WO2017092250A1 - 一种盗链的检测方法及装置 - Google Patents

一种盗链的检测方法及装置 Download PDF

Info

Publication number
WO2017092250A1
WO2017092250A1 PCT/CN2016/082826 CN2016082826W WO2017092250A1 WO 2017092250 A1 WO2017092250 A1 WO 2017092250A1 CN 2016082826 W CN2016082826 W CN 2016082826W WO 2017092250 A1 WO2017092250 A1 WO 2017092250A1
Authority
WO
WIPO (PCT)
Prior art keywords
acquisition request
resource acquisition
information
preset
processing status
Prior art date
Application number
PCT/CN2016/082826
Other languages
English (en)
French (fr)
Inventor
魏帆
李茗
Original Assignee
乐视控股（北京）有限公司
乐视云计算有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 乐视控股（北京）有限公司, 乐视云计算有限公司 filed Critical 乐视控股（北京）有限公司
Priority to US15/245,205 priority Critical patent/US20170155567A1/en
Publication of WO2017092250A1 publication Critical patent/WO2017092250A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/60—Network streaming of media packets
    • H04L65/75—Media network packet handling
    • H04L65/764—Media network packet handling at the destination 
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the present invention relates to the field of information technology, and in particular, to a method and device for detecting a chain.
  • the invention provides a method and a device for detecting stolen chains, which are used to solve the problem that the data resources of the website are lost and the system resources are wasted due to the inability to detect the stolen chains.
  • the invention provides a method for detecting a stolen chain, the method comprising:
  • the alarm information is output.
  • the invention provides a chain detecting device, which comprises:
  • a receiving unit configured to receive a resource acquisition request sent by the client, where the resource acquisition request carries the IP address information of the client;
  • a statistical unit configured to collect processing state information corresponding to the resource acquisition request in a preset geographical area corresponding to the IP address information
  • an output unit configured to output alarm information if the processing status information does not meet the preset condition.
  • the method and device for detecting a stolen chain provided by the present invention firstly receive a resource acquisition request sent by a client, where the resource acquisition request carries the IP address information of the client, and then the statistics correspond to the IP address information.
  • the embodiment of the present invention synchronizes and counts the processing state information corresponding to the resource acquisition request in a certain area, and By detecting whether the processing status information is abnormal, the chain detection is implemented, thereby avoiding the loss of the website data resources and the waste of system resources.
  • FIG. 1 is a flow chart of a method for detecting a stolen chain according to the present invention
  • FIG. 2 is a flow chart of another method for detecting chain stealing provided by the present invention.
  • FIG. 3 is a block diagram showing the structure of a chain detecting device provided by the present invention.
  • FIG. 4 is a block diagram showing the structure of another chain detecting device provided by the present invention.
  • the embodiment of the invention provides a method for detecting a stolen chain. As shown in FIG. 1 , the method can be applied to a server. The specific steps include:
  • the resource acquisition request carries the IP address information of the client. Since the client needs a communication port when interacting with the resource server, the resource acquisition request sent by each client carries the IP address of the communication port.
  • the resource acquisition request may further carry the identifier information of the resource to be acquired, so that the resource server obtains and returns the corresponding resource to the server according to the identifier information of the resource.
  • the preset geographical area is divided according to different regions in advance. For example, the geographical area of Beijing may be divided according to the area, that is, different preset geographical areas correspond to different areas, and the geographical range of China may be divided according to the province.
  • the embodiment of the invention is not limited.
  • the processing status information may specifically be the number of times that the resource acquisition request is received in a certain period of time, the bandwidth traffic that the resource acquisition request consumes in a certain period of time, and the like, which are not limited in the embodiment of the present invention.
  • the preset geographical range corresponding to the client can be obtained by using the IP address information.
  • the preset condition may be different according to the statistical processing status information, and the preset condition may be whether the request frequency of the resource acquisition request is greater than or equal to a preset frequency threshold, and may also be the resource acquisition request within a certain time. Whether the bandwidth consumption is greater than or equal to a preset threshold, etc., is not limited in the embodiment of the present invention.
  • the alarm information may be text information, audio information, video information, and the like, which are not limited in the embodiment of the present invention. For example, when the alarm information is text information, the text prompt information of the stolen chain may be displayed; when the alarm information is audio information, the audio prompt information of the stolen chain may be played; when the alarm information is video information, this may Play flash video prompts.
  • the alarm information is output, so that the stolen chain can be discovered and reported in time, so that the stolen chain can be processed in time, and the website can be avoided. Loss of data resources and waste of system resources.
  • a method for detecting a stolen chain first receives a resource acquisition request sent by a client, where the resource acquisition request carries IP address information of the client, and then statistics are corresponding to the IP address information.
  • the embodiment of the present invention synchronizes and counts the processing state information corresponding to the resource acquisition request in a certain area, and detects the situation, because the user distribution area of the resource is distributed and widely distributed, and the resource synchronization request is not synchronized. If the status information is abnormal, the stealing chain detection is implemented, thereby avoiding the loss of the website data resources and the waste of system resources.
  • the embodiment of the present invention further provides a method for detecting a stolen chain.
  • the method can be applied to a resource server, and the specific steps include:
  • the resource acquisition request carries the IP address information of the client. Since the client needs a communication port when interacting with the resource server, the resource acquisition request sent by each client carries the IP address of the communication port.
  • the resource acquisition request may further carry the identifier information of the resource to be acquired, so that the resource server obtains and returns the corresponding resource to the server according to the identifier information of the resource.
  • the preset geographical range is divided according to different regions in advance.
  • the geographical scope of the Chaoyang District can be divided according to the community, that is, different preset geographical regions correspond to different communities, and the geographical scope of Jiangsu province can be performed according to the city.
  • the division is not limited in the embodiment of the present invention.
  • the processing status information may specifically be the number of times the resource acquisition request is received within a certain period of time, for example, receiving 100 requests within 1 minute, and may also acquire bandwidth traffic consumed by the resource within a certain period of time. For example, a bandwidth of 100 M or the like is consumed in one minute, which is not limited in the embodiment of the present invention.
  • the step 202 may be: acquiring the area attribute information corresponding to the IP address information; and collecting the processing status information corresponding to the resource acquisition request in the preset area corresponding to the area attribute information.
  • the IP address information is parsed to obtain the regional attribute information corresponding to the IP address information.
  • the regional attribute information corresponding to the IP address information can be parsed as Beijing.
  • the regional attribute information corresponding to the IP address information can be parsed as Guiyang City, Guizhou province.
  • Each of the regional attribute information may correspond to one or more IP address information.
  • the processing status information does not meet the preset condition, and the number of times that the resource acquisition request is received in a certain period of time is greater than or equal to a preset threshold.
  • the alarm information is output when the number of times the resource acquisition request is received within a certain period of time is greater than or equal to a preset threshold.
  • the preset threshold of the number of times the request is received within 1 minute is 10 times, and the number of times the request is received in one minute in real time is 100 times, which exceeds the preset threshold, indicating that the sunrise is at this time.
  • the alarm information is output so that the problem can be handled in time.
  • the processing status information does not meet the preset condition, and the bandwidth usage that the resource acquisition request consumes in a period of time is greater than or equal to a preset threshold.
  • the step 203 may be specifically: if the bandwidth acquisition traffic consumed by the resource acquisition request is greater than or equal to a preset threshold, the alarm information is output.
  • the resource request corresponding to the request is image resource data
  • the bandwidth resource traffic of the image resource data is usually 5M, that is, the bandwidth consumed by the corresponding time period is 5M, and when the actually consumed bandwidth traffic is 500M,
  • the alarm information is outputted so that the problem can be handled in time.
  • the bandwidth resource traffic normally consumed by the video resource data is 500 M, that is, the bandwidth traffic consumed in the preset time period is 500 M, and when the actual consumed bandwidth traffic is 500 M, At this time, the bandwidth traffic is in the normal range and no alarm is generated. It can be seen that by configuring different preset processing state information for different resource requests, the detection accuracy of the chain stealing can be further improved, and unnecessary alarms can be avoided.
  • the alarm information is output, so that the stolen chain can be discovered and reported in time, so that the stolen chain can be processed in time, and the website can be avoided. Loss of data resources and waste of system resources.
  • the preset time period can be configured according to actual requirements. For the stolen chain problem that is easier to handle, the preset time period can be configured to be relatively small. For the more difficult to handle the stolen chain problem, the preset time period can be configured.
  • the embodiment of the present invention is not limited.
  • the amount of preset data is the amount of data requested for normal feedback. By feeding back the resources of the preset data amount corresponding to the resource acquisition request within a preset time period, the data resource loss of the website can be reduced when the chain stealing occurs. And the waste of system resources. And by configuring a preset time period, you can also After the problem of theft chain is solved, the certificate can be restored to the normal processing mechanism.
  • Step 204b along with step 204a, terminates processing the resource acquisition request within the preset time period.
  • the processing of the resource acquisition request in the preset time period may be: not feeding back the resource corresponding to the resource acquisition request or feeding back the error prompt information to the client, so as to avoid the client repeating again.
  • the resource acquisition request is sent to the resource server.
  • the specific application scenario may be as follows, but is not limited thereto, including: first, the resource server receives the resource acquisition request sent by the client, where the resource acquisition request carries the IP address information of the client as 110.102.156.12, by obtaining the geographical attribute information of the client by parsing the IP address information into the Inner Mongolia Autonomous Region of China, and then counting that the resource acquisition request in the Inner Mongolia Autonomous Region of China is sent 10,000 times in one minute, and the resource acquisition request is consumed.
  • the bandwidth traffic is 100G.
  • the resource acquisition request is 1000 in one minute, and the bandwidth traffic is 10G.
  • the alarm information is output, so that the abnormality caused by the existence of the stolen chain is performed. Processing, and terminating the resources of the resource acquisition request request or only feeding back 10G resources, thereby avoiding the loss of website data resources and the waste of system resources.
  • Another method for detecting a stolen chain first receives a resource acquisition request sent by a client, where the resource acquisition request carries the IP address information of the client, and then collects information about the IP address.
  • the embodiment of the present invention synchronizes and counts the processing state information corresponding to the resource acquisition request in a certain area, and By detecting whether the processing status information is abnormal, the chain detection is implemented, thereby avoiding the loss of the website data resources and the waste of system resources.
  • the embodiment of the present invention provides a device for detecting a stolen chain.
  • the device may be disposed in a resource server.
  • the device includes: a receiving unit 31.
  • the receiving unit 31 is configured to receive a resource acquisition request sent by the client, where the resource acquisition request is The IP address information of the client is carried in the middle.
  • the statistic unit 32 is configured to collect processing state information corresponding to the resource acquisition request in a preset area corresponding to the IP address information.
  • the output unit 33 is configured to output alarm information if the processing status information does not meet the preset condition.
  • the apparatus for detecting a stolen chain first receives a resource acquisition request sent by a client, where the resource acquisition request carries the IP address information of the client, and then the statistics correspond to the IP address information.
  • the embodiment of the present invention synchronizes and counts the processing state information corresponding to the resource acquisition request in a certain area, and By detecting whether the processing status information is abnormal, the chain detection is implemented, thereby avoiding the loss of the website data resources and the waste of system resources.
  • an embodiment of the present invention provides a device for detecting a stolen chain, and the device may be disposed in a resource server.
  • the device includes: a receiving unit. 41.
  • a statistical unit 42 an output unit 43, a feedback unit 44, and a termination unit 45.
  • the receiving unit 41 is configured to receive a resource acquisition request sent by the client, where the resource acquisition request carries the IP address information of the client.
  • the statistic unit 42 is configured to collect processing state information corresponding to the resource acquisition request in a preset geographical area corresponding to the IP address information.
  • the output unit 43 is configured to output alarm information if the processing status information does not meet the preset condition.
  • the statistic unit 42 is specifically configured to acquire regional attribute information corresponding to the IP address information
  • the processing status information corresponding to the resource acquisition request is counted in a preset area corresponding to the area attribute information.
  • the processing status information does not meet the preset condition, and the number of times the resource acquisition request is received within a certain period of time is greater than or equal to a preset threshold.
  • the output unit 43 is specifically configured to: if the resource acquisition request is received within a certain period of time The number of times is greater than or equal to the preset threshold, and the alarm information is output.
  • the processing status information does not meet the preset condition, and the bandwidth usage of the resource acquisition request consumed in a period of time is greater than or equal to a preset threshold.
  • the output unit 43 is configured to output alarm information if the bandwidth consumption consumed by the resource acquisition request is greater than or equal to a preset threshold.
  • the feedback unit 44 is configured to feed back a resource of a preset data amount corresponding to the resource acquisition request within a preset time period.
  • the terminating unit 45 is configured to terminate processing the resource acquisition request within the preset time period.
  • Another apparatus for detecting a stolen chain first receives a resource acquisition request sent by a client, where the resource acquisition request carries the IP address information of the client, and then collects information about the IP address.
  • the embodiment of the present invention synchronizes and counts the processing state information corresponding to the resource acquisition request in a certain area, and By detecting whether the processing status information is abnormal, the chain detection is implemented, thereby avoiding the loss of the website data resources and the waste of system resources.
  • the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, ie may be located A place, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment. Those of ordinary skill in the art can understand and implement without deliberate labor.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明提供一种盗链的检测方法及装置，涉及信息技术领域，可以实现对盗链的检测，从而可以避免网站数据资源的流失以及系统资源的浪费。所述方法包括：首先接收客户端发送的资源获取请求，所述资源获取请求中携带有所述客户端的IP地址信息，然后统计在与所述IP地址信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息，若所述处理状态信息不符合预置条件，则输出告警信息。本发明适用于对盗链进行检测。

Description

一种盗链的检测方法及装置 技术领域
本发明涉及信息技术领域，尤其涉及一种盗链的检测方法及装置。
背景技术
随着信息技术的不断发展，应用网络的用户也越来越多，用户可以通过网络获取各种所需的资源，随之而来的网络安全问题也越来越多。其中，盗链为比较常见的安全问题之一。盗链具体为当服务器接收到用户发送的资源请求时，这样的资源请求有可能被恶意的第三方或非法操作的用户进行复制，然后恶意的第三方或非法操作的用户将复制的资源请求同时分发给多个非法用户，这样使得非法用户也可访问网站中的资源，造成网站的资源浪费。
目前，由于使用资源的用户分布地域较为分散与广泛，无法实现对所有资源获取请求进行统计同步，进而无法实现对盗链进行检测，从而造成网站数据资源的流失以及系统资源的浪费。
发明内容
本发明提供一种盗链的检测方法及装置，用以解决现有由于无法实现对盗链进行检测，从而造成的网站数据资源的流失以及系统资源浪费的问题。
本发明提供一种盗链的检测方法，该方法包括：
接收客户端发送的资源获取请求，所述资源获取请求中携带有所述客户端的IP地址信息；
统计在与所述IP地址信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息；
若所述处理状态信息不符合预置条件，则输出告警信息。
本发明提供一种盗链的检测装置，该装置包括：
接收单元，用于接收客户端发送的资源获取请求，所述资源获取请求中携带有所述客户端的IP地址信息；
统计单元，用于统计在与所述IP地址信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息；
输出单元，用于若所述处理状态信息不符合预置条件，则输出告警信息。
本发明提供的一种盗链的检测方法及装置，首先接收客户端发送的资源获取请求，所述资源获取请求中携带有所述客户端的IP地址信息，然后统计在与所述IP地址信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息，若所述处理状态信息不符合预置条件，则输出告警信息。与目前由于使用资源的用户分布地域较为分散与广泛，无法实现对所有资源获取请求进行统计同步相比，本发明实施例通过同步并统计一定区域范围内的资源获取请求对应的处理状态信息，并通过检测处理状态信息是否存在异常实现盗链检测，从而可以避免网站数据资源的流失以及系统资源的浪费。
附图说明
为了更清楚地说明本发明或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作以简单地介绍，显而易见地，下面描述中的附图是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明提供的一种盗链的检测方法流程图；
图2为本发明提供的另一种盗链的检测方法流程图；
图3为本发明提供的一种盗链的检测装置的结构组成框图；
图4为本发明提供的另一种盗链的检测装置的结构组成框图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合本发明中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例提供了一种盗链的检测方法，如图1所示，该方法可以应用于服务器中，具体步骤包括：
101、接收客户端发送的资源获取请求。
其中，所述资源获取请求中携带有所述客户端的IP地址信息。由于客户端与资源服务器交互时都需要通讯端口，因此，每一个客户端发送的资源获取请求中都携带有该通讯端口的IP地址。所述资源获取请求中还可以携带有需要获取的资源的标识信息，以便于资源服务器根据该资源的标识信息获取并向服务器反馈对应的资源。
102、统计在与所述IP地址信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息。
其中，预置地域范围是预先根据不同地域进行划分的，例如，将北京市的地域范围可以按照区进行划分，即不同预置地域范围对应不同的区，将中国的地域范围可以按照省进行划分，本发明实施例不做限定。所述处理状态信息具体可以为该资源获取请求在一定时间段内接收到的次数、该资源获取请求在一定时间段内消耗的带宽流量等，本发明实施例不做限定。对于本发明实施例，由于通过解析IP地址信息能够获取到该客户端所在的实际地理位置区域，因此，通过IP地址信息能够获取到客户端对应的预置地域范围。
103、若所述处理状态信息不符合预置条件，则输出告警信息。
其中，所述预置条件根据统计的处理状态信息的不同而不同，预置条件可以为该资源获取请求的请求频率是否大于或等于预设频率阈值，还可以为该资源获取请求在一定时间内的带宽消耗量是否大于或等于预设阈值等，本发明实施例不做限定。所述告警信息可以为文本信息、音频信息、视频信息等，本发明实施例不做限定。例如，当告警信息为文本信息时，则可以显示存在盗链的文本提示信息；当告警信息为音频信息时，则可以播放存在盗链的音频提示信息；当告警信息为视频信息时，这可以播放flash视频提示信息。
对于本发明实施例，通过在资源获取请求对应的处理状态信息不符合预置条件时，输出告警信息，可以实现及时发现盗链并进行上报，从而可以对盗链进行及时的处理，可以避免网站数据资源的流失以及系统资源的浪费。
本发明实施例提供的一种盗链的检测方法，首先接收客户端发送的资源获取请求，所述资源获取请求中携带有所述客户端的IP地址信息，然后统计在与所述IP地址信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息，若所述处理状态信息不符合预置条件，则输出告警信息。与目前 由于使用资源的用户分布地域较为分散与广泛，无法实现对所有资源获取请求进行统计同步相比，本发明实施例通过同步并统计一定区域范围内的资源获取请求对应的处理状态信息，并通过检测处理状态信息是否存在异常实现盗链检测，从而可以避免网站数据资源的流失以及系统资源的浪费。
与上述方法相对应地，本发明实施例还提供了一种盗链的检测方法，如图2所示，该方法可以应用于资源服务器中，具体步骤包括：
201、接收客户端发送的资源获取请求。
其中，所述资源获取请求中携带有所述客户端的IP地址信息。由于客户端与资源服务器交互时都需要通讯端口，因此，每一个客户端发送的资源获取请求中都携带有该通讯端口的IP地址。所述资源获取请求中还可以携带有需要获取的资源的标识信息，以便于资源服务器根据该资源的标识信息获取并向服务器反馈对应的资源。
202、统计在与所述IP地址信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息。
其中，预置地域范围是预先根据不同地域进行划分的，例如，将朝阳区的地域范围可以按照社区进行划分，即不同预置地域范围对应不同的社区，将江苏省的地域范围可以按照市进行划分，本发明实施例不做限定。所述处理状态信息具体可以为该资源获取请求在一定时间段内接收到的次数，例如，在1分钟内接收到100次请求，还可以为该资源获取请求在一定时间段内消耗的带宽流量，例如，在1分钟内消耗了100M带宽等，本发明实施例不做限定。
对于本发明实施例，步骤202具体可以为：获取所述IP地址信息对应的地域属性信息；统计在与所述地域属性信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息。具体可以通过对IP地址信息进行解析，获取该IP地址信息对应的地域属性信息。例如，当IP地址信息为1.202.121.215时，可以解析出该IP地址信息对应的地域属性信息为北京，当IP地址信息为1.204.134.261时，可以解析出该IP地址信息对应的地域属性信息为贵州省贵阳市。其中，每一个地域属性信息可以对应一个或多个IP地址信息。
203、若所述处理状态信息不符合预置条件，则输出告警信息。
在本发明实施例中，所述处理状态信息不符合预置条件可以为：所述资源获取请求在一定时间段内接收到的次数大于或等于预设阈值此时，步骤203具体可以为：若所述资源获取请求在一定时间段内接收到的次数大于或等于预设阈值，则输出告警信息。例如，在朝阳区范围内该请求在1分钟内接收次数的预设阈值为10次，实时统计的该请求在1分钟内接收到的次数为100次，超出了预设阈值，说明此时朝阳区范围内明显存在该请求被非法复制的现象，因此输出告警信息，以便及时处理问题。
可替换地，所述处理状态信息不符合预置条件包括：所述资源获取请求在一段时间内消耗的带宽流量大于或等于预设阈值。此时，步骤203具体可以为：若所述资源获取请求在一段时间内消耗的带宽流量大于或等于预设阈值，则输出告警信息。例如，该资源请求对应请求的为图片资源数据，该图片资源数据通常消耗的带宽流量为5M，即预置时间段内对应消耗的带宽流量为5M,当实际消耗的带宽流量为500M时，说明此时明显存在请求被非法复制的现象，因此输出告警信息，以便及时处理问题。当该资源请求对应请求的为视频资源数据时，该视频资源数据通常消耗的带宽流量为500M，即预置时间段内对应消耗的带宽流量为500M,当实际消耗的带宽流量为500M时，说明此时带宽流量处于正常范围，不进行告警。可以看出，通过为不同资源请求配置不同的预置处理状态信息，可以进一步提高盗链的检测精度，避免进行不必要的告警。
对于本发明实施例，通过在资源获取请求对应的处理状态信息不符合预置条件时，输出告警信息，可以实现及时发现盗链并进行上报，从而可以对盗链进行及时的处理，可以避免网站数据资源的流失以及系统资源的浪费。
204a、在预置时间周期内，反馈与所述资源获取请求对应的预置数据量的资源。
其中，预置时间周期可以根据实际需求进行配置，对于较为容易处理的盗链问题，可以将预置时间周期配置的相对小一些，对于较难处理的盗链问题，可以将预置时间周期配置的相对大一些，本发明实施例不做限定。预置数据量为一次请求正常反馈的数据量，通过在预置时间周期内，反馈与所述资源获取请求对应的预置数据量的资源，可以在出现盗链时，降低网站数据资源的流失以及系统资源的浪费。并且通过配置预置时间周期，也可以保 证在盗链问题解决后，可以对该资源请求恢复正常的处理机制。
与步骤204a并列的步骤204b、在所述预置时间周期内终止处理所述资源获取请求。
对于本发明实施例，在所述预置时间周期内终止处理所述资源获取请求具体可以为：不反馈所述资源获取请求对应的资源或者向客户端反馈错误提示信息，以避免客户端再次重复向资源服务器发送该资源获取请求。通过在预置时间周期内终止处理所述资源获取请求，可以在出现盗链时，进一步降低或者避免网站数据资源的流失以及系统资源的浪费。
对于本发明实施例，具体的应用场景可以如下所示，但不限于此，包括：首先资源服务器接收客户端发送的资源获取请求，所述资源获取请求中携带有所述客户端的IP地址信息为110.102.156.12，通过对该IP地址信息解析得到该客户端的地域属性信息为中国内蒙古自治区，然后统计出在中国内蒙古自治区该资源获取请求在一分钟的发送次数为1万次，该资源获取请求消耗的带宽流量为100G,而正常情况下该资源获取请求在一分钟的发送次数为1000，消耗的带宽流量为10G，此时，输出告警信息，以便对由于盗链的存在导致的该异常现象进行处理，并且终止反馈该资源获取请求请求的资源或者只反馈10G的资源，从而可以避免网站数据资源的流失以及系统资源的浪费。
本发明实施例提供的另一种盗链的检测方法，首先接收客户端发送的资源获取请求，所述资源获取请求中携带有所述客户端的IP地址信息，然后统计在与所述IP地址信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息，若所述处理状态信息不符合预置条件，则输出告警信息。与目前由于使用资源的用户分布地域较为分散与广泛，无法实现对所有资源获取请求进行统计同步相比，本发明实施例通过同步并统计一定区域范围内的资源获取请求对应的处理状态信息，并通过检测处理状态信息是否存在异常实现盗链检测，从而可以避免网站数据资源的流失以及系统资源的浪费。
进一步的，作为对图1所示方法的具体实现，本发明实施例提供了一种盗链的检测装置，该装置可以设置在资源服务器内，如图3所示，该装置包括：接收单元31、统计单元32、输出单元33。
接收单元31，用于接收客户端发送的资源获取请求，所述资源获取请求 中携带有所述客户端的IP地址信息。
统计单元32，用于统计在与所述IP地址信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息。
输出单元33，用于若所述处理状态信息不符合预置条件，则输出告警信息。
需要说明的是，本发明实施例提供的盗链的检测装置所涉及各功能单元的其他相应描述可以参照图1中的对应描述，在此不再赘述。
本发明实施例提供的一种盗链的检测装置，首先接收客户端发送的资源获取请求，所述资源获取请求中携带有所述客户端的IP地址信息，然后统计在与所述IP地址信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息，若所述处理状态信息不符合预置条件，则输出告警信息。与目前由于使用资源的用户分布地域较为分散与广泛，无法实现对所有资源获取请求进行统计同步相比，本发明实施例通过同步并统计一定区域范围内的资源获取请求对应的处理状态信息，并通过检测处理状态信息是否存在异常实现盗链检测，从而可以避免网站数据资源的流失以及系统资源的浪费。
再进一步的，作为对图2所示方法的具体实现，本发明实施例提供了一种盗链的检测装置，该装置可以设置在资源服务器内，如图4所示，该装置包括：接收单元41、统计单元42、输出单元43、反馈单元44、终止单元45。
接收单元41，用于接收客户端发送的资源获取请求，所述资源获取请求中携带有所述客户端的IP地址信息。
统计单元42，用于统计在与所述IP地址信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息。
输出单元43，用于若所述处理状态信息不符合预置条件，则输出告警信息。
所述统计单元42，具体用于获取所述IP地址信息对应的地域属性信息；
统计在与所述地域属性信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息。
进一步地，所述处理状态信息不符合预置条件包括：所述资源获取请求在一定时间段内接收到的次数大于或等于预设阈值，
所述输出单元43，具体用于若所述资源获取请求在一定时间段内接收到 的次数大于或等于预设阈值，则输出告警信息。
进一步地，所述处理状态信息不符合预置条件包括：所述资源获取请求在一段时间内消耗的带宽流量大于或等于预设阈值，
所述输出单元43，具体用于若所述资源获取请求在一段时间内消耗的带宽流量大于或等于预设阈值，则输出告警信息。
进一步地，反馈单元44，用于在预置时间周期内，反馈与所述资源获取请求对应的预置数据量的资源。
终止单元45，用于在所述预置时间周期内终止处理所述资源获取请求。
需要说明的是，本发明实施例提供的盗链的检测装置所涉及各功能单元的其他相应描述可以参照图2中的对应描述，在此不再赘述。
本发明实施例提供的另一种盗链的检测装置，首先接收客户端发送的资源获取请求，所述资源获取请求中携带有所述客户端的IP地址信息，然后统计在与所述IP地址信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息，若所述处理状态信息不符合预置条件，则输出告警信息。与目前由于使用资源的用户分布地域较为分散与广泛，无法实现对所有资源获取请求进行统计同步相比，本发明实施例通过同步并统计一定区域范围内的资源获取请求对应的处理状态信息，并通过检测处理状态信息是否存在异常实现盗链检测，从而可以避免网站数据资源的流失以及系统资源的浪费。
以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性的劳动的情况下，即可以理解并实施。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到各实施方式可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件。基于这样的理解，上述技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行各个实施 例或者实施例的某些部分所述的方法。
最后应说明的是：以上实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的精神和范围。

Claims (10)

  1. 一种盗链的检测方法，其特征在于，包括：
    接收客户端发送的资源获取请求，所述资源获取请求中携带有所述客户端的IP地址信息；
    统计在与所述IP地址信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息；
    若所述处理状态信息不符合预置条件，则输出告警信息。
  2. 根据权利要求1所述的方法，其特征在于，所述统计在与所述IP地址信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息包括：
    获取所述IP地址信息对应的地域属性信息；
    统计在与所述地域属性信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息。
  3. 根据权利要求1所述的方法，其特征在于，所述处理状态信息不符合预置条件包括：
    所述资源获取请求在一定时间段内接收到的次数大于或等于预设阈值，或所述资源获取请求在一段时间内消耗的带宽流量大于或等于预设阈值。
  4. 根据权利要求1所述的方法，其特征在于：
    所述告警信息为文本信息、音频信息和/或视频信息。
  5. 根据权利要求1所述的方法，其特征在于，所述若所述处理状态信息不符合预置条件，则输出告警信息之后，所述方法还包括：
    在预置时间周期内，反馈与所述资源获取请求对应的预置数据量的资源；和/或
    在所述预置时间周期内终止处理所述资源获取请求。
  6. 一种盗链的检测装置，其特征在于，包括：
    接收单元，用于接收客户端发送的资源获取请求，所述资源获取请求中携带有所述客户端的IP地址信息；
    统计单元，用于统计在与所述IP地址信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息；
    输出单元，用于若所述处理状态信息不符合预置条件，则输出告警信息。
  7. 根据权利要求6所述的盗链的检测装置，其特征在于，
    所述统计单元，具体用于获取所述IP地址信息对应的地域属性信息；
    统计在与所述地域属性信息对应的预置地域范围内，所述资源获取请求对应的处理状态信息。
  8. 根据权利要求6所述的盗链的检测装置，其特征在于，所述处理状态信息不符合预置条件包括：
    所述资源获取请求在一定时间段内接收到的次数大于或等于预设阈值，或所述资源获取请求在一段时间内消耗的带宽流量大于或等于预设阈值。
  9. 根据权利要求6所述的盗链的检测装置，其特征在于：
    所述告警信息为文本信息、音频信息和/或视频信息。
  10. 根据权利要求6所述的盗链的检测装置，其特征在于，所述装置还包括：
    反馈单元，用于在预置时间周期内，反馈与所述资源获取请求对应的预置数据量的资源；
    终止单元，用于在所述预置时间周期内终止处理所述资源获取请求。
PCT/CN2016/082826 2015-11-30 2016-05-20 一种盗链的检测方法及装置 WO2017092250A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/245,205 US20170155567A1 (en) 2015-11-30 2016-08-24 Method and device for detecting hotlinking

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510856256.7A CN105656877A (zh) 2015-11-30 2015-11-30 一种盗链的检测方法及装置
CN201510856256.7 2015-11-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/245,205 Continuation US20170155567A1 (en) 2015-11-30 2016-08-24 Method and device for detecting hotlinking

Publications (1)

Publication Number Publication Date
WO2017092250A1 true WO2017092250A1 (zh) 2017-06-08

Family

ID=56481914

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/082826 WO2017092250A1 (zh) 2015-11-30 2016-05-20 一种盗链的检测方法及装置

Country Status (2)

Country Link
CN (1) CN105656877A (zh)
WO (1) WO2017092250A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109819327B (zh) * 2019-01-17 2021-10-29 网宿科技股份有限公司 一种盗播处理方法及装置
CN112688902B (zh) * 2019-10-18 2023-04-18 上海哔哩哔哩科技有限公司 防盗链方法、装置以及计算机设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102045348A (zh) * 2010-12-01 2011-05-04 北京迅捷英翔网络科技有限公司 一种防盗链系统及方法
WO2012113253A1 (zh) * 2011-02-25 2012-08-30 中兴通讯股份有限公司 一种实现内容下载的方法及系统
CN103684885A (zh) * 2013-12-31 2014-03-26 新浪网技术(中国)有限公司 一种网站服务器访问异常确定方法及装置
CN104079531A (zh) * 2013-03-26 2014-10-01 中国移动通信集团公司 一种盗链检测方法、系统及装置
CN104601604A (zh) * 2014-06-12 2015-05-06 国家电网公司 网络安全态势分析方法
CN104811773A (zh) * 2015-04-28 2015-07-29 天脉聚源(北京)传媒科技有限公司 基于防盗链的频道播放实现方法、系统及设备

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101841435B (zh) * 2010-01-18 2012-08-29 中国科学院计算机网络信息中心 Dns查询流量异常的检测方法、装置和系统
CN104135507B (zh) * 2014-06-30 2018-01-16 北京奇艺世纪科技有限公司 一种防盗链的方法和装置
CN104702618B (zh) * 2015-03-26 2018-11-06 广东睿江云计算股份有限公司 确定网络访问信息的方法和装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102045348A (zh) * 2010-12-01 2011-05-04 北京迅捷英翔网络科技有限公司 一种防盗链系统及方法
WO2012113253A1 (zh) * 2011-02-25 2012-08-30 中兴通讯股份有限公司 一种实现内容下载的方法及系统
CN104079531A (zh) * 2013-03-26 2014-10-01 中国移动通信集团公司 一种盗链检测方法、系统及装置
CN103684885A (zh) * 2013-12-31 2014-03-26 新浪网技术(中国)有限公司 一种网站服务器访问异常确定方法及装置
CN104601604A (zh) * 2014-06-12 2015-05-06 国家电网公司 网络安全态势分析方法
CN104811773A (zh) * 2015-04-28 2015-07-29 天脉聚源(北京)传媒科技有限公司 基于防盗链的频道播放实现方法、系统及设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
YIN, YAGUANG ET AL.: "Analysis of Video Sharing Site Link Protection Technology and Research on Video Download Method", RADIO & TV BROADCAST ENGINEERING, 30 November 2010 (2010-11-30), pages 46 - 49 *

Also Published As

Publication number Publication date
CN105656877A (zh) 2016-06-08

Similar Documents

Publication Publication Date Title
US11252060B2 (en) Data center traffic analytics synchronization
US20200287920A1 (en) Endpoint network traffic analysis
JPWO2016006520A1 (ja) 検知装置、検知方法及び検知プログラム
WO2015090241A1 (zh) 监控业务运行数据入库的方法和相关设备及系统
CN110362455B (zh) 一种数据处理方法和数据处理装置
CN108616429A (zh) 一种推送服务的重连方法及设备
EP3111616A1 (en) Detecting and managing abnormal data behavior
KR20170117111A (ko) 메시지 푸시 방법 및 장치
JP2016508638A5 (zh)
CN111698126B (zh) 信息监控方法、系统及计算机可读存储介质
CN112738099B (zh) 一种检测慢速攻击的方法、装置、存储介质和电子设备
CN109495378A (zh) 检测异常帐号的方法、装置、服务器及存储介质
CN107395717A (zh) 一种应用于运维审计系统的空闲超时自动断开的方法
CN105791027B (zh) 一种工业网络异常中断的检测方法
WO2017092250A1 (zh) 一种盗链的检测方法及装置
CN112417469B (zh) 一种基于硬件加密的区块链轻节点数据采集方法及装置
WO2016082509A1 (zh) 一种检测标签交换路径连通性的方法及装置
CN102821097A (zh) 一种接入检测方法及装置
CN102571277B (zh) 序号检测消息的发送方法及装置
CN114760083B (zh) 一种攻击检测文件的发布方法、装置及存储介质
CN104410643A (zh) 一种sdn控制器基于统计值的防攻击方法
US11218427B1 (en) Detecting lagging nodes in a time-synchronized distributed environment
CN102355375B (zh) 具有隐私保护功能的分布式异常流量检测方法与系统
CN104407960B (zh) 数据监控方法及装置
WO2017107462A1 (zh) 基于p2p网络的数据处理方法、装置及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16869564

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16869564

Country of ref document: EP

Kind code of ref document: A1