WO2017041666A1

WO2017041666A1 - Processing method and device directed at access request

Info

Publication number: WO2017041666A1
Application number: PCT/CN2016/097854
Authority: WO
Inventors: 刘岩; 赵洪涛
Original assignee: 阿里巴巴集团控股有限公司
Priority date: 2015-09-11
Filing date: 2016-09-02
Publication date: 2017-03-16
Also published as: CN106534051A; CN106534051B

Abstract

Provided are a processing method and device directed at an access request. The method comprises: when receiving an access request of a client, a DNS server forwarding the access request of the client to a first jump server for jump accessing; the DNS receiving a notification message sent by the first skip server when an abnormal access is determined; and the DNS server forwarding an access request of the client to a second skip server for traffic cleaning according to the notification message. In the embodiments of the application, defence is conducted directed at a single access; while ensuring the security of a first skip server, it is ensured that other normal accesses are not affected, thereby reducing error rate and improving the efficiency.

Description

Processing method and device for access request

The present application claims priority to Chinese Patent Application Serial No. No. No. No. No. No. No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No

Technical field

The present application relates to the technical field of computer processing, and in particular, to a processing method for an access request and a processing device for an access request.

Background technique

In the Internet, each IP (Internet Protocol) protocol address can have a host name.

DNS (Domain Name System), a distributed database that maps domain names and IP addresses to each other. The IP address corresponding to the host name is finally resolved by the host name, which makes it easier for users to access the Internet. Intuitive and meaningful domain names are all right, without having to remember the IP addresses that can be read directly by the machine.

In some cases, the jump server is configured for the DNS server, and the user who currently accesses the domain name is directed to another specified network address through the special settings of the server.

When the DNS server is attacked, if the attacked domain name needs to be redirected, a large number of forwarding resolution requests are collected into the jump server, causing the forwarding server to be subjected to a large-scale traffic attack, which may render it unusable.

Currently, the forwarding server has a hard limit on the traffic that is accessed. If the traffic limit is exceeded, access will be restricted. Even normal access will be restricted, the error rate is high, and the efficiency is low.

Summary of the invention

In view of the above problems, embodiments of the present application have been made in order to provide a processing method for an access request and a corresponding processing device for an access request that overcomes the above problems or at least partially solves the above problems.

In order to solve the above problem, the embodiment of the present application discloses a processing method for an access request, including:

When receiving the access request of the client, the DNS server forwards the access request of the client to the first jump server for the jump access;

The DNS server receives the notification message sent by the first transfer server when determining the abnormal access;

The DNS server forwards the access request of the client to the second jump server for traffic cleaning according to the notification message.

Optionally, the source address is included in the access request of the client;

The step of forwarding the client's access request to the first transfer server for the jump access includes:

Searching for address record data corresponding to the source address; the first record hopping address of the first jump server is recorded in the address record data;

Sending the first forwarding address to the client, and acquiring the destination address corresponding to the source address from the first forwarding server for loading.

Optionally, the step of forwarding the access request of the client to the second forwarding server for performing traffic cleaning includes:

Modifying, by the first forwarding address of the first forwarding server in the address record data, a second forwarding address of the second forwarding server;

Sending the second forwarding address to the client to access the second forwarding server and performing traffic cleaning on the access request.

Optionally, the notification message is generated by the first forwarding server when determining that the traffic of the client's access request exceeds a preset traffic threshold.

Optionally, the access request is performed by the second forwarding server by using the traffic cleaning access request;

The access request that failed to pass the traffic cleaning is rejected by the second transfer server.

The embodiment of the present application further discloses a processing method for an access request, including:

The first jump server receives the access request of the client forwarded by the DNS server;

The first jump server determines whether the client's access request is abnormal access;

If yes, sending a notification message to the DNS server to forward the client's access request to the second forwarding server for traffic cleaning;

If not, the client's access request is forwarded to the specified page.

Optionally, it also includes:

Sends an alert message for abnormal access from a preset interface.

Optionally, the access request of the client includes a source address, and the step of the first forwarding server receiving the access request forwarded by the DNS server and the client includes:

The first transfer server receives the access request sent by the client through the first transfer address;

The first forwarding address is obtained by the NDS server when the access request of the client is received, and the address record data corresponding to the source address is obtained, and the first jump of the first jump server is recorded in the address record data. Ground site.

Optionally, the step of determining, by the first jump server, whether the access request of the client is abnormal access includes:

The traffic of the client's access request is determined to exceed the preset traffic threshold; if yes, the client's access request is determined to be abnormal access, and if not, the client's access request is determined to be normal access.

Optionally, the step of sending the notification message to the DNS server to forward the access request of the client to the second forwarding server for traffic cleaning includes:

Sending a notification message to the DNS server, and notifying that the first forwarding address of the first jump server in the address record data is modified to the second forwarding address of the second jump server, so that the second forwarding address is Send to the client, access the second transfer server, and perform traffic cleaning on the access request.

Optionally, the step of forwarding the client's access request to the specified page:

Finding a destination address corresponding to the source address;

The destination address is sent to the client for loading to display the specified page.

The embodiment of the present application further discloses a processing device for an access request, which is applied to a DNS server, and the device includes:

The first forwarding module is configured to: when receiving the access request of the client, forward the access request of the client to the first forwarding server for the jump access;

a notification message receiving module, configured to receive a notification message sent by the first transition server when determining an abnormal access;

The second forwarding module is configured to forward the access request of the client to the second forwarding server for performing traffic cleaning according to the notification message.

Optionally, the source address is included in the access request of the client;

The first forwarding module includes:

An address record data search sub-module, configured to search for address record data corresponding to the source address, where the first transfer address of the first jump server is recorded in the address record data;

The first forwarding address sending submodule is configured to send the first forwarding address to the client, to obtain the destination address corresponding to the source address from the first forwarding server for loading.

Optionally, the second forwarding module includes:

An address record data modification submodule, configured to modify a first forwarding address of the first jump server in the address record data to a second jump address of the second jump server;

The second forwarding address sending submodule is configured to send the second forwarding address to the client to access the second forwarding server and perform traffic cleaning on the access request.

The embodiment of the present application further discloses a processing device for an access request, which is applied to a first jump server, and the device includes:

An access request receiving module, configured to receive a client access request forwarded by a DNS server;

The abnormal access judging module is configured to determine whether the access request of the client is abnormal access; if yes, the notification message sending module is called, and if not, the jump module is called;

a notification sending module, configured to send a notification message to the DNS server, to forward the access request of the client to the second forwarding server for traffic cleaning;

The jump module is used to jump the client's access request to the specified page.

Optionally, it also includes:

An alarm module for sending an abnormally accessed alarm information from a preset interface.

Optionally, the source address is included in the access request of the client, where the access request receiving module includes:

An address access submodule, configured to receive an access request sent by the client by using the first forwarding address;

The first forwarding address is obtained by the NDS server when the access request of the client is received, and the address record data corresponding to the source address is obtained, and the first jump of the first jump server is recorded in the address record data. address.

Optionally, the abnormal access judgment module includes:

The traffic judgment sub-module is configured to determine that the traffic of the client's access request exceeds a preset traffic threshold; if yes, the first determining sub-module is invoked, and if not, the second determining sub-module is invoked;

a first determining submodule, configured to determine that the access request of the client is an abnormal access;

The second determining submodule is configured to determine that the client access request is a normal access.

Optionally, the notification message sending module includes:

a notification sub-module, configured to send a notification message to the DNS server, to notify that the first forwarding address of the first jump server in the address record data is modified to the second forwarding address of the second transfer server, The second forwarding address is sent to the client, accesses the second forwarding server, and performs traffic cleaning on the access request.

Optionally, the jump module includes:

The destination address is searched for the sub-module, and the destination address corresponding to the source address is searched for;

The destination address sending submodule sends the destination address to the client for loading to display the specified page.

Embodiments of the present application include the following advantages:

In the embodiment of the present application, the client accesses the DNS server to the first jump server for jump access, and the client accesses the abnormality of the DNS server to the second jump server for traffic cleaning, for individual access. Defense, while ensuring the security of the first jump server, while ensuring that other normal access is not affected, reducing the error rate and improving efficiency.

DRAWINGS

1 is a flow chart of the steps of Embodiment 1 of a processing method for an access request according to the present application;

2 is a flow chart of steps of Embodiment 2 of a processing method for an access request according to the present application;

3 is a structural block diagram of Embodiment 1 of a processing apparatus for an access request according to the present application;

FIG. 4 is a structural block diagram of Embodiment 2 of a processing apparatus for an access request according to the present application.

detailed description

The above described objects, features and advantages of the present application will become more apparent and understood.

Referring to FIG. 1 , a flow chart of a step 1 of a processing method for an access request according to the present application is shown. Specifically, the method may include the following steps:

Step 101: When receiving the access request of the client, the DNS server forwards the access request of the client to the first jump server for the jump access;

Applying the embodiment of the present application, a first source server (host name or domain name) may be added to the first server (also referred to as a URL (Uniform Resource Locator) forwarding server). The address record data of the transfer address (such as the IP address), that is, the first transfer address of the first jump server recorded in the A (Address) record data.

And, adding a jump record to the database (such as tair) of the first jump server, where the jump record is The source address and destination address are recorded.

For example, the domain name www.abc.com (source address) with www is redirected via 301 redirect to the domain name abc.com (destination address) without www.

It should be noted that the A record data will be different according to the line configured by the user, that is, the user can select different lines corresponding to different A record data, different search engines correspond to different A record data, and the like.

When a user accesses a source address (such as a domain name) through a client (such as a browser), an access request is sent to the DNS server, that is, the source address is included in the access request.

The DNS server searches for the address record data corresponding to the source address (that is, the A record data), and sends the first jump address (such as the IP address) pointed to by the A record data to the client, and the client loads the first jump address (eg, IP address), access the first jump server.

If the access request of the client is a normal access, the first jump server returns a corresponding jump record to the client, and the client obtains the destination address corresponding to the source address from the first jump server to load, and requests the display page.

Step 102: The DNS server receives a notification message sent by the first forwarding server when determining an abnormal access.

In the embodiment of the present application, the first forwarding server may identify the source IP address, the destination IP address, the input interface, the output interface, the Socket source port, the destination port, the protocol, the TOS, etc. based on protocols such as Netflow, sFlow, and Netstream. A flow collects and analyzes traffic data to determine whether the client's access request is abnormal.

The detection of abnormal traffic (access request) is usually divided into three steps, the calculation of the measured value of the detection index, the calculation of the baseline value of the detection index, and the comparison of the measured value with the baseline value.

Each type of detection indicator corresponds to one or more possible attacks. That is to say, some detection indicators are specifically for detecting a specific abnormal flow, and when some detection indicators are abnormal, only one can be judged to exist. Several possible abnormal traffic, this indicator is a non-specific indicator.

Each test has its own baseline, but the baseline algorithm is similar.

There are usually two types of baseline algorithms, one is a periodic baseline and the other is a moving window baseline.

If the trend of the normal value of the detection index has a significant periodicity, a periodic baseline can be used.

If the normal value of the detection index does not change significantly, and it fluctuates within a small range, the moving window baseline can be used.

In an example of a protection service rule, the first jump server considers an abnormal access when it determines that the traffic of the client's access request exceeds a preset traffic threshold.

Generally, attack types for DNS servers include domain name hijacking, DDoS attacks, DNS cache poisoning attacks, DNS spoofing, and the like.

Take the DDoS attack as an example. By submitting a large number of requests to the DNS server, the DNS server is overloaded, resulting in slow website access and even crashes, thereby preventing users from accessing the DNS server.

When a DDoS attack occurs, the attacker puts up a large number of domain name resolution requests. Among these requests, the URL forwarding resolution request is only one of them. When a large number of URL forwarding resolution requests are collected into the URL forwarding server, the URL forwarding server (ie, the first jump server) is also affected.

If the abnormal access is considered, a notification message may be generated, and the notification message is sent to the DNS server to forward the access request of the client to the second jump server for traffic cleaning.

At this point, the URL forwarding resolution of the source address (such as the domain name or host name) will be aborted, and this process does not affect the URL forwarding resolution of other domain names or host names.

In addition, the first jump server may also send an abnormal access alarm information from a preset interface, which may be a mail interface to send an email, or an instant messaging interface to send an instant messaging message, and the like.

After the administrator receives the alarm information, the policy analysis of the black hole URL forwarding server can be restored to normal by some policies, or used to monitor the current server status to ensure the normal operation of the system.

If the normal access is considered, the client's access request is forwarded to the specified page, that is, the first jump server returns the corresponding jump record to the client, and the client obtains the destination address corresponding to the source address from the first jump server. Load, request to display the page.

Step 103: The DNS server forwards the access request of the client to the second forwarding server for traffic cleaning according to the notification message.

In a specific implementation, the DNS server may modify the first forwarding address of the first forwarding server in the address record data to the second forwarding address of the second forwarding server.

The function of the second jump server and the URL forwarding server is basically the same, but an additional function for traffic cleaning and filtering is added, which can be called a black hole URL forwarding server.

The DNS server can send the second forwarding address to the client to access the second forwarding server and perform traffic cleaning on the access request.

In a practical application, the access request flows through a filter created according to a pre-configured defense policy and a threshold that then transmits the traffic to each analysis detection module. After detection, the flow is transmitted to an identification module that extracts the refined data and continuously adjusts the filter to apply the characteristics of the constantly changing abnormal flow.

The Black Hole URL Forwarding Server can combine various authentication, analysis, and implementation techniques to identify and isolate malicious traffic based on a Multiple Authentication Process (MVP) structure.

The flow cleaning process can be roughly divided into five parts:

1. Filtering;

Includes static and dynamic DDoS filter filters.

2. Anti-fraud;

The packet used to verify the entry into the black hole URL forwarding server has no spoofing information.

3. Abnormal recognition;

Detects traffic that passes filter filters and anti-spoofing and compares it to the baseline behavior recorded over time, searching for unusual traffic and identifying the source of malicious packets.

4. Protocol analysis;

Handling malicious data discovered by anomaly identification in order to identify specific application attacks, such as http-error attacks.

5. Rate limit.

An execution option is provided to prevent illicit traffic from attacking the target.

The access request of the traffic cleaning is performed by the second transfer server, that is, the second jump server returns the corresponding jump record to the client, and the client obtains the destination address corresponding to the source address from the second transfer server. Load, request to display the page.

Referring to FIG. 2, a flow chart of the steps of the second embodiment of the processing method for the access request of the present application is shown, which may specifically include the following steps:

Step 201: The first transfer server receives the access request of the client forwarded by the DNS server.

Step 202, the first jump server determines whether the client's access request is abnormal access; if yes, step 203 is performed, and if not, step 204 is performed;

Step 203: Send a notification message to the DNS server to forward the client's access request to the second forwarding service. Server for traffic cleaning;

Step 204: Jump the client's access request to the specified page.

In an embodiment of the present application, the method may further include the following steps:

Step 205: Send an abnormal access alarm information from a preset interface.

In an embodiment of the present application, the client's access request includes a source address, and step 201 may include the following sub-steps:

Sub-step S11, the first transfer server receives an access request sent by the client through the first transfer address;

In an embodiment of the present application, step 202 may include the following sub-steps:

Sub-step S21, it is determined that the traffic of the client's access request exceeds a preset traffic threshold; if so, sub-step S22 is performed, and if not, sub-step S23 is performed;

Sub-step S22, determining that the client's access request is an abnormal access;

Sub-step S23, determining that the client's access request is a normal access.

In an embodiment of the present application, step 203 may include the following sub-steps:

Sub-step S31, sending a notification message to the DNS server, notifying that the first forwarding address of the first jump server in the address record data is modified to the second forwarding address of the second jump server, to The second forwarding address is sent to the client, accesses the second forwarding server, and performs traffic cleaning on the access request.

In an actual application, the access request of the traffic cleaning is performed by the second transfer server;

In an embodiment of the present application, step 204 may include the following sub-steps:

Sub-step S41, searching for a destination address corresponding to the source address;

Sub-step S42, the destination address is sent to the client for loading to display the specified page.

In the embodiment of the present application, since the method embodiment 2 is basically similar to the application of the method embodiment 1, the description is For a more detailed description, refer to the description of the method embodiment 1. The embodiment of the present application is not described in detail herein.

It should be noted that, for the method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should understand that the embodiments of the present application are not limited by the described action sequence, because In accordance with embodiments of the present application, certain steps may be performed in other sequences or concurrently. In the following, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required in the embodiments of the present application.

Referring to FIG. 3, a structural block diagram of a processing apparatus for an access request according to an application of the present application is shown in the DNS server. Specifically, the following modules may be included:

The first forwarding module 301 is configured to: when receiving the access request of the client, forward the access request of the client to the first forwarding server for the jump access;

The notification message receiving module 302 is configured to receive a notification message sent by the first transition server when determining an abnormal access;

The second forwarding module 303 is configured to forward the access request of the client to the second forwarding server for traffic cleaning according to the notification message.

In an embodiment of the present application, the source address is included in the access request of the client;

The first forwarding module 301 can include the following submodules:

In an embodiment of the present application, the second forwarding module 303 may include the following submodules:

In a specific implementation, the notification message is generated by the first forwarding server when determining that the traffic of the client's access request exceeds a preset traffic threshold.

Referring to FIG. 4, a structural block diagram of Embodiment 2 of a processing device for an access request according to the present application is shown, which is applied to a first jump server, and specifically includes the following modules:

The access request receiving module 401 is configured to receive an access request of the client forwarded by the DNS server;

The abnormal access judging module 402 is configured to determine whether the access request of the client is abnormal access; if yes, the notification message sending module 403 is invoked, and if not, the jump module 404 is invoked;

The notification message sending module 403 is configured to send a notification message to the DNS server, to forward the access request of the client to the second jump server for traffic cleaning;

The jump module 404 is configured to jump the client's access request to the specified page.

In an embodiment of the present application, the apparatus may further include the following modules:

In an embodiment of the present application, the access request of the client includes a source address, and the access request receiving module 401 may include the following submodules:

In an embodiment of the present application, the abnormal access judging module 402 may include the following sub-modules:

In an embodiment of the present application, the notification message sending module 403 may include the following sub-modules:

In one embodiment of the present application, the jump module 404 can include the following sub-modules:

For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

The various embodiments in the present specification are described in a progressive manner, and each embodiment focuses on differences from other embodiments, and the same similar parts between the various embodiments can be referred to each other.

Those skilled in the art will appreciate that embodiments of the embodiments of the present application can be provided as a method, apparatus, or computer program product. Therefore, the embodiments of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, embodiments of the present application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

In a typical configuration, the computer device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory. The memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory. Memory is an example of a computer readable medium. Computer readable media includes both permanent and non-persistent, removable and non-removable media. Information storage can be implemented by any method or technology. The information can be computer readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transportable media can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include non-persistent computer readable media, such as modulated data signals and carrier waves.

Embodiments of the present application are described with reference to flowcharts and/or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, a special purpose computer, an embedded processor or other programmable data processing terminal device to produce a machine such that it is provided by a computer or other programmable data processing terminal The instructions executed by the processor of the processor generate means for implementing the functions specified in one or more blocks of the flowchart or in a block or blocks of the flowchart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The instruction device implements the functions specified in one or more blocks of the flowchart or in a flow or block of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device such that a series of operational steps are performed on the computer or other programmable terminal device to produce computer-implemented processing, such that the computer or other programmable terminal device The instructions executed above provide steps for implementing the functions specified in one or more blocks of the flowchart or in a block or blocks of the flowchart.

While a preferred embodiment of the embodiments of the present application has been described, those skilled in the art can make further changes and modifications to the embodiments once they are aware of the basic inventive concept. Therefore, the appended claims are intended to be interpreted as including all the modifications and the modifications

Finally, it should also be noted that in this context, relational terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities. There is any such actual relationship or order between operations. Furthermore, the terms "comprises" or "comprising" or "comprising" or any other variations are intended to encompass a non-exclusive inclusion, such that a process, method, article, or terminal device that includes a plurality of elements includes not only those elements but also Other elements that are included, or include elements inherent to such a process, method, article, or terminal device. An element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal device that comprises the element, without further limitation.

The method for processing an access request and the processing device for the access request provided by the present application are described in detail above. The principles and implementation manners of the present application are described in the following. The descriptions are only used to help understand the method of the present application and its core ideas; at the same time, for those of ordinary skill in the art, according to the idea of the present application, there will be changes in the specific embodiments and application scopes. The contents of this specification are not to be construed as limiting the present application.

Claims

A processing method for an access request, comprising:

When receiving the access request of the client, the DNS server forwards the access request of the client to the first jump server for the jump access;

The DNS server receives the notification message sent by the first transfer server when determining the abnormal access;

The DNS server forwards the access request of the client to the second jump server for traffic cleaning according to the notification message.
The method according to claim 1, wherein the client access request includes a source address;

The step of forwarding the client's access request to the first transfer server for the jump access includes:

Searching for address record data corresponding to the source address; the first record hopping address of the first jump server is recorded in the address record data;

Sending the first forwarding address to the client, and acquiring the destination address corresponding to the source address from the first forwarding server for loading.
The method according to claim 2, wherein the step of forwarding the access request of the client to the second jump server for traffic cleaning comprises:

Modifying, by the first forwarding address of the first forwarding server in the address record data, a second forwarding address of the second forwarding server;

Sending the second forwarding address to the client to access the second forwarding server and performing traffic cleaning on the access request.
The method according to claim 1 or 2 or 3, wherein the notification message is generated by the first jump server when it is determined that the traffic of the client's access request exceeds a preset traffic threshold.
Method according to claim 1 or 2 or 3, characterized in that

Through the access request of the traffic cleaning, the second transfer server performs the jump access;

The access request that failed to pass the traffic cleaning is rejected by the second transfer server.
A processing method for an access request, comprising:

The first jump server receives the access request of the client forwarded by the DNS server;

The first jump server determines whether the client's access request is abnormal access;

If yes, sending a notification message to the DNS server to forward the client's access request to the second forwarding server for traffic cleaning;

If not, the client's access request is forwarded to the specified page.
The method of claim 6 further comprising:

Sends an alert message for abnormal access from a preset interface.
A processing device for an access request, which is applied to a DNS server, the device comprising:

The first forwarding module is configured to: when receiving the access request of the client, forward the access request of the client to the first forwarding server for the jump access;

a notification message receiving module, configured to receive a notification message sent by the first transition server when determining an abnormal access;

The second forwarding module is configured to forward the access request of the client to the second forwarding server for performing traffic cleaning according to the notification message.
The apparatus according to claim 8, wherein the access request of the client includes a source address;

The first forwarding module includes:

An address record data search sub-module, configured to search for address record data corresponding to the source address, where the first transfer address of the first jump server is recorded in the address record data;

The first forwarding address sending submodule is configured to send the first forwarding address to the client, to obtain the destination address corresponding to the source address from the first forwarding server for loading.
The apparatus according to claim 9, wherein the second forwarding module comprises:

An address record data modification submodule, configured to modify a first forwarding address of the first jump server in the address record data to a second jump address of the second jump server;

The second forwarding address sending submodule is configured to send the second forwarding address to the client to access the second forwarding server and perform traffic cleaning on the access request.
The apparatus according to claim 8 or 9 or 10, wherein the notification message is generated by the first jump server when it is determined that the traffic of the client's access request exceeds a preset traffic threshold.
Device according to claim 8 or 9 or 10, characterized in that

Through the access request of the traffic cleaning, the second transfer server performs the jump access;

The access request that failed to pass the traffic cleaning is rejected by the second transfer server.
A processing device for an access request, which is applied to a first jump server, the device comprising:

An access request receiving module, configured to receive a client access request forwarded by a DNS server;

The abnormal access judging module is configured to determine whether the access request of the client is abnormal access; if yes, the notification message sending module is called, and if not, the jump module is called;

a notification sending module, configured to send a notification message to the DNS server, to forward the access request of the client to the second forwarding server for traffic cleaning;

The jump module is used to jump the client's access request to the specified page.
The device according to claim 13, further comprising:

An alarm module for sending an abnormally accessed alarm information from a preset interface.