CN103095711B - A kind of application layer ddos attack detection method for website and system of defense - Google Patents

A kind of application layer ddos attack detection method for website and system of defense Download PDF

Info

Publication number
CN103095711B
CN103095711B CN201310018798.8A CN201310018798A CN103095711B CN 103095711 B CN103095711 B CN 103095711B CN 201310018798 A CN201310018798 A CN 201310018798A CN 103095711 B CN103095711 B CN 103095711B
Authority
CN
China
Prior art keywords
sequence
user
website
page
clicks
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201310018798.8A
Other languages
Chinese (zh)
Other versions
CN103095711A (en
Inventor
徐川
唐红
赵国锋
杜成
张毅
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Fuzhou Qilian Information Consulting Co ltd
Original Assignee
Chongqing University of Post and Telecommunications
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Chongqing University of Post and Telecommunications filed Critical Chongqing University of Post and Telecommunications
Priority to CN201310018798.8A priority Critical patent/CN103095711B/en
Publication of CN103095711A publication Critical patent/CN103095711A/en
Application granted granted Critical
Publication of CN103095711B publication Critical patent/CN103095711B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Landscapes

  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The present invention relates to a kind of application layer ddos attack detection method and system of defense, relate to network security, particularly the detection of application layer ddos attack and defence.The present invention is by being analyzed user access activity, it is proposed that click on detection method and the system of defense of sequence prediction based on user.First extract the page URL of website, utilize clustering algorithm to cluster, obtain the page classifications of this websiteV j Sequence is clicked on user;Then utilize user to click on sequence construct random walk figure, calculate next observation cycle of user by random walk process and click on sequence;By training threshold value, the sequence similarity finally calculating forecasting sequence and click on sequence, judges that user clicks on the abnormity of sequence.The present invention can effectively detect application layer ddos attack, particularly simulates the query-attack of normal users behavior, can be widely applied to data center's Website server Prevention-Security.

Description

A kind of application layer ddos attack detection method for website and system of defense
Technical field
The present invention relates to network safety filed, especially relate to the application layer ddos attack detection method for website and prevent Imperial system.
Background technology
Distributed denial of service attack (Distributed Denial of Service, DDoS), always the Internet One of the most serious threat that service supplier-Web server is faced.Tradition DDoS based on Internet or transport layer attacks Mode of hitting is detected well by increasingly mature network protection technology (fire wall, Intrusion Detection Technique etc.), calculates simultaneously The change of pattern makes more to service to be interacted by Web, and this accelerates ddos attack mode and develops to application layer.Occur Ddos attack in application layer generally uses real IP address as attacking node, utilizes the leak of application layer protocol, to target Server sends a large amount of query-attack based on HTTP legal agreement, can easily pass through network-safeguard system, and this makes it become undoubtedly The safety problem solved it is badly in need of for current web services device.
But most achievement in research is to detect Internet or transport layer ddos attack, be not suitable for based on The detection of application layer ddos attack.Existing application layer ddos attack detection method is also mainly for big vast formula based on http protocol Attack detecting, realizes attack detecting by the traffic characteristic of HTTP request or protocol characteristic are carried out statistical analysis, this for The asymmetrical attack mode using normal speed query-attack is then invalid.
Ranjan proposes the detection method of dialogue-based middle HTTP request statistics abnormality degree, and the method is first to website pages Classifying in face, then adds up the classification situation of user's HTTP request in each session, and train normal users with this HTTP request model, finally by the departure degree identification query-attack with normal users model.The method is attacked for asymmetric The characteristic hit, has carried out page classifications with HTTP request to resource consumption situation first;But it uses the HTTP request in session Statistical nature carries out the training of normal model, the feature remaining flow embodied, but the stream of asymmetrical attack person Flow characteristic is consistent with normal users, and the unified model used can not access feature to all types user is described.
Summary of the invention
It is an object of the invention to: for website based on application layer http protocol ddos attack, it is provided that one can be to employing The attack traffic of flood formula and asymmetrical attack mode carries out method and the system of defense detected;Due under asymmetrical attack mode, The discharge characteristic of assailant is consistent with normal users, brings difficulty to attack detecting and defence, to this end, inventor proposes accordingly Solution.
A kind of application layer ddos attack detection method for website, comprises the steps:
Extract the page URL of website, utilize K-means clustering algorithm that HTTP request is classified according to website, obtain The page classifications set of this websiteV j ,jFor page type, by HTTP request and page classifications setV j Mate, and then obtain User clicks on sequenceu i ={x 1 ,x 2 ,…,x n ,x i Represent the one click of user,iFor isolated user number.
User is utilized to click on sequenceu i ={x 1 ,x 2 ,…,x n Training obtain page transition probability matrixP Vj
Sequence is clicked on according to useru i ={x 1 ,x 2 ,…,x n , construct this user institute accession page random walk figure.
Sequence is clicked on according to the user in user's Current observation cycleu i ={x 1 ,x 2 ,…,x n , page transition probability matrixP Vj Random walk calculating is carried out, it was predicted that the user obtaining next observation cycle of user clicks on sequence with page random walk figureu i = {x 1 ,x 2 ,…,x n }.ProbabilityDistribution Vector computing formula during random walk calculates is, its InpFor adjacency matrix,s 0It is vectorial for initial probability distribution,For redirecting probability of happening,dEach top is jumped to during for redirecting The ProbabilityDistribution Vector of point.pIt is specially page transition probability matrixP Vj s 0Obtain from random walk figure;dIt is specially the page to turn Move probability matrixP Vj In a column vector;Redirect probability of happeningIt is set to 0.15.
The user calculated in the Current observation cycle clicks on sequenceu i ={x 1 ,x 2 ,…,x n And user's point of next observation cycle Hit sequenceu i ={x 1 ,x 2 ,…,x n Sequence similarity.The computing formula of sequence similarity is,u i Represent User in the Current observation cycle clicks on sequence,u Represent that the user of next observation cycle clicks on sequence.
Compare according to sequence similarity and threshold value and judge that user clicks on sequenceu i The most normal, if sequence similarity Then show that less than threshold value this user clicks on sequenceu i For attack sequence, otherwise it it is normal access sequence.
A kind of application layer ddos attack system of defense for website, including request processing module, model training module, sequence Row prediction module and abnormality detection module, wherein, request processing module utilizes K-means clustering algorithm to HTTP request according to net Classifying in station, obtains classification setV j , and then obtain user and click on sequenceu i , and user is clicked on sequenceu i Biography sends to model Training module and sequence prediction module;Model training module clicks on sequence according to useru i Structure random walk figure, it is thus achieved that website Page transition probability matrixP Vj , and submit to Sequence Detection module;Sequence prediction module clicks on sequence useru i Current sight On the basis of the survey cycle, according to the prediction of random walk figure, next observation cycle user clicks on sequenceu i ;Abnormality detection module will User in the Current observation cycle clicks on sequenceu i Sequence is clicked on next observation cycle useru i Carry out sequence similarity meter Calculate.
The present invention can effectively detect application layer ddos attack, particularly simulates the query-attack of normal users behavior, can be wide General it is applied to data center's Website server Prevention-Security.
Accompanying drawing explanation
Fig. 1 is that application layer ddos attack system of defense disposes schematic diagram;
Fig. 2 is application layer ddos attack system of defense architectural schematic;
Fig. 3 is application layer ddos attack detection mode schematic diagram;
Fig. 4 is that user clicks on sequence prediction and abnormality detection schematic diagram;
Fig. 5 is random walk schematic diagram.
Detailed description of the invention
Being illustrated in figure 1 application layer ddos attack system of defense and dispose schematic diagram, system deployment is in data center's web services Device 1.2 front end, for protecting all web servers 1.2 of data center.System is to accessing data center server 80 port The HTTP request of 1.1 detects, and then abandons if query-attack, is then transmitted to server if normal request.
Being illustrated in figure 2 application layer ddos attack system of defense architectural schematic, this system is mainly by following four Module forms:
Request processing module 1, the HTTP request that this module is responsible for accessing server carries out pretreatment, first according to HTTP Request uses K-means(clustering algorithm based on distance) page of a website classified, classified by clustering algorithm SetV j ;J is page type, secondly according to HTTP request and page classifications setV j Mate, obtain the click sequence of useru i ={x 1 ,x 2 ,…,x n },u i In element x i V j , user is clicked on sequence and gives model training module 2 and sequence prediction mould Block 3.
Model training module 2, this module is responsible for training website user access activity, structuring user's accession page random walk Figure and the transition probability matrix of Website pageP Vj , submit to sequence prediction module and use.User to access pages random walk figure pin To unique user, may be used for distinguishing the access behavior of unique user;The transition probability matrix of Website page is used for describing access The clustering behavior of all users in this website, for the diversity avoiding unique user behavior difference to be brought.
Sequence prediction module 3, this module is responsible for clicking on sequence useru i ={x 1 ,x 2 ,…,x n Current observation cycle On the basis of, according to the prediction of random walk figure, next observation cycle user clicks on sequenceu i ={x 1 ,x 2 ,…,x n }。
Abnormality detection module 4, this module is responsible for clicking on user the normality of sequence and is detected, will use in observation cycle Sequence is clicked at familyu i ={x 1 ,x 2 ,…,x n And predict that the user obtained clicks on sequenceu i ={x 1 ,x 2 ,…,x n Carry out sequence phase Seemingly spend calculating, if similarity is higher than threshold value, then asks for normal users, be transmitted to server;If similarity is less than threshold value, Then ask for ddos attack, then abandon the HTTP request of this user.
Pretend normal users access process to solve assailant, system have employed in user clicks on sequence recognition based on The Forecasting Methodology of random walk, it is possible to the access behavior to user's next cycle carries out Accurate Prediction.
The application layer ddos attack detection method using the present invention to propose, compensate for tradition and is characterized as basis with customer flow The deficiency of method, it is possible to the asymmetric HTTP query-attack that effectively resource consumption is high to traffic characteristic is normal detects, and keeps away Having exempted from legacy system uses same model to describe the error that all user behaviors are brought.
Being illustrated in figure 3 application layer ddos attack detection method schematic diagram, the method includes following six step:
1, first extract the page URL of website, according to URL depth, URL popularity and consumer loyalty degree, utilize K-means (clustering algorithm based on distance) clustering algorithm clusters, and obtains the page classifications of this websiteV j ,jFor page type.
2, distinguish a user by IP, obtain the click sequence in session of this useru i ={x 1 ,x 2 ,…,x n ,i For isolated user number, utilize the click sequence training page transition probability matrix of all usersP Vj
3, sequence is clicked on according to a session of useru i ={x 1 ,x 2 ,…,x n , construct this user institute accession page with Machine migration figure.
4, according to the click sequence in user's Current observation timeu i ={x 1 ,x 2 ,…,x n , page transition probability matrixP Vj Random walk process calculating is carried out, it was predicted that the user obtaining next observation cycle of user clicks on sequence with page random walk figureu i ={x 1 ,x 2 ,…,x n }。
5, calculating observation sequenceu i ={x 1 ,x 2 ,…,x n And forecasting sequenceu i ={x 1 ,x 2 ,…,x n Sequence similarity, Computing formula is,u i Represent that the user in the Current observation cycle clicks on sequence,u Represent next observation cycle User clicks on sequence.
6, compare according to sequence similarity and threshold value and judge the normality of this sequence, if sequence similarity is less than threshold Value then shows that this user's access sequence is attack sequence, otherwise is normal access sequence.
With an instantiation, user is clicked on sequence random walk figure building method below to be analyzed, example: the page SetIn have 5 pages, i.e.k=5, training setDIn have 4 user's access sequences be respectivelyu 1=1,2,3,4,4},u 2 =3,4,5,2},u 3=3,5,2,4,1,3},u 4=2,1,5}, then by page setWith training setDThat derives is oriented Random walk figure as shown in Figure 5.
Fig. 4 show user and clicks on sequence prediction and abnormality detection schematic diagram, and this method is by acquisition in observation cycle T User clicks on sequenceu i (k)={x 1 ,x 2 ,…,x n , calculate the user in next observation cycle T+1 by random walk process Click on sequenceu i `(k+1)={x n+1, x n+2, …, x m+n , concrete calculating process is as follows:
Sequence is clicked on the user in observation cycle Tu i (k)={x 1 ,x 2 ,…,x n For inputting, pass through random walk process Calculate user to click on next timex n+1, 4 input parameters of random walk process needs: adjacency matrixp, initial probability distribution vectors 0, redirect probability of happening, when redirecting, jump to the ProbabilityDistribution Vector on each summit in figured.Wherein adjacency matrixpFor Website page transition probability matrixP Vj ;Initial probability distribution vectors 0Obtain from random walk figure;Redirect ProbabilityDistribution Vectord For Website page transition probability matrixP Vj In a column vector;Redirect probability of happeningIt is set to 0.15.
Output probability distribution vector after walk process is denoted as every times,sComputational methods be shown below:
(1)
By vectorsInput as formula (1), ProbabilityDistribution Vector now, until convergence, is remembered by the formula that iterates (1) Make, vectorIt is the ProbabilityDistribution Vector of steady statue, from vectorIn choosex n+1Click next timex n+1
According to newly obtained clickx n+1Constitute and click on sequenceu i (k)={x 2 ,x 2 ,…,x n+1, using it as enter through with Machine walk process calculates and clicks on next timex n+2, such double countingmSecondary, the user obtained in observation cycle T+1 clicks on sequenceu i ` (k+1)={x n+1, x n+2, …, x m+n }.Observation sequence in calculating observation cycle T+1u i (k+1)={x 1, x 2, …, x m } And forecasting sequenceu i `(k+1)={x n+1, x n+2, …, x m+n Similarity, it is achieved sequence variation detect.

Claims (3)

1. the application layer ddos attack detection method for website, it is characterised in that comprise the steps:
Extract the page URL of website, according to URL depth, URL popularity and consumer loyalty degree, utilize K-means clustering algorithm pair HTTP request is classified according to website, obtains the page classifications set of this websiteV j ,jFor page type, distinguish one by IP Individual user, and then the user obtained in session of this user clicks on sequenceu i ={x 1 ,x 2 ,…,x n ,iFor isolated user number;
The user utilizing all users clicks on sequenceu i ={x 1 ,x 2 ,…,x n Training obtain page transition probability matrixP Vj
Sequence is clicked on according to useru i ={x 1 ,x 2 ,…,x n , construct this user institute accession page random walk figure;
Sequence is clicked on according to the user in user's Current observation cycleu i ={x 1 ,x 2 ,…,x n , page transition probability matrixP Vj With Page random walk figure carries out random walk calculating, it was predicted that the user obtaining next observation cycle of user clicks on sequenceu i ={x 1 ,x 2 ,…,x n };
The user calculated in the Current observation cycle clicks on sequenceu i ={x 1 ,x 2 ,…,x n And the user of next observation cycle click on sequence Rowu i ={x 1 ,x 2 ,…,x n Sequence similarity, computing formula is,u i In representing the Current observation cycle User clicks on sequence,u Represent that the user of next observation cycle clicks on sequence;
Compare according to sequence similarity and threshold value and judge that user clicks on sequenceu i It is the most normal, if sequence similarity is less than Threshold value then shows that this user clicks on sequenceu i For attack sequence, otherwise it it is normal access sequence.
A kind of application layer ddos attack detection method for website, it is characterised in that: described To page classifications setV j After, by HTTP request and page classifications setV j Mate, and then obtain user and click on sequenceu i = {x 1 ,x 2 ,…,x n }。
A kind of application layer ddos attack detection method for website, it is characterised in that: described with ProbabilityDistribution Vector computing formula during machine migration calculates is, whereinpFor adjacency matrix,s 0For Initial probability distribution vector,For redirecting probability of happening,dThe ProbabilityDistribution Vector on each summit is jumped to during for redirecting.
CN201310018798.8A 2013-01-18 2013-01-18 A kind of application layer ddos attack detection method for website and system of defense Active CN103095711B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201310018798.8A CN103095711B (en) 2013-01-18 2013-01-18 A kind of application layer ddos attack detection method for website and system of defense

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201310018798.8A CN103095711B (en) 2013-01-18 2013-01-18 A kind of application layer ddos attack detection method for website and system of defense

Publications (2)

Publication Number Publication Date
CN103095711A CN103095711A (en) 2013-05-08
CN103095711B true CN103095711B (en) 2016-10-26

Family

ID=48207844

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201310018798.8A Active CN103095711B (en) 2013-01-18 2013-01-18 A kind of application layer ddos attack detection method for website and system of defense

Country Status (1)

Country Link
CN (1) CN103095711B (en)

Families Citing this family (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103810241B (en) * 2013-11-22 2017-04-05 北京奇虎科技有限公司 Filter method and device that a kind of low frequency is clicked on
CN104901971B (en) * 2015-06-23 2019-03-15 北京东方棱镜科技有限公司 The method and apparatus that safety analysis is carried out to network behavior
TWI562013B (en) * 2015-07-06 2016-12-11 Wistron Corp Method, system and apparatus for predicting abnormality
CN105592070B (en) * 2015-11-16 2018-10-23 中国银联股份有限公司 Application layer DDoS defence methods and system
CN105510971A (en) * 2016-02-18 2016-04-20 福建师范大学 Seismic data abnormality detection method based on random walk
CN105812280B (en) * 2016-05-05 2019-06-04 四川九洲电器集团有限责任公司 A kind of classification method and electronic equipment
CN106209861B (en) * 2016-07-14 2019-07-12 南京邮电大学 One kind being based on broad sense Jie Kade similarity factor Web application layer ddos attack detection method and device
CN107798571B (en) * 2016-08-31 2019-08-30 阿里巴巴集团控股有限公司 Malice address/malice order identifying system, method and device
WO2018095192A1 (en) 2016-11-23 2018-05-31 腾讯科技(深圳)有限公司 Method and system for website attack detection and prevention
CN106778259B (en) * 2016-12-28 2020-01-10 北京明朝万达科技股份有限公司 Abnormal behavior discovery method and system based on big data machine learning
CN108874813B (en) * 2017-05-10 2022-07-29 腾讯科技(北京)有限公司 Information processing method, device and storage medium
CN107204991A (en) * 2017-07-06 2017-09-26 深信服科技股份有限公司 A kind of server exception detection method and system
CN107491970B (en) * 2017-08-17 2021-04-02 北京三快在线科技有限公司 Real-time anti-cheating detection monitoring method and system and computing equipment
CN107707547A (en) * 2017-09-29 2018-02-16 北京神州绿盟信息安全科技股份有限公司 The detection method and equipment of a kind of ddos attack
CN108540440A (en) * 2018-02-02 2018-09-14 努比亚技术有限公司 DDOS attack solution, server and computer readable storage medium
CN111476610B (en) * 2020-04-16 2023-06-09 腾讯科技(深圳)有限公司 Information detection method, device and computer readable storage medium
CN112488321B (en) * 2020-12-07 2022-07-01 重庆邮电大学 Antagonistic machine learning defense method oriented to generalized nonnegative matrix factorization algorithm
CN112231700B (en) * 2020-12-17 2021-05-11 腾讯科技(深圳)有限公司 Behavior recognition method and apparatus, storage medium, and electronic device

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102184406A (en) * 2009-11-11 2011-09-14 索尼公司 Information processing device, information processing method, and program
CN102487293A (en) * 2010-12-06 2012-06-06 中国人民解放军理工大学 Satellite communication network abnormity detection method based on network control

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102184406A (en) * 2009-11-11 2011-09-14 索尼公司 Information processing device, information processing method, and program
CN102487293A (en) * 2010-12-06 2012-06-06 中国人民解放军理工大学 Satellite communication network abnormity detection method based on network control

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
基于shell命令和多阶Markov链模型的用户伪装攻击检测;肖喜 翟起滨 田新广 陈小娟 叶润国;《电子学报》;20110531;第39卷(第5期);正文第1201页 *
基于用户行为分析的应用层DDoS攻击检测方法;赵国锋 喻守成 文晟;《计算机应用研究》;20110228;第28卷(第2期);全文 *

Also Published As

Publication number Publication date
CN103095711A (en) 2013-05-08

Similar Documents

Publication Publication Date Title
CN103095711B (en) A kind of application layer ddos attack detection method for website and system of defense
Xie et al. Monitoring the application-layer DDoS attacks for popular websites
Sun et al. {HinDom}: A robust malicious domain detection system based on heterogeneous information network with transductive classification
Xie et al. A large-scale hidden semi-Markov model for anomaly detection on user browsing behaviors
Jyothi et al. Brain: Behavior based adaptive intrusion detection in networks: Using hardware performance counters to detect ddos attacks
CN113079143A (en) Flow data-based anomaly detection method and system
Zhu et al. A deep learning approach for network anomaly detection based on AMF-LSTM
CN109117634A (en) Malware detection method and system based on network flow multi-view integration
CN109600363A (en) A kind of internet-of-things terminal network portrait and abnormal network access behavioral value method
CN107392016A (en) A kind of web data storehouse attack detecting system based on agency
CN109284296A (en) A kind of big data PB grades of distributed informationm storage and retrieval platforms
Patil et al. S-DDoS: Apache spark based real-time DDoS detection system
Xu et al. Detection on application layer DDoS using random walk model
Ye et al. Application layer DDoS detection using clustering analysis
CN104113544B (en) Network inbreak detection method and system based on fuzzy hidden conditional random fields model
Liao et al. Feature extraction and construction of application layer DDoS attack based on user behavior
Meng et al. Ddos attack detection system based on analysis of users' behaviors for application layer
Beckett et al. New sensing technique for detecting application layer DDoS attacks targeting back-end database resources
Lei et al. Detecting malicious domains with behavioral modeling and graph embedding
Liang et al. Unveiling fake accounts at the time of registration: An unsupervised approach
CN107231383A (en) The detection method and device of CC attacks
Agrawal et al. Estimating strength of a DDoS attack in real time using ANN based scheme
Wang et al. HTTP-SoLDiER: An HTTP-flooding attack detection scheme with the large deviation principle
Badis et al. Toward a source detection of botclouds: a pca-based approach
Jiang et al. A highly efficient remote access Trojan detection method

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C14 Grant of patent or utility model
GR01 Patent grant
TR01 Transfer of patent right

Effective date of registration: 20221104

Address after: 710061 Room 222, East of Floor 2, Office Building, Hanguang Community, No. 10, Hanguang South Section, Yanta District, Xi'an, Shaanxi

Patentee after: Xi'an Longhe Linchuang Intellectual Property Agency Co.,Ltd.

Address before: 400065 Chongqing Nan'an District huangjuezhen pass Chongwen Road No. 2

Patentee before: CHONGQING University OF POSTS AND TELECOMMUNICATIONS

Effective date of registration: 20221104

Address after: Room 1111, Building 1, Wanting Building, Labor Community, Xixiang Street, Bao'an District, Shenzhen City, Guangdong Province, 518101

Patentee after: Shenzhen Occupy Information Technology Co.,Ltd.

Address before: 710061 Room 222, East of Floor 2, Office Building, Hanguang Community, No. 10, Hanguang South Section, Yanta District, Xi'an, Shaanxi

Patentee before: Xi'an Longhe Linchuang Intellectual Property Agency Co.,Ltd.

TR01 Transfer of patent right
TR01 Transfer of patent right

Effective date of registration: 20240408

Address after: Room 05-5, 8th Floor, Hesheng Industrial and Commercial Building, No. 89 Fuxin Middle Road, Wangzhuang Street, Jin'an District, Fuzhou City, Fujian Province, 350000

Patentee after: Fuzhou Qilian Information Consulting Co.,Ltd.

Country or region after: China

Address before: Room 1111, Building 1, Wanting Building, Labor Community, Xixiang Street, Bao'an District, Shenzhen City, Guangdong Province, 518101

Patentee before: Shenzhen Occupy Information Technology Co.,Ltd.

Country or region before: China

TR01 Transfer of patent right