CN109842627B - Method and device for determining service request frequency - Google Patents
Method and device for determining service request frequency Download PDFInfo
- Publication number
- CN109842627B CN109842627B CN201910126033.3A CN201910126033A CN109842627B CN 109842627 B CN109842627 B CN 109842627B CN 201910126033 A CN201910126033 A CN 201910126033A CN 109842627 B CN109842627 B CN 109842627B
- Authority
- CN
- China
- Prior art keywords
- address
- request
- user
- area
- determining
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Abstract
The embodiment of the invention provides a method and a device for determining service request frequency, wherein the method comprises the following steps: acquiring a service request from a request terminal, wherein the service request of the request terminal carries a first IP address; acquiring user density of request terminals in a preset area, wherein the first IP address is allocated to the preset area, and the user density is the number of the request terminals in the unit area of the preset area; and determining the request frequency of the first IP address, wherein the request frequency of the first IP address is obtained through the pre-established correspondence between the user density and the request frequency of the IP address. Therefore, the request frequency of the first IP address can be obtained by acquiring the first IP address, and compared with the prior art, the possibility that the user request is killed by mistake can be reduced under the condition that the request frequency of the first IP address is known subsequently.
Description
Technical Field
The present invention relates to the field of data analysis, and in particular, to a method and an apparatus for determining a service request frequency.
Background
In the network operation process, a network attacker can initiate a large number of Internet Protocol (IP) requests to the network for the purposes of traffic flushing, ticket robbing and the like. These numerous IP requests sent per unit time are referred to as abnormal IP requests, and IP requests other than these abnormal IP requests are referred to as normal IP requests.
In order to ensure the normal operation of the network, the general network uniformly sets a request threshold value for all IP addresses to limit the IP request times of one IP address; and blocking the IP requests with the IP request times of the same IP address larger than the request threshold value.
The number of IP requests for each IP address may be different, and it is difficult to estimate the number of IP requests for the same IP address, so that the number of IP requests for one IP address is limited by using the request threshold, and normal IP requests may be mistakenly killed.
Disclosure of Invention
An object of the embodiments of the present invention is to provide a method and an apparatus for determining a service request frequency, which are used to determine a request frequency of a first IP address. The specific technical scheme is as follows:
in a first aspect, the present invention provides a method for determining a service request frequency, where the method includes:
acquiring a service request from a request terminal, wherein the service request of the request terminal carries a first IP address;
acquiring user density of request terminals in a preset area, wherein the first IP address is allocated to the preset area, and the user density is the number of the request terminals in the unit area of the preset area;
and determining the request frequency of the first IP address, wherein the request frequency of the first IP address is obtained through the pre-established correspondence between the user density and the request frequency of the IP address.
Further, the obtaining of the user density of the request terminal in the preset area includes:
determining the total number of all the request terminals in the preset area as the total user quantity;
and determining the quotient of the total user quantity and the area of the preset area as the user density of the request terminal in the preset area.
Further, the obtaining of the user density of the request terminal in the preset area includes:
if the preset area belongs to a preset busy region, estimating the user growth amount of the preset busy region;
determining the sum of the user growth amount and the total amount of all the request terminals in the preset area as the total user amount;
and determining the quotient of the total user quantity and the area of the preset area as the user density of the request terminal in the preset area.
Further, the corresponding relation between the user density and the request frequency of the IP address is pre-established by adopting the following steps:
the method comprises the steps of determining the total user quantity of service requests of terminals aiming at the service requests of the terminals with the same IP address, wherein the service requests of the terminals carry the IP address, and the total user quantity of the service requests of the terminals comprises the following steps: determining the total user quantity by using the sum of the total quantity of all terminals in the area to which the IP address is allocated and the estimated user growth quantity of the preset busy area; or, determining the total user quantity by using the total quantity of all terminals in the area to which the IP address is allocated;
aiming at the service request of the terminal with the same IP address, determining the user density in the area to which the IP address is allocated by utilizing the quotient of the total user quantity of the service request of the terminal and the area to which the IP address is allocated;
acquiring the request frequency of the IP address aiming at the service request of the terminal with the same IP address;
and carrying out linear regression on the user density of each IP address in the distributed areas and the request frequency of the IP addresses to obtain a linear equation taking the user density as an independent variable and the request frequency of the IP addresses as a dependent variable.
Further, after determining the request frequency of the first IP address, the method further includes:
acquiring the service request times of the request terminal in unit time as the current request frequency of the first IP address;
and sending a warning instruction of risk early warning when the current request frequency is higher than the request frequency of the first IP address and reaches a preset threshold value.
In a second aspect, the present invention provides an apparatus for determining a service request frequency, the apparatus comprising:
the first acquisition module is used for acquiring a service request from a request terminal, wherein the service request of the request terminal carries a first IP address;
a second obtaining module, configured to obtain a user density of request terminals in a preset region, where the first IP address is allocated to the preset region, and the user density is the number of request terminals in a unit region area of the preset region;
and the processing module is used for determining the request frequency of the first IP address, and the request frequency of the first IP address is obtained through the pre-established corresponding relation between the user density and the request frequency of the IP address.
Further, the second obtaining module is configured to:
determining the total number of all the request terminals in the preset area as the total user quantity;
and determining the quotient of the total user quantity and the area of the preset area as the user density of the request terminal in the preset area.
Further, the second obtaining module is configured to:
if the preset area belongs to a preset busy region, estimating the user growth amount of the preset busy region;
determining the sum of the user growth amount and the total amount of all the request terminals in the preset area as the total user amount;
and determining the quotient of the total user quantity and the area of the preset area as the user density of the request terminal in the preset area.
Further, the apparatus further comprises: an establishment module to:
the method comprises the steps of determining the total user quantity of service requests of terminals aiming at the service requests of the terminals with the same IP address, wherein the service requests of the terminals carry the IP address, and the total user quantity of the service requests of the terminals comprises the following steps: determining the total user quantity by using the sum of the total quantity of all terminals in the area to which the IP address is allocated and the estimated user growth quantity of the preset busy area; or, determining the total user quantity by using the total quantity of all terminals in the area to which the IP address is allocated;
aiming at the service request of the terminal with the same IP address, determining the user density in the area to which the IP address is allocated by utilizing the quotient of the total user quantity of the service request of the terminal and the area to which the IP address is allocated;
acquiring the request frequency of the IP address aiming at the service request of the terminal with the same IP address;
and carrying out linear regression on the user density of each IP address in the distributed areas and the request frequency of the IP addresses to obtain a linear equation taking the user density as an independent variable and the request frequency of the IP addresses as a dependent variable.
Further, the apparatus further comprises:
a third obtaining module, configured to obtain, after determining a request frequency of the first IP address, a number of service requests of the requesting terminal in a unit time as a current request frequency of the first IP address;
and the sending module is used for sending a warning instruction of risk early warning under the condition that the current request frequency is higher than the request frequency of the first IP address and reaches a preset threshold value.
In a third aspect, an embodiment of the present invention provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, where the processor and the communication interface complete communication between the memory and the processor through the communication bus;
a memory for storing a computer program;
a processor for implementing the method steps of the first aspect when executing the program stored in the memory.
In a fourth aspect, the present invention provides a computer-readable storage medium having stored thereon instructions which, when run on a computer, cause the computer to perform the method of any of the first aspects described above.
In a fifth aspect, the present invention also provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the method of any of the first aspects described above.
According to the method and the device for determining the service request frequency, provided by the embodiment of the invention, the service request from the request terminal is obtained, and the service request carries the first IP address; acquiring user density of request terminals in a preset area, wherein the first IP address is allocated to the preset area, and the user density is the number of the request terminals in the unit area of the preset area; and determining the request frequency of the first IP address, wherein the request frequency of the first IP address is obtained through the pre-established correspondence between the user density and the request frequency of the IP address.
Therefore, the service request carrying the first IP address is obtained, the user density of the request terminal in the preset area is obtained, the request frequency of the first IP address is obtained through the pre-established corresponding relation between the user density and the request frequency of the IP address, the request frequency of the first IP address can be obtained through obtaining the first IP address, and the possibility that the user request is killed by mistake can be reduced under the condition that the request frequency of the first IP address is known subsequently.
Of course, not all of the advantages described above need to be achieved at the same time in the practice of any one product or method of the invention.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required in the description of the embodiments or the prior art will be briefly described below.
Fig. 1 is a first flowchart of a method for determining a service request frequency according to an embodiment of the present invention;
fig. 2 is a schematic diagram of a first process for obtaining a user density of a request terminal in a preset area according to an embodiment of the present invention;
fig. 3 is a schematic diagram of a second process of acquiring a user density of a request terminal in a preset area according to an embodiment of the present invention;
fig. 4 is a schematic flow chart of pre-establishing a correspondence between user density and request frequency according to an embodiment of the present invention;
FIG. 5 is a diagram illustrating an IP address covering the east of Yunnan, according to an embodiment of the present invention;
FIG. 6 is a schematic diagram of an IP address assigned to a company in accordance with an embodiment of the present invention;
fig. 7 is a second flowchart of a method for determining a service request frequency according to an embodiment of the present invention;
fig. 8 is a schematic structural diagram of a system for determining a service request frequency according to an embodiment of the present invention;
fig. 9 is a schematic structural diagram of an apparatus for determining a service request frequency according to an embodiment of the present invention;
fig. 10 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.
Detailed Description
The technical solutions in the embodiments of the present invention will be described below with reference to the drawings in the embodiments of the present invention.
Aiming at the problem that the number of times of IP requests of one IP address is limited by using a request threshold value and the normal IP requests can be killed by mistake because the number of times of IP requests of the same IP address is difficult to estimate in the prior art, the embodiment of the invention provides a method and a device for determining service request frequency, which adopt the following steps to determine the request frequency of a first IP address:
acquiring a service request from a request terminal, wherein the service request carries a first IP address; acquiring user density of request terminals in a preset area, wherein the first IP address is allocated to the preset area, and the user density is the number of the request terminals in the unit area of the preset area; and determining the request frequency of the first IP address, wherein the request frequency of the first IP address is obtained through the pre-established correspondence between the user density and the request frequency of the IP address.
Therefore, the service request carrying the first IP address is obtained, the user density of the request terminal in the preset area is obtained, the request frequency of the first IP address is obtained through the pre-established corresponding relation between the user density and the request frequency of the IP address, the request frequency of the first IP address can be obtained through obtaining the first IP address, and the possibility that the user request is killed by mistake can be reduced under the condition that the request frequency of the first IP address is known subsequently.
First, a method for determining a service request frequency according to an embodiment of the present invention is described below.
The method for determining the service request frequency provided by the embodiment of the invention is applied to electronic equipment. The method provided by the embodiment of the invention can be applied to electronic equipment. Further, the electronic device may be: desktop computers, laptop computers, intelligent mobile terminals, servers, and the like. Without limitation, any electronic device that can implement the present invention is within the scope of the present invention.
Referring to fig. 1, fig. 1 is a first flowchart of a method for determining a service request frequency according to an embodiment of the present invention. The method for determining the service request frequency provided by the embodiment of the invention can comprise the following steps:
The request terminal is configured to request a required service by using a first IP address carried in a service request, where the service request may be, but is not limited to, an IP request. And the terminal carrying the service request of the first IP address is called a request terminal. The IP address carried in the service request of the requesting terminal is referred to as a first IP address. The first IP address may be an IP address that needs to determine the request frequency, and may be included in each IP address in the preset database, and the first IP address may be, but is not limited to, any one of all IP addresses, and may also be, but is not limited to, two or more IP addresses.
The IP address of the embodiment of the present invention may not only include the first IP address, but also include other IP addresses, such as the second IP address, the third IP address, and the like. The "first" in the first IP address, "second" in the second IP address, and "third" in the third IP address are only for distinguishing different IP addresses, and are not limited in order. The other IP address may be an IP address carried in the other requesting terminal. The terminal in the embodiment of the invention comprises: requesting terminals and other requesting terminals.
The number of the requesting terminals in this step 110 is not limited, and the number of the requesting terminals may be one or more. The specific number of the request terminals is determined by the request terminals allocated with the first IP address in the preset area when the first IP address is allocated according to the preset area.
And step 120, acquiring the user density of the request terminals in the preset area, wherein the first IP address is allocated to the preset area, and the user density is the number of the request terminals in the unit area of the preset area.
The preset area refers to an area to which the first IP address is pre-allocated, and the position of the preset area is known. The total user volume in this area is divided by the area of this area, i.e. the first user volume per unit area, also called user density. For example, the first IP address is allocated to 1 building, 2 buildings, 3 buildings and 4 buildings of the D-cell of the C-cell of the B-city of a-province, B-city, C-city, and so on, and the preset region covers the corresponding regions of the 4 buildings of the D-cell of the C-cell of the B-city of a-province, B-city, C-cell of the 1 building, 2 buildings, 3 buildings, 4 buildings, and so on, and thus the preset region can be determined.
The requesting terminal, which generally carries the service request of the first IP address, is located in a preset area where the first IP address is allocated. In other words, the location position of the requesting terminal to which the IP address has been allocated is within a preset area.
Generally, there may be an application scenario in which the requesting terminal uses the first IP address for a long time, and there may also be an application scenario in which the requesting terminal does not use the first IP address for a long time, for example, the requesting terminal newly joins the first IP address and is allocated to a preset area, and needs to allocate the first IP address to the requesting terminal, and after the requesting terminal uses the first IP address for a period of time, the requesting terminal is no longer in the preset area and no longer uses the first IP address. Since the general positioning accuracy of the IP address is at the market level, the positioning is rough, and at this time, in order to more accurately determine that the request terminal is located in the preset area, and thus more accurately obtain the user density of the request terminal in the preset area, in this step 120, the user density of the request terminal in the preset area may be obtained by adopting the following method:
the method comprises the steps of firstly, acquiring first positioning data of a request terminal; secondly, determining whether the first positioning data is in a preset area, if so, allocating a first IP address to the request terminal, and acquiring the user density of the request terminal in the preset area; and if the first positioning data is not in the preset area, deleting the first positioning data of the request terminal and acquiring the user density of the request terminal in the preset area. Therefore, the condition that the request terminals leave the preset area can be processed, the service requests of the request terminals can be ignored, the number of the request terminals in the preset area can be accurately grasped, and the load of the server can be reduced.
For the first IP address, the positioning data generated by the module having the positioning system is referred to as first positioning data. The modules of the positioning system herein may include, but are not limited to: the module of the satellite Positioning System includes, for example, a module of a Global Positioning System (GPS) in the united states, a module of a beidou satellite System in china, and a module of a Galileo satellite Positioning System in europe. The embodiment of the present invention may be illustrated by using a GPS module to generate GPS data, which is not limited herein. The acquisition source of the first positioning data may be, but not limited to, analyzed from content carried by a user request, or may be obtained by positioning the requesting terminal itself.
The specific process of determining whether the first positioning data is located in the preset region in the second step may include: directly judging whether the first positioning data is in a preset area; or judging whether the first positioning data belongs to positioning data of a preset area, wherein the positioning data about the first IP address allocated to the preset area is recorded in a preset database, and the preset database can be set according to user requirements. The preset database can be an internal database or an external database, and is determined according to actual conditions. A detailed description of recording the positioning data of the first IP address allocated to the preset area in the preset database is obtained as follows.
Since the IP address is a virtual network address, and when the IP address is generally allocated, the IP address is configured to a first-class position in city, and the terminal having the modules of the positioning system is in a different position, and may use the same IP address, the modules of the positioning system may generate positioning data to position the respective positions. Therefore, for this IP address, positioning data about the first IP address assigned to the preset area can be collected in advance by the electronic device. This makes it possible to obtain the positioning data recorded in the preset database about the assignment of the first IP address to the preset area.
The same IP address is used for different locations of the terminal, and for this IP address, the positioning data recorded about this IP address can be collected in advance by the electronic device. The positioning data is exemplified by a terminal of a GPS module generating GPS data, but is not limited thereto:
for example, the office and home are in different locations. The terminal can be a mobile phone with a GPS module, the mobile phone can use mobile data traffic in an office, and the mobile phone can also use mobile data traffic at home. Therefore, the mobile phone is in different positions, the same IP address is used, and the positions of the office and the home can be respectively located by the GPS data generated by the GPS module of the mobile phone. Therefore, in conjunction with the data of the GPS module of the handset, for this IP address, GPS data can be collected in advance by the electronic device about the first IP address being assigned to the preset area.
For another example, a plurality of terminals use the same IP address, and it is assumed that the terminals may be mobile phones having GPS modules. This IP address may be a common IP address for a small area, which may be, but is not limited to, an airport, a campus, a residential community, a school, etc. Taking school as an example, a plurality of mobile phones use the same IP address of school, and different mobile phones are located at different positions of school, such as at a teaching building, a dormitory, a playground, and the like. The GPS module of each handset may generate GPS data to locate the respective location. For this IP address, GPS data about the first IP address assigned to the preset area may also be collected in advance by the electronic device.
In order to obtain the user density of the requesting terminal in the preset area, the step 120 may adopt any possible implementation manner, but is not limited to the following:
referring to fig. 2, in a possible implementation manner, in step 121, the total number of all the request terminals in the preset area is determined as the total user amount;
under the condition that the terminal carries the service request of the same IP address, the total number of all terminals in the area to which the IP address is distributed is the total user quantity, and the total user quantity in the preset area can be determined by using the total number of all the request terminals in the preset area.
Referring to fig. 3, in another possible implementation manner, in step 123, it is determined whether the preset area belongs to a preset busy area, and if not, step 124 is executed; if so, go to step 125;
the preset busy region can be a region where the pedestrian volume reaches the preset pedestrian volume in unit time, the preset threshold value can be set according to user requirements, and generally the preset pedestrian volume is determined according to the position of the region and the size of the pedestrian volume of the region. The estimation process for presetting the user growth amount in the busy area further comprises the following steps: and estimating the increase of the user according to the historical peak time of the pedestrian flow in the preset busy region, wherein the historical peak time of the pedestrian flow is used for indicating that the pedestrian flow in the period exceeds more than two times of other periods, and the other periods are periods except the peak time. Such as holidays. And the estimated different user growth amounts of the different preset busy areas are convenient to determine the user growth amount of each preset busy area. The preset busy area is exemplified by a square, a railway station or a shopping mall.
And step 125, estimating the increase of users in the preset busy area.
Because the pedestrian volume of the preset busy area in the historical pedestrian volume peak period is large, if the request frequency of the IP address is determined only according to the total number of the terminals in other periods, the request frequency of the IP address when the pedestrian volume is large can not be met, and therefore, the margin of the user growth amount is set for the preset busy area, so that the pedestrian volume of the preset busy area is large, normal service can still be provided for the preset busy area, the situation that the preset busy area is mistakenly judged as an abnormal user request when the pedestrian volume is large can be avoided, and the adaptability of the request frequency is enhanced.
The pre-established correspondence relationship between the user density and the request frequency may be, but is not limited to, a list relationship between the user density and the request frequency established by using the service request; the method can also be, but not limited to, a neural network trained by using the user density established by the service request and the request frequency, and the corresponding relation between the user density established by the service request and the request frequency is determined; or may be a functional relationship established. This allows the user density to be substituted into the functional relationship to determine the frequency of requests for the first IP address. Illustratively, referring to fig. 4, the correspondence between the user density and the request frequency of the IP address is pre-established by the following steps:
The total amount of the determined total users further comprises the following steps of by utilizing the sum of the total amount of all terminals in the area to which the IP address is distributed and the estimated user growth amount of the preset busy area:
and determining the sum of the total number of all terminals in the area to which the IP address is allocated and the estimated user increment of the preset busy area as the total user amount.
Determining a total subscriber amount using the total number of all terminals in the area to which the IP address is assigned, further comprising: and determining the total number of all terminals in the area to which the IP address is allocated as the total user quantity.
Because the request amount is different in the same area but in different people flow areas, such as the request amount is different in the coastal area and the northwest area, for example, as shown in fig. 5 below, an IP address covering the east of Yunnan is provided, and the coverage range of the IP address is large; fig. 6 shows IP addresses allocated to a company, where the coverage of the IP addresses is small, but the daily request amounts of the two IP addresses are far apart, so that the preset busy areas of the two IP addresses can be quantized, that is, a user increment of one preset busy area is set, and then the total user amount is determined, so that the preset busy areas are divided more finely, and the obtained linear equation is more accurate.
And 134, performing linear regression on the user density and the request frequency of the IP addresses in the areas to which all the IP addresses are allocated to obtain a linear equation with the user density as an independent variable and the request frequency of the IP addresses as a dependent variable.
Illustratively, the linear equation is: f (x) ═ ax + b, where a is the weight of the user density, the calculation result of each batch and each IP address is different, the value range of a is between 40 and 200, b is a constant obtained by regression, the calculation result of each batch and each IP address is different, the value range of b is between 1200 and 4000, f (x) is the request frequency, and x is the user density.
In order to establish a relatively accurate corresponding relation between the user density and the request frequency, after abnormal service requests are removed from all the service requests, the service requests can be used in advance to establish a linear equation, so that the obtained linear equation is more accurate, the linear equation is conveniently used in the later period, and the request frequency for determining the IP address is more accurate. The abnormal service request may be, but is not limited to, detected using an iforcest algorithm or determined by other means, which is not illustrated herein.
Therefore, the service request carrying the first IP address is obtained, the user density of the request terminal in the preset area is obtained, the request frequency of the first IP address is obtained through the pre-established corresponding relation between the user density and the request frequency of the IP address, the request frequency of the first IP address can be obtained through obtaining the first IP address, and the possibility that the user request is killed by mistake can be reduced under the condition that the request frequency of the first IP address is known subsequently.
The determination of the request frequency of the first IP address in step 130 may be applied in the context of security, but is not limited thereto. Further, referring to fig. 7 in conjunction with fig. 1 to fig. 4, in the method for determining a service request frequency according to the embodiment of the present invention, after step 130, the method further includes:
And 150, sending a warning instruction of risk early warning under the condition that the current request frequency is higher than the request frequency of the first IP address and reaches a preset threshold value. The preset threshold may be set according to a user requirement. The reminding instruction is used for reminding the existence of risk early warning. Therefore, the subsequent process of increasing the risk level or increasing the risk threshold or the individual process according to the reminding instruction of the risk early warning belongs to the protection scope of the embodiment of the invention, and the examples are not repeated.
In the embodiment of the invention, the service request carrying the first IP address is obtained, the user density of the request terminal in the preset area is obtained, the request frequency of the first IP address is obtained through the pre-established corresponding relation between the user density and the request frequency of the IP address, the request frequency of the first IP address can be obtained by obtaining the first IP address, and the possibility that the user request is mistakenly killed can be reduced under the condition that the request frequency of the first IP address is known subsequently. Moreover, the request frequency of the determined first IP address is applied to the scene of risk estimation, so that the mistaken killing of high-frequency normal user requests can be prevented, and the user requests with malicious requests and sudden increase can be prevented.
When the electronic device may be, but is not limited to, a server, as shown in fig. 8, a system for determining a service request frequency includes: a terminal 21 and a server 22.
The terminal 21 sends a user request;
the server 22 acquires a service request from a request terminal, wherein the service request of the request terminal carries a first IP address; acquiring user density of request terminals in a preset area, wherein the first IP address is allocated to the preset area, and the user density is the number of the request terminals in the unit area of the preset area; determining the request frequency of the first IP address, wherein the request frequency of the first IP address is obtained through the pre-established corresponding relation between the user density and the request frequency of the IP address; acquiring the service request times of a request terminal in unit time as the current request frequency of a first IP address; under the condition that the current request frequency is higher than the request frequency of the first IP address and reaches a preset threshold value, sending a warning instruction of risk early warning to a server 23 of the risk early warning system; the server 23 of the risk early warning system receives the reminding instruction of the risk early warning, and according to the reminding instruction of the risk early warning, the risk level is increased or the risk threshold value is increased.
In the embodiment of the invention, the service request carrying the first IP address is obtained, the user density of the request terminal in the preset area is obtained, the request frequency of the first IP address is obtained through the pre-established corresponding relation between the user density and the request frequency of the IP address, the request frequency of the first IP address can be obtained by obtaining the first IP address, and the possibility that the user request is mistakenly killed can be reduced under the condition that the request frequency of the first IP address is known subsequently. Moreover, the request frequency of the determined first IP address is applied to the scene of risk estimation, so that the mistaken killing of high-frequency normal user requests can be prevented, and the user requests with malicious requests and sudden increase can be prevented.
The following is a description of the apparatus for determining a service request frequency according to the embodiment of the present invention.
Referring to fig. 9, fig. 9 is a schematic structural diagram of an apparatus for determining a service request frequency according to an embodiment of the present invention. The embodiment of the invention provides a device for determining service request frequency, which comprises:
a first obtaining module 31, configured to obtain a service request from a requesting terminal, where the service request of the requesting terminal carries a first IP address;
a second obtaining module 32, configured to obtain a user density of request terminals in a preset region, where the first IP address is allocated to the preset region, and the user density is the number of request terminals in a unit region area of the preset region;
a processing module 33, configured to determine a request frequency of the first IP address, where the request frequency of the first IP address is obtained through a pre-established correspondence between a user density and the request frequency of the IP address.
Further, the second obtaining module is configured to:
determining the total number of all the request terminals in the preset area as the total user quantity;
and determining the quotient of the total user quantity and the area of the preset area as the user density of the request terminal in the preset area.
Further, the second obtaining module is configured to:
if the preset area belongs to a preset busy region, estimating the user growth amount of the preset busy region;
determining the sum of the user growth amount and the total amount of all the request terminals in the preset area as the total user amount;
and determining the quotient of the total user quantity and the area of the preset area as the user density of the request terminal in the preset area.
Further, the apparatus further comprises: an establishment module to:
the method comprises the steps of determining the total user quantity of service requests of terminals aiming at the service requests of the terminals with the same IP address, wherein the service requests of the terminals carry the IP address, and the total user quantity of the service requests of the terminals comprises the following steps: determining the total user quantity by using the sum of the total quantity of all terminals in the area to which the IP address is allocated and the estimated user growth quantity of the preset busy area; or, determining the total user quantity by using the total quantity of all terminals in the area to which the IP address is allocated;
aiming at the service request of the terminal with the same IP address, determining the user density in the area to which the IP address is allocated by utilizing the quotient of the total user quantity of the service request of the terminal and the area to which the IP address is allocated;
acquiring the request frequency of the IP address aiming at the service request of the terminal with the same IP address;
and carrying out linear regression on the user density of each IP address in the distributed areas and the request frequency of the IP addresses to obtain a linear equation taking the user density as an independent variable and the request frequency of the IP addresses as a dependent variable.
Further, the apparatus further comprises:
a third obtaining module, configured to obtain, after determining a request frequency of the first IP address, a number of service requests of the requesting terminal in a unit time as a current request frequency of the first IP address;
and the sending module is used for sending a warning instruction of risk early warning under the condition that the current request frequency is higher than the request frequency of the first IP address and reaches a preset threshold value.
Referring to fig. 10, fig. 10 is a schematic structural diagram of an electronic device according to an embodiment of the present invention. The embodiment of the present invention further provides an electronic device, which includes a processor 41, a communication interface 42, a memory 43 and a communication bus 44, wherein the processor 41, the communication interface 42, and the memory 43 complete mutual communication through the communication bus 44,
a memory 43 for storing a computer program;
the processor 41, when executing the program stored in the memory 43, implements the following steps:
acquiring a service request from a request terminal, wherein the service request of the request terminal carries a first IP address;
acquiring user density of request terminals in a preset area, wherein the first IP address is allocated to the preset area, and the user density is the number of the request terminals in the unit area of the preset area;
and determining the request frequency of the first IP address, wherein the request frequency of the first IP address is obtained through the pre-established correspondence between the user density and the request frequency of the IP address.
The communication bus mentioned in the electronic device may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The communication bus may be divided into an address bus, a data bus, a control bus, etc. For convenience, only one thick line is used in the figures, but there is not only one bus or one type of bus.
The communication interface is used for communication between the electronic equipment and other equipment.
The Memory may include a Random Access Memory (RAM) or a Non-Volatile Memory (NVM), such as at least one disk Memory. Optionally, the memory may also be at least one memory device located remotely from the processor.
The Processor may be a general-purpose Processor, including a Central Processing Unit (CPU), a Network Processor (NP), and the like; the Integrated Circuit may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other Programmable logic device, a discrete Gate or transistor logic device, or a discrete hardware component.
In yet another embodiment of the present invention, a computer-readable storage medium is further provided, which has instructions stored therein, and when the instructions are executed on a computer, the instructions cause the computer to execute the method for determining the service request frequency in any of the above embodiments.
In a further embodiment of the present invention, there is also provided a computer program product containing instructions which, when run on a computer, cause the computer to perform the method of determining the frequency of service requests as described in any of the above embodiments.
In the above embodiments, the implementation may be wholly or partially realized by software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loaded and executed on a computer, cause the processes or functions described in accordance with the embodiments of the invention to occur, in whole or in part. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable device. The computer instructions may be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, from one website, computer, server, or data center to another website, computer, server, or data center via wire (e.g., coaxial cable, fiber optics, Digital Subscriber Line (DSL), or wireless (e.g., infrared, wireless, microwave, etc.), the computer readable storage medium may be any available medium that can be accessed by a computer or a data storage device including one or more integrated servers, data centers, etc., the available medium may be magnetic medium (e.g., floppy disk, hard disk, magnetic tape), optical medium (e.g., high density Digital Video Disc, DVD for short), or a semiconductor medium (such as a Solid State Disk (SSD for short)), etc.
It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
All the embodiments in the present specification are described in a related manner, and the same and similar parts among the embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the apparatus/electronic device/storage medium embodiment/computer program product containing instructions, the description is relatively simple as it is substantially similar to the method embodiment, and reference may be made to some descriptions of the method embodiment for relevant points.
The above description is only for the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention shall fall within the protection scope of the present invention.
Claims (11)
1. A method of determining a frequency of service requests, the method comprising:
acquiring a service request from a request terminal, wherein the service request of the request terminal carries a first IP address;
acquiring user density of request terminals in a preset area, wherein the first IP address is allocated to the preset area, and the user density is the number of the request terminals in the unit area of the preset area to which the first IP address is allocated;
and determining the request frequency of the first IP address, wherein the request frequency of the first IP address is obtained through the pre-established correspondence between the user density and the request frequency of the IP address.
2. The method of claim 1, wherein the obtaining the user density of the requesting terminal in the preset area comprises:
determining the total number of all the request terminals in the preset area as the total user quantity;
and determining the quotient of the total user quantity and the area of the preset area as the user density of the request terminal in the preset area.
3. The method of claim 1, wherein the obtaining the user density of the requesting terminal in the preset area comprises:
if the preset area belongs to a preset busy region, estimating the user growth amount of the preset busy region;
determining the sum of the user growth amount and the total amount of all the request terminals in the preset area as the total user amount;
and determining the quotient of the total user quantity and the area of the preset area as the user density of the request terminal in the preset area.
4. The method of claim 1, wherein the correspondence between the user density and the request frequency of the IP address is pre-established by:
the method comprises the steps of determining the total user quantity of service requests of terminals aiming at the service requests of the terminals with the same IP address, wherein the service requests of the terminals carry the IP address, and the total user quantity of the service requests of the terminals comprises the following steps: determining the total user quantity by using the sum of the total quantity of all terminals in the area to which the IP address is allocated and the estimated user growth quantity of the preset busy area; or, determining the total user quantity by using the total quantity of all terminals in the area to which the IP address is allocated;
determining the user density in the region to which the IP address is allocated according to the service request of the terminal with the same IP address and the quotient of the total user quantity of the service request of the terminal and the region area to which the IP address is allocated;
acquiring the request frequency of the IP address aiming at the service request of the terminal with the same IP address;
and carrying out linear regression on the user density of each IP address in the distributed areas and the request frequency of the IP addresses to obtain a linear equation taking the user density as an independent variable and the request frequency of the IP addresses as a dependent variable.
5. The method of any of claims 1 to 4, wherein after determining the frequency of requests for the first IP address, the method further comprises:
acquiring the service request times of the request terminal in unit time as the current request frequency of the first IP address;
and sending a warning instruction of risk early warning when the current request frequency is higher than the request frequency of the first IP address and reaches a preset threshold value.
6. An apparatus for determining a frequency of service requests, the apparatus comprising:
the first acquisition module is used for acquiring a service request from a request terminal, wherein the service request of the request terminal carries a first IP address;
a second obtaining module, configured to obtain a user density of request terminals in a preset region, where the first IP address is allocated to the preset region, and the user density is a number of the request terminals in a unit region area of the preset region to which the first IP address is allocated;
and the processing module is used for determining the request frequency of the first IP address, and the request frequency of the first IP address is obtained through the pre-established corresponding relation between the user density and the request frequency of the IP address.
7. The apparatus of claim 6, wherein the second obtaining module is to:
determining the total number of all the request terminals in the preset area as the total user quantity;
and determining the quotient of the total user quantity and the area of the preset area as the user density of the request terminal in the preset area.
8. The apparatus of claim 6, wherein the second obtaining module is to:
if the preset area belongs to a preset busy region, estimating the user growth amount of the preset busy region;
determining the sum of the user growth amount and the total amount of all the request terminals in the preset area as the total user amount;
and determining the quotient of the total user quantity and the area of the preset area as the user density of the request terminal in the preset area.
9. The apparatus of claim 6, wherein the apparatus further comprises: an establishment module to:
the method comprises the steps of determining the total user quantity of service requests of terminals aiming at the service requests of the terminals with the same IP address, wherein the service requests of the terminals carry the IP address, and the total user quantity of the service requests of the terminals comprises the following steps: determining the total user quantity by using the sum of the total quantity of all terminals in the area to which the IP address is allocated and the estimated user growth quantity of the preset busy area; or, determining the total user quantity by using the total quantity of all terminals in the area to which the IP address is allocated;
determining the user density in the region to which the IP address is allocated according to the service request of the terminal with the same IP address and the quotient of the total user quantity of the service request of the terminal and the region area to which the IP address is allocated;
acquiring the request frequency of the IP address aiming at the service request of the terminal with the same IP address;
and carrying out linear regression on the user density of each IP address in the distributed areas and the request frequency of the IP addresses to obtain a linear equation taking the user density as an independent variable and the request frequency of the IP addresses as a dependent variable.
10. The apparatus of any of claims 6 to 9, further comprising:
a third obtaining module, configured to obtain, after determining a request frequency of the first IP address, a number of service requests of the requesting terminal in a unit time as a current request frequency of the first IP address;
and the sending module is used for sending a warning instruction of risk early warning under the condition that the current request frequency is higher than the request frequency of the first IP address and reaches a preset threshold value.
11. An electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;
the memory is used for storing a computer program;
the processor, when executing the program stored in the memory, implementing the method steps of any of claims 1-5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910126033.3A CN109842627B (en) | 2019-02-20 | 2019-02-20 | Method and device for determining service request frequency |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910126033.3A CN109842627B (en) | 2019-02-20 | 2019-02-20 | Method and device for determining service request frequency |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109842627A CN109842627A (en) | 2019-06-04 |
| CN109842627B true CN109842627B (en) | 2021-07-20 |
Family
ID=66884789
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910126033.3A Active CN109842627B (en) | 2019-02-20 | 2019-02-20 | Method and device for determining service request frequency |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109842627B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111968367B (en) * | 2020-08-12 | 2021-12-14 | 上海宝通汎球电子有限公司 | Internet of things communication management system and management method |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101572701A (en) * | 2009-02-10 | 2009-11-04 | 中科正阳信息安全技术有限公司 | Security gateway system for resisting DDoS attack for DNS service |
| CN103281397A (en) * | 2013-06-13 | 2013-09-04 | 苏州联讯达软件有限公司 | Data-caching method and system based on timestamps and access density |
| CN107578263A (en) * | 2017-07-21 | 2018-01-12 | 北京奇艺世纪科技有限公司 | A kind of detection method, device and the electronic equipment of advertisement abnormal access |
| CN108259421A (en) * | 2016-12-29 | 2018-07-06 | 沈阳美行科技有限公司 | The statistical method and system of a kind of user activity |
| CN108449308A (en) * | 2018-01-18 | 2018-08-24 | 北京奇艺世纪科技有限公司 | Identify the method and device that malice resource accesses |
| CN108684044A (en) * | 2018-06-20 | 2018-10-19 | 中诚信征信有限公司 | A kind of user behavior detecting system, method and device |
| CN109104336A (en) * | 2018-09-27 | 2018-12-28 | 平安普惠企业管理有限公司 | Service request processing method, device, computer equipment and storage medium |
| CN109190070A (en) * | 2018-08-01 | 2019-01-11 | 北京奇艺世纪科技有限公司 | A kind of data processing method, device, system and application server |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR101391781B1 (en) * | 2012-08-07 | 2014-05-07 | 한국전자통신연구원 | Apparatus and Method for Detecting HTTP Botnet based on the Density of Web Transaction |
-
2019
- 2019-02-20 CN CN201910126033.3A patent/CN109842627B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101572701A (en) * | 2009-02-10 | 2009-11-04 | 中科正阳信息安全技术有限公司 | Security gateway system for resisting DDoS attack for DNS service |
| CN103281397A (en) * | 2013-06-13 | 2013-09-04 | 苏州联讯达软件有限公司 | Data-caching method and system based on timestamps and access density |
| CN108259421A (en) * | 2016-12-29 | 2018-07-06 | 沈阳美行科技有限公司 | The statistical method and system of a kind of user activity |
| CN107578263A (en) * | 2017-07-21 | 2018-01-12 | 北京奇艺世纪科技有限公司 | A kind of detection method, device and the electronic equipment of advertisement abnormal access |
| CN108449308A (en) * | 2018-01-18 | 2018-08-24 | 北京奇艺世纪科技有限公司 | Identify the method and device that malice resource accesses |
| CN108684044A (en) * | 2018-06-20 | 2018-10-19 | 中诚信征信有限公司 | A kind of user behavior detecting system, method and device |
| CN109190070A (en) * | 2018-08-01 | 2019-01-11 | 北京奇艺世纪科技有限公司 | A kind of data processing method, device, system and application server |
| CN109104336A (en) * | 2018-09-27 | 2018-12-28 | 平安普惠企业管理有限公司 | Service request processing method, device, computer equipment and storage medium |
Non-Patent Citations (3)
| Title |
|---|
| Predicting user behavior through sessions using the web log mining;G. Neelima; Sireesha Rodda;《2016 International Conference on Advances in Human Machine Interaction (HMI)》;20160411;1-5页 * |
| 基于内容中心网的缓存算法研究;黄莹莹；杨龙祥;《计算机技术与发展》;20180531;第28卷(第5期);187-192页 * |
| 基于异常检测技术的数据防爬系统设计与应用;任宏伟;《中国优秀硕士学位论文全文数据库 信息科技辑》;20170115;I139-69页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109842627A (en) | 2019-06-04 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109768879B (en) | Method and device for determining target service server and server | |
| CN107305611B (en) | Method and device for establishing model corresponding to malicious account and method and device for identifying malicious account | |
| CN110337059B (en) | Analysis algorithm, server and network system for family relationship of user | |
| CN104219230B (en) | Identify method and the device of malicious websites | |
| US10219115B2 (en) | Facilitation of mobile device geolocation | |
| CN111131493B (en) | Data acquisition method and device and user portrait generation method and device | |
| CN108901035B (en) | Identification method and device for terminal of Internet of things | |
| CN108684044B (en) | User behavior detection system, method and device | |
| CN109842627B (en) | Method and device for determining service request frequency | |
| CN110650438B (en) | User standing area similarity judgment method, device, equipment and medium | |
| CN109688096B (en) | IP address identification method, device, equipment and computer readable storage medium | |
| CN109756530B (en) | Target application server and method and device for determining geographic position information | |
| CN107612946B (en) | IP address detection method and device and electronic equipment | |
| US11678290B2 (en) | Wireless connection monitoring, classification, and priority | |
| CN113423120A (en) | Data distribution processing method and device based on private network terminal and electronic equipment | |
| CN111262779A (en) | Method, device, server and system for acquiring data in instant messaging | |
| CN107040603B (en) | Method and device for determining active scene of application program App | |
| CN114338516B (en) | Traffic forwarding and policy determining method and device | |
| CN116471582A (en) | Artificial intelligence-based one-person multi-card user identification method and device | |
| CN113515612B (en) | Method and device for identifying black-birth mobile phone number | |
| CN115243268A (en) | Community fraud relationship identification method and system and readable storage medium | |
| WO2016194498A1 (en) | Communication-speed-restricted user extracting device, throughput estimating device, communication-speed-restricted user extracting method, throughput estimating method, communication-speed-restricted user extracting program, and throughput estimating program | |
| CN110708665B (en) | Method and device for determining home area of access network equipment | |
| CN111049710A (en) | Method and device for accessing server | |
| CN113556748B (en) | Signaling tracing identification method, device and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |