the session is invalid, the server does not directly respond to the request and performs the operations of connection and login again.

In practical applications, especially in web applications, a client often has a need to refresh data periodically, that is, to request data recorded on the server side periodically, and the client initiates a request for obtaining data to the server in a polling manner. If the client does not perform any operation for a long time after receiving the data, the session should be set to be invalid at the moment in order to ensure the security of the system. However, since the client initiates a request for obtaining data to the server in a polling manner, that is, the server receives the request all the time, session failure is not set, which causes a hidden danger in system security.

Disclosure of Invention

The embodiment of the disclosure aims to provide a session processing method, a session processing device, a server and a machine-readable storage medium, so as to improve system security. The specific technical scheme is as follows:

in a first aspect, an embodiment of the present disclosure provides a session processing method, where the method includes:

establishing a session with an opposite terminal;

determining a request interval sequence of the opposite terminal according to the request sent by the opposite terminal, wherein the request interval sequence comprises time intervals of a plurality of requests sent by the opposite terminal in a preset session period;

setting the session to expire if the time intervals in the sequence of request intervals are periodic.

In a possible implementation manner, the determining a request interval sequence of the peer end according to the request sent by the peer end includes:

receiving a plurality of requests sent by the opposite terminal in a preset session period, and recording a timestamp of each received request to obtain a request time sequence;

clustering the timestamps in the request time sequence to obtain a plurality of timestamp clusters, wherein the difference value of any two timestamps in the same timestamp cluster is smaller than a first preset threshold value;

aiming at each timestamp cluster, calculating a cluster timestamp of the timestamp cluster according to the timestamp in the timestamp cluster;

and respectively calculating the difference value of every two cluster time stamps adjacent in the time domain to obtain a request interval sequence formed by all the difference values.

In a possible implementation manner, the setting method of the first preset threshold includes:

acquiring a plurality of preset request sequences of polling requests, wherein the request sequences comprise timestamps of opposite terminals for sending the polling requests;

clustering the request sequences of all polling requests to obtain a plurality of request clusters;

calculating the time difference between the last time stamp and the first time stamp in the request cluster aiming at each request cluster to obtain the time width of the request cluster;

setting the maximum value of the time widths of all the request clusters as the first preset threshold value.

In a possible implementation, before the step of setting a session to expire if the time interval in the sequence of request intervals is periodic, the method further comprises:

equally dividing the request interval sequence to obtain a first sequence and a second sequence;

determining a longest common subsequence of the first sequence and the second sequence using a longest common subsequence algorithm;

determining that the time interval in the request interval sequence is periodic if the longest common subsequence matches the tail of the first sequence, the longest common subsequence matches the head of the second sequence, the remaining portion of the first sequence other than the longest common subsequence matches the tail of the longest common subsequence, and the remaining portion of the second sequence other than the longest common subsequence matches the head of the longest common subsequence.

In one possible embodiment, the step of determining the longest common subsequence of the first sequence and the second sequence using a longest common subsequence algorithm includes:

extracting a first subsequence in the first sequence and a second subsequence in the second sequence;

and calculating difference values of the elements in the first subsequence and the elements in the second subsequence in sequence, and if all the difference values are smaller than a second preset threshold value, determining the longest common subsequence based on the first subsequence and the second subsequence.

In a possible implementation manner, the setting manner of the second preset threshold includes:

the method comprises the steps of obtaining a plurality of first sample request sequences and a plurality of second sample request sequences, wherein the first sample request sequences are preset polling request sequences, and the second sample request sequences are preset polling request sequences comprising a plurality of random requests or doped random requests;

acquiring each preset second preset threshold to be tested, and respectively calculating the periodic hit rate of the time interval in the request interval sequence corresponding to each first sample request sequence under different second preset thresholds to be tested and the periodic false judgment rate of the time interval in the request interval sequence corresponding to each second sample request sequence to obtain the hit rate and the false judgment rate corresponding to each second preset threshold to be tested;

and selecting the second preset threshold value from the second preset threshold values to be tested according to the hit rate and the misjudgment rate corresponding to the second preset threshold values to be tested.

In a possible implementation manner, the selecting the second preset threshold from the second preset thresholds to be tested according to the hit rate and the false positive rate corresponding to each second preset threshold to be tested includes:

and selecting the second preset threshold to be tested with the minimum misjudgment rate as the second preset threshold from the second preset thresholds to be tested, wherein the corresponding hit rate is greater than the preset first numerical value and the corresponding misjudgment rate is less than the second numerical value.

In a second aspect, an embodiment of the present disclosure provides a session processing apparatus, including:

the session establishing module is used for establishing a session with an opposite terminal;

a sequence determining module, configured to determine a request interval sequence of the peer end according to a request sent by the peer end, where the request interval sequence includes time intervals of multiple requests sent by the peer end in a preset session period;

a session setting module, configured to set the session to be invalid if the time interval in the request interval sequence is periodic.

In a third aspect, an embodiment of the present disclosure provides a server, including a session unit and a bypass analysis unit;

the session unit is used for establishing a session with an opposite terminal; receiving a plurality of requests sent by the opposite terminal in a preset session period, and recording a timestamp of each received request to obtain a request time sequence;

the bypass analysis unit is used for acquiring the request time sequence from the conversation unit; clustering the timestamps in the request time sequence to obtain a plurality of timestamp clusters, wherein the difference value of any two timestamps in the same timestamp cluster is smaller than a first preset threshold value; aiming at each timestamp cluster, calculating a cluster timestamp of the timestamp cluster according to the timestamp in the timestamp cluster; respectively calculating the difference value of every two cluster time stamps adjacent to each other in the time domain to obtain a request interval sequence formed by all the difference values; if the time interval in the request interval sequence is periodic, a failure instruction is sent to the conversation unit;

the session unit is further configured to set the session of the opposite end to be invalid after receiving the invalidation instruction sent by the bypass analysis unit.

In a fourth aspect, embodiments of the present disclosure provide a server comprising a processor and a machine-readable storage medium, wherein,

a machine readable storage medium for storing a computer program;

a processor, configured to execute a computer program stored on a machine-readable storage medium, to implement the method provided by the first aspect of the embodiments of the disclosure.

In a fifth aspect, the present disclosure provides a machine-readable storage medium, in which a computer program is stored, and when the computer program is executed by a processor, the method provided by the first aspect of the present disclosure is implemented.

In a sixth aspect, the disclosed embodiments also provide a computer program product containing instructions, which when run on a computer, cause the computer to perform the method provided by the first aspect of the disclosed embodiments.

According to the session processing method, the session processing device, the server and the machine-readable storage medium provided by the embodiment of the disclosure, a request interval sequence including time intervals of a plurality of requests sent by an opposite terminal in a preset session period is obtained, and if the time intervals in the request interval sequence are periodic, a session is set to be invalid. The request interval sequence records time intervals of a plurality of requests sent by the opposite terminal in the preset session period, if the time intervals are periodic, the opposite terminal initiates the requests in a polling mode, under the condition, the server can judge that the opposite terminal does not perform any operation in the preset session period, the session is set to be invalid, and the condition that the session is still valid under the condition that the opposite terminal does not operate in the preset session period is avoided, so that the system safety is improved.

Drawings

In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present disclosure, and it is obvious for those skilled in the art that other embodiments can be obtained by using the drawings without creative efforts.

Fig. 1 is a schematic flow chart of a session processing method according to an embodiment of the present disclosure;

fig. 2 is a schematic view of a device status monitoring page of the operation and maintenance system according to the embodiment of the disclosure;

fig. 3 is a flowchart illustrating a session processing method according to another embodiment of the disclosure;

fig. 4 is a schematic diagram of an experimental result after adjusting a second preset threshold according to an embodiment of the disclosure;

fig. 5 is a flowchart illustrating a session processing method according to still another embodiment of the disclosure;

FIG. 6 is a flowchart illustrating an embodiment of the present disclosure for determining whether a sequence is a periodic sequence within tolerance of an error;

fig. 7 is a schematic structural diagram of a session processing apparatus according to an embodiment of the present disclosure;

fig. 8 is a schematic structural diagram of a server according to an embodiment of the present disclosure;

fig. 9 is a schematic structural diagram of a server according to another embodiment of the present disclosure;

fig. 10 is a schematic structural diagram of a server according to still another embodiment of the present disclosure.

Detailed Description

The technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the drawings in the embodiments of the present disclosure, and it is obvious that the described embodiments are only a part of the embodiments of the present disclosure, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments disclosed herein without making any creative effort, shall fall within the protection scope of the present disclosure.

In order to improve the security of a C/S system, the embodiment of the disclosure provides a session processing method, a session processing device, a server and a machine-readable storage medium. In the following, a session processing method provided by the embodiment of the present disclosure is first described.

The execution main body of the session processing method provided by the embodiment of the disclosure is a server in a C/S system. The manner of implementing the session processing method provided by the embodiment of the present disclosure may be at least one of software, hardware circuit, and logic circuit provided in the server.

The opposite end in the embodiment of the disclosure is a Customer, namely a client, in the C/S system; in some embodiments, the peer may also play the role of a server of other clients, and all of them are within the protection scope of the present application.

As shown in fig. 1, a session processing method provided by an embodiment of the present disclosure may include the following steps.

S101, establishing a session with an opposite terminal.

S102, determining a request interval sequence of the opposite terminal according to a request sent by the opposite terminal, wherein the request interval sequence comprises time intervals of a plurality of requests sent by the opposite terminal in a preset session period.

S103, if the time interval in the request interval sequence is periodic, setting the session to be invalid.

By applying the embodiment of the disclosure, the server firstly needs to establish a session with the opposite terminal, and after the session is established, the opposite terminal can request data from the server based on the session. The server obtains a request interval sequence containing a plurality of request time intervals sent by opposite terminals in a preset session period, and if the time intervals in the request interval sequence are periodic, the session is set to be invalid. The request interval sequence records time intervals of a plurality of requests sent by the opposite terminal in the preset session period, if the time intervals are periodic, the opposite terminal initiates the requests in a polling mode, under the condition, the server can judge that the opposite terminal does not perform any operation in the preset session period, the session is set to be invalid, and the condition that the session is still valid under the condition that the opposite terminal does not operate in the preset session period is avoided, so that the system safety is improved.

When an opposite terminal has requirements for data access, data refresh and the like, a corresponding request is sent to a server, and under a normal condition, the opposite terminal sends a plurality of requests to the server within a period of time, wherein the requests can be sent by the opposite terminal simultaneously or at intervals. When the opposite terminal sends the request, the opposite terminal can know the time for sending the request by itself, so the opposite terminal can send a request interval sequence to the server, and the request interval sequence records the time intervals of a plurality of requests sent by the opposite terminal in a preset session period. Of course, the opposite end may also send a request only to the server, and the server receives the request, records the time when the request is received, and then calculates the time intervals of multiple requests sent by the opposite end within the preset session period to form a request interval sequence. The preset session period refers to a preset timeout duration of a session between the peer and the server, for example, if the preset session period is set to 30 minutes, if there is no request response action for more than 30 minutes between the peer and the server, the session will fail, and the peer needs to log in/authenticate again to continue requesting.

Optionally, S102 may specifically include the following steps:

the method comprises the steps of firstly, receiving a plurality of requests sent by the opposite end in a preset session period, and recording a timestamp of each received request to obtain a request time sequence.

And secondly, clustering the timestamps in the request time sequence to obtain a plurality of timestamp clusters, wherein the difference value of any two timestamps in the same timestamp cluster is smaller than a first preset threshold value.

And thirdly, calculating the cluster timestamp of each timestamp cluster according to the timestamp in the timestamp cluster.

And fourthly, subtracting two adjacent timestamps in the updated request time sequence to obtain a request interval sequence consisting of all the difference values.

To identify the behavior of the peer by analyzing the requests from the peer, the server first records the time stamp of each request sent by the peer in a preset session period, forming a request time sequence, for example, S1 ═ 1561884710012,1561884710022,1561884770589,1561884997541, where each time stamp represents the time when the server receives a request. In the embodiment of the present disclosure, a plurality of opposite terminals may send requests, and after receiving the requests sent by the plurality of opposite terminals, the server records timestamps of the requests in the same request time sequence, and marks corresponding opposite terminal identifiers for each timestamp. Of course, the server may form a request time series for each peer.

In the C/S system, a plurality of requests sent simultaneously or at short intervals from the same peer are called a request cluster, and the timestamp of each request in a request cluster is called a timestamp cluster. There are two criteria for determining whether multiple requests belong to a request cluster: whether they are from the same peer, whether their interval time is less than a given first preset threshold.

The clustering method of the timestamp clusters can be referred to as a clustering method in the related art. In one embodiment, clustering timestamps in a request time sequence to obtain a plurality of timestamp clusters includes:

and step A, selecting a first timestamp from the request time sequence, creating a timestamp cluster, taking the first timestamp as a main timestamp of the timestamp cluster and dividing the timestamp cluster into the timestamp clusters, wherein the timestamps in the request time sequence are arranged according to a time sequence.

Step B, calculating the difference value between the nth timestamp in the request time sequence and the main timestamp of the newly established timestamp cluster, and if the difference value is smaller than a first preset threshold value, dividing the nth timestamp into the newly established timestamp cluster; and if the difference is not smaller than a first preset threshold value, a timestamp cluster is newly established, the nth timestamp is used as a main timestamp of the currently established timestamp cluster and is divided into the currently established timestamp cluster, and the initial value of n is 2.

And C, increasing the value of n by 1, and returning to execute the step B until all the time stamps finish the division of the time stamp clusters.

In one embodiment, clustering timestamps in a request time sequence to obtain a plurality of timestamp clusters includes:

step a, selecting an unselected timestamp from a time sequence, judging whether a timestamp cluster with a difference value between a main timestamp and a currently selected timestamp smaller than a first preset threshold exists in an established timestamp cluster, and if so, dividing the currently selected timestamp into the timestamp cluster; and if not, newly establishing a timestamp cluster for the currently selected timestamp, and dividing the currently selected timestamp into the currently established timestamp clusters as the main timestamp of the currently established timestamp cluster.

And b, repeatedly executing the step a until each timestamp in the time sequence is divided into timestamp clusters.

The cluster timestamp of the timestamp cluster may be an average of all timestamps in the timestamp cluster, or may be an average of a largest timestamp and a smallest timestamp in the timestamp cluster, or a median value of each timestamp in the timestamp cluster, or any timestamp.

For example, for the request time sequence S1 ═ {1561884710012,1561884710022,1561884770589,1561884997541}, assuming that the first preset threshold is 200ms, the difference between the timestamps of the two previous requests in S1 is smaller than the first preset threshold, which indicates that the two requests belong to one request cluster, i.e., the timestamps of the two requests belong to one timestamp cluster; the cluster timestamp may be calculated from the two timestamps, for example, either one of the two timestamps may be selected as the request cluster timestamp, or an average of the two timestamps may be calculated as the request cluster timestamp. The difference value between the time stamps of the two subsequent requests and the time stamp of the previous request is obviously greater than a first preset threshold value, and the two subsequent requests do not belong to the same request cluster, namely the time stamps of the two subsequent requests do not belong to one time stamp cluster; this process is called clustering. For example, if the cluster time stamp is selected as the average of the time stamps of two requests belonging to the same request cluster, the updated request time series is S2 ═ 1561884710017,1561884770589,1561884997541} based on the request time series S1.

After obtaining the updated request time series, the request interval series composed of the difference values can be obtained by subtracting the two cluster time stamps adjacent to each other (time series adjacent to each other) in the series, and for example, the request interval series S3 is obtained by subtracting the two cluster time stamps adjacent to each other in S2 based on the updated request time series S2 {60572,226952 }.

Optionally, the method for setting the first preset threshold includes the following steps:

the method comprises the steps of firstly, obtaining a plurality of preset request sequences of polling requests, wherein the request sequences comprise timestamps of opposite terminals for sending the polling requests.

And secondly, clustering the request sequences of the polling requests to obtain a plurality of request clusters.

And thirdly, calculating the time difference between the last time stamp and the first time stamp in the request cluster aiming at each request cluster to obtain the time width of the request cluster.

And fourthly, setting the maximum value in the time widths of all the request clusters as a first preset threshold value.

In the above embodiment, the first preset threshold is a preset threshold parameter, and the first preset threshold is set based on a plurality of preset polling requests, for example, as shown in fig. 2, the first preset threshold is a device status monitoring page of the operation and maintenance system. On the page, the CPU utilization rate and the memory utilization rate are refreshed once every 30 seconds, the new session rate and the number of concurrent sessions are refreshed once every 60 seconds, and the flow statistics is refreshed once every 100 seconds. Therefore, the CPU utilization rate and the memory utilization rate of the equipment requesting the server from the opposite terminal form a request cluster, the new session rate and the number of concurrent sessions of the equipment requesting the server from the opposite terminal form a request cluster, and the traffic statistics of the equipment requesting the server from the opposite terminal form a request cluster.

Based on the above example, it may be preset that the peer initiates multiple polling requests, for example, Ajax (Asynchronous JavaScript and XML) polling requests, each polling request corresponds to a request sequence recording a timestamp of the polling request, and then the request sequences of the polling requests are clustered, so as to obtain multiple request clusters. The k-meas (k means) clustering algorithm is an iterative clustering analysis algorithm, and the k objects are randomly selected as initial clustering centers, the clustering centers and the objects distributed to the clustering centers represent a cluster, each object is distributed, the clustering centers of the clusters are recalculated according to the existing objects in the clusters, and the process is repeated until a certain termination condition is met (for example, no object is redistributed to different clusters, no clustering center is changed again, error scoring, local minimum and the like).

As described above, the CPU utilization and the memory utilization of the device requesting the server from the peer end are divided into one request cluster, the new session rate and the number of concurrent sessions of the device requesting the server from the peer end are divided into one request cluster, and the traffic statistics of the device requesting the server from the peer end is one request cluster. And aiming at each request cluster, calculating the time difference between the last time stamp and the first time stamp in the request cluster to obtain the width of the request cluster, and finally setting the maximum value in the widths of all the request clusters as a first preset threshold value. In order to improve the accuracy, the maximum value of the widths of all request clusters of each test can be obtained through a plurality of tests, and then the average value of the maximum values is set as the first preset threshold.

After the request interval sequence is acquired, the request interval sequence needs to be judged, whether the time interval in the request interval sequence is periodic or not is judged, if the time interval is periodic, the opposite terminal initiates a polling request, and if the time interval is not periodic, the opposite terminal initiates a random request, so that the session can be continuously kept effective. If it is a polling request, the peer does not perform any operation, so the session needs to be set to failure at this time.

A session, which may include a session control or token, is a component that controls access to the system by a peer. In the session-based access control technology, after a certain opposite terminal passes identity authentication, a server generates a session to be stored in a server, timeout time is set, when the opposite terminal initiates a request to the server again, the server firstly verifies whether the session of the opposite terminal is valid, and then requests for response are carried out; when the opposite terminal does not make a request for a long time, the session is overtime and invalid, when the opposite terminal accesses again, the server detects that the session of the opposite terminal is invalid, and then the opposite terminal is verified and logged in again. In the token-based access control technology, after a certain opposite terminal passes identity authentication, a server generates a token response to the opposite terminal, the token and the role of the opposite terminal are associated with the authority, then the server carries the token in a request header when accessing the server, the server firstly verifies the validity of the token, checks the role and the authority associated with the token, and then requests for response. Likewise, tokens also have timeout failures.

Based on the embodiment shown in fig. 1, the embodiment of the present disclosure further provides a session processing method, as shown in fig. 3, the method may include the following steps.

S301, establishing a session with the opposite terminal.

S302, determining to obtain a request interval sequence of the opposite terminal according to a request sent by the opposite terminal, wherein the request interval sequence comprises time intervals of a plurality of requests sent by the opposite terminal in a preset session period.

And S303, equally dividing the request interval sequence to obtain a first sequence and a second sequence.

S304, determining the longest common subsequence of the first sequence and the second sequence by using the longest common subsequence algorithm.

S305, judging whether the longest common subsequence matches with the tail of the first sequence, whether the longest common subsequence matches with the head of the second sequence, whether the rest part except the longest common subsequence in the first sequence matches with the tail of the longest common subsequence, and whether the rest part except the longest common subsequence in the second sequence matches with the head of the longest common subsequence. If both are true, S305 is performed, otherwise S306 is performed.

And S306, setting the session as failure.

S307, maintaining the session to be valid.

The request generated by human operation is irregular and random, while the request generated by polling at opposite terminal timing is periodic, therefore, it needs to judge whether the time interval in the request interval sequence is periodic, if so, it means that the polling request is initiated at opposite terminal timing, and if not, it means that the request is random.

For example, a page has three portions of data that are periodically refreshed, a first portion being refreshed every 20 seconds, a second portion being refreshed every 10 seconds, and a third portion being refreshed every 15 seconds. The three are superimposed to obtain a request interval sequence of {10,5,5,10,10,5,5,10,10,5,5,10,10,5,5,10,10,5,5,10, … }, which is obviously a periodic sequence.

Assuming sequence 314159263141592631415926314159263141592631415, the sequence is divided equally, resulting in a first sequence half _1 being 3141592631415926314159 and a second sequence half _2 being 26314159263141592631415, then using the longest common subsequence algorithm, the longest common subsequence segment _ common of half _1 and half _2 is 2631415926314159, the half _1 except for the remainder of segment _ common being extra _1 being 314159, located at the head of half _1, and extra _1 matching the tail of segment _ common; the half _2, except for the remainder of the segment _ common, is located at the tail of half _2, 2631415, and the extra _2 matches the head of segment _ common, this feature can be used to determine whether the time intervals in the request interval sequence are periodic, that is, if segment _ common matches the tail of half _1, segment _ common matches the head of half _2, extra _1 matches the tail of segment _ common, and extra _2 matches the head of segment _ common, then the time intervals in the request interval sequence can be determined to be periodic.

Optionally, S303 may specifically be: extracting a first subsequence in the first sequence and a second subsequence in the second sequence; and calculating difference values of the elements in the first subsequence and the elements in the second subsequence in sequence, and determining the longest common subsequence based on the first subsequence and the second subsequence if all the difference values are smaller than a second preset threshold value.

In two sequences (the first sequence and the second sequence in this embodiment), some sequence elements are the same, and sub-sequences formed by multiple elements may also be equal, so that the equal sub-sequence with the Longest length is the Longest Common sub-sequence between the two sequences, and the algorithm for solving the equal sub-sequence with the Longest length by dynamic programming is the LCS (Longest Common sub-sequence) algorithm. The dynamic programming equation in the LCS algorithm is as follows:

where dp (i, j) represents the longest common subsequence length between s1[0, i ] and s2[0, j ]. In solving for dp (i, j), the longest common subsequence between s1[0, i ] and s2[0, j ] is also found.

One basic operation in the LCS algorithm step is to compare whether the elements in the first and second subsequences are equal. However, in some scenarios, strict judgment and the like are not required, but judgment within an error tolerance and the like, and specifically, an error inner judgment and the like may be adopted, that is, an error threshold is given, and if an absolute value of a difference between two elements is smaller than the error threshold, the two elements are considered to be equal within the error. That is, the difference values between the elements in the first subsequence and the elements in the second subsequence are sequentially calculated according to the sequence, and if each difference value is smaller than a second preset threshold, the longest common subsequence is determined based on the first subsequence and the second subsequence. Specifically, the longest common subsequence may be selected from the first subsequence and the second subsequence, or an average value of each corresponding element may be calculated to obtain a new sequence as the longest common subsequence.

Optionally, the setting manner of the second preset threshold may specifically include the following steps:

the method comprises the steps of firstly, obtaining a plurality of first sample request sequences and a plurality of second sample request sequences, wherein the first sample request sequences are preset polling request sequences, and the second sample request sequences are preset polling request sequences comprising a plurality of random requests or doped random requests.

And secondly, acquiring each preset second preset threshold to be tested, and respectively calculating the periodic hit rate of the time interval in the request interval sequence corresponding to each first sample request sequence under different second preset thresholds to be tested, and the periodic false judgment rate of the time interval in the request interval sequence corresponding to each second sample request sequence to obtain the hit rate and the false judgment rate corresponding to each second preset threshold to be tested.

And thirdly, selecting a second preset threshold from the second preset thresholds to be tested according to the hit rate and the misjudgment rate corresponding to the second preset thresholds to be tested.

In this disclosure, the second preset threshold may be obtained by training, and there are two indicators for evaluating the accuracy of the periodic determination: hit rate and false positive rate. Since the polling request initiated by the opposite terminal must be periodic, the hit rate refers to: probability that a request interval sequence of polling requests initiated by a peer for a plurality of times is determined to be periodic; random requests are often aperiodic, so the false positive rate refers to: probability that a request interval sequence of a plurality of random requests or polling requests doped with random requests is determined to be periodic. In the disclosed embodiment, a polling request of a page as shown in fig. 2 may be used to generate a first sample request sequence of a plurality of preset polling requests and a second sample request sequence of a plurality of preset polling requests including a plurality of random requests or a mixture of random requests. Assume that the peer generates a total of 10000 first sample request sequences, 5000 second sample request sequences comprising a plurality of random requests, and 5000 second sample request sequences doped with random-requested polling requests. For example, in the method of the foregoing embodiment, under the condition of the set second preset thresholds to be tested (e.g., 0ms, 50ms, 100ms, … 1000ms, etc.), the hit rate that determines that the time interval in the request interval sequence corresponding to each first sample request sequence is periodic is calculated, and the false rate that determines that the time interval in the request interval sequence corresponding to each second sample request sequence is periodic is calculated, based on the experimental result shown in fig. 4, the hit rate and the false rate both tend to increase, when the second preset threshold is very small, the condition of the determination period sequence is very strict, which makes the false rate very small, and at the same time, because the determination condition is strict, the hit rate is also very small; however, when the second preset threshold value becomes larger, the determination condition is relaxed, and the hit rate increases, which is accompanied by an increase in the erroneous determination rate. As can be seen from the figure, when the second preset threshold is set to 300ms, the misjudgment rate can reach 5.3%, the hit rate can reach 93.4%, and the hit rate and the misjudgment rate are balanced, so the second preset threshold can be set to 300 ms.

In addition to reaching the balance, a second preset threshold may be determined by using a preset first value and a preset second value, and optionally, the selecting a second preset threshold from the second preset thresholds to be tested according to the hit rate and the false positive rate corresponding to each second preset threshold to be tested includes: and selecting the second preset threshold to be tested with the minimum misjudgment rate as a second preset threshold from the second preset thresholds to be tested, wherein the corresponding hit rate is greater than the preset first numerical value and the corresponding misjudgment rate is less than the second numerical value. The first value can be set in a self-defined way according to actual conditions, such as 85%, 90% or 95%; the second value can be set in a customized way according to actual conditions, for example, the second value is set to be 5%, 8% or 10% and the like. And selecting the second preset threshold to be tested with the minimum misjudgment rate as the second preset threshold from the second preset thresholds to be tested, wherein the corresponding hit rate is greater than the preset first numerical value and the corresponding misjudgment rate is less than the second numerical value, so that the misjudgment condition can be reduced. Of course, one of the second preset thresholds to be tested, which has a hit rate greater than the preset first value and a corresponding false positive rate less than the second value, may be randomly selected or the second preset threshold to be tested, which has the highest hit rate, may be selected as the second preset threshold.

To sum up, the session processing method provided by the embodiment of the present disclosure, as shown in fig. 5, mainly includes the following steps:

s501, a request time sequence S1[0, m ] composed of arrival time stamps of all requests in a past session period in a certain session is obtained.

S502, judging whether S1[0, m ] is empty or not. If empty, go to S503; otherwise, S504 is performed.

S503, it is determined that no request has arrived in the past session period, and S506 is performed.

S504, clustering S1[0, m ] to obtain S2[0, n ], and calculating a request interval sequence S3[0, n-1] according to S2[0, n ].

The process of clustering s1[0, m ] is to determine whether the difference between any two timestamps in s1[0, m ] is smaller than a first preset threshold, if so, calculate a request cluster timestamp according to the two timestamps, and replace the two timestamps in s1[0, m ] with the request cluster timestamp, thereby obtaining s2[0, n ]. After s2[0, n ] is obtained, the two adjacent timestamps in s2[0, n ] are differentiated to obtain a request interval sequence s3[0, n-1] composed of the difference values.

S505, judging whether S3[0, n-1] is a periodic sequence within the tolerance of the error. If so, executing S506, otherwise, returning to executing S501.

S506, setting the session as invalid, and destroying the server session or token.

As shown in fig. 6, S505 may be specifically subdivided into the following steps:

s5051, equally dividing S3[0, n-1] into two sections from the middle: half _1 ═ s3[0, (n-1)/2], half _2 ═ s3[ (n-1)/2+1, n-1 ].

S5052, determining the longest common subsequence segment _ common of half _1 and half _2 by adopting a longest common subsequence algorithm based on an error inner judgment method and the like.

The specific manner of determining segment _ common is shown in the embodiment shown in fig. 3, and will not be described herein.

S5053, judging whether segment _ common matches with the tail of half _1, segment _ common matches with the head of half _2, extra _1 matches with the tail of segment _ common, and extra _2 matches with the head of segment _ common. If so, S5054 is performed, otherwise S5055 is performed.

Wherein, the extra _1 is the remaining part of the half _1 from which the segment _ common is removed, and the extra _2 is the remaining part of the half _2 from which the segment _ common is removed.

S5054, S3[0, n-1] is determined to be a periodic sequence.

S5055, it is determined that S3[0, n-1] is not a periodic sequence.

Corresponding to the foregoing method embodiment, an embodiment of the present disclosure provides a session processing apparatus, as shown in fig. 7, including:

a session establishing module 710, configured to establish a session with a peer.

A sequence determining module 720, configured to determine a request interval sequence of an opposite end according to a request sent by the opposite end, where the request interval sequence includes time intervals of multiple requests sent by the opposite end in a preset session period;

a session setting module 730, configured to set the session to be disabled if the time interval in the request interval sequence is periodic.

Optionally, the sequence determining module 720 may be specifically configured to: receiving a plurality of requests sent by an opposite terminal in a preset session period, and recording a timestamp of each received request to obtain a request time sequence; clustering the timestamps in the request time sequence to obtain a plurality of timestamp clusters, wherein the difference value of any two timestamps in the same timestamp cluster is smaller than a first preset threshold value; aiming at each timestamp cluster, calculating a cluster timestamp of the timestamp cluster according to the timestamp in the timestamp cluster; and respectively calculating the difference value of every two cluster time stamps adjacent in the time domain to obtain a request interval sequence formed by all the difference values.

Optionally, the apparatus may further include: a first preset threshold setting module;

the device comprises a first preset threshold setting module, a second preset threshold setting module and a polling module, wherein the first preset threshold setting module is used for acquiring a plurality of preset request sequences of polling requests, and the request sequences comprise timestamps of opposite terminals for sending the polling requests; clustering the request sequences of all polling requests to obtain a plurality of request clusters; calculating the time difference between the last time stamp and the first time stamp in the request cluster aiming at each request cluster to obtain the time width of the request cluster; the maximum value of the time widths of all request clusters is set as a first preset threshold value.

Optionally, the apparatus may further include: a judgment module;

the judging module is used for equally dividing the request interval sequence to obtain a first sequence and a second sequence; determining the longest common subsequence of the first sequence and the second sequence by using a longest common subsequence algorithm; the time interval in the request interval sequence is determined to be periodic if the longest common subsequence matches the tail of the first sequence, the longest common subsequence matches the head of the second sequence, a remaining portion of the first sequence other than the longest common subsequence matches the tail of the longest common subsequence, and a remaining portion of the second sequence other than the longest common subsequence matches the head of the longest common subsequence.

Optionally, the determining module may be specifically configured to: extracting a first subsequence in the first sequence and a second subsequence in the second sequence; and calculating difference values of the elements in the first subsequence and the elements in the second subsequence in sequence, and determining the longest common subsequence based on the first subsequence and the second subsequence if all the difference values are smaller than a second preset threshold value.

Optionally, the apparatus may further include: a second preset threshold setting module;

a second preset threshold setting module, configured to obtain a plurality of first sample request sequences and a plurality of second sample request sequences, where the first sample request sequences are request sequences of preset polling requests, and the second sample request sequences are request sequences of preset polling requests including a plurality of random requests or doped random requests; acquiring each preset second preset threshold to be tested, and respectively calculating the periodic hit rate of the time interval in the request interval sequence corresponding to each first sample request sequence under different second preset thresholds to be tested and the periodic false judgment rate of the time interval in the request interval sequence corresponding to each second sample request sequence to obtain the hit rate and the false judgment rate corresponding to each second preset threshold to be tested; and selecting a second preset threshold from the second preset thresholds to be tested according to the hit rate and the misjudgment rate corresponding to the second preset thresholds to be tested.

Optionally, the second preset threshold setting module is specifically configured to select, as the second preset threshold, the second preset threshold to be tested, where the corresponding hit rate is greater than the preset first value and the corresponding false positive rate is less than the second value.

By applying the embodiment of the disclosure, the server obtains the request interval sequence including the time intervals of a plurality of requests sent by the opposite terminal in the preset session period, and if the time intervals in the request interval sequence are periodic, the session is set to be invalid. The request interval sequence records time intervals of a plurality of requests sent by the opposite terminal in the preset session period, if the time intervals are periodic, the opposite terminal initiates the requests in a polling mode, under the condition, the server can judge that the opposite terminal does not perform any operation in the preset session period, the session is set to be invalid, and the condition that the session is still valid under the condition that the opposite terminal does not operate in the preset session period is avoided, so that the system safety is improved.

The embodiment of the present disclosure further provides a server, as shown in fig. 8, including a session unit 801 and a bypass analysis unit 802;

a session unit 801, configured to establish a session with an opposite end; receiving a plurality of requests sent by an opposite terminal in a preset session period, and recording a timestamp of each received request to obtain a request time sequence;

a bypass analysis unit 802, configured to obtain a request time sequence from the session unit; clustering the timestamps in the request time sequence to obtain a plurality of timestamp clusters, wherein in the same timestamp cluster, the difference value between one timestamp and another timestamp is smaller than a first preset threshold value; aiming at each timestamp cluster, calculating a cluster timestamp of the timestamp cluster according to the timestamp in the timestamp cluster; respectively calculating the difference value of every two cluster time stamps adjacent to each other in the time domain to obtain a request interval sequence formed by all the difference values; if the time interval in the request interval sequence is periodic, a failure instruction is sent to the conversation unit;

the session unit 801 is further configured to set the session of the opposite end to be invalid after receiving the invalidation instruction sent by the bypass analysis unit.

In an implementation manner of the embodiment of the present disclosure, the server is configured as shown in fig. 9, and may include other modules of the server in addition to the session module and the bypass analysis module shown in fig. 8, where the session module includes a database for recording the request time sequence.

After the request of each opposite terminal arrives, the session module records the time stamp of each request, and only maintains the request time sequence in the past two session periods, thus ensuring that a large amount of data cannot be accumulated in the database. The bypass analysis module is an independently running thread or process, and can continuously read the request time sequence of each opposite end in the database to perform bypass analysis (the bypass analysis is performed in an independent thread or process, so that the service flow of the session module or other modules of the server is not blocked). The analysis method used for bypass analysis is the session handling method described above. Once judging that a certain session is invalid, the bypass analysis module calls the session module, namely, sends an invalid instruction to the session module, so that the session module sets the recorded session as invalid.

Embodiments of the present disclosure also provide a server, as shown in fig. 10, comprising a processor 1001 and a machine-readable storage medium 1002, wherein,

a machine-readable storage medium 1002 for storing a computer program;

the processor 1001 is configured to implement the session processing method when executing the computer program stored on the machine-readable storage medium 1002.

The machine-readable storage medium may include a RAM (Random Access Memory) and a NVM (Non-volatile Memory), such as at least one disk Memory. Alternatively, the machine-readable storage medium may be at least one memory device located remotely from the processor.

The Processor may be a general-purpose Processor, including a Central Processing Unit (CPU), a Network Processor (NP), and the like; but also a DSP (Digital Signal Processing), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other Programmable logic device, discrete Gate or transistor logic device, discrete hardware component.

In this embodiment, the processor reads the computer program stored in the storage medium and runs the computer program, so as to implement: the server obtains a request interval sequence containing a plurality of request time intervals sent by opposite terminals in a preset session period, and if the time intervals in the request interval sequence are periodic, the session is set to be invalid. The request interval sequence records time intervals of a plurality of requests sent by the opposite terminal in the preset session period, if the time intervals are periodic, the opposite terminal initiates the requests in a polling mode, under the condition, the server can judge that the opposite terminal does not perform any operation in the preset session period, the session is set to be invalid, and the condition that the session is still valid under the condition that the opposite terminal does not operate in the preset session period is avoided, so that the system safety is improved.

In addition, the embodiment of the disclosure provides a machine-readable storage medium, in which a computer program is stored, and the computer program is executed by a processor to implement the session processing method.

In this embodiment, the storage medium stores a computer program that executes the session processing method provided in the embodiments of the present disclosure when running, and thus can implement: the server obtains a request interval sequence containing a plurality of request time intervals sent by opposite terminals in a preset session period, and if the time intervals in the request interval sequence are periodic, the session is set to be invalid. The request interval sequence records time intervals of a plurality of requests sent by the opposite terminal in the preset session period, if the time intervals are periodic, the opposite terminal initiates the requests in a polling mode, under the condition, the server can judge that the opposite terminal does not perform any operation in the preset session period, the session is set to be invalid, and the condition that the session is still valid under the condition that the opposite terminal does not operate in the preset session period is avoided, so that the system safety is improved.

In yet another embodiment provided by the present disclosure, there is also provided a computer program product containing instructions which, when run on a computer, cause the computer to perform any of the session processing methods in the above embodiments.

In the above embodiments, the implementation may be wholly or partially realized by software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. The procedures or functions described in accordance with the embodiments of the disclosure are, in whole or in part, generated when the computer program instructions are loaded and executed on a computer. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable device. The computer instructions may be stored on a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, from one website, computer, server, or data center to another website, computer, server, or data center via wire (e.g., coaxial cable, fiber, DSL (Digital Subscriber Line)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device, such as a server, a data center, etc., that incorporates one or more of the available media. The usable medium may be a magnetic medium (e.g., a floppy Disk, a hard Disk, a magnetic tape), an optical medium (e.g., a DVD (Digital Versatile Disk)), or a semiconductor medium (e.g., a SSD (Solid State Disk)), etc.

For the server, the machine-readable storage medium and the computer program product embodiment, since the contents of the method involved are substantially similar to those of the foregoing method embodiment, the description is relatively simple, and the relevant points can be referred to the partial description of the method embodiment.

It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.

All the embodiments in the present specification are described in a related manner, and the same and similar parts among the embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the apparatus, server, machine-readable storage medium, and computer program product embodiments, since they are substantially similar to the method embodiments, the description is relatively simple, and reference may be made to some descriptions of the method embodiments for relevant points.

The above description is only for the preferred embodiment of the present disclosure, and is not intended to limit the scope of the present disclosure. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure are included in the scope of protection of the present disclosure.

Claims

1. A method for session processing, the method comprising:

establishing a session with an opposite terminal;

2. The method according to claim 1, wherein the determining the request interval sequence of the peer end according to the request sent by the peer end comprises:

3. The method according to claim 2, wherein the setting method of the first preset threshold value comprises:

4. The method according to claim 1 or 2, wherein before the step of setting a session to expire if the time intervals in the sequence of request intervals are periodic, the method further comprises:

5. The method of claim 4, wherein the step of determining the longest common subsequence of the first sequence and the second sequence using a longest common subsequence algorithm comprises:

6. The method according to claim 5, wherein the setting of the second preset threshold includes:

7. The method of claim 6, wherein selecting the second preset threshold value from the second preset threshold values to be tested according to the hit rate and the false positive rate corresponding to the second preset threshold values to be tested comprises:

8. A server, comprising a session unit and a bypass analysis unit;

9. A server, comprising a processor and a machine-readable storage medium, wherein,

the machine-readable storage medium for storing a computer program;

the processor, when executing the computer program stored on the machine-readable storage medium, implementing the method of any of claims 1-7.

10. A machine readable storage medium, in which a computer program is stored which, when being executed by a processor, carries out the method of any one of claims 1 to 7.