CN113542047A - Abnormal request detection method and device, electronic equipment and computer readable medium - Google Patents

Abnormal request detection method and device, electronic equipment and computer readable medium Download PDF

Info

Publication number
CN113542047A
CN113542047A CN202010318187.5A CN202010318187A CN113542047A CN 113542047 A CN113542047 A CN 113542047A CN 202010318187 A CN202010318187 A CN 202010318187A CN 113542047 A CN113542047 A CN 113542047A
Authority
CN
China
Prior art keywords
request
link
page
sub
main link
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202010318187.5A
Other languages
Chinese (zh)
Other versions
CN113542047B (en
Inventor
龚小冬
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Jingdong Century Trading Co Ltd
Beijing Wodong Tianjun Information Technology Co Ltd
Original Assignee
Beijing Jingdong Century Trading Co Ltd
Beijing Wodong Tianjun Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Jingdong Century Trading Co Ltd, Beijing Wodong Tianjun Information Technology Co Ltd filed Critical Beijing Jingdong Century Trading Co Ltd
Priority to CN202010318187.5A priority Critical patent/CN113542047B/en
Publication of CN113542047A publication Critical patent/CN113542047A/en
Application granted granted Critical
Publication of CN113542047B publication Critical patent/CN113542047B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/955—Retrieval from the web using information identifiers, e.g. uniform resource locators [URL]
    • G06F16/9566—URL specific, e.g. using aliases, detecting broken or misspelled links
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/958—Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0601—Electronic shopping [e-shopping]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

The disclosure relates to a method and a device for detecting an abnormal request, electronic equipment and a computer readable medium, and belongs to the technical field of internet. The method comprises the following steps: acquiring a network link of each page as a main link of each page, and respectively acquiring a network link of an interface required for rendering each page as a sub-link related to the main link of the page; obtaining a page link rule matrix according to the main link of each page and the sub-link related to the main link of the page; acquiring a page request record in a preset detection time period, and detecting a page request in the page request record through the page link rule matrix to determine an abnormal request in the page request record. According to the method and the device, the incidence relation between the main link and the sub link is established, and the corresponding detection rule is provided based on the incidence relation, so that the abnormal request in the page request is detected and analyzed, and the accuracy and the reliability of the abnormal request detection can be improved.

Description

Abnormal request detection method and device, electronic equipment and computer readable medium
Technical Field
The present disclosure relates to the field of internet technologies, and in particular, to a method and an apparatus for detecting an abnormal request, an electronic device, and a computer-readable medium.
Background
With the rapid development of electronic commerce, online shopping has become an indispensable shopping mode in people's life. However, in some e-commerce platforms, besides the normal page request when the user performs online shopping, there are also many abnormal requests of the interface, which also affects the normal shopping experience of the user while causing the benefit of the merchant to be damaged.
At present, in the detection of abnormal requests, the used detection method is generally simpler, certain missed detection and false detection are easily caused, and the detection accuracy and reliability are lower. Therefore, a new method for detecting an abnormal request is needed, which can improve the accuracy and reliability of the detection.
It is to be noted that the information disclosed in the above background section is only for enhancement of understanding of the background of the present disclosure, and thus may include information that does not constitute prior art known to those of ordinary skill in the art.
Disclosure of Invention
The present disclosure is directed to a method for detecting an abnormal request, an apparatus for detecting an abnormal request, an electronic device, and a computer-readable medium, so as to improve the accuracy and reliability of detecting an abnormal request at least to a certain extent.
According to a first aspect of the present disclosure, there is provided a method for detecting an abnormal request, including:
acquiring a network link of each page as a main link of each page, and respectively acquiring a network link of an interface required for rendering each page as a sub-link related to the main link of the page;
obtaining a page link rule matrix according to the main link of each page and the sub-link related to the main link of the page;
acquiring a page request record in a preset detection time period, and detecting a page request in the page request record through the page link rule matrix to determine an abnormal request in the page request record.
In an exemplary embodiment of the present disclosure, the detecting, by the page link rule matrix, a page request in the page request record to determine an abnormal request in the page request record includes:
judging whether each page request in the page request record is a main link request corresponding to the main link in the page link rule matrix or a sub-link request corresponding to a sub-link related to the main link;
and if the page request is not the main link request corresponding to the main link or the sub-link request corresponding to the sub-link related to the main link, determining the page request as an abnormal request.
In an exemplary embodiment of the present disclosure, the determining whether each page request in the page request record is a main link request corresponding to the main link in the page link rule matrix or a sub link request corresponding to a sub link related to the main link includes:
comparing a page request link of the page request with a main link in the page link rule matrix, and judging whether the page request is the main link request corresponding to the main link;
if the page request is the main link request, acquiring a page request meeting a preset request time rule with the main link request from the page request record, and using the page request as a sub-link request to be detected corresponding to the main link request;
and judging whether the sub-link request to be detected is a sub-link request corresponding to the sub-link related to the main link or not through the page link rule matrix according to the page request record of the sub-link request to be detected.
In an exemplary embodiment of the present disclosure, the page request record further includes page request time of the page request, and the obtaining, from the page request record, a page request that satisfies a preset request time rule with the main link request as a sub-link request to be tested corresponding to the main link request includes:
acquiring a page request with the page request time after the main link request from the page request record;
judging whether the time difference between the page request time of the page request and the page request time of the main link request is smaller than or equal to a time difference threshold value or not;
and if the time difference between the page request and the page request time of the main link request is smaller than or equal to the time difference threshold, taking the page request as a sub-link request to be tested corresponding to the main link request.
In an exemplary embodiment of the present disclosure, the determining, according to the page request record of the sub-link request to be detected, whether the sub-link request to be detected is a sub-link request corresponding to a sub-link related to the main link through the page link rule matrix includes:
acquiring all sub-links related to the main link corresponding to the main link request from the page link rule matrix to obtain a related sub-link set of the main link request;
judging whether the sub-link request to be detected is in a related sub-link set of the main link request according to the page request link of the sub-link request to be detected, and judging whether a page request record of the sub-link request to be detected is matched with a page request record of the main link request;
if the sub-link request to be tested is in the sub-link set related to the main link request, and the page request record of the sub-link request to be tested is matched with the main link request, the sub-link request to be tested is the sub-link request corresponding to the sub-link related to the main link.
In an exemplary embodiment of the present disclosure, the determining whether the page request record of the child link request to be tested matches the page request record of the main link request further includes:
judging whether the page request source address of the sub-link request to be tested is the same as the page request source address of the main link request;
judging whether the user agent identification of the sub-link request to be tested is the same as the user agent identification of the main link request;
and if the page request source address and the user agent identification of the sub-link request to be tested are the same as those of the main link request, matching the page request record of the sub-link request to be tested with the page request record of the main link request.
In an exemplary embodiment of the disclosure, after the determining the abnormal request in the page request record, the method further includes:
and if the page request is an abnormal request, acquiring a page request source address and a user agent identifier of the abnormal request to obtain abnormal request information of the abnormal request.
According to a second aspect of the present disclosure, there is provided an apparatus for detecting an abnormal request, comprising:
the network link obtaining module is used for obtaining the network link of each page as the main link of each page and respectively obtaining the network link of an interface required for rendering each page as the sub-link related to the main link of the page;
the rule matrix generation module is used for obtaining a page link rule matrix according to the main link of each page and the sub-link related to the main link of the page;
and the page request detection module is used for acquiring a page request record in a preset detection time period and detecting a page request in the page request record through the page link rule matrix so as to determine an abnormal request in the page request record.
According to a third aspect of the present disclosure, there is provided an electronic device comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the method of detecting an exception request of any one of the above via execution of the executable instructions.
According to a fourth aspect of the present disclosure, there is provided a computer readable medium having stored thereon a computer program which, when executed by a processor, implements the method of detecting an abnormal request of any one of the above.
The exemplary embodiments of the present disclosure may have the following advantageous effects:
in the method for detecting an abnormal request according to the exemplary embodiment of the present disclosure, a page link rule matrix is obtained on the basis of establishing an association relationship between a main link and a sub-link of a page, and an abnormal request in a page request record is detected through the page link rule matrix. In the method for detecting an abnormal request in the exemplary embodiment of the present disclosure, on one hand, by establishing an association relationship between a main link and a sub-link of a page, historical access conditions of the page can be combined during detection, so that accuracy and reliability of detection of the abnormal request are improved; on the other hand, by using the page link rule matrix to detect the abnormal request, different link rules can be configured for different main links, so that the expandability of the abnormal request detection method is increased, and the accuracy and reliability of the abnormal request detection are further improved.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and together with the description, serve to explain the principles of the disclosure. It is to be understood that the drawings in the following description are merely exemplary of the disclosure, and that other drawings may be derived from those drawings by one of ordinary skill in the art without the exercise of inventive faculty.
FIG. 1 shows a flow diagram of a method of detection of an exception request of an example embodiment of the present disclosure;
FIG. 2 illustrates a flow diagram for determining an exception request in a page request record in an example embodiment of the present disclosure;
FIG. 3 illustrates a flowchart of determining whether a page request is a primary link request or a child link request according to an example embodiment of the present disclosure;
FIG. 4 is a flowchart illustrating an example embodiment of the present disclosure for determining a child link request under test;
fig. 5 is a flowchart illustrating a process of determining whether a sub-link request to be tested is a sub-link request according to an example embodiment of the present disclosure;
FIG. 6 is a flowchart illustrating a process of determining whether a child link request under test matches a primary link request according to an example embodiment of the present disclosure;
FIG. 7 illustrates a block diagram of a method for detection of an exception request in accordance with a specific embodiment of the present disclosure;
FIG. 8 shows a schematic flow diagram of a detection analysis module in a specific embodiment according to the present disclosure;
FIG. 9 illustrates a flow diagram of sub-link analysis in a particular embodiment according to the present disclosure;
FIG. 10 shows a block diagram of an apparatus for detecting an exception request of an example embodiment of the present disclosure;
FIG. 11 illustrates a schematic structural diagram of a computer system suitable for use in implementing an electronic device of an embodiment of the present disclosure.
Detailed Description
Example embodiments will now be described more fully with reference to the accompanying drawings. Example embodiments may, however, be embodied in many different forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a thorough understanding of embodiments of the disclosure. One skilled in the relevant art will recognize, however, that the subject matter of the present disclosure can be practiced without one or more of the specific details, or with other methods, components, devices, steps, and the like. In other instances, well-known technical solutions have not been shown or described in detail to avoid obscuring aspects of the present disclosure.
Furthermore, the drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and thus their repetitive description will be omitted. Some of the block diagrams shown in the figures are functional entities and do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in the form of software, or in one or more hardware modules or integrated circuits, or in different networks and/or processor devices and/or microcontroller devices.
In some related embodiments, the abnormal request of the page can be detected by the following methods:
(1) IP-based address detection
An IP Address (Internet Protocol Address) is used as a source Address of a request, and whether a certain Address initiates a large number of interface requests can be determined as a basis for determining whether the request is an abnormal request. However, if a large number of abnormal requests are initiated through the dynamically changing IP address, a certain amount of missed detection and false detection can be caused by simply judging through the IP address. In addition, many abnormal requests can also avoid the detection of the system through the IP address by adopting a mode of reducing the request frequency, and certain missed detection can also occur in the case.
(2) User-Agent based detection
The normal request initiated by the browser can carry User-Agent information, and the judgment mode of the interface abnormal request can be used by judging whether the User-Agent information exists or not. However, the method of determining only by the User-Agent information is too simple, and a large number of abnormal requests can construct the User-Agent information by themselves, which may cause a false detection or the like.
(3) Refer-based detection
The reference (source) based detection is a more common approach. Whether the interface request is an abnormal request is judged by detecting whether a link in the refer is empty or whether an incidence relation is connected with the current request. However, this method also has a certain problem, for example, when the browser directly enters the request link, the corresponding referrer is empty, and in this case, only detecting the referrer causes certain misjudgment, and misjudgment of a normal request as an abnormal request is made. In addition, detection can be effectively avoided by constructing the referrer in the request header, so that certain missed detection is caused.
It can be seen from the above related embodiments that simply detecting some parameters or too simple detection rules will cause certain missed detection and false detection, and the abnormal request will easily construct corresponding parameters, thereby avoiding the detection rules and resulting in lower detection accuracy. Moreover, the analysis and detection are carried out by depending on a single request, and the problem of inaccurate detection can also exist without combining the historical access situation.
In order to solve the above problem, the present exemplary embodiment provides a method for detecting an abnormal request, which analyzes data in a page request record by introducing an association relationship between a main link and a sub-link, determines whether an abnormal request exists in the page request record by statistically analyzing an access relationship between the main link and the sub-link, and improves accuracy and reliability of detecting the abnormal request by combining a historical access condition of a page.
The present exemplary embodiment first provides a method of detecting an abnormal request. Referring to fig. 1, the method for detecting an abnormal request may include the following steps:
and S110, acquiring the network link of each page as a main link of each page, and respectively acquiring the network link of an interface required for rendering each page as a sub-link related to the main link of the page.
In this exemplary embodiment, the main link refers to a URL (Uniform Resource Locator) of a page visited by a user, that is, a request link of the page; the sub link refers to an interface link required for rendering the page, that is, an interface request link depends on the page URL and follows the page URL request, and thus, an association relationship exists between the main link and the sub link.
The main link and the sub link related to the main link of each page are obtained, the related information of the network request may be obtained from a development and debugging tool of the browser, the page URL and the related interface connection of each page may be obtained therefrom, and the main link and the sub link related to the main link of the page may also be obtained in other manners, which is not limited in this example embodiment.
And S120, obtaining a page link rule matrix according to the main links of the pages and the sub-links related to the main links of the pages.
In a normal browser page access process, a main link is generally requested, a back-end server renders a main link page, returned content is analyzed, a sub-link on which the main link depends is requested to be rendered again, and content rendering is finally completed and displayed on an interface. Different related sub-links can be acquired by analyzing the page characteristics of different page main links, so that corresponding main-sub-link rules on the page are constructed. The more sub-link rules corresponding to each main link, the more accurate the detection result.
Constructing the corresponding main-sub link rule on the page can be realized by establishing a page link rule matrix. The method for establishing the page link rule matrix comprises the following steps:
the link rule of the main link and the sub link of the single page p1 can pass through rulep1Specifically, the method comprises the following steps:
rulep1＝[mainUrlp1 subUrlp1]T
wherein, mainUrlp1Requesting a link, subUrl, for a page of primary linksp1A sub-link set corresponding to the main link, specifically [ subUrl1 subUrl2…subUrlN]Where N represents the Nth sub-link. For the main links of M pages needing to be detected, a corresponding page link Rule matrix Rule is as follows:
Rule＝[rulep1 rulep2…rulepM]T
where pM is the corresponding Mth primary link.
S130, acquiring a page request record in a preset detection time period, and detecting a page request in the page request record through a page link rule matrix to determine an abnormal request in the page request record.
The page request records in the preset detection time period can capture all the access records in the specific time period through the request record logs and arrange the access records to obtain the request information of the page. The preset detection time period may be set to a certain day or a certain week according to the detection requirement, and the present exemplary embodiment is not particularly limited. The request data in the page request record may include a page request source address, a page request link, a page request time, and a user agent identification of the request, which may be expressed as:
req＝[ip url time agent]T
wherein req represents a page request record, IP (request source IP) represents a page request source address, url represents a page request link, time represents a page request time, and Agent (User-Agent information) represents a User Agent identifier.
Acquiring all page request record sets in a preset detection time period, and expressing the page request record sets by using Req, specifically comprising the following steps:
Req＝[req1 req2…reqK]T
wherein the parameter K represents a total of K request records.
In this example embodiment, the exception request refers to a child link that exists independently of the main link. Normally, requests initiated by the browser exist in a manner that a main link and a sub-link request are interdependent, and the request time of the main link is prior to the sub-link. If a child link exists independently of the primary link, the child link is an exception request. For example, in an e-commerce platform, e-commerce merchants offer a large number of promotional programs to attract more users to visit and purchase, similar to visiting stores to obtain gift bags, getting coupons, or getting cash directly. The sales promotion activities can increase the access amount and the transaction amount of the users in the shops, but also attract a series of illegal requests to directly obtain the related sales promotion activity data, or obtain the profit by obtaining all the activity data and reselling on the market, and the illegal requests for directly swiping the interfaces such as coupons, gift bags and the like are abnormal requests.
After acquiring page request records within a preset detection time period, analyzing and detecting request data in the page request records through a page link rule matrix, acquiring main links in the page request records according to the page request links in the page request records, searching corresponding sub-link request records within a certain time threshold, and if an interface request does not belong to the sub-link request range related to the main links, determining that the interface request is an abnormal request.
The method for detecting an abnormal request in the present exemplary embodiment may be applicable to a background application server that can record a request log record, but cannot effectively count specific access conditions of a primary link and a secondary link, and an abnormal behavior analysis of a direct request interface that needs to be obtained in real time and contains sensitive data.
In the method for detecting an abnormal request according to the exemplary embodiment of the present disclosure, a page link rule matrix is obtained on the basis of establishing an association relationship between a main link and a sub-link of a page, and an abnormal request in a page request record is detected through the page link rule matrix. In the method for detecting an abnormal request in the exemplary embodiment of the present disclosure, on one hand, by establishing an association relationship between a main link and a sub-link of a page, historical access conditions of the page can be combined during detection, so that accuracy and reliability of detection of the abnormal request are improved; on the other hand, by using the page link rule matrix to detect the abnormal request, different link rules can be configured for different main links, so that the expandability of the abnormal request detection method is increased, and the accuracy and reliability of the abnormal request detection are further improved.
Next, the above steps of the present exemplary embodiment will be described in more detail with reference to fig. 2 to 6.
In step S130, as shown in fig. 2, detecting the page request in the page request record through the page link rule matrix to determine an abnormal request in the page request record, which may specifically include the following steps:
step S210, judging whether each page request in the page request record is a main link request corresponding to a main link in the page link rule matrix or a sub-link request corresponding to a sub-link related to the main link.
Step S220, if the page request is not the main link request corresponding to the main link or is not the sub-link request corresponding to the sub-link related to the main link, determining the page request as an abnormal request.
In this exemplary embodiment, since the child link request depends on the main link request of the page, if a certain page request in the page request record is neither the main link request corresponding to the main link nor the child link request corresponding to the child link related to the main link, that is, the page request as the child link request exists independently from the main link, the page request is an exception request.
The page link rule matrix includes a main link and a link rule corresponding to a sub-link related to the main link, and can be used to determine whether a page request is a main link request or a related sub-link request according to request data in a page request record. Next, a specific determination method will be described with reference to fig. 3 to 6.
In step S210, as shown in fig. 3, determining whether each page request in the page request record is a main link request corresponding to a main link in the page link rule matrix, or a sub-link request corresponding to a sub-link related to the main link may specifically include the following steps:
step S310, comparing the page request link of the page request with the main link in the page link rule matrix, and judging whether the page request is the main link request corresponding to the main link.
The page request link of the page request to be detected is obtained, all main links are extracted from the page link rule matrix and compared, and whether the page request link of the page request belongs to the main links in the page link rule matrix or not is judged. If the page request of the page request links with the primary link, the page request is the primary link request and belongs to a valid request.
Step S320, if the page request is a main link request, the page request meeting the preset request time rule with the main link request is obtained from the page request record and is used as a sub-link request to be detected corresponding to the main link request.
In this exemplary embodiment, the sub-link request to be tested refers to a page request that meets a preset request time rule with the main link request in terms of request time. As shown in fig. 4, the method for determining whether the page request is a sub-link request to be tested corresponding to the main link request in step S320 may specifically include the following steps:
and S410, acquiring the page request with the page request time after the main link request from the page request record.
Because the main link and the sub-link request are interdependent, and the request time of the main link request is prior to the sub-link request, only the page request with the request time after the main link request is considered when determining the sub-link request to be tested corresponding to the main link request.
Step S420, whether the time difference between the page request time of the page request and the page request time of the main link request is smaller than or equal to a time difference threshold value is judged.
In the actual process of accessing the page, the request of the sub-link is generally within a short time after the main link, for example, within 10 seconds, if the request time difference between the main link and the sub-link is too long, the sub-link can be considered to be unrelated to the main link, and the main link and the sub-link do not belong to the same sub-request process. Therefore, whether the page request is a sub-link request to be tested corresponding to the main link request can be determined by judging whether the request time difference between the page request and the main link request is smaller than or equal to a time difference threshold value. The time difference threshold may be set according to actual conditions, and may generally be 10 seconds or 15 seconds, which is not specifically limited herein.
And S430, if the time difference between the page request and the page request time of the main link request is smaller than or equal to a time difference threshold value, taking the page request as a sub-link request to be tested corresponding to the main link request.
In order to facilitate obtaining the sub-link request to be tested after the main link and with the request time difference within the time difference threshold, the data requested to be recorded may be preprocessed when the page request record is obtained.
After all page request record sets in a preset detection time period are obtained, each request record can be sequenced according to time ascending order, so that when each page request is obtained in sequence for detection analysis, if a certain page request is determined to be a main link request, page requests with the request time within a time difference threshold value of the main link request in the subsequent page requests are the sub-link requests to be detected corresponding to the main link request.
S330, judging whether the sub-link request to be detected is the sub-link request corresponding to the sub-link related to the main link or not through the page link rule matrix according to the page request record of the sub-link request to be detected.
After determining the sub-link request to be detected corresponding to the main link request, judging whether the sub-link request to be detected accords with the sub-link rule corresponding to the main link request through the page link rule matrix, and if the sub-link request to be detected accords with the sub-link rule corresponding to the main link request, determining that the sub-link request to be detected is the sub-link request corresponding to the sub-link related to the main link.
As shown in fig. 5, the method for determining whether the sub-link request to be tested is a sub-link request corresponding to a sub-link related to the main link in step S330 may specifically include the following steps:
step S510, all sub-links related to the main link corresponding to the main link request are obtained from the page link rule matrix, and a related sub-link set of the main link request is obtained.
If the main link request of the page p1 is judged to correspond to the sub-link request to be tested, the link rules of the main link and the sub-link of the page p1 are obtained from the page link rule matrix, namely, the main link and the sub-link of the page p1 are obtained
rulep1＝[mainUrlp1 subUrlp1]T
Then obtaining the sub-link set subUrl corresponding to the main link from the sub-link set subUrlp1The set of related child links as the main link request includes [ subUrl ]1 subUrl2…subUrlN]And N represents the Nth sub-link corresponding to the main link.
Step S520, judging whether the sub-link request to be detected is in the related sub-link set of the main link request according to the page request link of the sub-link request to be detected, and judging whether the page request record of the sub-link request to be detected is matched with the page request record of the main link request.
Firstly, judging whether a page request link of a sub-link request to be tested is in a sub-link set [ subUrl ] related to a main link request1 subUrl2…subUrlN]And judging whether the page request is matched with the main link request according to the request data in the page request record.
Step S530, if the sub-link request to be tested is in the sub-link set related to the main link request and the page request record of the sub-link request to be tested is matched with the main link request, the sub-link request to be tested is the sub-link request corresponding to the sub-link related to the main link.
If the page request link of the sub-link request to be tested is in the sub-link set related to the main link request and is also matched with the main link request, the sub-link request to be tested is a sub-link request corresponding to the sub-link related to the main link and belongs to an effective request.
If the page request link of the sub-link request to be tested is not in the sub-link set related to the main link request, or the page request record is not matched with the main link request, the sub-link request to be tested does not belong to the sub-link request corresponding to the sub-link related to the main link. And if the sub-link request to be tested does not belong to the main link requests of other pages, the sub-link request to be tested is an abnormal request.
In step S520, the page request record further includes a page request source address of the page request and a user agent identifier, as shown in fig. 6, it is determined whether the page request record of the child link request to be tested matches the page request record of the main link request, and the method specifically includes the following steps:
step S610, judging whether the page request source address of the sub-link request to be tested is the same as the page request source address of the main link request.
Step S620, judging whether the user agent identification of the sub-link request to be tested is the same as the user agent identification of the main link request.
Step S630, if the page request source address and the user agent identification of the sub-link request to be tested are the same as those of the main link request, matching the page request record of the sub-link request to be tested with the page request record of the main link request.
The request data in the page request record includes the requested page request source address, the page request link, the page request time, and the user agent identification, i.e.
req＝[ip url time agent]T
Because the page request time (time) of the sub-link request to be tested and the page request time of the main link request are within the time difference threshold, if the page request link (url) of the sub-link request to be tested is in the sub-link set related to the main link request, it is only necessary to judge whether the page request source address (ip) and the user agent identifier (agent) of the sub-link request to be tested are matched with the main link request, and it can be determined whether the sub-link request to be tested is the sub-link request corresponding to the sub-link related to the main link. If the page request source address and the user agent identification of the sub-link request to be tested are the same as those of the main link request, matching the page request record of the sub-link request to be tested with the main link request, wherein the sub-link request to be tested is the sub-link request corresponding to the sub-link related to the main link.
After determining the abnormal request in the page request record in step S130, the method for detecting an abnormal request of this example embodiment may further include:
and if the page request is an abnormal request, acquiring a page request source address and a user agent identifier of the abnormal request to obtain abnormal request information of the abnormal request.
After the abnormal request in the preset detection time period is determined, integrating a page request source address and a user agent identification in request data of the abnormal request, and extracting corresponding abnormal request source information to serve as a basis for subsequently preventing the request source from accessing.
The following describes an application scenario of the disclosed abnormal request detection method by exemplifying the above steps in this exemplary embodiment through a specific embodiment.
Fig. 7 is a block diagram of a method for detecting an abnormal request in an embodiment of the present disclosure. In this embodiment, three processing modules are mainly involved, which are: a link rule sorting module 701, a request record preprocessing module 702 and a check analysis module 703.
The link rule sorting module 701 is used for constructing corresponding rules of main link-sub link, namely constructing a page link rule matrix, and providing a detection rule basis for a subsequent detection analysis module;
the request record preprocessing module 702 is configured to preprocess the request record data, obtain all page request record sets within a preset detection time period, and arrange the page request record sets according to a sequence of request times to provide a data basis for a subsequent detection analysis module;
the detection analysis module 703 is a core module, and is configured to complete detection of the abnormal request and extraction of a corresponding abnormal request source by combining a data basis and a rule basis.
Fig. 8 is a schematic flow chart of a detection and analysis module in an embodiment of the present disclosure, which includes the following specific steps:
and step S810, initializing a coordinate i, an effective sub-link set and an ineffective sub-link set.
The coordinate i is initialized to 0 and the active and inactive child link sets are initialized to the empty set.
And S820, acquiring the page request record with the coordinate i and the network link of the page.
And S830, judging whether the network link of the page is a main link.
Judging whether the network link of the page request is a main link in the page link rule matrix, if the network link of the page request does not belong to the main link, entering the step S840; if the network link of the page request is the main link, the process proceeds to step S860.
And S840, judging whether the page request belongs to the effective sub-link set.
If the page request is already in the active sub-link set, directly entering step S880, and continuing to detect the next page request; if the page request is not in the active child link set, step S850 is entered.
And step S850, storing the page request into the invalid sub-link set.
And S860, acquiring a sub-link set corresponding to the main link and adding a page request to an effective request set.
If the network link of the page request is the main link, the current page request is added to the effective request set, and the sub-link set corresponding to the main link is obtained for detecting and analyzing the sub-link in the next step.
And step S870, entering a sub-link analysis flow.
And S880, judging whether the coordinate is larger than or equal to the size of the request record set or not according to the coordinate i + 1.
After the analysis of the current round is finished, the coordinate i +1 is made, and whether the coordinate i at the time is larger than or equal to the size of the request record set is judged, that is, whether all page requests in the page request record set are analyzed completely is judged. If the coordinate i is smaller than the size of the request record set, the step S820 is entered, and the next page request is continuously analyzed; and if the coordinate i is larger than or equal to the size of the request record set, completing analysis, determining the corresponding page request in the invalid sub-link set as an abnormal request, and extracting corresponding abnormal request source information.
Fig. 9 is a schematic flow chart of the sub-link analysis in an embodiment of the present disclosure, which is a development of a specific step after entering the sub-link analysis flow in step S870, and the specific steps of the flow chart are as follows:
step s910, initializing the coordinate j ═ i + 1.
Since the page request records are sorted in the request record preprocessing module 702 according to the sequence of the request time, when the sub-link request corresponding to the main link is analyzed, only the page request records after the main link request coordinate need to be analyzed in sequence.
Step S920, acquiring a page request record with the coordinate j.
And S930, judging whether the time difference between the request time of the page and the main link is less than or equal to a time difference threshold value.
If the time difference between the request time of the current page request and the main link is less than or equal to the time difference threshold, the step S940 is continued to perform judgment; if the time difference between the request time of the current page request and the main link is greater than the time difference threshold, which indicates that the current page request and the subsequent page requests are not related to the current main link request, the sub-link analysis process of the current round is directly ended, and the process returns to the process of fig. 8.
And S940, judging whether the network link of the page belongs to the sub-link set corresponding to the main link or not, and judging whether the IP address and the User-Agent of the page are the same as the main link or not.
Obtaining main link mainUrl from page link rule matrixpiCorresponding sub-link set [ subUrl ]1subUrl2…subUrlN]Judging whether the network link of the current page belongs to the sub-link set corresponding to the main link or not, and judging whether the page request source address (IP address) and the user agent identifier (user-agent) of the current page are connected with the main link or notThe same is true. If the above conditions are satisfied, go to step S950; if one condition is not met, the sub-link analysis flow of the round is directly ended, and the flow returns to the flow of fig. 8.
And S950, removing the page request from the invalid sub-link set and adding the page request into the valid sub-link set.
And judging whether the invalid sub-link set contains the current page request, if so, removing the current page request from the invalid sub-link set, and adding the current page request into the valid sub-link set.
And S960, judging whether the coordinate is larger than or equal to the size of the request record set or not by using the coordinate j + 1.
After the analysis of the current round is finished, enabling the coordinate j +1, and judging whether the coordinate j at the moment is larger than or equal to the size of the request record set, if the coordinate j is smaller than the size of the request record set, entering the step S920, and continuing to analyze the next sub-link; and if the coordinate j is larger than or equal to the size of the request record set, finishing the sub-link analysis process.
It should be noted that although the various steps of the methods of the present disclosure are depicted in the drawings in a particular order, this does not require or imply that these steps must be performed in this particular order, or that all of the depicted steps must be performed, to achieve desirable results. Additionally or alternatively, certain steps may be omitted, multiple steps combined into one step execution, and/or one step broken down into multiple step executions, etc.
Further, the disclosure also provides a device for detecting an abnormal request. Referring to fig. 10, the apparatus for detecting the exception request may include a network link obtaining module 1010, a rule matrix generating module 1020, and a page request detecting module 1030. Wherein:
the network link obtaining module 1010 may be configured to obtain a network link of each page as a main link of each page, and respectively obtain a network link of an interface required for rendering each page as a sub-link related to the main link of the page;
the rule matrix generation module 1020 may be configured to obtain a page link rule matrix according to the main links of the pages and the sub-links related to the main links of the pages;
the page request detecting module 1030 may be configured to obtain a page request record within a preset detection time period, and detect a page request in the page request record through a page link rule matrix to determine an abnormal request in the page request record.
In some exemplary embodiments of the present disclosure, the page request detecting module 1030 may include a link request judging unit and an abnormal request determining unit. Wherein:
the link request judging unit may be configured to judge whether each page request in the page request record is a main link request corresponding to a main link in the page link rule matrix, or a sub-link request corresponding to a sub-link related to the main link;
the exception request determining unit may be configured to determine the page request as an exception request if the page request is not a main link request corresponding to a main link, and is not a sub-link request corresponding to a sub-link related to the main link.
In some exemplary embodiments of the present disclosure, the link request determining unit may include a main link request determining unit, a sub-link request acquiring unit to be tested, and a sub-link request determining unit. Wherein:
the main link request judging unit may be configured to compare a page request link of the page request with a main link in the page link rule matrix, and judge whether the page request is a main link request corresponding to the main link;
the sub-link request to be tested acquiring unit may be configured to acquire, if the page request is a main link request, a page request that satisfies a preset request time rule with the main link request from the page request record, as a sub-link request to be tested corresponding to the main link request;
the sub-link request determining unit may be configured to determine, according to a page request record of the sub-link request to be detected, whether the sub-link request to be detected is a sub-link request corresponding to a sub-link related to the main link through a page link rule matrix.
In some exemplary embodiments of the present disclosure, the sub-link request acquisition unit under test may include a page request acquisition unit, a request time difference determination unit, and a sub-link request determination unit under test.
Wherein:
the page request acquisition unit may be configured to acquire, from the page request record, a page request whose page request time is after the main link request;
the request time difference determination unit may be configured to determine whether a time difference between a page request time of the page request and a page request time of the main link request is less than or equal to a time difference threshold;
the sub-link request to be tested determining unit may be configured to, if a time difference between the page request and the page request time of the main link request is less than or equal to a time difference threshold, use the page request as the sub-link request to be tested corresponding to the main link request.
In some exemplary embodiments of the present disclosure, the sub-link request determining unit may include a related sub-link set obtaining unit, a sub-link request matching unit to be tested, and a sub-link request determining unit.
Wherein:
the related sub-link set obtaining unit may be configured to obtain all sub-links related to the main link corresponding to the main link request from the page link rule matrix, to obtain a related sub-link set of the main link request;
the sub-link request matching unit to be tested can be used for judging whether the sub-link request to be tested is in a related sub-link set of the main link request according to the page request link of the sub-link request to be tested and judging whether the page request record of the sub-link request to be tested is matched with the page request record of the main link request;
the sub-link request determining unit may be configured to determine that the sub-link request to be detected is a sub-link request corresponding to a sub-link related to the main link if the sub-link request to be detected is in a sub-link set related to the main link request and a page request record of the sub-link request to be detected matches the main link request.
In some exemplary embodiments of the present disclosure, the child link request matching unit under test may include a request source address matching unit, a user agent identification matching unit, and a page request record matching unit.
Wherein:
the request source address matching unit may be configured to determine whether a page request source address of the sub-link request to be detected is the same as a page request source address of the main link request;
the user agent identifier matching unit may be configured to determine whether the user agent identifier of the sub-link request to be detected is the same as the user agent identifier of the main link request;
the page request record matching unit may be configured to match the page request record of the child link request to be tested with the page request record of the main link request if the page request source address and the user agent identifier of the child link request to be tested are the same as those of the main link request.
In some exemplary embodiments of the present disclosure, the apparatus for detecting an exception request may further include an exception request information determining module, which may be configured to, if the page request is an exception request, obtain a page request source address and a user agent identifier of the exception request, so as to obtain exception request information of the exception request.
The details of each module/unit in the above-mentioned device for detecting an abnormal request have been described in detail in the corresponding method embodiment section, and are not described herein again.
FIG. 11 illustrates a schematic structural diagram of a computer system suitable for use with the electronic device to implement an embodiment of the invention.
It should be noted that the computer system 1100 of the electronic device shown in fig. 11 is only an example, and should not bring any limitation to the functions and the scope of the application of the embodiment of the present invention.
As shown in fig. 11, the computer system 1100 includes a Central Processing Unit (CPU)1101, which can perform various appropriate actions and processes in accordance with a program stored in a Read Only Memory (ROM)1102 or a program loaded from a storage section 1108 into a Random Access Memory (RAM) 1103. In the RAM 1103, various programs and data necessary for system operation are also stored. The CPU 1101, ROM 1102, and RAM 1103 are connected to each other by a bus 1104. An input/output (I/O) interface 1105 is also connected to bus 1104.
The following components are connected to the I/O interface 1105: an input portion 1106 including a keyboard, mouse, and the like; an output portion 1107 including a signal output unit such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and a speaker; a storage section 1108 including a hard disk and the like; and a communication section 1109 including a network interface card such as a LAN card, a modem, or the like. The communication section 1109 performs communication processing via a network such as the internet. A driver 1110 is also connected to the I/O interface 1105 as necessary. A removable medium 1111 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 1110 as necessary, so that a computer program read out therefrom is mounted into the storage section 1108 as necessary.
In particular, according to an embodiment of the present invention, the processes described below with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the invention include a computer program product comprising a computer program embodied on a computer-readable medium, the computer program comprising program code for performing the method illustrated in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication portion 1109 and/or installed from the removable medium 1111. When the computer program is executed by a Central Processing Unit (CPU)1101, various functions defined in the system of the present application are executed.
It should be noted that the computer readable media shown in the present disclosure may be computer readable signal media or computer readable storage media or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In contrast, in the present disclosure, a computer-readable signal medium may include a propagated data signal with computer-readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, fiber optic cable, RF, etc., or any suitable combination of the foregoing.
The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
As another aspect, the present application also provides a computer-readable medium, which may be contained in the electronic device described in the above embodiments; or may exist separately without being assembled into the electronic device. The computer readable medium carries one or more programs which, when executed by an electronic device, cause the electronic device to implement the method as described in the embodiments below.
It should be noted that although in the above detailed description several modules of the device for action execution are mentioned, this division is not mandatory. Indeed, the features and functionality of two or more of the modules described above may be embodied in one module, in accordance with embodiments of the present disclosure. Conversely, the features and functions of one module described above may be further divided into embodiments by a plurality of modules.
Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the disclosure disclosed herein. This application is intended to cover any variations, uses, or adaptations of the disclosure following, in general, the principles of the disclosure and including such departures from the present disclosure as come within known or customary practice within the art to which the disclosure pertains.
It will be understood that the present disclosure is not limited to the precise arrangements described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims (10)

1. A method for detecting an abnormal request, comprising:
acquiring a network link of each page as a main link of each page, and respectively acquiring a network link of an interface required for rendering each page as a sub-link related to the main link of the page;
obtaining a page link rule matrix according to the main link of each page and the sub-link related to the main link of the page;
acquiring a page request record in a preset detection time period, and detecting a page request in the page request record through the page link rule matrix to determine an abnormal request in the page request record.
2. The method for detecting an abnormal request according to claim 1, wherein the detecting a page request in the page request record through the page link rule matrix to determine an abnormal request in the page request record comprises:
judging whether each page request in the page request record is a main link request corresponding to the main link in the page link rule matrix or a sub-link request corresponding to a sub-link related to the main link;
and if the page request is not the main link request corresponding to the main link or the sub-link request corresponding to the sub-link related to the main link, determining the page request as an abnormal request.
3. The method according to claim 2, wherein the page request record includes page request links of the page requests, and the determining whether each page request in the page request record is a main link request corresponding to the main link in the page link rule matrix or a sub-link request corresponding to a sub-link related to the main link includes:
comparing a page request link of the page request with a main link in the page link rule matrix, and judging whether the page request is the main link request corresponding to the main link;
if the page request is the main link request, acquiring a page request meeting a preset request time rule with the main link request from the page request record, and using the page request as a sub-link request to be detected corresponding to the main link request;
and judging whether the sub-link request to be detected is a sub-link request corresponding to the sub-link related to the main link or not through the page link rule matrix according to the page request record of the sub-link request to be detected.
4. The method according to claim 3, wherein the page request record further includes a page request time of the page request, and the obtaining, from the page request record, a page request that satisfies a preset request time rule with the main link request as the sub-link request to be tested corresponding to the main link request includes:
acquiring a page request with the page request time after the main link request from the page request record;
judging whether the time difference between the page request time of the page request and the page request time of the main link request is smaller than or equal to a time difference threshold value or not;
and if the time difference between the page request and the page request time of the main link request is smaller than or equal to the time difference threshold, taking the page request as a sub-link request to be tested corresponding to the main link request.
5. The method for detecting an abnormal request according to claim 3, wherein the determining, according to the page request record of the child link request to be detected, whether the child link request to be detected is a child link request corresponding to the child link related to the main link through the page link rule matrix includes:
acquiring all sub-links related to the main link corresponding to the main link request from the page link rule matrix to obtain a related sub-link set of the main link request;
judging whether the sub-link request to be detected is in a related sub-link set of the main link request according to the page request link of the sub-link request to be detected, and judging whether a page request record of the sub-link request to be detected is matched with a page request record of the main link request;
if the sub-link request to be tested is in the sub-link set related to the main link request, and the page request record of the sub-link request to be tested is matched with the main link request, the sub-link request to be tested is the sub-link request corresponding to the sub-link related to the main link.
6. The method for detecting an abnormal request according to claim 5, wherein the page request record further includes a page request source address of the page request and a user agent identifier, and the determining whether the page request record of the child link request to be tested matches the page request record of the main link request comprises:
judging whether the page request source address of the sub-link request to be tested is the same as the page request source address of the main link request;
judging whether the user agent identification of the sub-link request to be tested is the same as the user agent identification of the main link request;
and if the page request source address and the user agent identification of the sub-link request to be tested are the same as those of the main link request, matching the page request record of the sub-link request to be tested with the page request record of the main link request.
7. The method of detecting an exception request according to claim 1, wherein after said determining an exception request in said page request record, said method further comprises:
and if the page request is an abnormal request, acquiring a page request source address and a user agent identifier of the abnormal request to obtain abnormal request information of the abnormal request.
8. An apparatus for detecting an abnormal request, comprising:
the network link obtaining module is used for obtaining the network link of each page as the main link of each page and respectively obtaining the network link of an interface required for rendering each page as the sub-link related to the main link of the page;
the rule matrix generation module is used for obtaining a page link rule matrix according to the main link of each page and the sub-link related to the main link of the page;
and the page request detection module is used for acquiring a page request record in a preset detection time period and detecting a page request in the page request record through the page link rule matrix so as to determine an abnormal request in the page request record.
9. An electronic device, comprising:
a processor; and
memory for storing one or more programs that, when executed by the one or more processors, cause the one or more processors to implement a method of detecting an exception request as claimed in any one of claims 1 to 7.
10. A computer-readable medium, on which a computer program is stored, which, when being executed by a processor, carries out a method of detecting an abnormal request according to any one of claims 1 to 7.
CN202010318187.5A 2020-04-21 2020-04-21 Abnormal request detection method and device, electronic equipment and computer readable medium Active CN113542047B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202010318187.5A CN113542047B (en) 2020-04-21 2020-04-21 Abnormal request detection method and device, electronic equipment and computer readable medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202010318187.5A CN113542047B (en) 2020-04-21 2020-04-21 Abnormal request detection method and device, electronic equipment and computer readable medium

Publications (2)

Publication Number Publication Date
CN113542047A true CN113542047A (en) 2021-10-22
CN113542047B CN113542047B (en) 2023-04-07

Family

ID=78123848

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202010318187.5A Active CN113542047B (en) 2020-04-21 2020-04-21 Abnormal request detection method and device, electronic equipment and computer readable medium

Country Status (1)

Country Link
CN (1) CN113542047B (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115150449A (en) * 2022-06-30 2022-10-04 苏州浪潮智能科技有限公司 Method, system, terminal and storage medium for rejecting abnormal connection in network sharing

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104035940A (en) * 2013-03-07 2014-09-10 腾讯科技（深圳）有限公司 Webpage link storage method and server
CN105531679A (en) * 2013-10-10 2016-04-27 英特尔公司 Anomaly detection on web client
CN106453266A (en) * 2016-09-20 2017-02-22 微梦创科网络科技（中国）有限公司 Abnormal networking request detection method and apparatus
WO2019148684A1 (en) * 2018-01-30 2019-08-08 深圳市元征软件开发有限公司 Vehicle interior monitoring method and device
CN110708270A (en) * 2018-07-10 2020-01-17 阿里巴巴集团控股有限公司 Abnormal link detection method and device
CN110851683A (en) * 2019-10-25 2020-02-28 陈奕博 Webpage display method for prerendering
CN110932987A (en) * 2019-10-28 2020-03-27 苏宁云计算有限公司 Method and device for flow control of URL (Uniform resource locator) connection number

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104035940A (en) * 2013-03-07 2014-09-10 腾讯科技（深圳）有限公司 Webpage link storage method and server
CN105531679A (en) * 2013-10-10 2016-04-27 英特尔公司 Anomaly detection on web client
CN106453266A (en) * 2016-09-20 2017-02-22 微梦创科网络科技（中国）有限公司 Abnormal networking request detection method and apparatus
WO2019148684A1 (en) * 2018-01-30 2019-08-08 深圳市元征软件开发有限公司 Vehicle interior monitoring method and device
CN110708270A (en) * 2018-07-10 2020-01-17 阿里巴巴集团控股有限公司 Abnormal link detection method and device
CN110851683A (en) * 2019-10-25 2020-02-28 陈奕博 Webpage display method for prerendering
CN110932987A (en) * 2019-10-28 2020-03-27 苏宁云计算有限公司 Method and device for flow control of URL (Uniform resource locator) connection number

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
刘卫国等: "一种全部属性聚类和特征属性聚类相结合的无监督异常检测模型", 《铁道学报》 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115150449A (en) * 2022-06-30 2022-10-04 苏州浪潮智能科技有限公司 Method, system, terminal and storage medium for rejecting abnormal connection in network sharing
CN115150449B (en) * 2022-06-30 2023-08-08 苏州浪潮智能科技有限公司 Method, system, terminal and storage medium for rejecting abnormal connection by network sharing

Also Published As

Publication number Publication date
CN113542047B (en) 2023-04-07

Similar Documents

Publication Publication Date Title
US11860866B2 (en) Automated sequential site navigation
US10521837B1 (en) Preemptive transaction analysis
US20160321679A1 (en) Device and membership identity matching
US20110153401A1 (en) Testing the validity of electronic coupon codes
US10949853B2 (en) Systems and methods for providing concurrent data loading and rules execution in risk evaluations
US8666893B1 (en) Electronic funds transfer authentication system
US20220027961A1 (en) Using embedded elements for online content verification
CN104753909A (en) Updated information authentication method, device and system
CN113542047B (en) Abnormal request detection method and device, electronic equipment and computer readable medium
CN114004700A (en) Service data processing method and device, electronic equipment and storage medium
US20190188578A1 (en) Automatic discovery of data required by a rule engine
US20150248673A1 (en) Methods and apparatus for a token management system for transactions
US11210642B2 (en) Methods and systems for deconflicting data from multiple sources in computer systems
CN111427915A (en) Information processing method and device, storage medium and electronic equipment
CN115052037A (en) Client detection method, device, storage medium and equipment
CN113656314A (en) Pressure test processing method and device
US20230205825A1 (en) Extracting webpage features using coded data packages for page heuristics
CN113656385A (en) Data cleaning method, data cleaning device, storage medium and electronic equipment
KR20090002018A (en) Method of examining advertisement and advertisement examining system
CN108305078B (en) Program order-swiping identification method and device
CN113988948A (en) Satisfaction collecting method, device, equipment and storage medium
US20190303955A1 (en) Trafficview
CN115344788A (en) Processing method, processing device and electronic equipment
CN112085240A (en) Method and system for processing transaction data of first-order commodities
CN113762684A (en) New user risk assessment method and device, electronic equipment and medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant