Summary of the invention
The technical problem that the present invention solves is how to avoid the mail reception system to suffer the problem of flood attack.
In order to address the above problem, the invention provides a kind of mail reception method for managing system of mobile unit, the mail reception method for managing system of this mobile unit comprises: after the number of mail of once collecting reaches first preset value, revise the state of abnormality mark at least; When mail next time, collect the mail that is less than or equal to second preset value based on described abnormality mark.
Alternatively, the mail reception method for managing system of described mobile unit also comprises: describedly collect the mail that is less than or equal to second preset value based on described abnormality mark when mail next time and also comprise: receive earlier the mail that afterwards is sent to service platform; Perhaps, preferentially receive the mail that the safe list that is provided with the user is complementary.
Alternatively, described abnormality mark is reset along with the startup of mail reception system, perhaps is reset after the spam that receives service platform cleans out signal.
Alternatively, described abnormality mark is reset along with the startup of mail reception system and comprises: be later than the described abnormality mark of just resetting when service platform cleans out time of spam in the start-up time of mail reception system.
Alternatively, the mail reception method for managing system of described mobile unit also comprises: before once receiving mail, the number of mail that statistics is once collected, in the number of mail of once collecting during less than the 3rd preset value, receive the described mail of once collecting, otherwise, described mail is filtered, mail after will filtering then once sends
Described mail is filtered comprises: statistics once is sent to the occurrence number of sender sign of the mail of inbox from service platform, with the occurrence number of the sender's sign filtrating mail greater than set point.
Alternatively, the mail reception method for managing system of described mobile unit also comprises: sender's sign of obtaining the described mail of once collecting, add up the occurrence number of described sender's sign, described at least after the number of mail of once collecting reaches first preset value, the state of revising abnormality mark is meant that the occurrence number that reaches first preset value and described sender sign in the number of mail of once collecting during greater than preset times, revises the state of described abnormality mark.
Alternatively, described sender identifies in the IP address that comprises sender's title, server domain name and sender at least a.
A kind of mail reception system of mobile unit, comprise timing unit, inbox, memory space, counting unit and abnormality mark modification unit, timing unit is used to write down the operating time of inbox, inbox is used to receive mail, memory space is used to store the mail that inbox receives, and counting unit is counted the number of mail that inbox or memory space once receive; The state of abnormality mark when the counting of described counting unit reaches first preset value, is revised at least in abnormality mark modification unit; Described inbox is collected the mail that is less than or equal to second preset value based on described abnormality mark when next addressee.
Alternatively, the mail reception system of described mobile unit also comprises pre-calculation unit and filter element, described pre-calculation unit statistics once is sent to the calculated value and the 3rd preset value of the number of mail and the more described pre-calculation unit of inbox from service platform, described pre-calculation unit is also calculated the occurrence number of each sender's sign, produce received signal during less than the 3rd preset value and transmit received signal at described calculated value to inbox, described inbox once receives described mail based on received signal, described pre-calculation unit produces the occurrence number of trap signal and transmission filtering signal and each sender sign during greater than the 3rd preset value to filter element at described calculated value, filter element is triggered the occurrence number of the sender's sign filtrating mail greater than set point by trap signal, with the mail transmission that is not filtered to inbox.
Alternatively, the mail reception system of described mobile unit also comprises acquiring unit and statistic unit, and described acquiring unit obtains sender's sign of the described mail of once collecting; The occurrence number of statistic unit statistics sender sign; Described abnormality mark is revised the unit at least when the counting of described counting unit reaches first preset value, the state of revising abnormality mark is meant when described abnormality mark is revised occurrence number that the unit reaches first preset value and described sender sign at the counting of described counting unit greater than preset times, revises the state of described abnormality mark.
Alternatively, described sender identifies in the IP address that comprises sender's title, server domain name and sender at least a.
Alternatively, described counting unit is up counter or subtract counter.
Alternatively, the mail reception system of described mobile unit also comprises reset cell, and this reset cell produces the reset signal of the described abnormality mark that is used to reset.
Alternatively, described reset signal when mail reception system start-up or inbox when starting or when being later than service platform the start-up time of mail reception system and cleaning out time of spam or the mail reception system produce when receiving the signal that service platform cleaning spam finishes.
Alternatively, described inbox receives earlier the mail that afterwards is sent to server when collecting the mail that is less than or equal to second preset value; Perhaps, described inbox is preferential receives the mail that the safe list that is provided with the user is complementary.
In addition, the present invention also provides a kind of mobile unit, and this mobile unit comprises aforesaid mail reception system.
Compared with prior art, the invention has the beneficial effects as follows:
1, the present invention is by after reaching first preset value in the quantity that once mails, when next addressee, only collect the mail that quantity is less than or equal to second preset value, like this, the mail reception system need not be busy with handling these useless packets, and can't handle normal data, the mail reception system can not suffer flood attack.In addition, need not design buffer, also need not to connect other Anti-Spam servers, thereby cost be low.
2, by receiving earlier the mail that afterwards is sent to service platform; Perhaps, preferential receive the mail that the safe list that is provided with the user is complementary, that is new mail or send out earlier with the mail that safe list is complementary can guarantee the service that the user is current.
3, described abnormality mark is reset along with the startup of mail reception system, perhaps after cleaning out signal, the spam that receives service platform is reset, like this, can avoid service platform to remove rubbish mail and there is the situation of abnormality mark in the mail reception system, guarantee that the user can enjoy service.
4, because the present invention is later than the described abnormality mark of just resetting when service platform cleans out time of spam in the start-up time of mail reception system, like this, can avoid misoperation and make the situation that abnormality mark is reset, such as, service platform need clean out spam at 15 o'clock, and the user started mobile unit or mail reception system at 13 o'clock, and this moment, spam is not also cleaned out, when adopting this programme, abnormality mark can not be reset at 13 o'clock, like this, can guarantee accurately, guarantee that the user can enjoy service.
Embodiment
The inventor finds that existing electronics receiving system can suffer a kind of flood attack of being initiated by wooden horse, this flood attack makes destination host can't in time handle other normal request, give and use the mail reception system to make troubles, and the described Anti-Spam of employing Chinese patent Granted publication CN1286305C, though can reduce the networking cost of Anti-Spam, but,, can not drop to cost minimum owing to need the design buffer.
For this reason, the invention provides a kind of mail reception method for managing system of mobile unit, described mailing system management method can prevent that the mail reception system from suffering flood attack, and, need not design buffer, also need not to connect other Anti-Spam servers, thereby cost be low.
See also Fig. 1, the mail reception method for managing system of present embodiment comprises:
S11: after the number of mail of once collecting reaches first preset value, revise the state of abnormality mark;
S12: when mail next time, collect the mail that is less than or equal to second preset value based on described abnormality mark.
See also Fig. 2, Fig. 2 is the structural representation that can be used for the mail reception system of present embodiment, as shown in Figure 2, described mail reception system is used to receive the mail from service platform A, comprises that timing unit 1, inbox 2, memory space 3, counting unit 4, abnormality mark revise unit 5.
Timing unit 1 is used to write down the operating time of inbox 2.Inbox 2 is based on definite time that once receives mail of the clocking value of timing unit 1, according to the mail of the time reception that once receives mail from service platform A.Described inbox 2 determines whether to receive mail based on the clocking value of timing unit 1 and can realize by following manner:
1, described timing unit 1 can be for possessing the up counter of Protection Counter Functions, suppose that inbox 2 received a mail every five minutes, then, described timing unit 1 counts from zero, when count up to clocking value in the time of 5 minutes feedback control signal to inbox 2, carry out clear operation simultaneously, then, inbox 2 receives mail according to described control signal;
2, described timing unit 1 is a subtract counter, still receiving a mail every five minutes with inbox 2 is the example explanation: described counter picked up counting from five minutes, feedback control signal is to inbox 2 when clocking value becomes 0, once more since five minutes countings, inbox 2 receives mail after receiving described control signal simultaneously.
Certainly, the clocking value of described timing unit 1 is set according to the custom of self by the user, such as, the user of mail reception system is accustomed to mail of reception in 10 minutes.Be understandable that described timing unit 1 can be one section program that can realize tally function, also can be for possessing the hardware of tally function.
Memory space 3 is used to store the mail that inbox 2 receives after inbox 2 receives mail.
The number of mail that 4 couples of service platform A of counting unit once send to inbox 2 is counted.Inbox 2 every reception one envelope mails, the numerical value of counting unit 4 just increases by 1.It is pointed out that described counting unit 4 is not that all mails that inbox 2 receives are counted, and just to inbox 2 each mail numbers that receive, described counting unit 4 can be up counter, also can be subtract counter.Same, described counting unit 4 can realize by hardware, also can realize by one section program that realizes tally function.
Abnormality mark is revised unit 5 and is judged whether the counting of described counting unit 4 reaches first preset value, when the counting of counting unit 4 reaches first preset value, revises the state of abnormality mark.Described inbox 2 is collected the mail that is less than or equal to second preset value based on described abnormality mark when next addressee.Described abnormality mark is revised unit 5 and is judged when the counting of counting unit 4 reaches first preset value have dual mode to realize:
1, when described counting unit 4 was up counter, the control signal that described inbox 2 receives timing unit 1 was triggered and begins to receive mail, inbox 2 every reception one envelope mails, and the numerical value of counting unit 4 just increases by 1.Counting unit 4 is transferred to abnormality mark with numerical value and revises unit 5 then, abnormality mark is revised the numerical value and the first preset value subtraction of the 5 pairs of counting units 4 in unit, when the value of subtraction is zero, the number of mail (counting of counting unit 4) that expression inbox 2 once receives reaches first preset value, abnormality mark is revised the state that abnormality mark is just revised in unit 5, such as, abnormality mark is revised as 1 by initial value 0.
2, when described counting unit 4 is subtract counter, the initial value of described counting unit 4 equals first preset value, described inbox 2 is triggered when receiving the control signal of timing unit 1 and receives mail, inbox 2 every reception one envelope mails, the numerical value of described counting unit 4 just reduces one, along with inbox 2 receives increasing of mail, the corresponding minimizing of the numerical value of counting unit 4 is until becoming 0.Numerical value in counting unit 4 is 0 o'clock, the number of mail (counting of counting unit 4) that expression inbox 2 once receives reaches first preset value, counting unit 4 directly is transferred to abnormality mark with 0 and revises unit 5, abnormality mark is revised unit 5 under the triggering of " 0 " signal, revise the state of abnormality mark, same, such as, abnormality mark is revised as 1 by initial value 0.Certainly, described abnormality mark is revised the numerical value that unit 5 also can obtain counting unit 4 in real time, and only the numerical value in described counting unit 4 is the state that abnormality mark is revised in triggering work in 0 o'clock.
In the method, first preset value and second preset value are provided with according to the disposal ability of inbox 2, once only can handle 100 envelopes such as inbox 2, and so, described first preset value also can be set to 70 envelopes, and second preset value is set to 3 envelopes.When after being attacked, not allowing inbox receive mail, also described second preset value can be made as 0.With first preset value is 20 envelopes, and second preset value is 5 envelopes, and described counting unit 4 is that up counter and inbox 2 are the mail reception method for managing system of example explanation present embodiment every mail of reception in 5 minutes.
Suppose timesharing at 14:25, inbox 2 received mail one time, then, divide from 14:25, timing unit 1 timing of starting from scratch, when timing during to 14:30, timing unit 2 sends control signal to inbox 2, inbox 2 begins to receive mail under the triggering of the control signal of timing unit 1, and the mail that receives deposited in the memory space 3, when inbox 2 received mail, the numerical value of described counting unit 4 just increased by 1, and counting unit 4 is transferred to abnormality mark with numerical value and revises unit 5 then, abnormality mark is revised unit 5 logarithm value and the first preset value subtraction, the value of subtraction be zero or greater than 0 o'clock (just the counting of counting unit 4 is 20 or greater than 20 o'clock, the value of subtraction be 0 or greater than 0), abnormality mark is revised the state that abnormality marks are revised in unit 5.This abnormality mark is transferred to inbox 2 then, and inbox 2 is when 14:35 tap receiving emails, and based on described abnormality mark, the quantity that receives mail is less than or equal to 5 envelopes, such as, receive 4 envelope mails in the 14:35 timesharing.Also can divide and continue to receive 4 envelope mails, described abnormality mark be reset to initial condition until the user of mail reception system at 14:40.Certainly, abnormality mark is revised unit 5 logarithm value and the first preset value subtraction, and the value of subtraction was less than 0 o'clock, and abnormality mark is revised the state that abnormality mark is not revised in unit 5.
Improvement as said method, the mail that described service platform will the back receives is sent to described mail reception system earlier, this mode can realize by following method: described service platform will sort to mail according to time sequencing, time is late more, then, it is forward more to sort, and the described time can be service platform when receiving mail, reads the time of self system.For example, service platform receives an envelope mail at 14:35 branch and 14:36 branch respectively, and then, service platform will divide the mail that receives to come the front at 14:36, and service platform is sent to the mail reception system with the mail that 14:36 receives then.Like this, behind the state of mail reception system modification abnormality mark, guarantee that the mobile unit user can also obtain the high mail service of some importance, such as, the mail relevant with the user's request of mobile unit.Again such as, the user is a businessperson, the importance of the addresses of items of mail that this user can most important business partner is set to the highest so, after the mail reception system suffers flood attack, service platform is when receiving mail, with this business partner's mail according to time-sequencing preceding, then, service platform is sent to this business partner's mail the mail reception system of described mobile unit.So new mail is sent out earlier, can guarantee the service that the user is current.
Certainly, except the importance of considering mail, preferential reception of described inbox and the mail that the safe list that the user is provided with is complementary also can be understood as the mailbox that service platform also can be sent to the mail with the safe list coupling mobile unit.Such as, above-mentioned businessperson can be positioned over important business partner's addresses of items of mail in the safe list, after the mail reception system suffers flood attack, still can receive this business partner's mail.
In addition, service platform self also has the function of interception flood attack, and described abnormality mark is reset along with the startup of mail reception system.Preferably, described mail reception system detects the time interval that this time starts with shutdown last time, at this during interval greater than set point, and the described abnormality mark of just resetting.Such as, the abnormality mark of previous embodiment is reset to 0 by 1.After adopting such setting, can avoid misoperation of users and the situation of replacement abnormality mark.Such as, service platform need clean out spam at 15 o'clock, and the user started mobile unit or mail reception system at 13 o'clock, and this moment, spam is not also cleaned out, when adopting this programme, abnormality mark can not be reset at 13 o'clock, like this, can guarantee accurately, guarantee that the user can enjoy service.
In addition, consider that service platform self also has the function of interception flood attack, described abnormality mark also can receive in the mail reception system and be reset after spam that service platform sends cleans out signal.Such as, after mobile unit was closed in user's parking, mobile unit system (comprising the mail reception system) entered deep sleep, and this moment, most of application programs can be forced to withdraw from.After meeting with the mail flood attack, the spam that service platform needs the time cleaning to receive, after the user is stopped, particularly stop a very long time (such as: spend the night) afterwards, the spam of very possible service platform end is cleaned out.In these cases, owing to spam is cleaned out, with the replacement abnormality mark.
See also Fig. 3, Fig. 3 is the structural representation of another embodiment of mail reception system of mobile unit of the mail reception method for managing system correspondence of this enforcement mobile unit, in this schematic diagram, described mail reception system comprises that timing unit 1, inbox 2, memory space 3, abnormality mark revise unit 5 and counting unit 6.The difference of this embodiment and a last embodiment is that described counting unit 6 is used for the number of mail in the Real time identification memory space 3, and promptly the number of mail that memory space 3 is once received is counted; Described abnormality mark is revised unit 5 and is judged whether the counting of counting unit 6 reaches first preset value, the method that this embodiment is corresponding with first embodiment of mail reception system is compared, the mail that inbox 2 is received is not counted, but after inbox 2 receives mail and is stored in memory space 3, the mail that memory space 3 once stores is counted.
See also Fig. 4 and Fig. 5, Fig. 4 and Fig. 5 are the flow chart of mail reception method for managing system second embodiment of the present invention and the structural representation of corresponding mail reception system thereof, and the method for this embodiment comprises:
S21: before once receiving mail, the number of mail that statistics is once collected;
S22: number of mail of more once collecting and the 3rd preset value, in the number of mail of once collecting during less than the 3rd preset value, receive the described mail of once collecting, in the number of mail of once collecting during greater than the 3rd preset value, described mail is filtered, mail after will filtering then once sends, described mail is filtered comprises that statistics once is sent to the occurrence number of sender sign of the mail of inbox from service platform, with the occurrence number of the sender's sign filtrating mail greater than set point;
S23: after the number of mail of once collecting reaches first preset value, revise the state of abnormality mark;
S24: when mail next time, collect the mail that is less than or equal to second preset value based on described abnormality mark.
See also Fig. 5, the mail reception system of present embodiment comprises timing unit 1, inbox 2, memory space 3, counting unit 4 and abnormality mark are revised unit 5, the difference of first embodiment of this embodiment and mail reception system is, this mail reception system also comprises pre-calculation unit 7 and filter element 8, these pre-calculation unit 7 statistics once are sent to the number of mail of inbox and compare calculated value and the 3rd preset value from service platform, the described number of mail that once is sent to inbox from service platform is the number of mail once collected of inbox just, and described pre-calculation unit 7 is also calculated the occurrence number of each sender's sign in the mail that is received.Described pre-calculation unit 7 produces received signal during less than the 3rd preset value and transmits received signal to inbox 2 at described calculated value, inbox 2 once receives described mail based on received signal, described pre-calculation unit 7 produces trap signal and transmission filtering signal during greater than the 3rd preset value to filter element 8 at described calculated value, filter element 8 is triggered the occurrence number of the sender's sign filtrating mail greater than set point by trap signal, with the mail transmission that is not filtered to inbox 2.
In this embodiment, the 3rd preset value is greater than first preset value, such as, the 3rd preset value is made as 200, the first preset values and is made as 100.So in such cases, number of mail can be surpassed 200 flood attack prevention by step S21 and step S22, stop number of mail to be lower than 200 flood attack by step S23 and step S24 then, the first embodiment step S11 and the step S12 of step S23 and step S24 and mail reception method for managing system are similar, do not repeat them here.Like this, adopted for two steps stoped flood attack, reduce the influence of flood attack, make the mail reception system can not paralyse the addressee system.
In the above-described embodiment, described mail is filtered and can carry out in the following way: statistics once is sent to the occurrence number of sender's sign of the mail of inbox 2 from service platform A, the sender is identified occurrence number falls (rejection) greater than the filtrating mail of set point, with the mail transmission that is not filtered to inbox 2.Described sender sign can be for sender's title, server domain name or sender's IP address etc.
See also Fig. 6 and Fig. 7, the 3rd embodiment of mail reception method for managing system of the present invention comprises:
S31: before once mailing, obtain sender's sign of the described mail of once collecting;
S32: the occurrence number of adding up described sender's sign;
S33: after the number of mail of once collecting reaches first preset value, and during greater than preset times, revise the state of abnormality mark in the occurrence number of sender sign;
S34: when mail next time, collect the mail that is less than or equal to second preset value based on described abnormality mark.
Corresponding with the 3rd embodiment of above-mentioned mail reception method for managing system, mail reception of the present invention system comprises that timing unit 1, inbox 2, memory space 3, counting unit 4, abnormality mark revise unit 5, compare with first embodiment of mail reception system, the mail reception system of present embodiment also comprises acquiring unit 9 and statistic unit 10.Described acquiring unit 9 obtains sender's sign of the described mail of once collecting.The described sender of statistic unit 10 statistics identifies occurrence number.Described abnormality mark is revised unit 5 after 2 addressee quantity of inbox reach first predetermined number and when the number of times that a described sender identifies appearance surpasses preset times, just revises the state of abnormality mark.
In the above-mentioned mail reception system, described sender's sign can be sender's title, server domain name or sender's IP address, be designated sender's name with the sender and be called the occurrence number how example explanation statistic unit 10 adds up sender's sign, such as, inbox 2 receives sender's name when being called each envelope of mail of B, C, D, outbox B, the C of statistic unit 10 statistics, the value of D are respectively 1,1,1, when receiving sender's name once more when being called the mail of B, statistic unit 10 statistics senders' sender B, C, the value of D are 2,1,1.
When the sender is designated server domain name and sender's IP address, the IP address that can obtain server domain name and sender by the mode of resolving, the occurrence number of the IP address of statistic unit 10 statistical server domain name correspondences and sender's IP address.
In this embodiment, timing unit 1, inbox 2, memory space 3, counting unit 4, abnormality mark are revised unit 5 and how to be cooperated the state of revising abnormality mark to be described among first embodiment of the mail reception management system corresponding with the mail reception method for managing system, do not repeat them here.
Adopt the foregoing description, can stop flood attack accurately.Such as, first preset value is that the preset times of the occurrence number of 50 envelopes and sender's sign is 40 envelopes (preset times that supposition sender name is called E is 40), when inbox 2 receives 50 envelope mails, this 50 envelope mail might comprise that sender's name is called mail 10 envelopes of F, sender's name is called mail 10 envelopes of G, and sender's name is called mail 30 envelopes of E, at this moment, the state of abnormality mark can not revised by described mail reception system, has improved the accuracy of judging.
Be understandable that how the quantity that once receives mail can also obtain server domain name and/or sender's IP address in conjunction with server domain name and/or sender's IP address, can adopt prior art, does not repeat them here.When in conjunction with server domain name and/or sender's IP address, described abnormality mark is revised unit 5 in the quantity that once receives mail during greater than the occurrence number of first preset value and server domain name, perhaps, greater than the IP address occurrence number of first preset value and sender's title during, perhaps revise the state of abnormality mark in the quantity that once receives mail during greater than preset times greater than the IP address occurrence number of the occurrence number of first preset value and server domain name and sender's title in the quantity that once receives mail greater than preset times.
As the improvement of above-mentioned mail reception system, described mail reception system can also comprise reset cell, and this reset cell produces the reset signal of the described abnormality mark that is used to reset.Described reset signal when mail reception system start-up or inbox when starting or when being later than service platform the start-up time of mail reception system and cleaning out time of spam or the mail reception system produce when receiving the signal that service platform cleaning spam finishes.Be the course of work that example illustrates this reset cell to be later than start-up time of mail reception system the time that service platform cleans out spam only: supposition was when suffering flood attack, and abnormality mark is 1, and service platform has cleaned out spam at 13 o'clock.Then, when starting the mail reception system at 15 o'clock, the time that this reset cell obtains mail reception system start-up is later than the time that service platform cleans out spam, and then, reset cell resets to 0 with abnormality mark by 1, and expression does not suffer flood attack.
Though the present invention discloses as above with preferred embodiment, the present invention is defined in this.Any those skilled in the art without departing from the spirit and scope of the present invention, all can do various changes and modification, so protection scope of the present invention should be as the criterion with claim institute restricted portion.