CN106549784A - A kind of data processing method and equipment - Google Patents
A kind of data processing method and equipment Download PDFInfo
- Publication number
- CN106549784A CN106549784A CN201510603327.2A CN201510603327A CN106549784A CN 106549784 A CN106549784 A CN 106549784A CN 201510603327 A CN201510603327 A CN 201510603327A CN 106549784 A CN106549784 A CN 106549784A
- Authority
- CN
- China
- Prior art keywords
- abnormal data
- data
- server
- abnormal
- auxiliary server
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
Abstract
This application discloses a kind of data processing method and equipment, including：Master server receives the abnormal data alarm that at least one auxiliary server sends, the ID comprising the user for sending abnormal data in abnormal data alarm；The first abnormal data synchronizing information comprising ID is sent to the auxiliary server within institute's range of management；Receive the number of the abnormal data that each described auxiliary server sends；When it is determined that the number sum of the abnormal data for receiving is more than given threshold, the abnormal data comprising the ID is sent to auxiliary server and intercept instruction.So, in a distributed system, abnormal data is monitored by auxiliary server, auxiliary server is avoided in the problem for causing the reduction of webserver work efficiency in real time to caused by master server synchrodata when synchronous data are abnormal data, also attack probability of the abnormal data to master server is significantly reduced, the safety of network service system is effectively improved.
Description
Technical field
The application is related to field of computer technology, more particularly to a kind of data processing method and equipment.
Background technology
With the development of Internet technology, people are increasing to the dependency of the Internet.People can pass through
Internet checking data, can also enjoy the various network services of Virtual network operator offer.
Usually, in order to preferably give people to provide network service, Virtual network operator adopts distributed network
Service system.So-called distributed network service system includes the (letter below of at least one primary networking service device
Claim master server) and at least one auxiliary network server (hereinafter referred to as auxiliary server), master server with
Auxiliary server provides network service jointly.
Illustrate how distributed network service provides network service so that user initiates logging request as an example below.
Specifically, when user access the Internet when, user from distributed network service system apart from itself compared with
Upper network parameters are obtained near auxiliary server (for example：IP address, domain name addresses etc.), and based on acquisition
To upper network parameters initiate logging request to the auxiliary server, the user that the user is carried in the logging request steps on
Record information, for example：Username and password etc..The auxiliary server is utilized and is divided when the logging request is received
The logging request is synchronized to master server by cloth framework.Master server is when the logging request is received, right
The user login information is authenticated, and login response message is passed sequentially through auxiliary server when certification passes through
The user is sent to, the operation of User logs in the Internet is completed.
But, with the development of science and technology, occur in that network hacker.Some network hackers are exclusively used in attacking
Website server so that Website server cisco unity malfunction under attack.For example：When a certain malice is used
Family sends logging request to the Website server of a certain website, and so auxiliary server is receiving user's transmission
Each time during logging request, by the logging request synchronized transmission for receiving to master server.Once malicious user
It is intended to attack master server, then send multiple logging request or malicious attack data at short notice, make
Obtain in the data volume short time between auxiliary server and master server on communication link and increase severely.Due to master server
The limited bandwidth of communication link between auxiliary server, will cause resource quilt between master server and auxiliary server
Shared by malicious attack data so that the work efficiency of network service system is reduced, while reducing network service
The safety of system.
The content of the invention
In view of this, the embodiment of the present application provides a kind of data processing method and equipment, for solving at present
The problem that work efficiency is relatively low and safety is poor that network service system is present.
This application provides a kind of data processing method, including：
Master server receives the abnormal data alarm that at least one auxiliary server sends, wherein, the abnormal number
According to the ID comprising the user for sending abnormal data in alarm；
The master server sends comprising the ID the to the auxiliary server within institute's range of management
One abnormal data synchronizing information, wherein, the first abnormal data synchronizing information is used to indicate the auxiliary service
Device sends to the master server and receives the described abnormal number sent by the corresponding user of the ID
According to number；
The master server receives the number of the abnormal data that each described auxiliary server sends；
The master server it is determined that the abnormal data for receiving number sum be more than given threshold when,
The abnormal data comprising the ID is sent to the auxiliary server and intercepts instruction, wherein, the exception
Data interception instructs the exception for indicating the auxiliary server to the corresponding user's transmission of the ID
Data are intercepted.
Present invention also provides a kind of data processing method, including：
The pending data that auxiliary server receive user sends, wherein, comprising described in the pending data
The ID of user；
The auxiliary server it is determined that the pending data for receiving number more than setting threshold value when,
Abnormal data alarm is sent to master server, wherein, the ID is included in the abnormal data alarm.
Present invention also provides a kind of data handling equipment, including：
Receiving unit, for receiving the abnormal data alarm that at least one auxiliary server sends, wherein, it is described
ID comprising the user for sending abnormal data in abnormal data alarm；
Transmitting element, for comprising the ID the is sent to the auxiliary server within institute's range of management
One abnormal data synchronizing information, wherein, the first abnormal data synchronizing information is used to indicate the auxiliary service
Device sends to the master server and receives the described abnormal number sent by the corresponding user of the ID
According to number；
The receiving unit, be additionally operable to receive the abnormal data that each described auxiliary server sends
Number；
The transmitting element, is additionally operable to it is determined that the number sum of the abnormal data for receiving is more than setting
During threshold value, the abnormal data comprising the ID is sent to the auxiliary server and intercept instruction, wherein,
The abnormal data intercepts instruction for indicating that the auxiliary server is sent out to the corresponding user of the ID
The abnormal data for sending is intercepted.
Present invention also provides a kind of data handling equipment, including：
Receiving unit, for the pending data that receive user sends, wherein, wrap in the pending data
ID containing the user；
Transmitting element, for it is determined that the number of the pending data for receiving is more than setting threshold value
When, abnormal data alarm is sent to master server, wherein, the user is included in the abnormal data alarm
Mark.
The application has the beneficial effect that：
The embodiment of the present application master server receives the abnormal data alarm that at least one auxiliary server sends, described
ID comprising the user for sending abnormal data in abnormal data alarm；To auxiliary within institute's range of management
Server sends the first abnormal data synchronizing information comprising the ID, and first abnormal data is same
Step information is used to indicate that the auxiliary server is received by the ID pair to master server transmission
The number of the abnormal data that the user for answering sends；Receive the described different of each auxiliary server transmission
The number of regular data；When it is determined that the number sum of the abnormal data for receiving is more than given threshold, to
The auxiliary server sends the abnormal data comprising the ID and intercepts instruction, and the abnormal data is intercepted
Instruct for indicating that the auxiliary server is carried out to the abnormal data that the corresponding user of the ID sends
Intercept.So, in a distributed system, abnormal data is monitored by auxiliary server, works as master server
When the abnormal data for receiving server transmission is alerted, synchronous each auxiliary server that obtains is received into exception
The number of data, determines a need for intercepting abnormal data with this, thus avoid auxiliary server and exists
The webserver is caused when synchronous data are abnormal data to caused by master server synchrodata in real time
The problem that work efficiency is reduced, also effectively intercepts the attack of abnormal data at auxiliary server, reduces
Attack probability of the abnormal data to master server, effectively improves the safety of network service system.
Description of the drawings
For the technical scheme being illustrated more clearly that in the embodiment of the present application, below will be to institute in embodiment description
The accompanying drawing that needs are used is briefly introduced, it should be apparent that, drawings in the following description are only the application's
Some embodiments, for one of ordinary skill in the art, in the premise for not paying creative labor
Under, can be with according to these other accompanying drawings of accompanying drawings acquisition.
A kind of schematic flow sheet of data processing method that Fig. 1 is provided for the embodiment of the present application；
A kind of schematic flow sheet of data processing method that Fig. 2 is provided for the embodiment of the present application；
A kind of schematic flow sheet of data processing method that Fig. 3 is provided for the embodiment of the present application；
A kind of structural representation of data handling equipment that Fig. 4 is provided for the embodiment of the present application；
A kind of structural representation of data handling equipment that Fig. 5 is provided for the embodiment of the present application.
Specific embodiment
In order to realize the purpose of the application, the embodiment of the present application provides a kind of data processing method and equipment,
Master server receives the abnormal data alarm that at least one auxiliary server sends, and wraps in the abnormal data alarm
ID containing the user for sending abnormal data；Send comprising institute to the auxiliary server within institute's range of management
The first abnormal data synchronizing information of ID is stated, the first abnormal data synchronizing information is used to indicate institute
State auxiliary server and the institute sent by the corresponding user of the ID is received to master server transmission
State the number of abnormal data；Receive the number of the abnormal data that each described auxiliary server sends；
It is determined that when the number sum of the abnormal data for receiving is more than given threshold, sending to the auxiliary server
Abnormal data comprising the ID intercepts instruction, and it is described for indicating that the abnormal data intercepts instruction
Auxiliary server is intercepted to the abnormal data that the corresponding user of the ID sends.So, in distribution
In formula system, abnormal data is monitored by auxiliary server, when master server is receiving server transmission
Abnormal data when alerting, obtain the number that each auxiliary server receives abnormal data by synchronous, sentenced with this
It is fixed whether to need to intercept abnormal data, auxiliary server is thus avoid in real time to master server synchronization
The problem of webserver work efficiency reduction is caused caused by data when synchronous data are abnormal data,
Also effectively the attack of abnormal data is intercepted at auxiliary server, abnormal data is reduced to master server
Probability is attacked, the safety of network service system is effectively improved.
With reference to Figure of description, to the application, each embodiment is described in further detail.Obviously, institute
The embodiment of description is only some embodiments of the present application, rather than the embodiment of whole.Based on the application
In embodiment, it is all that those of ordinary skill in the art are obtained under the premise of creative work is not made
Other embodiments, belong to the scope of the application protection.
A kind of schematic flow sheet of data processing method that Fig. 1 is provided for the embodiment of the present application.Methods described can
With as described below.The executive agent of the embodiment of the present application is master server.
Step 101：Master server receives the abnormal data alarm that at least one auxiliary server sends.
Wherein, the ID comprising the user for sending abnormal data in the abnormal data alarm.
In a step 101, in distributed network service system, when auxiliary monitoring server is to abnormal data
And when determining that satisfaction sends abnormal data alarm conditions, abnormal data alarm is sent to master server, and different
Comprising the ID for sending abnormal data in regular data alarm so that master server can be to the ID
The abnormal data that corresponding user sends is judged.
That is, within the compass of competency of master server, arbitrary auxiliary server is detecting abnormal number
According to and determine meet send abnormal data alarm conditions when, can to master server send abnormal data accuse
It is alert so that in the range of master server certain hour, to receive the abnormal data announcement that at least one auxiliary server sends
It is alert.
Need exist for illustrating, the ID described in the embodiment of the present application can be the IP of user
Address, or the device identification of the used equipment of user, are not specifically limited here.
Step 102：The master server is sent comprising the user to the auxiliary server within institute's range of management
First abnormal data synchronizing information of mark.
Wherein, the first abnormal data synchronizing information is used to indicate the auxiliary server to the master server
Transmission receives the number of the abnormal data sent by the corresponding user of the ID.
In a step 102, the master server can with by the way of broadcast to auxiliary within institute's range of management
Server sends the first abnormal data synchronizing information comprising the ID, it would however also be possible to employ point-to-point
It is same that mode sends the first abnormal data comprising the ID to the auxiliary server within institute's range of management
Step information, can also be sent using other modes, here for the sender of the first abnormal data synchronizing information
Formula is not specifically limited.
Specifically, master server receive at least one server transmission abnormal data alert when, it is determined that
There is the risk attacked in distributed network service system, in order to further determine that distributed network
Whether service system is attacked, then master server is sent comprising described to the server within institute's range of management
First abnormal data synchronizing information of ID, so contributes to master server and further obtains user's mark
Know the frequency that corresponding user sends abnormal data, be to determine whether distributed network service system is attacked
Judgment basis are provided.
Step 103：The master server receives the abnormal data that each described auxiliary server sends
Number.
In step 103, the master server is receiving the described different of each auxiliary server transmission
During the number of regular data, the master server is according to the exception for receiving each auxiliary server transmission
The number of data, calculates the number and value of the abnormal data for receiving.
Alternatively, abnormal number is also included in the abnormal data alarm and the first abnormal data synchronizing information
According to the time for occurring, so, also imply that master server same to auxiliary server the first abnormal data of transmission
During step information, need to inform the time that auxiliary server exception data occur, the time can be a time period,
Can also be a time point, not limit here.
Each described auxiliary server when the first abnormal data synchronizing information is received, according to the first abnormal number
According to the time that the abnormal data included in synchronizing information occurs, count in the time range that the abnormal data occurs
The number of the abnormal data for receiving, and the number that statistics is obtained is sent to into master server.
So, the master server is according to the abnormal data for receiving each auxiliary server transmission
Number, counts the number and value of the abnormal data for receiving.
Step 104：The master server judges whether the number sum of the abnormal data for receiving is more than
Given threshold, if being more than, execution step 105；Otherwise, execution step 106.
Explanation is needed exist for, the size of involved given threshold can basis in the embodiment of the present application
It is actually needed determination, it is also possible to determine according to the practical situation of network service system resource load or adjust in real time
It is whole, do not limit here.
Step 105：The master server is it is determined that the number sum of the abnormal data for receiving is more than setting
When determining threshold value, the abnormal data comprising the ID is sent to the auxiliary server and intercept instruction.
Wherein, the abnormal data intercepts instruction for indicating the auxiliary server to ID correspondence
User send abnormal data intercepted.
In step 105, the master server is it is determined that the number sum of the abnormal data for receiving is big
When given threshold, determine that distributed network service system is subject to the malicious attack of user, need to the use
Family identifies the abnormal data of corresponding user's transmission and is intercepted, then master server sends to auxiliary server and wraps
Abnormal data containing the ID intercepts instruction.
Step 106：The master server is it is determined that the number sum of the abnormal data for receiving is not more than
During given threshold, the data flush instructions comprising the ID are sent to the auxiliary server.
Wherein, the data flush instructions are clear for indicating the auxiliary server for receiving the data flush instructions
The record of the abnormal data number that the corresponding user of the sky ID sends.
In step 106, the master server it is determined that the number sum of the abnormal data for receiving not
During more than given threshold, it may be determined that distributed network service system not yet by user malicious attack or
Person is subject to the probability of malicious attack less, the abnormal data that can be sent to the corresponding user of the ID
Processed.
Alternatively, the master server sends data flush instructions to the auxiliary server, including：
The master server sends the second abnormal data comprising the time cycle to the auxiliary server synchronously to be believed
Breath, the master server determine when reaching the time cycle abnormal data for receiving number it
No more than given threshold when, send data flush instructions to the auxiliary server.
Wherein, the second abnormal data synchronizing information is used to indicate that each receives the described second abnormal number
The number of the abnormal data received in the time cycle is sent according to the auxiliary server of synchronizing information
To the master server.
It should be noted that the time cycle described in the embodiment of the present application is may refer to from the first exception of transmission
Data synchronization information start after a period of time, so described master server is it is determined that what is received is described different
When the number sum of regular data is not more than given threshold, then continue for some time, it is desirable to which auxiliary server is reported to be held
The number of the abnormal data that the corresponding user of the ID for receiving continuous this period sends, with further
Determine whether the abnormal data that the corresponding user of the ID sends belongs to malicious attack data.
" the first abnormal data synchronizing information " that be related in the embodiment of the present application and " the second abnormal data is same
" first " and " second " included in step information " is only intended to differentiation master server and have sent exception twice
Data synchronization information, does not have other particular meanings.
Specifically, the is sent as the abnormal data alarm that master server is sent according to portion of secondary server determines
One abnormal data, that is to say, that the abnormal data that the corresponding user of the ID sends is now to portion of secondary
Malicious attack is constituted for server, but whether malicious attack is constituted to master server and can't be determined, then
Master server sends the first abnormal data synchronizing information, it is desirable to which the auxiliary server within compass of competency reports reception
With this, the number of the abnormal data sent to the corresponding user of the ID, judges that the ID is corresponding
Whether the abnormal data that user sends constitutes malicious attack to master server.When the master server is it is determined that connect
When the number sum of the abnormal data for receiving is not more than given threshold, can alert to abnormal data is sent
Auxiliary server send the abnormal data comprising the ID and intercept instruction, it is also possible to not yet sending different
The auxiliary server of regular data alarm sends the data flush instructions comprising the ID, does not do concrete here
Limit.
Alternatively, the master server is sending the abnormal number comprising the ID to the auxiliary server
After instruction is intercepted, methods described also includes：
The master server sends the data processing instructions comprising the ID to the auxiliary server.
Wherein, the data processing instructions receive the auxiliary server pair of the data processing instructions for instruction
The abnormal data that the corresponding user of the ID sends is processed.
Alternatively, the master server determines the abnormal data for receiving when reaching the time cycle
Number sum be more than given threshold when, redirect execution step 105.
It should be noted that the abnormal data described in the embodiment of the present application refers to that user sends the frequency of data
More than the data of specified numerical value, specified numerical value here can determine according to actual needs, not limit here.
By the scheme of the embodiment of the present application, master server receives the abnormal number that at least one auxiliary server sends
According to alarm, the ID comprising the user for sending abnormal data in the abnormal data alarm；To being managed
Within the scope of auxiliary server send the first abnormal data synchronizing information comprising the ID, described the
One abnormal data synchronizing information is used to indicate that the auxiliary server is received by institute to master server transmission
State the number of the abnormal data that the corresponding user of ID sends；Receive each described auxiliary server
The number of the abnormal data for sending；It is determined that the number sum of the abnormal data for receiving is more than setting
When determining threshold value, the abnormal data comprising the ID is sent to the auxiliary server and intercept instruction, it is described
Abnormal data intercepts instruction for indicating what the auxiliary server was sent to the corresponding user of the ID
Abnormal data is intercepted.So, in a distributed system, abnormal data is monitored by auxiliary server,
When master server is alerted in the abnormal data for receiving server transmission, each auxiliary server is obtained by synchronous
The number of abnormal data is received, is determined a need for intercepting abnormal data with this, be thus avoid
Auxiliary server is caused when synchronous data are abnormal data to caused by master server synchrodata in real time
The problem that webserver work efficiency is reduced, also effectively intercepts the attack of abnormal data in auxiliary server
Place, reduces attack probability of the abnormal data to master server, effectively improves the peace of network service system
Quan Xing.
A kind of schematic flow sheet of data processing method that Fig. 2 is provided for the embodiment of the present application.Methods described can
With as described below.Server supplemented by the executive agent of the embodiment of the present application.
Step 201：The pending data that auxiliary server receive user sends.
Wherein, the ID comprising the user in the pending data.
Step 202：The auxiliary server determines whether the number of the pending data for receiving is more than and sets
Determine threshold value, if being more than, execution step 203；If being not more than, to the described pending number for receiving
According to being processed.
Step 203：The auxiliary server is it is determined that the number of the pending data for receiving is more than setting
During threshold value, abnormal data alarm is sent to master server.
Wherein, the ID is included in the abnormal data alarm.
In step 203, in order to avoid causing distributed network service system due to the malicious attack of user
Work paralysis, determines a thresholding for each the auxiliary server in distributed network service system first
Value, the threshold value are used to judge the malicious attack whether auxiliary server is subject to user.I.e. for user is setting
The number of cycle interior transmission pending data of fixing time, is entered by the size for comparing the number with set threshold value
And judge whether the auxiliary server is subject to the malicious attack of user.For example：When the number is more than setting threshold value
When, determine that the auxiliary server is subject to the malicious attack of user；When the number no more than sets threshold value, really
The fixed auxiliary server is not yet by the malicious attack of user.
Once auxiliary server determines that itself is subject to the malicious attack of user, then send abnormal number to master server
According to alarm, remind master server be subject to the malicious attack of user, so do not dislike in malicious attack degree
Before change, enable to distributed network service system and carry out prevention preparation in advance, improve network service
The safety of system.
It should be noted that for different auxiliary server, setting threshold value can be with difference, it is also possible to identical,
Here do not limit.
Step 204：The auxiliary server receive that the master server sends comprising the ID the
One abnormal data synchronizing information.
Wherein, the first abnormal data synchronizing information is used to indicate the auxiliary server to the master server
Transmission receives the number of the abnormal data sent by the corresponding user of the ID.
Step 205：The auxiliary server according to the first abnormal data synchronizing information, to the main service
Device sends the number of the abnormal data that the corresponding user of the ID for receiving sends.
In step 205, the auxiliary server is according to the first abnormal data synchronizing information, it is determined that receiving
The number of the abnormal data that the corresponding user of the ID for arriving sends, and the number for determining is sent out
Give master server.
Alternatively, if the time also occurred comprising abnormal data in the first abnormal data synchronizing information, this
Sample, also implies that master server, when the first abnormal data synchronizing information is sent to auxiliary server, needs to accuse
Know the time that auxiliary server exception data occur, when the time can be a time period, or one
Between point, do not limit here.
The auxiliary server when the first abnormal data synchronizing information is received, according to the first abnormal data synchronization
The time that the abnormal data included in information occurs, count and receive in the time range that the abnormal data occurs
The abnormal data number, and the number that obtains of statistics is sent to into master server.
Step 206：The auxiliary server receives the abnormal data interception instruction that the master server sends.
Wherein, the abnormal data intercepts instruction for indicating the auxiliary server to ID correspondence
User send abnormal data intercepted.
Step 207：The auxiliary server is intercepted according to the abnormal data and is instructed, and intercepts the ID
The abnormal data that corresponding user sends.
Alternatively, the auxiliary server is in the ID correspondence received to master server transmission
User send the abnormal data number after, methods described also includes：
Step 208：It is comprising the time cycle second different that the auxiliary server receives that the master server sends
Regular data synchronizing information.
Wherein, the second abnormal data synchronizing information is used to indicate that each receives the described second abnormal number
The number of the abnormal data received in the time cycle is sent according to the auxiliary server of synchronizing information
To the master server.
Step 209：The auxiliary server determines the time according to the second abnormal data synchronizing information
The number of the abnormal data that the corresponding user of the ID that receives in the cycle sends, and by institute
The number for stating abnormal data is sent to the master server.
Step 210：The auxiliary server receives the number comprising the ID that the master server sends
According to flush instructions.
Wherein, the data flush instructions are clear for indicating the auxiliary server for receiving the data flush instructions
The record of the abnormal data number that the corresponding user of the sky ID sends.
Step 211：The auxiliary server empties the ID correspondence according to the data flush instructions
User send abnormal data number record.
Step 212：The auxiliary server receives the number comprising the ID that the master server sends
According to process instruction.
Wherein, the data processing instructions receive the auxiliary server pair of the data processing instructions for instruction
The abnormal data that the corresponding user of the ID sends is processed.
Step 213：The auxiliary server processes the ID correspondence according to the data processing instructions
User send abnormal data.
It should be noted that after step 205, step 206 and step 207 belong to a kind of situation, step
Rapid 208 to step 213 belongs to another kind of situation, and both situations can not be same in a data handling procedure
When exist.
Fig. 3 provides a kind of schematic flow sheet of data processing method for the embodiment of the present application.Methods described can
With as described below.
Step 301：The pending data that auxiliary server receive user sends.
Wherein, the ID comprising the user in the pending data.
Step 302：The auxiliary server determines whether the number of the pending data for receiving is more than and sets
Determine threshold value, if being more than, execution step 303；If being not more than, to the described pending number for receiving
According to being processed.
Step 303：The auxiliary server is it is determined that the number of the pending data for receiving is more than setting
During threshold value, abnormal data alarm is sent to master server.
Step 304：Master server receives the abnormal data alarm that at least one auxiliary server sends.
Wherein, the ID comprising the user for sending abnormal data in the abnormal data alarm.
Step 305：The master server is sent comprising the user to the auxiliary server within institute's range of management
First abnormal data synchronizing information of mark.
Wherein, the first abnormal data synchronizing information is used to indicate the auxiliary server to the master server
Transmission receives the number of the abnormal data sent by the corresponding user of the ID.
Step 306：The auxiliary server receive that the master server sends comprising the ID the
One abnormal data synchronizing information.
Step 307：The auxiliary server according to the first abnormal data synchronizing information, to the main service
Device sends the number of the abnormal data that the corresponding user of the ID for receiving sends.
Step 308：The master server receives the abnormal data that each described auxiliary server sends
Number.
Step 309：The master server judges whether the number sum of the abnormal data for receiving is more than
Given threshold, if being more than, execution step 310；Otherwise, execution step 313.
Step 310：The master server is it is determined that the number sum of the abnormal data for receiving is more than setting
When determining threshold value, the abnormal data comprising the ID is sent to the auxiliary server and intercept instruction.
Wherein, the abnormal data intercepts instruction for indicating the auxiliary server to ID correspondence
User send abnormal data intercepted.
Step 311：The auxiliary server receives the abnormal data interception instruction that the master server sends.
Step 312：The auxiliary server is intercepted according to the abnormal data and is instructed, and intercepts the ID
The abnormal data that corresponding user sends.
Step 313：The master server is it is determined that the number sum of the abnormal data for receiving is not more than
During given threshold, the second abnormal data synchronizing information comprising the time cycle is sent to the auxiliary server.
Wherein, the second abnormal data synchronizing information is used to indicate that each receives the described second abnormal number
The number of the abnormal data received in the time cycle is sent according to the auxiliary server of synchronizing information
To the master server.
Step 314：It is comprising the time cycle second different that the auxiliary server receives that the master server sends
Regular data synchronizing information.
Step 315：The auxiliary server determines the time according to the second abnormal data synchronizing information
The number of the abnormal data that the corresponding user of the ID that receives in the cycle sends, and by institute
The number for stating abnormal data is sent to the master server.
Step 316：The master server judges to determine the institute for receiving again when reaching the time cycle
The number sum of abnormal data is stated whether more than setting threshold value, if being more than, execution step 310；Otherwise,
Perform 317.
Step 317：The master server determines the described abnormal number for receiving when reaching the time cycle
According to number sum be not more than given threshold when, send data flush instructions to the auxiliary server.
Wherein, the data flush instructions are clear for indicating the auxiliary server for receiving the data flush instructions
The record of the abnormal data number that the corresponding user of the sky ID sends.
Step 318：The auxiliary server receives the number comprising the ID that the master server sends
According to flush instructions.
Step 319：The auxiliary server empties the ID correspondence according to the data flush instructions
User send abnormal data number record.
Step 320：The master server is sent at the data comprising the ID to the auxiliary server
Reason instruction.
Wherein, the data processing instructions receive the auxiliary server pair of the data processing instructions for instruction
The abnormal data that the corresponding user of the ID sends is processed.
Step 321：The auxiliary server receives the number comprising the ID that the master server sends
According to process instruction.
Step 322：The auxiliary server processes the ID correspondence according to the data processing instructions
User send abnormal data.
The structural representation of a kind of data handling equipment that Fig. 4 is provided for the embodiment of the present application, at the data
Reason equipment includes：Receiving unit 41 and transmitting element 42, wherein：
Receiving unit 41, for receiving the abnormal data alarm that at least one auxiliary server sends, wherein, institute
State the ID comprising the user for sending abnormal data in abnormal data alarm；
Transmitting element 42, for sending comprising the ID to the auxiliary server within institute's range of management
First abnormal data synchronizing information, wherein, the first abnormal data synchronizing information is used to indicate the auxiliary clothes
Business device sends to the master server and receives the exception sent by the corresponding user of the ID
The number of data；
The receiving unit 41, is additionally operable to receive the abnormal data that each described auxiliary server sends
Number；
The transmitting element 42, is additionally operable to it is determined that the number sum of the abnormal data for receiving is more than setting
When determining threshold value, the abnormal data comprising the ID is sent to the auxiliary server and intercept instruction, wherein,
The abnormal data intercepts instruction for indicating that the auxiliary server is sent out to the corresponding user of the ID
The abnormal data for sending is intercepted.
Alternatively, the data handling equipment also includes：Processing unit 43, wherein：
The processing unit 43, for determining the number of the abnormal data for receiving, specifically includes：
According to the number for receiving the abnormal data that each described auxiliary server sends, what calculating was received
The number and value of the abnormal data.
Alternatively, also go out comprising abnormal data in the abnormal data alarm and the abnormal data synchronizing information
The existing time；
The receiving unit 41 receives the number of the abnormal data that each described auxiliary server sends,
Specifically include：
The number of the abnormal data that each described auxiliary server sends is received, wherein, described in each
The number of the abnormal data that auxiliary server sends is that the auxiliary server occurs to the abnormal data
The abnormal data received in time range carries out counting what is obtained；
The processing unit 43 determines the number of the abnormal data for receiving, and specifically includes：
According to the number for receiving the abnormal data that each described auxiliary server sends, what statistics was received
The number and value of the abnormal data.
Alternatively, the transmitting element 42, be additionally operable to it is determined that the abnormal data for receiving number it
No more than given threshold when, send the data comprising the ID to the auxiliary server and empty finger
Order, wherein, the data flush instructions are clear for indicating the auxiliary server for receiving the data flush instructions
The record of the abnormal data number that the corresponding user of the sky ID sends.
Specifically, the transmitting element 42 sends data flush instructions to the auxiliary server, specifically includes：
The second abnormal data synchronizing information comprising the time cycle is sent to the auxiliary server, wherein, it is described
Second abnormal data synchronizing information is used to indicate that each receives the second abnormal data synchronizing information
The number of the abnormal data received in the time cycle is sent to master server by auxiliary server；
Determine that the number sum of the abnormal data for receiving is not more than to set when reaching the time cycle
When determining threshold value, data flush instructions are sent to the auxiliary server.
Alternatively, the transmitting element 42, is additionally operable to the auxiliary server send comprising the ID
Data processing instructions, wherein, the data processing instructions for indicate receive the data processing instructions
Auxiliary server the abnormal data that the corresponding user of the ID sends is processed.
It should be noted that the data handling equipment provided in the embodiment of the present application can pass through hardware mode reality
Existing, it is also possible to be realized by software mode, specific implementation is not limited here.
A kind of structural representation of data handling equipment that Fig. 5 is provided for the embodiment of the present application.At the data
Reason equipment includes：Receiving unit 51 and transmitting element 52, wherein：
Receiving unit 51, for the pending data that receive user sends, wherein, in the pending data
ID comprising the user；
Transmitting element 52, for it is determined that the number of the pending data for receiving is more than setting threshold value
When, abnormal data alarm is sent to master server, wherein, the user is included in the abnormal data alarm
Mark.
Alternatively, the data handling equipment includes：Processing unit 53, wherein：
The receiving unit 51, specifically for receiving that the master server sends comprising the ID
First abnormal data synchronizing information, wherein, the first abnormal data synchronizing information is used to indicate the auxiliary clothes
Business device sends to the master server and receives the exception sent by the corresponding user of the ID
The number of data；
The processing unit 53, for according to the first abnormal data synchronizing information, to the master server
The number of the abnormal data that the corresponding user of the ID that transmission is received sends.
Alternatively, the receiving unit 51, the abnormal data sent specifically for receiving the master server are blocked
Instruction is cut, wherein, the abnormal data intercepts instruction for indicating the auxiliary server to the ID
The abnormal data that corresponding user sends is intercepted；
The processing unit 53, instructs for being intercepted according to the abnormal data, intercepts the ID pair
The abnormal data that the user for answering sends.
Alternatively, the receiving unit 51, specifically for receiving all comprising the time of the master server transmission
The second abnormal data synchronizing information of phase, wherein, the second abnormal data synchronizing information is each for indicating
The individual auxiliary server for receiving the second abnormal data synchronizing information will be received in the time cycle
The number of the abnormal data is sent to the master server；
The processing unit 53, for according to the second abnormal data synchronizing information, determining week time
The number of the abnormal data that the corresponding user of the ID received in the phase sends, and will be described
The number of abnormal data is sent to the master server.
Alternatively, the receiving unit 51, specifically for the reception master server transmission comprising the use
The data flush instructions of family mark, wherein, it is clear that the data flush instructions receive the data for instruction
The auxiliary server of do-nothing instruction empties the record of the abnormal data number that the corresponding user of the ID sends；
The processing unit 53, for according to the data flush instructions, emptying the ID corresponding
The record of the abnormal data number that user sends.
Alternatively, the receiving unit 51, specifically for the reception master server transmission comprising the use
The data processing instructions of family mark, wherein, the data processing instructions are received at the data for instruction
The auxiliary server of reason instruction is processed to the abnormal data that the corresponding user of the ID sends；
The processor 53, for according to the data processing instructions, processing the corresponding use of the ID
The abnormal data that family sends.
It should be noted that the data handling equipment provided in the embodiment of the present application can pass through hardware mode reality
Existing, it is also possible to be realized by software mode, specific implementation is not limited here.
It will be understood by those skilled in the art that embodiments herein can be provided as method, device (equipment),
Or computer program.Therefore, the application can using complete hardware embodiment, complete software embodiment,
Or with reference to the form of the embodiment in terms of software and hardware.And, the application can using at one or more its
In include computer-usable storage medium (the including but not limited to disk storage of computer usable program code
Device, CD-ROM, optical memory etc.) on the form of computer program implemented.
The application is with reference to the method according to the embodiment of the present application, device (equipment) and computer program
Flow chart and/or block diagram describing.It should be understood that can by computer program instructions flowchart and/or
Each flow process and/or square frame and flow chart and/or flow process and/or square frame in block diagram in block diagram
With reference to.These computer program instructions can be provided to general purpose computer, special-purpose computer, Embedded Processor
Or the processor of other programmable data processing devices is producing a machine so that by computer or other
The instruction of the computing device of programmable data processing device produce for realizing in one flow process of flow chart or
The device of the function of specifying in one square frame of multiple flow processs and/or block diagram or multiple square frames.
These computer program instructions may be alternatively stored in and computer or other programmable datas process can be guided to set
In the standby computer-readable memory for working in a specific way so that be stored in the computer-readable memory
Instruction produce and include the manufacture of command device, command device realization is in one flow process or multiple of flow chart
The function of specifying in one square frame of flow process and/or block diagram or multiple square frames.
These computer program instructions can be also loaded in computer or other programmable data processing devices, made
Obtain and series of operation steps is performed on computer or other programmable devices to produce computer implemented place
Reason, so as to the instruction performed on computer or other programmable devices is provided for realizing in flow chart one
The step of function of specifying in flow process or one square frame of multiple flow processs and/or block diagram or multiple square frames.
Although having been described for the preferred embodiment of the application, those skilled in the art once know base
This creative concept, then can make other change and modification to these embodiments.So, appended right will
Ask and be intended to be construed to include preferred embodiment and fall into the had altered of the application scope and change.
Obviously, those skilled in the art can carry out various changes and modification without deviating from this Shen to the application
Scope please.So, if these modifications of the application and modification belong to the application claim and its equivalent
Within the scope of technology, then the application is also intended to comprising these changes and modification.
Claims (14)
1. a kind of data processing method, it is characterised in that include：
Master server receives the abnormal data alarm that at least one auxiliary server sends, wherein, the abnormal number
According to the ID comprising the user for sending abnormal data in alarm；
The master server sends comprising the ID the to the auxiliary server within institute's range of management
One abnormal data synchronizing information, wherein, the first abnormal data synchronizing information is used to indicate the auxiliary service
Device sends to the master server and receives the described abnormal number sent by the corresponding user of the ID
According to number；
The master server receives the number of the abnormal data that each described auxiliary server sends；
The master server it is determined that the abnormal data for receiving number sum be more than given threshold when,
The abnormal data comprising the ID is sent to the auxiliary server and intercepts instruction, wherein, the exception
Data interception instructs the exception for indicating the auxiliary server to the corresponding user's transmission of the ID
Data are intercepted.
2. data processing method as claimed in claim 1, it is characterised in that the master server determines
The number of the abnormal data for receiving, including：
Number of the master server according to the abnormal data for receiving each auxiliary server transmission,
The number and value of the abnormal data that calculating is received.
3. data processing method as claimed in claim 1, it is characterised in that the abnormal data alarm
With the time also occurred comprising abnormal data in the first abnormal data synchronizing information；
The master server receives the number of the abnormal data that each described auxiliary server sends, bag
Include：
The master server receives the number of the abnormal data that each described auxiliary server sends, its
In, the number of the abnormal data that each described auxiliary server sends is the auxiliary server to described different
The abnormal data received in the time range that regular data occurs carries out counting what is obtained；
The master server determines the number of the abnormal data for receiving, including：
Number of the master server according to the abnormal data for receiving each auxiliary server transmission,
The number and value of the abnormal data that statistics is received.
4. the data processing method as described in any one of claims 1 to 3, it is characterised in that the side
Method also includes：
The master server is it is determined that the number sum of the abnormal data for receiving is not more than given threshold
When, the data flush instructions comprising the ID are sent to the auxiliary server, wherein, the data
Flush instructions empty the ID pair for indicating the auxiliary server for receiving the data flush instructions
The record of the abnormal data number that the user for answering sends.
5. data processing method as claimed in claim 4, it is characterised in that the master server is to institute
State auxiliary server and send data flush instructions, including：
The master server sends the second abnormal data comprising the time cycle to the auxiliary server synchronously to be believed
Breath, wherein, the second abnormal data synchronizing information is used to indicate that each receives the described second abnormal number
The number of the abnormal data received in the time cycle is sent according to the auxiliary server of synchronizing information
To the master server；
The master server determines the number of the abnormal data for receiving when reaching the time cycle
When sum is not more than given threshold, data flush instructions are sent to the auxiliary server.
6. data processing method as claimed in claim 5, it is characterised in that methods described also includes：
The master server sends the data processing instructions comprising the ID to the auxiliary server, its
In, the data processing instructions for indicate receive the data processing instructions auxiliary server to the use
Family identifies the abnormal data of corresponding user's transmission and is processed.
7. a kind of data processing method, it is characterised in that include：
The pending data that auxiliary server receive user sends, wherein, comprising described in the pending data
The ID of user；
The auxiliary server it is determined that the pending data for receiving number more than setting threshold value when,
Abnormal data alarm is sent to master server, wherein, the ID is included in the abnormal data alarm.
8. data processing method as claimed in claim 7, it is characterised in that methods described also includes：
The auxiliary server receives the comprising the ID first abnormal number that the master server sends
According to synchronizing information, wherein, the first abnormal data synchronizing information is used to indicate the auxiliary server to described
Master server sends the number for receiving the abnormal data sent by the corresponding user of the ID；
The auxiliary server is sent to the master server and is received according to the first abnormal data synchronizing information
The number of the abnormal data that the corresponding user of the ID for arriving sends.
9. data processing method as claimed in claim 8, it is characterised in that methods described also includes：
The auxiliary server receives the abnormal data interception instruction that the master server sends, wherein, it is described different
Regular data intercepts instruction for indicating that it is different that the auxiliary server is sent to the corresponding user of the ID
Regular data is intercepted；
The auxiliary server is intercepted according to the abnormal data and is instructed, and intercepts the corresponding user of the ID
The abnormal data of transmission.
10. data processing method as claimed in claim 8, it is characterised in that methods described also includes：
The second abnormal data comprising the time cycle that the auxiliary server receives the master server transmission is same
Step information, wherein, the second abnormal data synchronizing information is different for indicating that each receives described second
The auxiliary server of regular data synchronizing information is by the number of the abnormal data received in the time cycle
It is sent to the master server；
The auxiliary server is determined in the time cycle and is received according to the second abnormal data synchronizing information
The number of the abnormal data that the corresponding user of the ID that arrives sends, and by the abnormal data
Number be sent to the master server.
11. data processing methods as claimed in claim 10, it is characterised in that methods described also includes：
The auxiliary server receives the data comprising the ID of the master server transmission and empties finger
Order, wherein, the data flush instructions are clear for indicating the auxiliary server for receiving the data flush instructions
The record of the abnormal data number that the corresponding user of the sky ID sends；
The auxiliary server empties the corresponding user of the ID and sends according to the data flush instructions
Abnormal data number record.
12. data processing methods as claimed in claim 11, it is characterised in that methods described also includes：
The auxiliary server receives the data processing comprising the ID of the master server transmission and refers to
Order, wherein, the data processing instructions receive the auxiliary server pair of the data processing instructions for instruction
The abnormal data that the corresponding user of the ID sends is processed；
The auxiliary server processes the corresponding user of the ID and sends according to the data processing instructions
Abnormal data.
13. a kind of data handling equipment, it is characterised in that include：
Receiving unit, for receiving the abnormal data alarm that at least one auxiliary server sends, wherein, it is described
ID comprising the user for sending abnormal data in abnormal data alarm；
Transmitting element, for comprising the ID the is sent to the auxiliary server within institute's range of management
One abnormal data synchronizing information, wherein, the first abnormal data synchronizing information is used to indicate the auxiliary service
Device sends to the master server and receives the described abnormal number sent by the corresponding user of the ID
According to number；
The receiving unit, be additionally operable to receive the abnormal data that each described auxiliary server sends
Number；
The transmitting element, is additionally operable to it is determined that the number sum of the abnormal data for receiving is more than setting
During threshold value, the abnormal data comprising the ID is sent to the auxiliary server and intercept instruction, wherein,
The abnormal data intercepts instruction for indicating that the auxiliary server is sent out to the corresponding user of the ID
The abnormal data for sending is intercepted.
14. a kind of data handling equipment, it is characterised in that include：
Receiving unit, for the pending data that receive user sends, wherein, wrap in the pending data
ID containing the user；
Transmitting element, for it is determined that the number of the pending data for receiving is more than setting threshold value
When, abnormal data alarm is sent to master server, wherein, the user is included in the abnormal data alarm
Mark.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510603327.2A CN106549784B (en) | 2015-09-21 | 2015-09-21 | A kind of data processing method and equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510603327.2A CN106549784B (en) | 2015-09-21 | 2015-09-21 | A kind of data processing method and equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106549784A true CN106549784A (en) | 2017-03-29 |
| CN106549784B CN106549784B (en) | 2019-06-07 |
Family
ID=58364234
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510603327.2A Active CN106549784B (en) | 2015-09-21 | 2015-09-21 | A kind of data processing method and equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106549784B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109561045A (en) * | 2017-09-25 | 2019-04-02 | 北京京东尚科信息技术有限公司 | Data interception method and device, storage medium and electronic equipment |
| CN110008050A (en) * | 2019-04-11 | 2019-07-12 | 北京百度网讯科技有限公司 | Method and apparatus for handling information |
| CN111107522A (en) * | 2017-09-01 | 2020-05-05 | 珠海格力电器股份有限公司 | Security method and device, electric appliance, server and storage medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101282366A (en) * | 2008-05-21 | 2008-10-08 | 北京中企开源信息技术有限公司 | Method and apparatus for processing data transmission in point-to-point network |
| CN101826991A (en) * | 2010-02-04 | 2010-09-08 | 蓝盾信息安全技术股份有限公司 | Method and system for identifying illegal data packet |
| US7894360B2 (en) * | 2006-12-25 | 2011-02-22 | Fujitsu Limited | Trouble-factor detecting device, trouble-factor detecting method, and computer product |
| CN104883364A (en) * | 2015-05-11 | 2015-09-02 | 广东小天才科技有限公司 | Method and device for judging abnormity of server accessed by user |
-
2015
- 2015-09-21 CN CN201510603327.2A patent/CN106549784B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7894360B2 (en) * | 2006-12-25 | 2011-02-22 | Fujitsu Limited | Trouble-factor detecting device, trouble-factor detecting method, and computer product |
| CN101282366A (en) * | 2008-05-21 | 2008-10-08 | 北京中企开源信息技术有限公司 | Method and apparatus for processing data transmission in point-to-point network |
| CN101826991A (en) * | 2010-02-04 | 2010-09-08 | 蓝盾信息安全技术股份有限公司 | Method and system for identifying illegal data packet |
| CN104883364A (en) * | 2015-05-11 | 2015-09-02 | 广东小天才科技有限公司 | Method and device for judging abnormity of server accessed by user |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111107522A (en) * | 2017-09-01 | 2020-05-05 | 珠海格力电器股份有限公司 | Security method and device, electric appliance, server and storage medium |
| CN111107522B (en) * | 2017-09-01 | 2022-02-11 | 珠海格力电器股份有限公司 | Security method and device, electric appliance, server and storage medium |
| CN109561045A (en) * | 2017-09-25 | 2019-04-02 | 北京京东尚科信息技术有限公司 | Data interception method and device, storage medium and electronic equipment |
| CN110008050A (en) * | 2019-04-11 | 2019-07-12 | 北京百度网讯科技有限公司 | Method and apparatus for handling information |
| CN110008050B (en) * | 2019-04-11 | 2023-06-30 | 北京百度网讯科技有限公司 | Method and device for processing information |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106549784B (en) | 2019-06-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| EP3481029B1 (en) | Internet defense method and authentication server | |
| US20150229669A1 (en) | Method and device for detecting distributed denial of service attack | |
| US10841809B2 (en) | Spectrum sharing method and apparatus thereof | |
| CN101605108B (en) | Method, system and apparatus for instant communication | |
| US10362043B2 (en) | Method and apparatus for detecting man-in-the-middle attack | |
| CN104754533B (en) | The method, apparatus and terminal of a kind of SMS interception | |
| WO2017050108A1 (en) | Authentication method, apparatus and system for accessing wifi hotspot | |
| CN104469827B (en) | A kind of processing method and processing device of Radio Link Failure | |
| US11451961B2 (en) | Security enhancements for early data transmissions | |
| US11895533B2 (en) | Method for controlling connection between terminal and network, and related apparatus | |
| US20150139211A1 (en) | Method, Apparatus, and System for Detecting Rogue Wireless Access Point | |
| CN106549784A (en) | A kind of data processing method and equipment | |
| WO2019030727A1 (en) | Method for resuming connection after rejection | |
| CN106790299B (en) | Wireless attack defense method and device applied to wireless Access Point (AP) | |
| AU2019254040B2 (en) | Method for secure handling of early data transmission | |
| EP2931000B1 (en) | Wireless communication apparatus, wireless communication method, and wireless communication program | |
| CN109561487B (en) | Method and device for reducing energy consumption of mobile terminal and mobile terminal | |
| CN104023001A (en) | Method for AC equipment to forward unauthorized message information | |
| US20230254146A1 (en) | Cybersecurity guard for core network elements | |
| CN112153032A (en) | Information processing method, device, computer readable storage medium and system | |
| CN105791036A (en) | AP access detection method and device | |
| US11051171B2 (en) | Communication method, related device, and system | |
| US11233828B1 (en) | Methods, systems, and media for protecting computer networks using adaptive security workloads | |
| CN109803260A (en) | Refuse cut-in method, apparatus and system | |
| CN113660666B (en) | Bidirectional request response detection method for man-in-the-middle attack |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20200923 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman, British Islands Patentee after: Innovative advanced technology Co.,Ltd. Address before: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman, British Islands Patentee before: Advanced innovation technology Co.,Ltd. Effective date of registration: 20200923 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman, British Islands Patentee after: Advanced innovation technology Co.,Ltd. Address before: A four-storey 847 mailbox in Grand Cayman Capital Building, British Cayman Islands Patentee before: Alibaba Group Holding Ltd. |