WO2019052469A1 - 一种网络请求处理方法、装置、电子设备及存储介质 - Google Patents

一种网络请求处理方法、装置、电子设备及存储介质 Download PDF

Info

Publication number
WO2019052469A1
WO2019052469A1 PCT/CN2018/105233 CN2018105233W WO2019052469A1 WO 2019052469 A1 WO2019052469 A1 WO 2019052469A1 CN 2018105233 W CN2018105233 W CN 2018105233W WO 2019052469 A1 WO2019052469 A1 WO 2019052469A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
score
network request
attribute information
network
Prior art date
Application number
PCT/CN2018/105233
Other languages
English (en)
French (fr)
Inventor
彭正茂
王生新
孟伟
Original Assignee
北京金山云网络技术有限公司
北京金山云科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京金山云网络技术有限公司, 北京金山云科技有限公司 filed Critical 北京金山云网络技术有限公司
Publication of WO2019052469A1 publication Critical patent/WO2019052469A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources

Definitions

  • the present application relates to the field of Internet security technologies, and in particular, to a network request processing method, apparatus, electronic device, and storage medium.
  • some network platforms generally have functions that enable users to register or log in, for example, many online shopping platforms.
  • the function of registering or logging in for users is not only convenient for users to manage their various shopping information, but also enables the online shopping platform to better serve users.
  • the user login or registration information of the network platform is also vulnerable to attacks by network hackers.
  • the network hacker steals the user's login account and login password by writing a malicious program; on the other hand, the network hacker writes maliciously.
  • the way of the program maliciously registers multiple account information that is not put into use in a short period of time, which causes the network platform to appear paralyzed.
  • the login/registration operation information is statistically registered, that is, the burying point; and then, according to the statistics of the login/registration operation information and the requirements of the network platform, Develop a security policy to block or alert against abnormal login/registration behavior on the network platform.
  • the reputation level, the verification code corresponding to the reputation level is set as the security policy of the user login behavior; or, for the protocol (Internet Protocol, IP) address interconnected by the same network, the statistical user logs in to the network platform for a period of time. According to the statistics, the corresponding verification code can be set as the security policy of the user login behavior.
  • the related solutions can be divided into two categories: The security strategy of one type of solution is relatively simple, so the defense effect is not good, and it is easy to bypass the abnormal login/registration behavior; the security policy of another type of scheme is more complicated and needs to pass through the network.
  • the front and back ends of the platform set up complex logic to collect large amounts of data. Sometimes this logic adjustment becomes a burden for the main business (login/registration behavior, etc.).
  • the purpose of the embodiments of the present application is to provide a network request processing method, apparatus, electronic device, and storage medium, so as to improve the blocking or alarming effect on the abnormal login/registration behavior of the network platform, and reduce abnormal login to the network platform.
  • the rate of false negatives or false positives for registration is to provide a network request processing method, apparatus, electronic device, and storage medium, so as to improve the blocking or alarming effect on the abnormal login/registration behavior of the network platform, and reduce abnormal login to the network platform.
  • the embodiment of the present application discloses a network request processing method, including: receiving a network request; wherein the network request includes a login account request or a registration account request; the login account request includes a corresponding login account; Include the corresponding registered account; obtain the IP attribute information corresponding to the network request; according to the IP attribute information, perform the first scoring of the network request according to the preset first scoring rule, and obtain the first scoring score; determine the first scoring Whether the score is lower than a preset first score threshold; if the first score is lower than the preset first score threshold, blocking the network request; if the first score is not lower than the preset first
  • the score threshold is used to obtain the IP behavior information corresponding to the network request; according to the IP behavior information, according to the preset second scoring rule, the network request is scored a second time to obtain the second scoring score; and whether the second scoring score is determined Lower than the preset second score threshold; if the second score is lower than the preset second score threshold, then Request reminder alarm network.
  • the embodiment of the present application discloses a network request processing apparatus, where the apparatus includes: a receiving unit configured to receive a network request; wherein the network request includes a login account request or a registration account request; and the login account request includes a corresponding The login account includes the corresponding registered account; the IP attribute information obtaining unit is configured to obtain the IP attribute information corresponding to the network request; the first scoring unit is set according to the IP attribute information according to the preset first scoring rule.
  • the first judging unit is configured to determine whether the first scoring score is lower than a preset first scoring threshold; the blocking unit is set to be at the first When the score of the score is lower than the preset first score threshold, the network request is blocked; the IP behavior information acquisition unit is configured to acquire the network request when the first score is not lower than the preset first score threshold Corresponding IP behavior information; the second scoring unit is set to be based on the IP behavior information, according to the preset second score The rule is to perform a second scoring on the network request to obtain a second scoring score; the second judging unit is configured to determine whether the second scoring score is lower than a preset second scoring threshold; the alarm reminding unit is set to be in the first When the second scoring score is lower than the preset second score threshold, an alert is given to the network request.
  • the embodiment of the present application further provides an electronic device, including a processor and a memory; a memory, configured to store a computer program; and a processor, configured to perform the method step of the network request processing when the program stored on the memory is executed.
  • the embodiment of the present application further provides a computer readable storage medium, where the computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the method step of the network request processing.
  • the embodiment of the present application further provides an application program for executing the network request processing method provided by the present application at runtime.
  • the network request is received; the IP attribute information corresponding to the network request is obtained; and the network request is first scored according to the preset first scoring rule according to the IP attribute information.
  • the second scoring rule is set to perform a second scoring of the network request to obtain a second scoring score; if the second scoring score is lower than the preset second scoring threshold, an alert is alerted to the network request.
  • the corresponding parameter may be manually collected when the user logs in to the network platform, and if not, the corresponding security policy may be formulated.
  • the network platform needs to obtain the parameters of the user login through JS (JavaScript), such as whether there is mouse position movement, keyboard input or input waiting, etc.
  • the relevant security policy can be formulated according to the parameter.
  • Collect device information on the client such as browser version, browser window size, host resolution, time stamp or mouse movement track, etc., and collect the device information as a unique identifier (GUID), and formulate relevant information according to the device information. security strategy.
  • a large number of artificial burying points are not required at the corresponding control of the network platform corresponding to the network request, but the corresponding IP attribute information and IP behavior are directly requested according to the existing network request.
  • the information, blocking or alerting the network request improves the blocking or alarming effect on the abnormal login/registration behavior of the network platform, thereby improving the risk control effect on the network platform.
  • implementing any of the products or methods of the present application necessarily does not necessarily require all of the advantages described above to be achieved at the same time.
  • FIG. 1 is a schematic flowchart of a network request processing method according to an embodiment of the present application
  • FIG. 2 is a schematic structural diagram of a network request processing apparatus according to an embodiment of the present application.
  • FIG. 3 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
  • the embodiment of the present application provides a network request processing method. , devices, electronic devices and storage media.
  • FIG. 1 is a schematic flowchart of a network request processing method according to an embodiment of the present application, including the following steps:
  • Step 101 Receive a network request.
  • the network request includes a login account request or a registration account request.
  • Some network platforms or application software generally set functions that enable users to register or log in.
  • many online shopping platforms facilitate users to conduct online shopping, and have opened registration or login functions for users, which is not only convenient for users to manage their respective functions.
  • the item shopping information also enables the online shopping platform to better serve the users.
  • the user When the user needs to use the network platform or the application software, the user initiates a registration account request in the display interface of the network platform or the application software to register a new account of the network platform or the application software. After the user has registered the account of the network platform or the application software, the user will initiate a login account request in the display interface of the network platform or the application software according to his actual needs to log in to the registered account.
  • the login account request includes a corresponding login account; the registered account request includes a corresponding registered account.
  • the login account request includes a corresponding login account, that is, the login account request includes a login account to be logged in by the user.
  • the registration account request includes a corresponding registration account, that is, the registration account request includes a registered account to be registered by the user.
  • the login account request or the registration account request may be a login account request or a registration account request for the network platform or the application software, which is not limited in this application.
  • the network request processing method provided in this embodiment can be applied to an electronic device such as a smart phone, a tablet computer, or a desktop computer. Applying the above method in the above electronic device, processing the login account request and/or the registration account request.
  • Step 102 Obtain an IP (Internet Protocol, protocol interconnected) attribute information corresponding to the network request.
  • IP Internet Protocol, protocol interconnected
  • IP requests have corresponding IP addresses. Since the IP protocol belongs to the network layer in the Open System Interconnection (OSI) standard model, the network layer in the OSI standard model blocks the network request compared to other working layers of the OSI standard model. Alarm reminders are easier.
  • OSI Open System Interconnection
  • the existing various network security software, load balancing equipment and software all track and manage network requests with IP addresses as objects. Because the IP address is unique, the IP address corresponding to the network request can be identified by the IP address.
  • the location of the source of the network request may be determined, thereby determining which country the network request is from, and if the network request is from China, the network request may further be determined. Which province, which city and which county is from China.
  • the IDC Internet Data Center
  • the IP attribute information corresponding to the network request may include: geographic location attribute information, Internet data center IDC attribute information, network attribute information, application attribute information, and historical attribute information.
  • the obtaining the IP attribute information corresponding to the network request may include: requesting the corresponding IP address through the network, and acquiring the geographic location attribute information, the IDC attribute information, the network attribute information, the application attribute information, and the historical attribute information corresponding to the network request. . Since the IP address is uniformly allocated and managed by a dedicated organization, the above IP attribute information obtained according to the IP address requested by the network is relatively accurate.
  • Obtaining the geographic location attribute information corresponding to the network request may include: obtaining the provincial, city, and county information to which the IP address corresponding to the network request belongs. According to the actual needs, you can set the specific geographic location attribute information corresponding to the network request. For example, you can set the country information corresponding to the network request, and you can also set the national information and the province information corresponding to the network request. This application There is no limit to this. Since the IP address remains fixed for a short period of time, the source of the network request can be determined by obtaining the attribution of the IP address corresponding to the network request.
  • the IDC attribute information corresponding to the obtained network request may be used to determine whether the IP address corresponding to the network request belongs to the public network user or the individual user, that is, the attribute content of the IDC attribute information is obtained. If the IP address corresponding to the network request belongs to the public network user, the type of the public network user corresponding to the network request may be further determined according to actual needs. Generally, the IP address applied by the public network user is bound to the type information of the public network user.
  • the type information of the public network user can be obtained through Abstract Syntax Notation (ASN) data.
  • ASN Abstract Syntax Notation
  • the types of public network users may include: IDC service areas, large enterprises, education networks, and centralized export of operators.
  • the domain name system can be used to identify whether the IP address corresponding to the network request belongs to the public network user or the individual user. If the IP address corresponding to the network request belongs to the public network user, you can further pass the DNS according to actual needs. Determine the type of public network user corresponding to the network request.
  • the binding behavior may be machine-operated.
  • the network request corresponding to the IP address is likely to be a risky network request.
  • obtaining the IDC attribute information corresponding to the network request may further include: determining, by the related technology, whether the IP address corresponding to the network request belongs to the mobile phone base station.
  • the network attribute information corresponding to the obtained network request may be used to determine whether the IP address corresponding to the network request belongs to the fixed network or the mobile network, that is, the attribute content of the network attribute information is obtained. If the IP address corresponding to the network request belongs to the mobile network, the type of the mobile network corresponding to the network request may be further determined according to actual needs.
  • the type of the mobile network may include: a 3G/4G mobile network. Depending on the carrier, the type of mobile network can also include: Telecom/Unicom/Mobile.
  • the application attribute information corresponding to the obtained network request may be used to determine which one of the web server, the proxy server, and the VPN server the IP address corresponding to the network request is, that is, the application attribute information is obtained. Attribute content.
  • the historical attribute information corresponding to the obtained network request may be used to determine whether the IP address corresponding to the network request has a record of the network request being blocked and/or the alarm reminder, and determining the corresponding network request. Whether the IP address has a record in which the login account is attacked, that is, the attribute content of the historical attribute information is obtained.
  • determining whether the network request corresponding IP address has a record that the network request is blocked and/or alarming may include the following steps:
  • the corresponding IP address has not received the network request, it is determined that the IP address corresponding to the network request does not have a record of the network request being blocked and/or the alarm reminder;
  • the corresponding IP address has received the network request, it is determined whether the received network request is blocked or alarmed under the corresponding IP address;
  • the IP address corresponding to the network request does not have a record of the network request being blocked and/or the alarm reminder
  • the IP address corresponding to the network request has a record that the network request is blocked and/or alarmed.
  • the corresponding IP address in the above step receives the network request, which means that the corresponding IP address has received at least one network request.
  • the record that the network request is blocked may be a record in which the network request is blocked, or a record of the number of times the network request is blocked.
  • the record of the so-called blocked state is a record of the determination result as to whether or not the network request has been blocked.
  • the corresponding IP address receives two network requests, wherein the network request received for the first time is not blocked, and the network request received for the second time is blocked.
  • the blocked record of the network request may be: the network request is blocked or the network request is blocked once.
  • the record of the network request being alerted by the alarm may be recorded by the network requesting the status of the alarm reminder, or may be the record of the number of times the network request is alerted.
  • the so-called alarm reminder status record is: a record of the determination result as to whether the network request has been alerted by the alarm.
  • the login account mentioned here may be the login account included in the login account request in the network request, or may be the login account in the login account request for any network platform or application software, which is not limited in this application.
  • the record of the login account being attacked refers to a record in which the login account and the login password are stolen by any means, so that the user of the login account cannot use the login account normally.
  • the record may be a record of the login account being attacked, or a record of the number of times the login account was attacked.
  • the record of the so-called login account being attacked is a record of the determination result as to whether the login account has been attacked.
  • the geographic location attribute information, the IDC attribute information, the network attribute information, the application attribute information, and the historical attribute information corresponding to the network request may be acquired by using related technologies.
  • Step 103 Perform a first scoring of the network request according to the preset first scoring rule according to the IP attribute information, to obtain a first scoring score.
  • the network request may be scored for the first time according to the preset first scoring rule, and the purpose is to determine whether the network request is high risk according to the IP attribute information corresponding to the network request. Network request.
  • the network request is scored for the first time according to the preset first scoring rule, and the first scoring score is obtained, which may include:
  • Each attribute information in the IP attribute information is scored, wherein each attribute information is scored under the same full score system
  • the score of each attribute information is multiplied by the corresponding weight coefficient to obtain the weight score of each attribute information, and the weight scores of each attribute information are added to obtain the first score.
  • the weight coefficient of each attribute information in the IP attribute information may be determined by the network.
  • the management of the platform or application software is set according to actual needs, and the management of the network platform or application software scores each attribute information in the IP attribute information according to actual needs. It should be noted that, in an implementation manner, the management of the network platform or the application software may predefine various types in the network platform or the application software according to the contribution degree of various attribute information in the IP attribute information to the attack risk.
  • the weight coefficient of the attribute information wherein the higher the weight coefficient, the higher the contribution to the risk of attack.
  • the weight coefficient corresponding to the geographic location attribute information is 0.1
  • the weight coefficient corresponding to the IDC attribute information is 0.2
  • the weight coefficient corresponding to the network attribute information is 0.1
  • the weight coefficient corresponding to the application attribute information is 0.2
  • the weight coefficient corresponding to the historical attribute information contributes more to the risk than the other attribute information
  • IDC The attribute information and the application attribute information contribute more than the geographical attribute information and the network attribute information. It can be understood that for a network platform or application software, the contribution of various attribute information to the risk of attack can be known by big data analysis.
  • the management party of the network platform or the application software may pre-determine the attribute according to the contribution degree of the attribute content of the attribute information to the attack risk, in the network platform or the application software.
  • the scoring rule corresponding to the information wherein the higher the score indicates that the attack risk of the network request is lower, and the lower the score indicates the higher the attack risk of the network request.
  • the scoring rule corresponding to the network attribute information may be: for the fixed network given 3 Points, given 4 points for mobile networks.
  • the scoring rule corresponding to the application attribute information may be: given 4 points for the web server, 3 points for the proxy server, and 2 points for the VPN server. It can be understood that for a network platform or application software, the degree of contribution of different attribute contents of various attribute information to risks can be known by big data analysis. The above embodiments will be described in detail below with reference to specific examples.
  • the weight attribute score of the geographic location attribute information is 0.5
  • the weight score of the IDC attribute information is 0.6
  • the weight score of the network attribute information is 0.3
  • the weight score of the application attribute information is 0.8
  • the weight coefficient of the historical attribute information is 0.4.
  • the network request is scored for the first time according to the preset first scoring rule, and the first scoring score is obtained, which may include: In the attribute information combination score table, the score corresponding to the IP attribute information combination corresponding to the network request is searched, and the found score is used as the first score; wherein the IP attribute information combination corresponding to the network request includes: the network request corresponding Each attribute information in the IP attribute information.
  • each IP attribute information corresponds to a specific attribute content.
  • the geographical location attribute information of the network request is: the IP address corresponding to the network request belongs to Chun'an County, Hangzhou City, Zhejiang province
  • the IDC attribute information of the network request is: the IP address corresponding to the network request belongs to the public network user
  • the network request The network attribute information is: the IP address corresponding to the network request belongs to the fixed network
  • the application attribute information of the network request is: the IP address corresponding to the network request belongs to the web server
  • the historical attribute information corresponding to the network request is: the IP address corresponding to the network request exists.
  • combining the acquired specific attribute contents of each attribute information constitutes a combination of IP attribute information corresponding to the network request.
  • each attribute information in the IP attribute information corresponding to the network request may be one of the corresponding multiple attribute contents.
  • the geographical location attribute information of the network request may be A1, and the IDC attribute of the network request.
  • the information may be B1 or B2.
  • the network attribute information requested by the network may be C1 or C2.
  • the application attribute information requested by the network may be D1, D2 or D3.
  • the historical attribute information corresponding to the network request may be E1, E2, E3 or E4.
  • the IP attribute information combination corresponding to the network request may be ⁇ A1, B2, C1. , D2, E1 ⁇ .
  • the preset IP attribute information combination score table gives the scores of all kinds of IP attribute information combinations that the network request may correspond to. Since the login account request or the registration account request included in the network request is a login account request or a registration account request for the network platform or the application software, the preset IP attribute information combination score table may be determined by the management platform of the network platform or the application software. Actual needs to be given.
  • Step 104 Determine whether the first scoring score is lower than a preset first score threshold. If the first score is below the preset first score threshold, go to step 105. If the first scoring score is not below the preset first score threshold, go to step 106.
  • the preset first score threshold may be managed by the network platform or the application software. The party will set it according to actual needs.
  • step 105 the network request is blocked.
  • the network request includes the login account request
  • the network request is considered to be a high-risk network request, that is, The login account included in the login account request has a high risk of being attacked.
  • the network request is blocked.
  • the network request includes the registration account request
  • the network request is considered to be a high-risk network request, that is, The network platform or application software for the registration account request has a high risk of being maliciously registered, and the network request is blocked to ensure that the network platform or the application software can normally provide the user with the function of registering the account.
  • Step 106 Acquire IP behavior information corresponding to the network request.
  • the IP attribute obtained according to the IP address corresponding to the network request is relatively accurate.
  • the IP behavior information corresponding to the network request may also be obtained, and the network request is analyzed according to the IP behavior information whether the network request is a risky network request.
  • the IP behavior information may include: IP behavior trend information, IP behavior history synchronization information, and IP behavior similar comparison information.
  • the IP behavior trend information may be information about the change of the number of network requests counted in the current first preset period.
  • the first preset period may be a continuous period of time in minutes, hours, days, weeks, months or years, such as: 1 minute, 2 hours or 1 day, which is not limited in this application.
  • the current first preset period may be divided into a plurality of consecutive first preset sub-periods, and the number of network requests in each first preset sub-period in the current first preset period is counted, and the current The number information of the network request in each first preset sub-period in the first preset period is used as the IP behavior trend information.
  • the IP behavior history synchronization information may be information about the change of the number of network requests counted in the second preset period before the current first preset period.
  • the second preset period may be a continuous period of time in minutes, hours, days, weeks, months or years, such as: 1 minute, 2 hours or 1 day, which is not limited in this application.
  • the second preset period may be divided into a plurality of second preset sub-periods that are consecutive in time, and the number of network requests in each second preset sub-period in the second preset period is counted, and the second pre- The number of times of the network request in each second preset sub-period of the period is set as the IP history synchronization information.
  • the IP behavior similarity comparison information may include: two kinds of similar comparison information corresponding to the network request that is counted in the third preset period before the current first preset period.
  • the third preset period may be a continuous period of time in minutes, hours, days, weeks, months or years, such as: 1 minute, 2 hours or 1 day, which is not limited in this application.
  • the two similar comparison information includes:
  • the first type of comparison information may be the ratio of the number of login accounts of the IP address corresponding to the network request to the number of registered accounts.
  • the second type of comparison information may be the ratio of the number of login account success times of the corresponding IP address of the network request to the number of successful registration accounts.
  • the IP behavior similarity comparison information may further include: a third type of comparison information.
  • the third type of comparison information is: the number of times the login account corresponding to the network request is successfully logged in the first area and succeeded in the second area, which is counted in the fourth preset period before the current first preset period.
  • the fourth preset period may be a continuous time period in minutes, hours, days, weeks, months or years, such as: 1 minute, 2 hours or 1 day, which is not limited in this application.
  • the first area may be a certain country, or may be a certain province, city, or district, but is not limited thereto; the second area may also be a certain country, or may be a certain province or city. , district, but not limited to this.
  • the IP behavior trend information, the IP behavior history synchronization information, and the IP behavior similarity comparison information corresponding to the network request may be obtained by using related technologies.
  • Step 107 Perform a second scoring of the network request according to the preset second scoring rule according to the IP behavior information, to obtain a second scoring score.
  • the network request may be scored a second time according to the preset second scoring rule, and the purpose is to determine whether the network request is a general risk according to the IP behavior information corresponding to the network request. Network request.
  • performing a second scoring of the network request according to the preset second scoring rule may include:
  • Each action information in the IP behavior information is scored, wherein each action information is scored under the same perfect score system
  • each behavior information is multiplied by the corresponding weight coefficient to obtain a weight score for each behavior information, and the weight scores of each behavior information are added to obtain a second score.
  • the scoring rule according to the scoring of each behavior information in the IP behavior information may be set by the management platform of the network platform or the application software, and may be made in any of the scoring rules set by When the information content of the behavior information is known, the score corresponding to the behavior information can be determined.
  • scoring each of the behavior information in the IP behavior information includes:
  • Each of the similar comparison information in the IP behavior similarity information is scored, wherein each of the similar comparison information scores are performed under a preset full score system;
  • the scoring rules for scoring each type of comparative information in the IP behavior similar information may be set by the management platform of the network platform or the application software, and the set scoring rules may be adopted. When the information content of any of the similar comparison information is known, the score corresponding to the similar comparison information can be determined.
  • the above full score may be divided into multiple score segments, such as a first score segment, a second score segment, and a third score segment. Etc., it can also be divided into three segments of low, middle and high according to the level of the score, but it is not limited to this. It should be noted that the first score segment may correspond to a high score segment, the second score segment may correspond to an intermediate score segment, and the third score segment may correspond to a low score segment, and is not limited thereto.
  • a first preset value and a second preset value may be set, wherein the first preset value Less than the second preset value.
  • the network request When the ratio is smaller than the first preset value, the network request may be considered to have a low risk, and the score of the first type of comparison information is determined to be in the first fractional segment; when the ratio is less than the second preset value and not less than the first pre-predetermined value When setting the value, it can be considered that the network request has a general risk, and the score of the first type of comparison information is determined to be in the second score segment; when the ratio is not less than the second preset value, the network request may be considered to have a high risk, and the determination may be made.
  • the score for the first type of comparative information is in the third fraction.
  • a third preset value and a fourth preset value may be set, wherein the third preset Set the value to be less than the fourth preset value.
  • the network request When the ratio is less than the third preset value, the network request may be considered to have a low risk, and the score of the second type of comparison information is determined to be in the first score segment; when the ratio is less than the fourth preset value and not less than the third pre- When setting the value, it can be considered that the network request has a general risk, and the score of the second type of comparative information is determined to be in the second score segment; when the ratio is not less than the fourth preset value, the network request may be considered to have a high risk, and the determination may be made.
  • the score of the second type of comparative information is in the third fraction.
  • the third type of comparison information is the number of times the login account corresponding to the network request counted in the fourth preset period before the current first preset period is successfully logged in the first area and the number of successfully logged in the second area.
  • a fifth preset value and a sixth preset value may be set, wherein the fifth preset value is smaller than the fourth preset value.
  • the network request When the ratio is less than the fifth preset value, the network request may be considered to have a low risk, and the score of the third type of comparison information is determined to be in the first score segment; when the ratio is less than the sixth preset value and not less than the fifth pre- When setting the value, it can be considered that the network request has a general risk, and the score of the third type of comparative information is determined to be in the second score segment; when the ratio is not less than the sixth preset value, the network request may be considered to have a high risk, and the determination may be made.
  • the score for the third type of comparative information is in the third fraction.
  • the score of each similar information in the IP behavior similar comparison information may be: for each The similar comparison information is obtained according to the score mapping relationship of the score segment corresponding to the similar comparison information, and the specific score corresponding to the similar comparison information is obtained, wherein the score mapping relationship is: the mapping of the score and the specific information content relationship.
  • the specific implementation method of scoring each of the similar comparison information in the IP behavior similar information is not limited thereto.
  • the network request includes a login account request
  • the above-mentioned network request is considered to have a low/normal/high risk.
  • the login account included in the login account request is considered to have a low/general/high risk of being attacked.
  • the network request includes a registration account request
  • the above-mentioned network request is considered to have a low/general/high risk.
  • the network platform or the application software for which the registration account request is targeted may be low/general/high. risk.
  • the foregoing first/third/fifth preset values may be the same or different; the second/fourth/sixth preset values may be the same or different.
  • the weight coefficient of each behavior information in the IP behavior information may be determined by the network.
  • the management of the platform or application software is set according to actual needs, and the management of the network platform or application software scores each behavior information in the IP behavior information according to actual needs.
  • Step 108 Determine whether the second scoring score is lower than a preset second score threshold.
  • the preset second score threshold may be managed by the network platform or the application software. Set according to actual needs.
  • Step 109 If the second scoring score is lower than the preset second score threshold, an alert is sent to the network request.
  • the network request includes the login account request
  • the network request is considered to be a network request with a general risk, that is, The login account included in the login account request has a general risk of being attacked.
  • the user can use the login account normally, and alert the network request.
  • the network request for the case that the network request includes the registration account request, if the second scoring score is lower than the preset second score threshold, the network request is considered to be a network request with a general risk, that is, The network platform or application software for the registration account request has the general risk of being maliciously registered. To ensure that the network platform or application software can normally provide the user with the function of registering the account, the network request is alarmed.
  • the change information of the number of network requests counted in the current first preset period in step S106, or the change of the number of network requests counted in the second preset period before the current first preset period Information can include such situations as steep increases, dropped pits, very straight curves, zigzag curves, and the like.
  • steep increase means that the number of network requests increases in a short time
  • drop means that the number of network requests is greatly reduced in a short time
  • very straight curve means that the number of network requests changes linearly over a period of time.
  • a "zigzag curve” means that the number of network requests is zigzag over a period of time.
  • the first preset period is 5 minutes, and the first preset sub-period is 1 minute.
  • the IP behavior trend is "steep increase", if the number of network requests is [5,5,4,4,0], then the IP behavior trend is "falling pit” if the network requests The number of times is [5,6,7,8,9], then the IP behavior trend is "very straight curve”. If the number of network requests is [5,3,5,3,5], then IP behavior The trend is "zigzag curve".
  • the second scoring rule in step 107 may include: the network request in the above four cases corresponds to a lower second scoring score, and if the second scoring score is lower than the preset second score If the threshold is determined, the above four IP behaviors are all abnormal IP behaviors, and the network request is a network request with a risk, and the network request may be alerted.
  • the IP attribute information corresponding to the network request and the IP behavior information may also be combined to determine whether the network request is at risk.
  • a network request occurs in several situations: 1. It is assumed that the IP address corresponding to the network request belongs to an individual user, and a large number of other network requests appear in the IP address for a period of time before the network request; 2. The network request is assumed to correspond. The IP address has a regular network request to switch the login account; 3. It is assumed that the IP address corresponding to the network request has a large geographical offset in a short period of time.
  • the second scoring rule in step 107 may include: the above three cases are that the network request corresponds to a lower second scoring score, and if the second scoring score is lower than a preset second score threshold, determining the above The three IP behaviors are all abnormal IP behaviors, and the network request is a network request with a risk, and the network request can be alerted.
  • IP attribute information can also be used in the field of financial security. For example, it is used to judge the flow of funds between different users.
  • the network request processing method receives the network request, acquires the IP attribute information corresponding to the network request, and performs the first scoring of the network request according to the IP attribute information; if the first scoring score is lower than the preset number A score threshold is used to block the network request; otherwise, the IP behavior information corresponding to the network request is obtained; according to the IP behavior information, the network request is scored a second time according to the preset second scoring rule; if the second If the score is lower than the preset second score threshold, the network request is alerted.
  • a large number of artificial burying points are not needed at the corresponding control, but the network request is directly blocked according to the IP attribute information of the existing network request, and the network request is improved.
  • FIG. 2 is a schematic structural diagram of a network request processing apparatus according to an embodiment of the present disclosure.
  • the apparatus includes: a receiving unit 201, an IP attribute information acquiring unit 202, a first scoring unit 203, a first judging unit 204, and a blocking unit 205.
  • the receiving unit 201 is configured to receive a network request, where the network request includes a login account request or a registration account request; the login account request includes a corresponding login account; and the registration account request includes a corresponding registered account.
  • the IP attribute information acquiring unit 202 is connected to the receiving unit 201 and configured to acquire IP attribute information corresponding to the network request.
  • the first scoring unit 203 is connected to the IP attribute information acquiring unit 202, and is configured to perform the first scoring of the network request according to the preset first scoring rule according to the IP attribute information, to obtain the first scoring score.
  • the first determining unit 204 is connected to the first scoring unit 203, and is configured to determine whether the first scoring score is lower than a preset first scoring threshold.
  • the blocking unit 205 is connected to the first determining unit 204, and is configured to block the network request when the first scoring score is lower than the preset first scoring threshold.
  • the IP behavior information acquiring unit 206 is connected to the first determining unit 204, and is configured to acquire IP behavior information corresponding to the network request when the first scoring score is not lower than the preset first score threshold.
  • the second scoring unit 207 is connected to the IP behavior information acquiring unit 206, and is configured to perform a second scoring of the network request according to the preset second scoring rule according to the IP behavior information, to obtain a second scoring score.
  • the second determining unit 208 is connected to the second scoring unit 207, and is configured to determine whether the second scoring score is lower than a preset second scoring threshold.
  • the alarm reminding unit 209 is connected to the second determining unit 208, and is configured to alert the network request when the second scoring score is lower than the preset second scoring threshold.
  • the IP attribute information acquired by the IP attribute information acquiring unit 202 may include: geographic location attribute information, IDC attribute information, network attribute information, application attribute information, and historical attribute information.
  • the IP attribute information obtaining unit 202 may include: a geographic location attribute information acquiring subunit, an IDC attribute information acquiring subunit, a network attribute information acquiring subunit, an application attribute information acquiring subunit, and a historical attribute information acquiring subunit.
  • the geographic location attribute information obtaining sub-unit is configured to obtain the provincial, city, and county information to which the IP address corresponding to the network request belongs.
  • the IDC attribute information obtaining subunit is configured to obtain the IDC attribute information corresponding to the network request, and determine whether the IP address corresponding to the network request belongs to the public network user or the individual user according to the IDC attribute information corresponding to the obtained network request.
  • the network attribute information obtaining subunit is configured to obtain the network attribute information corresponding to the network request, and determine, according to the network attribute information corresponding to the obtained network request, whether the IP address corresponding to the network request belongs to the fixed network or the mobile network.
  • the application attribute information obtaining sub-unit is configured to obtain the application attribute information corresponding to the network request, and determine, according to the acquired application attribute information of the network request, which one of the web server, the proxy server, and the VPN server the IP address corresponding to the network request belongs to. .
  • the historical attribute information obtaining subunit is configured to obtain historical attribute information corresponding to the network request, and determine, according to the historical attribute information corresponding to the obtained network request, whether the network request corresponding IP address has a record that the network request is blocked and/or the alarm reminder exists. And determining whether the IP address corresponding to the network request has a record that the login account is attacked.
  • the first scoring unit 203 is configured to obtain a weight coefficient of each attribute information in the IP attribute information, where the weight coefficient is a positive number between 0 and 1; Each attribute information in the attribute information is scored, wherein each attribute information is scored under the same perfect score system; each attribute information score is multiplied by a corresponding weight coefficient to obtain each attribute The weighting score of the information is added to the weighting score of each attribute information to obtain the first scoring score.
  • the first scoring unit 203 is configured to search for a score corresponding to the IP attribute information combination corresponding to the network request in the preset IP attribute information combination score table, and search for the score corresponding to the IP attribute information combination corresponding to the network request.
  • the obtained score is used as the first scoring score; wherein the IP attribute information combination corresponding to the network request includes: each attribute information in the IP attribute information corresponding to the network request.
  • the IP behavior information acquired by the IP behavior information acquiring unit 206 may include: IP behavior trend information, IP behavior history synchronization information, and IP behavior similar comparison information; wherein the IP behavior trend information may be counted in the current first preset period.
  • the IP behavior similarity information may further include: a third type of comparison information; wherein the third type of comparison information may be: the current first preset period The ratio of the number of times the login account corresponding to the network request is successfully registered in the first area and the number of times the login is successfully registered in the second area, which is counted in the previous fourth preset period.
  • the second scoring unit 207 is configured to obtain a weight coefficient of each behavior information in the IP behavior information, where the weight coefficient is a positive number between 0 and 1; Each behavior information in the behavior information is scored, wherein each behavior information is scored under the same full score system; each score of the behavior information is multiplied by a corresponding weight coefficient to obtain each behavior The weighting score of the information is added to the weighting score of each behavioral information to obtain a second scoring score.
  • the second scoring unit 207 includes a molecular unit; the molecular unit is set to The IP behavior in the IP behavior information is scored by the same type of comparison information; wherein the classification of the IP behavior similarity information in the IP behavior information includes: scoring each of the similar comparison information in the IP behavior similar information, wherein Each of the similar comparison information scores are performed under a preset full score system; the scores of each of the similar comparison information are multiplied by the corresponding weight coefficients to obtain the weight scores of each of the similar comparison information, each of which The weight scores of the similar comparison information are added together, and the scores of the similar information of the IP behavior in the IP behavior information are obtained.
  • the molecular unit is further configured to: before the step of scoring each of the similar information in the IP behavior type comparison information,
  • the first type of comparison information is smaller than the first preset value, determining that the score of the first type of comparison information is in the first score segment; when the first type of comparison information is smaller than the second preset value and not smaller than the first preset
  • the score of the first type of comparative information is determined to be in the second score segment; when the first type of comparative information is not less than the second predetermined value, the score of the first type of comparative information is determined to be in the third fraction;
  • the first preset value is smaller than the second preset value; when the second type of comparison information is smaller than the third preset value, determining that the score of the second type of comparison information is in the first score segment; When less than the fourth preset value and not less than the third preset value, determining that the score of the second type of comparison information is in the second score segment; when the second type of comparison information is not less than the fourth preset value, determining the second The score of the similar comparison information is in the third score segment; wherein the third preset value is smaller than the fourth preset value
  • the network request processing apparatus receives the network request, acquires the IP attribute information corresponding to the network request, and performs the first scoring of the network request according to the IP attribute information; if the first scoring score is lower than the preset number A score threshold is used to block the network request; otherwise, the IP behavior information corresponding to the network request is obtained; according to the IP behavior information, the network request is scored a second time according to the preset second scoring rule; if the second If the score is lower than the preset second score threshold, the network request is alerted.
  • a large number of artificial burying points are not needed at the corresponding control, but the network request is directly blocked according to the IP attribute information of the existing network request, and the network request is improved.
  • network request processing device may be located in an electronic device, but is not limited thereto.
  • the embodiment of the present application further provides an electronic device, as shown in FIG. 3, including a processor 301 and a memory 303.
  • the memory 303 is configured to store a computer program; the processor 301 is configured to perform the method steps of the network request processing when the program stored on the memory 303 is executed, such as the method step of the network request processing shown in FIG. 1.
  • the communication bus mentioned in the above electronic device may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus.
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the communication bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 3, but it does not mean that there is only one bus or one type of bus.
  • the communication interface is set to communicate between the above electronic device and other devices.
  • the memory may include a random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage.
  • the memory may also be at least one storage device located away from the aforementioned processor.
  • the above processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (Network Processor, NP for short), or a digital signal processor (DSP). , Application Specific Integrated Circuit (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.
  • CPU central processing unit
  • NP Network Processor
  • DSP digital signal processor
  • ASIC Application Specific Integrated Circuit
  • FPGA Field-Programmable Gate Array
  • the embodiment of the present application further provides a computer readable storage medium, where the computer readable storage medium stores a computer program for performing the method steps of the network request processing, such as the method step of the network request processing shown in FIG.
  • the embodiment of the present application further provides an application program for executing the network request processing method provided by the present application at runtime.
  • the electronic device, the computer readable storage medium, and the application program provided by the embodiment receive the network request, acquire the IP attribute information corresponding to the network request, and perform the first scoring of the network request according to the IP attribute information; If the score is lower than the preset first score threshold, the network request is blocked; otherwise, the IP behavior information corresponding to the network request is obtained; and according to the IP behavior information, the network request is performed according to the preset second scoring rule.
  • the second scoring if the second scoring score is lower than the preset second scoring threshold, an alert is given to the network request.
  • a large number of artificial burying points are not needed at the corresponding control, but the network request is directly blocked according to the IP attribute information of the existing network request, and the network request is improved.
  • the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.
  • the device, the electronic device, the storage medium, and the application program in the embodiments of the present application are respectively the device, the electronic device, the storage medium, and the application program that apply the network request processing method, and all the embodiments of the network request processing method are described. Both are applicable to the device, electronic device, storage medium, and application, and all achieve the same or similar benefits.
  • the network request processing method, the device, the electronic device, and the storage medium provided by the embodiment of the present application do not need to perform a large number of artificial burying points at the corresponding control of the network platform corresponding to the network request, but directly Blocking or alerting the network request according to the IP attribute information and IP behavior information of the existing network request, thereby improving the blocking or alarming effect on the abnormal login/registration behavior of the network platform, thereby improving the network platform. Risk control effect.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Multimedia (AREA)
  • Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • General Health & Medical Sciences (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种网络请求处理方法、装置、电子设备及存储介质，所述方法包括：获取网络请求对应的IP属性信息；根据所述IP属性信息，依据预设的第一打分规则，对网络请求进行第一次打分；判断第一次打分分数是否低于预设的第一分数阈值；如果是，则对网络请求进行阻断；如果否，则获取网络请求对应的IP行为信息；根据所述IP行为信息，依据预设的第二打分规则，对网络请求进行第二次打分；判断第二次打分分数是否低于预设的第二分数阈值；如果是，则对网络请求进行报警提醒。本申请实施例根据网络请求对应的IP属性信息和IP行为信息，对网络请求进行阻断或报警提醒，提高了对网络平台的异常登录/注册行为的阻断或报警效果。

Description

一种网络请求处理方法、装置、电子设备及存储介质
本申请要求于2017年9月14日提交中国专利局、申请号为201710831755.X发明名称为“一种网络请求处理方法、装置、电子设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及互联网安全技术领域，特别是涉及一种网络请求处理方法、装置、电子设备及存储介质。
背景技术
随着互联网技术的发展，为了使用户更好地体验网络产品和服务并更好地管理用户的各项信息，一些网络平台普遍设置了可以使用户注册或登录的功能，例如，许多网上购物平台为方便用户进行网上购物，为用户开通了注册或登录的功能，不仅方便用户管理其各项购物信息，也使得网上购物平台能够更好地为用户提供服务。然而，网络平台的用户登录或注册信息也容易受到网络黑客的攻击，一方面，网络黑客通过编写恶意程序的方式盗取用户的登录账号和登录密码等信息；另一方面，网络黑客通过编写恶意程序的方式在较短的时间内恶意注册多个并不投入使用的账号信息，导致网络平台出现瘫痪。
针对上述问题，相关技术的解决方案中，首先，通过在网络平台人工输入代码，以统计登录/注册操作信息，即埋点；然后，根据所统计的登录/注册操作信息以及网络平台的需求，制定安全策略，以达到对网络平台上的异常登录/注册行为进行阻断或报警的目的。以下列举几种相关解决方案：通过人工埋点，统计用户登录网络平台的登录操作，如果登录时出现了输入密码错误或登录账号不存在的情况，则可根据用户的登录账号的信誉值对应的信誉等级，设置与该信誉等级对应的验证码作为用户登录行为的安全策略；或者，针对同一个网络之间互连的协议(Internet Protocol，IP)地址下，统计用户在一段时间内登录网络平台的请求次数，可以根据统计结果设置对应的验证码作为用户登录行为的安全策略。总之，相关的解决方案可分为两类： 一类方案的安全策略较为简单，因而防御效果不好，容易绕过异常登录/注册行为；另一类方案的安全策略较为复杂，需要通过在网络平台的前后端设置复杂的逻辑以采集大量的数据，有时这种逻辑调整反而成为主业务(登录/注册行为等)的负担。而且，上述解决方案中，一方面，需要根据网络平台的实际需求进行大量的人工埋点工作，不仅工作量大且容易出错，一旦人工埋点输入的代码出错，将直接导致对异常登录/注册行为的误报率或漏报率上升；另一方面，人工埋点只能搜集埋点时刻之后的操作信息，对于埋点时刻之前的操作信息则无法统计，因而对一些异常登录/注册行为容易漏报。
总之，通过人工埋点技术对网络平台的异常登录/注册行为进行阻断或报警，容易产生漏报或误报。
发明内容
本申请实施例的目的在于提供一种网络请求处理方法、装置、电子设备及存储介质，以提高对网络平台的异常登录/注册行为的阻断或报警效果，并降低对网络平台的异常登录/注册行为的漏报率或误报率。
为达到上述目的，本申请实施例公开了一种网络请求处理方法，包括：接收网络请求；其中，网络请求包括登录账号请求或注册账号请求；登录账号请求包括对应的登录账号；注册账号请求中包括对应的注册账号；获取网络请求对应的IP属性信息；根据IP属性信息，依据预设的第一打分规则，对网络请求进行第一次打分，得到第一次打分分数；判断第一次打分分数是否低于预设的第一分数阈值；如果第一次打分分数低于预设的第一分数阈值，则对网络请求进行阻断；如果第一次打分分数不低于预设的第一分数阈值，则获取网络请求对应的IP行为信息；根据IP行为信息，依据预设的第二打分规则，对网络请求进行第二次打分，得到第二次打分分数；判断第二次打分分数是否低于预设的第二分数阈值；如果第二次打分分数低于预设的第二分数阈值，则对网络请求进行报警提醒。
为达到上述目的，本申请实施例公开了一种网络请求处理装置，该装置包括：接收单元，设置为接收网络请求；其中，网络请求包括登录账号请求或注册账号请求；登录账号请求包括对应的登录账号；注册账号请求中包括 对应的注册账号；IP属性信息获取单元，设置为获取网络请求对应的IP属性信息；第一打分单元，设置为根据IP属性信息，依据预设的第一打分规则，对网络请求进行第一次打分，得到第一次打分分数；第一判断单元，设置为判断第一次打分分数是否低于预设的第一分数阈值；阻断单元，设置为在第一次打分分数低于预设的第一分数阈值时，对网络请求进行阻断；IP行为信息获取单元，设置为在第一次打分分数不低于预设的第一分数阈值时，获取网络请求对应的IP行为信息；第二打分单元，设置为根据IP行为信息，依据预设的第二打分规则，对网络请求进行第二次打分，得到第二次打分分数；第二判断单元，设置为判断第二次打分分数是否低于预设的第二分数阈值；报警提醒单元，设置为在第二次打分分数低于预设的第二分数阈值时，对网络请求进行报警提醒。
本申请实施例还提供了一种电子设备，包括处理器和存储器；存储器，设置为存放计算机程序；处理器，设置为执行存储器上所存放的程序时，实现上述网络请求处理的方法步骤。
本申请实施例还提供了一种计算机可读存储介质，该计算机可读存储介质内存储有计算机程序，该计算机程序被处理器执行时实现上述网络请求处理的方法步骤。
本申请实施例还提供了一种应用程序，所述应用程序用于在运行时执行本申请所提供的网络请求处理方法。
本申请实施例提供的一种网络请求处理方法中，接收网络请求；获取网络请求对应的IP属性信息；根据IP属性信息，依据预设的第一打分规则，对网络请求进行第一次打分，得到第一次打分分数；如果第一次打分分数低于预设的第一分数阈值，则对网络请求进行阻断；反之，则获取网络请求对应的IP行为信息；根据IP行为信息，依据预设的第二打分规则，对网络请求进行第二次打分，得到第二次打分分数；如果第二次打分分数低于预设的第二分数阈值，则对网络请求进行报警提醒。相关技术中，如果网络平台需要对用户登录请求进行帆布指纹识别，则可通过人工埋点统计用户登录网络平台时是否提交的相应的参数，如果没有则可制定相应的安全策略。如果网络平台需要通过JS(JavaScript)获取用户登录时的参数，如：是否有鼠标 位置移动、键盘输入或输入等待等，可以根据该参数制定相关的安全策略。在客户端采集设备信息，如：浏览器版本、浏览器窗口大小、主机分辨率、时间戳或鼠标移动轨迹等，将采集的设备信息作为一个唯一标识(GUID)，根据该设备信息制定相关的安全策略。与上述相关技术相比，本申请实施例中，不需要在网络请求对应的网络平台的相应控件处进行大量的人工埋点，而是直接根据已有的网络请求对应的IP属性信息和IP行为信息，对网络请求进行阻断或报警提醒，提高了对网络平台的异常登录/注册行为的阻断或报警效果，从而提高了对网络平台的风险控制效果。当然，实施本申请的任一产品或方法必不一定需要同时达到以上所述的所有优点。
附图说明
为了更清楚地说明本申请实施例和相关技术的技术方案，下面对实施例和相关技术中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本申请实施例提供的一种网络请求处理方法的流程示意图；
图2为本申请实施例提供的一种网络请求处理装置的结构示意图；
图3为本申请实施例提供的一种电子设备的结构示意图。
具体实施方式
为使本申请的目的、技术方案、及优点更加清楚明白，以下参照附图并举实施例，对本申请进一步详细说明。显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
为了提高对网络平台的异常登录/注册行为的阻断或报警效果，并降低对网络平台的异常登录/注册行为的漏报率或误报率，本申请实施例提供了一种网络请求处理方法、装置、电子设备及存储介质。
下面通过具体实施例，对本申请进行详细说明。
图1为本申请实施例提供的一种网络请求处理方法的流程示意图，包括以下步骤：
步骤101，接收网络请求。
本实施例中，网络请求包括登录账号请求或注册账号请求。
目前，一些网络平台或应用软件等普遍设置了可以使用户注册或登录的功能，例如，许多网上购物平台为方便用户进行网上购物，为用户开通了注册或登录的功能，不仅方便用户管理其各项购物信息，也使得网上购物平台能够更好地为用户提供服务。
当用户需要使用网络平台或应用软件时，用户会在网络平台或应用软件的显示界面中发起注册账号请求，来注册该网络平台或应用软件的新的账号。在用户已经注册网络平台或应用软件的账号后，用户会根据自己的实际需要，在网络平台或应用软件的显示界面中发起登录账号请求，来登录所注册的账号。
本实施例中，登录账号请求包括对应的登录账号；注册账号请求中包括对应的注册账号。需要说明的是，登录账号请求包括对应的登录账号，也就是说，该登录账号请求包括用户待进行登录的登录账号。类似的，注册账号请求包括对应的注册账号，也就是说，注册账号请求包括用户待进行注册的注册账号。本实施例中，登录账号请求或注册账号请求可以是针对网络平台或应用软件的登录账号请求或注册账号请求，本申请对此并不限定。
本实施例提供的网络请求处理方法可以应用于智能手机、平板电脑、台式计算机等电子设备中。在上述电子设备中应用上述方法，对登录账号请求和/或注册账号请求进行处理。
步骤102，获取网络请求对应的IP(Internet Protocol，网络之间互连的协议)属性信息。
一般情况下，网络请求都有对应的IP地址。由于IP协议属于开放式系统互联(OSI，Open System Interconnection)标准模型中的网络层，相比于OSI标准模型的其他工作层来说，在OSI标准模型中的网络层对网络请求进行阻断或报警提醒更为容易。现有的各种网络安全软件、负载均衡设备及软件，都是以IP地址为对象对网络请求进行追踪和管理的。由于IP地址具有唯一性，通过该IP地址可以对网络请求对应的IP属性进行标识。
例如，通过网络请求对应的IP地址的归属地，可以确定该网络请求来源的位置，即可以确定该网络请求来自于哪个国家，如果该网络请求来自于中国，那么进一步还可以确定，该网络请求来自于中国的哪个省、哪个市和哪个县。
再例如，通过网络请求对应的IP地址的IDC(Internet Data Center，互联网数据中心)属性信息，可以确定该网络请求来源于公网用户还是个人用户，其中，公网用户的类型可以包括：IDC服务区、大企业、教育网和运营商集中出口等。本实施例中，网络请求对应的IP属性信息可以包括：地理位置属性信息、互联网数据中心IDC属性信息、网络属性信息、应用属性信息和历史属性信息。
本实施例中，获取网络请求对应的IP属性信息，可以包括：通过网络请求对应的IP地址，获取网络请求对应的地理位置属性信息、IDC属性信息、网络属性信息、应用属性信息和历史属性信息。由于IP地址是由专门的机构进行统一分配和管理的，因此根据网络请求的IP地址所获取的上述IP属性信息是较为准确的。
获取网络请求对应的地理位置属性信息，可以包括：获取网络请求对应的IP地址所属的省市县区信息。根据实际需要，可以设定需要获取网络请求对应的具体的地理位置属性信息，例如：可以设定获取网络请求对应的国家信息，还可以设定获取网络请求对应的国家信息和省份信息，本申请对此并不限制。由于IP地址在较短的时间内是保持固定不变的，因此通过获取网络请求对应的IP地址的归属地可以判断该网络请求的来源地。
获取网络请求对应的IDC属性信息之后，可以根据获取的网络请求对应的IDC属性信息，判断网络请求对应的IP地址属于公网用户还是个人用户，即得到IDC属性信息的属性内容。如果网络请求对应的IP地址属于公网用户，根据实际需要，也可以进一步判断网络请求对应的公网用户的类型。一般情况下，公网用户所申请的IP地址会绑定该公网用户的类型信息等，可以通过抽象语法标记(Abstract Syntax Notation，简称ASN)数据获取该公网用户的类型信息等。其中，公网用户的类型可以包括：IDC服务区、大企业、教育网和运营商集中出口等。其中，可以通过域名系统(DNS，Domain Name System)查出网络请求对应的IP地址属于公网用户还是个人用户，如果网络请求对应的IP 地址属于公网用户，根据实际需要，也可以进一步通过DNS判断网络请求对应的公网用户的类型。
对于个人用户的IP地址或者出口IP地址，还可以通过相关技术进一步确定是否绑定了相关信息，如果绑定，则这种绑定行为极大可能是机器操作的。对应于该IP地址的网络请求极大可能是存在风险的网络请求。
在实际使用中，获取网络请求对应的IDC属性信息，还可以包括：相关技术判断网络请求对应的IP地址是否属于手机基站。
获取网络请求对应的网络属性信息之后，可以根据获取的网络请求对应的网络属性信息，判断网络请求对应的IP地址属于固定网络还是移动网络，即得到网络属性信息的属性内容。如果网络请求对应的IP地址属于移动网络，根据实际需要，也可以进一步判断网络请求对应的移动网络的类型。其中，移动网络的类型可以包括：3G/4G移动网络。按照运营商的不同，移动网络的类型也可以包括：电信/联通/移动网络。
获取网络请求对应的应用属性信息之后，可以根据获取的网络请求对应的应用属性信息，判断网络请求对应的IP地址属于web服务器、代理服务器以及VPN服务器中的哪一种，即得到应用属性信息的属性内容。
获取网络请求对应的历史属性信息之后，可以根据获取的网络请求对应的历史属性信息，判断网络请求对应的IP地址是否存在网络请求被阻断和/或报警提醒的记录，以及判断网络请求对应的IP地址是否存在登录账号被攻击的记录，即得到历史属性信息的属性内容。
本实施例中，判断网络请求对应的IP地址是否存在网络请求被阻断和/或报警提醒的记录，可以包括以下步骤：
判断在本次网络请求之前，对应的IP地址是否接受过网络请求；
如果对应的IP地址没有接收过网络请求，则确定网络请求对应的IP地址不存在网络请求被阻断和/或报警提醒的记录；
如果对应的IP地址接收过网络请求，则判断接收过的网络请求在对应的IP地址下是否被阻断过或被报警提醒过；
如果接收过的网络请求在对应的IP地址下没有被阻断过或被报警提醒过，则确定网络请求对应的IP地址不存在网络请求被阻断和/或报警提醒的记录；
如果接收过的网络请求在对应的IP地址下被阻断过或被报警提醒过，则确定网络请求对应的IP地址存在网络请求被阻断和/或报警提醒的记录。
上述步骤中的对应的IP地址接收过网络请求，是指对应的IP地址至少接受过一次网络请求。
需要说明的是，网络请求被阻断的记录可以是网络请求被阻断状态的记录，也可以是网络请求被阻断的次数的记录。所谓的被阻断状态的记录为：关于网络请求是否被阻断过的判定结果的记录。
举例来说：在本次网络请求之前，对应的IP地址接收过两次网络请求，其中，第一次接收的网络请求没有被阻断，第二次接收的网络请求被阻断。则网络请求的被阻断记录可以是：网络请求被阻断过或网络请求的被阻断次数为一次。
同样，网络请求被报警提醒的记录可以网络请求被报警提醒状态的记录，也可以是网络请求被报警提醒次数的记录。所谓的被报警提醒状态的记录为：关于网络请求是否被报警提醒过的判定结果的记录。
本实施例中，为了获取网络请求对应的历史属性信息，还需要判断网络请求对应的IP地址是否存在登录账号被攻击的记录。这里所说的登录账号可以是网络请求中的登录账号请求所包括的登录账号，也可以是其他针对任意网络平台或应用软件的登录账号请求中的登录账号，本申请对此并不限定。
需要说明的是，登录账号被攻击的记录是指登录账号和登录密码被通过任意一种方式盗取，致使该登录账号的用户无法正常使用该登录账号的一种记录。该记录可以是登录账号被攻击状态的记录，也可以是登录账号被攻击次数的记录。所谓的登录账号被攻击状态的记录为：关于登录账号是否被攻击过的判定结果的记录。
本实施例中，可以通过相关技术获取网络请求对应的地理位置属性信息、IDC属性信息、网络属性信息、应用属性信息和历史属性信息。
步骤103，根据IP属性信息，依据预设的第一打分规则，对网络请求进行第一次打分，得到第一次打分分数。
在获取网络请求对应的IP属性信息之后，可以根据预设的第一打分规则，对网络请求进行第一次打分，其目的在于根据网络请求对应的IP属性信息判断网络请求是否为存在高风险的网络请求。
在本实施例的一种实施方式中，根据IP属性信息，依据预设的第一打分规则，对网络请求进行第一次打分，得到第一次打分分数，可以包括：
获取IP属性信息中的每一种属性信息的权重系数，其中，权重系数为0到1之间的正数；
对IP属性信息中的每一种属性信息进行打分，其中，对每一种属性信息打分均在相同的满分制下进行；
将每一种属性信息的分数乘以对应的权重系数，得到每一种属性信息的权重分数，将每一种属性信息的权重分数相加，得到第一次打分分数。
本实施例中，由于网络请求所包括的登录账号请求或注册账号请求是针对网络平台或应用软件的登录账号请求或注册账号请求，IP属性信息中的每一种属性信息的权重系数可以由网络平台或应用软件的管理方根据实际需要进行设定，并且网络平台或应用软件的管理方根据可以实际需要对IP属性信息中的每一种属性信息进行打分。需要说明的是，在一种实现方式中，网络平台或应用软件的管理方，可以根据IP属性信息中各种属性信息对于攻击风险的贡献程度，在网络平台或应用软件中预先给定各种属性信息的权重系数，其中，权重系数越高，可以表明对于攻击风险的贡献程度越高。例如：地理位置属性信息对应的权重系数为0.1，IDC属性信息对应的权重系数为0.2，网络属性信息对应的权重系数为0.1，应用属性信息对应的权重系数为0.2，历史属性信息对应的权重系数为0.4，此时，地理位置属性信息和网络属性信息对于风险的贡献程度相同，IDC属性信息和应用属性信息对于风险的贡献程度相同，历史属性信息对于风险的贡献程度高于其他属性信息，IDC属性信息和应用属性信息的贡献程度高于地理位置属性信息和网络属性信息。可以理解的是，对于一个网络平台或应用软件而言，各种属性信息对于攻击风险的贡献程度可 以经过大数据分析所获知。
另外，需要说明的是，在一种实现方式中，网络平台或应用软件的管理方，可以根据属性信息的不同属性内容对于攻击风险的贡献程度，在网络平台或应用软件中预先给定该属性信息所对应的打分规则，其中，分数越高表明网络请求的攻击风险越低，分数越低表明网络请求的攻击风险越高。例如：在满分制为5分的情况下，假设来自固定网络的网络请求的攻击风险高于来自移动网络的网络请求，此时，网络属性信息对应的打分规则可以为：对于固定网络给定3分，对于移动网络给定4分。又如：在满分制为5分的情况下，假设来自Web服务器的网络请求的攻击风险低于来自代理服务器的网络请求，而来自代理服务器的网络请求的攻击风险低于来自VPN服务器的网络请求，此时，应用属性信息对应的打分规则可以为：对于Web服务器给定4分，对于代理服务器给定3分，对于VPN服务器给定2分。可以理解的是，对于一个网络平台或应用软件而言，各种属性信息的不同属性内容，对于风险的贡献程度可以经过大数据分析所获知。下面结合具体实例，对上述实施方式进行详细说明。
假设，IP属性信息中的每一种属性信息的具体的属性内容、权重系数和分数如表1所示，对每一种属性信息打分均在相同的满分制(5分)下进行，
表1
Figure PCTCN2018105233-appb-000001
由表1可知，地理位置属性信息的权重分数为0.5，IDC属性信息的权重分数为0.6，网络属性信息的权重分数为0.3，应用属性信息的权重分数为0.8，历 史属性信息的权重系数为0.4，所以第一次打分分数为2.6分。
在本实施例的又一种实施方式中，根据IP属性信息，依据预设的第一打分规则，对网络请求进行第一次打分，得到第一次打分分数，可以包括：在预设的IP属性信息组合分值表中，查找网络请求对应的IP属性信息组合所对应的分数，将所查找到的分数作为第一次打分分数；其中，网络请求对应的IP属性信息组合包括：网络请求对应的IP属性信息中的每种属性信息。
在获取了网络请求对应的IP属性信息后，每种IP属性信息都对应有具体的属性内容。例如，网络请求的地理位置属性信息为：网络请求对应的IP地址的所属地是浙江省杭州市淳安县，网络请求的IDC属性信息为：网络请求对应的IP地址属于公网用户，网络请求的网络属性信息为：网络请求对应的IP地址属于固定网络，网络请求的应用属性信息为：网络请求对应的IP地址属于web服务器，网络请求对应的历史属性信息为：网络请求对应的IP地址存在网络请求被阻断的记录，且网络请求对应的IP地址存在登录账号被盗的记录。
本实施例中，将获取的每种属性信息的具体的属性内容进行组合，则构成了网络请求对应的IP属性信息组合。
需要说明的是，网络请求对应的IP属性信息中的每种属性信息都可能是对应的多种属性内容中的一种，例如，网络请求的地理位置属性信息可能为A1，网络请求的IDC属性信息可能为B1或B2，网络请求的网络属性信息可能为C1或C2，网络请求的应用属性信息可能为D1，D2或D3，网络请求对应的历史属性信息可能为E1，E2，E3或E4，则网络请求对应的IP属性信息组合可能为1×2×2×3×4＝48种IP属性信息组合中的一种，比如，网络请求对应的IP属性信息组合可以为{A1，B2，C1，D2，E1}。
预设的IP属性信息组合分值表中给出了网络请求可能对应的所有种IP属性信息组合的分数。由于网络请求所包括的登录账号请求或注册账号请求是针对网络平台或应用软件的登录账号请求或注册账号请求，预设的IP属性信息组合分值表可以由网络平台或应用软件的管理方根据实际需要给出。
步骤104，判断第一次打分分数是否低于预设的第一分数阈值。如果第一次打分分数低于预设的第一分数阈值，转到步骤105。如果第一次打分分数不 低于预设的第一分数阈值，转到步骤106。
本实施例中，由于网络请求所包括的登录账号请求或注册账号请求是针对网络平台或应用软件的登录账号请求或注册账号请求，预设的第一分数阈值可以由网络平台或应用软件的管理方根据实际需要进行设定。
步骤105，对网络请求进行阻断。
本实施例中，对于网络请求包括登录账号请求的情况而言，如果第一次打分分数低于预设的第一分数阈值，则认为网络请求是存在高风险的网络请求，也就是说，认为登录账号请求包括的登录账号存在被攻击的高风险，为保障该登录账号的用户能够正常使用该登录账号，对网络请求进行阻断。
本实施例中，对于网络请求包括注册账号请求的情况而言，如果第一次打分分数低于预设的第一分数阈值，则认为网络请求是存在高风险的网络请求，也就是说，认为注册账号请求针对的网络平台或应用软件存在被恶意注册的高风险，为保障该网络平台或应用软件能够正常为用户提供注册账号的功能，对网络请求进行阻断。
步骤106，获取网络请求对应的IP行为信息。
一般情况下，根据网络请求对应的IP地址获得的IP属性是比较准确的。为进一步减少对异常网络请求的漏报率和误报率，还可以获取网络请求对应的IP行为信息，并根据该IP行为信息分析网络请求是否为存在风险的网络请求。
本实施例中，IP行为信息可以包括：IP行为走势信息、IP行为历史同期信息和IP行为同类对比信息。
IP行为走势信息可以为在当前第一预设周期内所统计的网络请求次数的变化信息。其中，第一预设周期可以是以分钟、小时、天、周、月或年为单位的连续时间段，如：1分钟，2小时或1天，本申请对此并不限制。
其中，可以将当前第一预设周期划分为多个在时间上连续的第一预设子周期，统计当前第一预设周期中每个第一预设子周期内网络请求的次数，将当前第一预设周期中每个第一预设子周期内网络请求的次数信息作为IP行为走势信息。
IP行为历史同期信息可以为在当前第一预设周期之前的第二预设周期内统计的网络请求次数的变化信息。其中，第二预设周期可以是以分钟、小时、天、周、月或年为单位的连续时间段，如：1分钟，2小时或1天，本申请对此并不限制。
其中，可以将第二预设周期划分为多个在时间上连续的第二预设子周期，统计第二预设周期中每个第二预设子周期内网络请求的次数，将第二预设周期中每个第二预设子周期内网络请求的次数信息作为IP历史同期信息。
IP行为同类对比信息可以包括：在当前第一预设周期之前的第三预设周期内统计的网络请求对应的两种同类对比信息。其中，第三预设周期可以是以分钟、小时、天、周、月或年为单位的连续时间段，如：1分钟，2小时或1天，本申请对此并不限制。其中，所述两种同类对比信息包括：
第一种同类对比信息可以为网络请求对应的IP地址的登录账号次数与注册账号次数的比值，
第二种同类对比信息可以为网络请求对应的IP地址的登录账号成功次数与注册账号成功次数的比值。
本实施例中，在网络请求包括登录账号请求的情况下，IP行为同类对比信息还可以包括：第三种同类对比信息。其中，第三种同类对比信息为：在当前第一预设周期之前的第四预设周期内统计的、网络请求对应的登录账号在第一区域被成功登录的次数与在第二区域被成功登录的次数的比值。其中，第四预设周期可以是以分钟、小时、天、周、月或年为单位的连续时间段，如：1分钟，2小时或1天，本申请对此并不限制。
需要说明的是，第一区域可以是某一个国家，也可以是某一个省、市、区，但并不限于此；上述第二区域也可以是某一个国家，也可以是某一个省、市、区，但并不限于此。
本实施例中，可以通过相关技术获取网络请求对应的IP行为走势信息、IP行为历史同期信息和IP行为同类对比信息。
步骤107，根据IP行为信息，依据预设的第二打分规则，对网络请求进行第二次打分，得到第二次打分分数。
在获取网络请求对应的IP行为信息之后，可以根据预设的第二打分规则，对网络请求进行第二次打分，其目的在于根据网络请求对应的IP行为信息判断网络请求是否为存在一般风险的网络请求。
本实施例中，根据IP行为信息，依据预设的第二打分规则，对网络请求进行第二次打分，可以包括：
获取IP行为信息中的每一种行为信息的权重系数，其中，权重系数为0到1之间的正数；
对IP行为信息中的每一种行为信息进行打分，其中，对每一种行为信息打分均在相同的满分制下进行；
将每一种行为信息的分数乘以对应的权重系数，得到每一种行为信息的权重分数，将每一种行为信息的权重分数相加，得到第二次打分分数。
需要说明的是，对IP行为信息中的每一种行为信息进行打分所依据的打分规则，可以由网络平台或应用软件的管理方所设定，通过所设定的打分规则，可以使得在任一种行为信息的信息内容已知时，均能够确定出该种行为信息对应的分数。在本实施例的一种实施方式中，在所述IP行为信息中包括IP行为同类对比信息的情况下，对所述IP行为信息中的每一种行为信息进行打分包括：
对所述IP行为信息中的IP行为同类对比信息打分；其中，对所述IP行为信息中的IP行为同类对比信息打分包括：
对IP行为同类对比信息中的每一种同类对比信息进行打分，其中，对每一种同类对比信息打分均在预先设定的满分制下进行；
将每一种同类对比信息的分数乘以对应的权重系数，得到每一种同类对比信息的权重分数，将每一种同类对比信息的权重分数相加，得到IP行为信息中的IP行为同类对比信息的分数。需要说明的是，对IP行为同类对比信息中的每一种同类对比信息进行打分所依据的打分规则，可以由网络平台或应用软件的管理方所设定，通过所设定的打分规则，可以使得在任一种同类对比信息的信息内容已知时，均能够确定出该种同类对比信息对应的分数。
进一步地，在对IP行为同类对比信息中的每一种同类对比信息进行打分的 步骤之前，可以将上述满分制为多个分数段，比如第一分数段，第二分数段，第三分数段等，也可以按照分数的高低分为低、中间、高三个分数段，但并不限于此。需要说明的是，上述第一分数段可以对应高分数段，第二分数段可以对应中间分数段，第三分数段可以对应低分数段，并不限于此。针对第一种同类对比信息为网络请求对应的IP地址的登录账号次数与注册账号次数的比值的情况，可以设定一第一预设值和第二预设值，其中，第一预设值小于第二预设值。当上述比值小于第一预设值时，可以认为该网络请求存在低风险，判定第一种同类对比信息的分数在第一分数段；当上述比值小于第二预设值且不小于第一预设值时，可以认为该网络请求存在一般风险，判定第一种同类对比信息的分数在第二分数段；当上述比值不小于第二预设值时，可以认为该网络请求存在高风险，判定第一种同类对比信息的分数在第三分数段。
针对第二种同类对比信息为网络请求对应的IP地址的登录账号成功次数与注册账号成功次数的比值的情况，可以设定一第三预设值和第四预设值，其中，第三预设值小于第四预设值。当上述比值小于第三预设值时，可以认为该网络请求存在低风险，判定第二种同类对比信息的分数在第一分数段；当上述比值小于第四预设值且不小于第三预设值时，可以认为该网络请求存在一般风险，判定第二种同类对比信息的分数在第二分数段；当上述比值不小于第四预设值时，可以认为该网络请求存在高风险，判定第二种同类对比信息的分数在第三分数段。
针对第三种同类对比信息为在当前第一预设周期之前的第四预设周期内统计的网络请求对应的登录账号在第一区域被成功登录的次数与在第二区域被成功登录的次数的比值的情况，可以设定一第五预设值和第六预设值，其中，第五预设值小于第四预设值。当上述比值小于第五预设值时，可以认为该网络请求存在低风险，判定第三种同类对比信息的分数在第一分数段；当上述比值小于第六预设值且不小于第五预设值时，可以认为该网络请求存在一般风险，判定第三种同类对比信息的分数在第二分数段；当上述比值不小于第六预设值时，可以认为该网络请求存在高风险，判定第三种同类对比信息的分数在第三分数段。
可以理解的是，在确定出IP行为同类对比信息中的每一种同类对比信息所 对应的分数段后，对IP行为同类对比信息中的每一种同类对比信息进行打分可以为：针对每一种同类对比信息，依据与该种同类对比信息对应的分数段相关的分数映射关系，得到该种同类对比信息对应的具体的分数，其中，该分数映射关系为：分数与具体的信息内容的映射关系。当然，对IP行为同类对比信息中的每一种同类对比信息进行打分的具体实现方式，并不局限于此。
具体的，如果该网络请求包括登录账号请求，则上述的认为该网络请求存在低/一般/高风险，具体可以是，认为该登录账号请求包括的登录账号存在被攻击的低/一般/高风险。如果该网络请求包括注册账号请求，则上述的认为该网络请求存在低/一般/高风险，具体可以是，认为该注册账号请求针对的网络平台或应用软件存在被恶意注册的低/一般/高风险。
上述的第一/第三/第五预设值可以相同，也可以不相同；上述的第二/第四/第六预设值可以相同，也可以不相同。本实施例中，由于网络请求所包括的登录账号请求或注册账号请求是针对网络平台或应用软件的登录账号请求或注册账号请求，IP行为信息中的每一种行为信息的权重系数可以由网络平台或应用软件的管理方根据实际需要进行设定，并且网络平台或应用软件的管理方根据可以实际需要对IP行为信息中的每一种行为信息进行打分。
步骤108，判断第二次打分分数是否低于预设的第二分数阈值。
本实施例中，由于网络请求所包括的登录账号请求或注册账号请求是针对网络平台或应用软件的登录账号请求或注册账号请求，预设第二分数阈值可以由网络平台或应用软件的管理方根据实际需要进行设定。
步骤109，如果第二次打分分数低于预设的第二分数阈值，则对网络请求进行报警提醒。
本实施例中，对于网络请求包括登录账号请求的情况而言，如果第二次打分分数低于预设的第二分数阈值，则认为网络请求是存在一般风险的网络请求，也就是说，认为登录账号请求包括的登录账号存在被攻击的一般风险，为保障该登录账号的用户能够正常使用该登录账号，对网络请求进行报警提醒。
本实施例中，对于网络请求包括注册账号请求的情况而言，如果第二次 打分分数低于预设的第二分数阈值，则认为网络请求是存在一般风险的网络请求，也就是说，认为注册账号请求针对的网络平台或应用软件存在被恶意注册的一般风险，为保障该网络平台或应用软件能够正常为用户提供注册账号的功能，对网络请求进行报警提醒。
在实际情况中，步骤S106中的在当前第一预设周期内所统计的网络请求次数的变化信息，或在当前第一预设周期之前的第二预设周期内统计的网络请求次数的变化信息，可以包括这样几种情形：陡增，掉坑，非常直的曲线，锯齿形曲线等。其中，“陡增”代表网络请求数在短时间内大量增加，“掉坑”代表网络请求数在短时间内大量减少，“非常直的曲线”代表网络请求数在一段时间内呈线性变化，“锯齿形曲线”代表网络请求数在一段时间内呈锯齿形。举例来说，假设第一预设周期为5分钟，第一预设子周期为1分钟，如果第一预设周期中5个第一预设子周期内网络请求的次数依次为[2,2,3,3,10]，则IP行为走势为“陡增”，如果网络请求的次数依次为[5,5,4,4,0]，则IP行为走势为“掉坑”，如果网络请求的次数依次为[5,6,7,8,9]，则IP行为走势为“非常直的曲线”，如果网络请求的次数依次为[5,3,5,3,5]，则IP行为走势为“锯齿形曲线”。在一些示例中，步骤107中的第二打分规则可以包括：上述的四种情况时的网络请求对应较低的第二打分分数，并且如果上述第二次打分分数低于预设的第二分数阈值，则判定以上四种IP行为走势均属于异常IP行为，则网络请求为存在风险的网络请求，可以对上述网络请求进行报警提醒。
另外，实际应用中，也可将网络请求对应的IP属性信息和IP行为信息结合起来判断网络请求是否存在风险。例如一网络请求出现这几种情形：1、假设网络请求对应的IP地址属于个人用户，且在该网络请求前一段时间内，该IP地址出现了大量的其他网络请求；2、假设网络请求对应的IP地址出现了有规律的切换登录账号的网络请求；3、假设网络请求对应的IP地址在较短的时间内发生了较大的地理偏移。则步骤107中的第二打分规则可以包括：上述的三种情况是的网络请求对应较低的第二打分分数，并且如果上述第二打分分数低于预设的第二分数阈值，则判定上述三种IP行为均属于异常IP行为，则网络请求为存在风险的网络请求，可以对上述网络请求进行报警提醒。
进一步地，通过将网络请求对应的IP属性信息和IP行为信息结合起来，还可用于金融安全领域。例如，用于判断不同用户间的资金流向等。
本实施例提供的网络请求处理方法，通过接收网络请求；获取网络请求对应的IP属性信息；根据IP属性信息，对网络请求进行第一次打分；如果第一次打分分数低于预设的第一分数阈值，则对网络请求进行阻断；反之，则获取网络请求对应的IP行为信息；根据IP行为信息，依据预设的第二打分规则，对网络请求进行第二次打分；如果第二次打分分数低于预设的第二分数阈值，则对网络请求进行报警提醒。与相关技术相比，本申请实施例中，不需要在相应的控件处进行大量的人工埋点，而是直接根据已有的网络请求对应的IP属性信息，对网络请求进行阻断，提高了对网络平台的异常登录/注册行为的阻断或报警提醒的效果。
需要说明的是，上述方法的执行主体可以是电子设备，但并不限于此。图2为本申请实施例提供的一种网络请求处理装置的结构示意图，该装置包括：接收单元201，IP属性信息获取单元202，第一打分单元203，第一判断单元204，阻断单元205，IP行为信息获取单元206，第二打分单元207，第二判断单元208，报警提醒单元209。
接收单元201，设置为接收网络请求；其中，网络请求包括登录账号请求或注册账号请求；登录账号请求包括对应的登录账号；注册账号请求中包括对应的注册账号。
IP属性信息获取单元202，与上述接收单元201连接，设置为获取网络请求对应的IP属性信息。
第一打分单元203，与IP属性信息获取单元202连接，设置为根据IP属性信息，依据预设的第一打分规则，对网络请求进行第一次打分，得到第一次打分分数。
第一判断单元204，与上述第一打分单元203连接，设置为判断第一次打分分数是否低于预设的第一分数阈值。
阻断单元205，与上述第一判断单元204连接，设置为在第一次打分分数低于预设的第一分数阈值时，对网络请求进行阻断。
IP行为信息获取单元206，与上述第一判断单元204连接，设置为在第一次打分分数不低于预设的第一分数阈值时，获取网络请求对应的IP行为信息。
第二打分单元207，与上述IP行为信息获取单元206连接，设置为根据IP行为信息，依据预设的第二打分规则，对网络请求进行第二次打分，得到第二次打分分数。
第二判断单元208，与上述第二打分单元207连接，设置为判断第二次打分分数是否低于预设的第二分数阈值。
报警提醒单元209，与上述第二判断单元208连接，设置为在第二次打分分数低于预设的第二分数阈值时，对网络请求进行报警提醒。
IP属性信息获取单元202获取的IP属性信息可以包括：地理位置属性信息、IDC属性信息、网络属性信息、应用属性信息和历史属性信息。
IP属性信息获取单元202，可以包括：地理位置属性信息获取子单元、IDC属性信息获取子单元、网络属性信息获取子单元、应用属性信息获取子单元、历史属性信息获取子单元。
地理位置属性信息获取子单元，设置为获取网络请求对应的IP地址所属的省市县区信息。
IDC属性信息获取子单元，设置为获取网络请求对应的IDC属性信息；根据获取的网络请求对应的IDC属性信息，判断网络请求对应的IP地址属于公网用户还是个人用户。
网络属性信息获取子单元，设置为获取网络请求对应的网络属性信息；根据获取的网络请求对应的网络属性信息，判断网络请求对应的IP地址属于固定网络还是移动网络。
应用属性信息获取子单元，设置为获取网络请求对应的应用属性信息；根据获取的网络请求对应的应用属性信息，判断网络请求对应的IP地址属于web服务器、代理服务器以及VPN服务器中的哪一种。
历史属性信息获取子单元，设置为获取网络请求对应的历史属性信息；根据获取的网络请求对应的历史属性信息，判断网络请求对应的IP地址是否存在网络请求被阻断和/或报警提醒的记录，以及判断网络请求对应的IP地址是否存在登录账号被攻击的记录。
在本实施例的一种实施方式中，第一打分单元203，设置为获取IP属性信息中的每一种属性信息的权重系数，其中，权重系数为0到1之间的正数；对IP属性信息中的每一种属性信息进行打分，其中，对每一种属性信息打分均在相同的满分制下进行；将每一种属性信息的分数乘以对应的权重系数，得到每一种属性信息的权重分数，将每一种属性信息的权重分数相加，得到第一次打分分数。
在本实施例的又一种实施方式中，第一打分单元203，设置为在预设的IP属性信息组合分值表中，查找网络请求对应的IP属性信息组合所对应的分数，将所查找到的分数作为第一次打分分数；其中，网络请求对应的IP属性信息组合包括：网络请求对应的IP属性信息中的每种属性信息。
IP行为信息获取单元206获取的IP行为信息可以包括：IP行为走势信息、IP行为历史同期信息和IP行为同类对比信息；其中，IP行为走势信息可以为在当前第一预设周期内所统计的网络请求次数的变化信息；IP行为历史同期信息可以为在当前第一预设周期之前的第二预设周期内统计的网络请求次数的变化信息；IP行为同类对比信息可以包括：在当前第一预设周期之前的第三预设周期内统计的网络请求对应的两种同类对比信息，其中，所述两种同类对比信息包括：第一种同类对比信息可以为网络请求对应的IP地址的登录账号次数与注册账号次数的比值；第二种同类对比信息可以为网络请求对应的IP地址的登录账号成功次数与注册账号成功次数的比值。
在接收单元201接收的网络请求包括登录账号请求的情况下，IP行为同类对比信息还可以包括：第三种同类对比信息；其中，第三种同类对比信息可以为：在当前第一预设周期之前的第四预设周期内统计的、网络请求对应的登录账号在第一区域被成功登录的次数与在第二区域被成功登录的次数的比值。
在本实施例的一种实施方式中，第二打分单元207，设置为获取IP行为信息中的每一种行为信息的权重系数，其中，权重系数为0到1之间的正数；对IP行为信息中的每一种行为信息进行打分，其中，对每一种行为信息打分均在相同的满分制下进行；将每一种行为信息的分数乘以对应的权重系数，得到每一种行为信息的权重分数，将每一种行为信息的权重分数相加，得到第二 次打分分数。
在本实施例的一种实施方式中，在所述IP行为信息中包括IP行为同类对比信息的情况下，所述第二打分单元207包括打分子单元；所述打分子单元，设置为对所述IP行为信息中的IP行为同类对比信息打分；其中，对所述IP行为信息中的IP行为同类对比信息打分包括：对IP行为同类对比信息中的每一种同类对比信息进行打分，其中，对每一种同类对比信息打分均在预先设定的满分制下进行；将每一种同类对比信息的分数乘以对应的权重系数，得到每一种同类对比信息的权重分数，将每一种同类对比信息的权重分数相加，得到IP行为信息中的IP行为同类对比信息的分数。
进一步地，所述打分子单元，还设置为在对所述IP行为同类对比信息中的每一种同类对比信息进行打分的步骤之前，
当第一种同类对比信息小于第一预设值时，判定第一种同类对比信息的分数在第一分数段；当第一种同类对比信息小于第二预设值且不小于第一预设值时，判定第一种同类对比信息的分数在第二分数段；当第一种同类对比信息不小于第二预设值时，判定第一种同类对比信息的分数在第三分数段；其中，第一预设值小于第二预设值；当第二种同类对比信息小于第三预设值时，判定第二种同类对比信息的分数在第一分数段；当第二种同类对比信息小于第四预设值且不小于第三预设值时，判定第二种同类对比信息的分数在第二分数段；当第二种同类对比信息不小于第四预设值时，判定第二种同类对比信息的分数在第三分数段；其中，第三预设值小于第四预设值；当第三种同类对比信息小于第五预设值时，判定第三种同类对比信息的分数在第一分数段；当第三种同类对比信息小于第六预设值且不小于第五预设值时，判定第三种同类对比信息的分数在第二分数段；当第三种同类对比信息不小于第六预设值时，判定第三种同类对比信息的分数在第三分数段；其中，第五预设值小于第六预设值。
本实施例提供的网络请求处理装置，通过接收网络请求；获取网络请求对应的IP属性信息；根据IP属性信息，对网络请求进行第一次打分；如果第一次打分分数低于预设的第一分数阈值，则对网络请求进行阻断；反之，则获取网络请求对应的IP行为信息；根据IP行为信息，依据预设的第二打分规则， 对网络请求进行第二次打分；如果第二次打分分数低于预设的第二分数阈值，则对网络请求进行报警提醒。与相关技术相比，本申请实施例中，不需要在相应的控件处进行大量的人工埋点，而是直接根据已有的网络请求对应的IP属性信息，对网络请求进行阻断，提高了对网络平台的异常登录/注册行为的阻断或报警提醒的效果。
需要说明的是，上述网络请求处理装置可以位于电子设备中，但并不限于此。
本申请实施例还提供了一种电子设备，如图3所示，包括处理器301和存储器303。存储器303，设置为存放计算机程序；处理器301，设置为执行存储器303上所存放的程序时，实现上述网络请求处理的方法步骤，比如图1所示的网络请求处理的方法步骤。
上述电子设备提到的通信总线可以是外设部件互连标准(PeripheralComponent Interconnect，简称PCI)总线或扩展工业标准结构(Extended IndustryStandard Architecture，简称EISA)总线等。该通信总线可以分为地址总线、数据总线、控制总线等。为便于表示，图3中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
通信接口设置为上述电子设备与其他设备之间的通信。
存储器可以包括随机存取存储器(Random Access Memory，简称RAM)，也可以包括非易失性存储器(non-volatile memory)，例如至少一个磁盘存储器。可选的，存储器还可以是至少一个位于远离前述处理器的存储装置。
上述的处理器可以是通用处理器，包括中央处理器(Central Processing Unit，简称CPU)、网络处理器(Network Processor，简称NP)等；还可以是数字信号处理器(Digital Signal Processing，简称DSP)、专用集成电路(Application SpecificIntegrated Circuit，简称ASIC)、现场可编程门阵列(Field-Programmable GateArray，简称FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。
本申请实施例还提供了一种计算机可读存储介质，计算机可读存储介质内存储有计算机程序，用以执行上述网络请求处理的方法步骤，比如图1所示 的网络请求处理的方法步骤：
本申请实施例还提供了一种应用程序，所述应用程序用于在运行时执行本申请所提供的网络请求处理方法。
本实施例提供的电子设备、计算机可读储介质、应用程序，通过接收网络请求；获取网络请求对应的IP属性信息；根据IP属性信息，对网络请求进行第一次打分；如果第一次打分分数低于预设的第一分数阈值，则对网络请求进行阻断；反之，则获取网络请求对应的IP行为信息；根据IP行为信息，依据预设的第二打分规则，对网络请求进行第二次打分；如果第二次打分分数低于预设的第二分数阈值，则对网络请求进行报警提醒。与相关技术相比，本申请实施例中，不需要在相应的控件处进行大量的人工埋点，而是直接根据已有的网络请求对应的IP属性信息，对网络请求进行阻断，提高了对网络平台的异常登录/注册行为的阻断或报警提醒的效果。
对于装置/电子设备/存储介质/应用程序实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。需要说明的是，本申请实施例的装置、电子设备、存储介质及应用程序分别是应用上述网络请求处理方法的装置、电子设备、存储介质及应用程序，则上述网络请求处理方法的所有实施例均适用于该装置、电子设备、存储介质及应用程序，且均能达到相同或相似的有益效果。
以上所述仅为本申请的较佳实施例而已，并不用以限制本申请，凡在本申请的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本申请保护的范围之内。
工业实用性
基于本申请实施例提供的上述网络请求处理方法、装置、电子设备及存储介质，与相关技术相比，不需要在网络请求对应的网络平台的相应控件处进行大量的人工埋点，而是直接根据已有的网络请求对应的IP属性信息和IP行为信息，对网络请求进行阻断或报警提醒，提高了对网络平台的异常登录/注册行为的阻断或报警效果，从而提高了对网络平台的风险控制效果。

Claims (23)

  1. 一种网络请求处理方法，所述方法包括：
    接收网络请求；其中，所述网络请求包括登录账号请求或注册账号请求；所述登录账号请求包括对应的登录账号；所述注册账号请求中包括对应的注册账号；
    获取所述网络请求对应的IP属性信息；
    根据所述IP属性信息，依据预设的第一打分规则，对所述网络请求进行第一次打分，得到第一次打分分数；判断第一次打分分数是否低于预设的第一分数阈值；
    如果第一次打分分数低于预设的第一分数阈值，则对所述网络请求进行阻断；
    如果第一次打分分数不低于预设的第一分数阈值，则获取所述网络请求对应的IP行为信息；
    根据所述IP行为信息，依据预设的第二打分规则，对所述网络请求进行第二次打分，得到第二次打分分数；判断第二次打分分数是否低于预设的第二分数阈值；
    如果第二次打分分数低于预设的第二分数阈值，则对所述网络请求进行报警提醒。
  2. 根据权利要求1所述的方法，其中，所述IP属性信息包括：地理位置属性信息、互联网数据中心IDC属性信息、网络属性信息、应用属性信息和历史属性信息。
  3. 根据权利要求1所述的方法，其中，所述获取所述网络请求对应的IP属性信息，包括：获取所述网络请求对应的地理位置属性信息、IDC属性信息、网络属性信息、应用属性信息和历史属性信息，其中，
    所述获取所述网络请求对应的地理位置属性信息，包括：获取所述网络请求对应的IP地址所属的省市县区信息；
    获取所述网络请求对应的IDC属性信息之后，所述方法还包括：根据获取 的所述网络请求对应的IDC属性信息，判断所述网络请求对应的IP地址属于公网用户还是个人用户；
    获取所述网络请求对应的网络属性信息之后，所述方法还包括：根据获取的所述网络请求对应的网络属性信息，判断所述网络请求对应的IP地址属于固定网络还是移动网络；
    获取所述网络请求对应的应用属性信息之后，所述方法还包括：根据获取的所述网络请求对应的应用属性信息，判断所述网络请求对应的IP地址属于web服务器、代理服务器以及VPN服务器中的哪一种；
    获取所述网络请求对应的历史属性信息之后，所述方法还包括，根据获取的所述网络请求对应的历史属性信息，判断所述网络请求对应的IP地址是否存在所述网络请求被阻断和/或报警提醒的记录，以及判断所述网络请求对应的IP地址是否存在登录账号被攻击的记录。
  4. 根据权利要求2所述的方法，其中，所述根据所述IP属性信息，依据预设的第一打分规则，对所述网络请求进行第一次打分，得到第一次打分分数，包括：
    获取所述IP属性信息中的每一种属性信息的权重系数，其中，所述权重系数为0到1之间的正数；
    对所述IP属性信息中的每一种属性信息进行打分，其中，对每一种属性信息打分均在相同的满分制下进行；
    将所述每一种属性信息的分数乘以对应的权重系数，得到所述每一种属性信息的权重分数，将所述每一种属性信息的权重分数相加，得到所述第一次打分分数。
  5. 根据权利要求2所述的方法，其中，所述根据所述IP属性信息，依据预设的第一打分规则，对所述网络请求进行第一次打分，得到第一次打分分数，包括：
    在预设的IP属性信息组合分值表中，查找所述网络请求对应的IP属性信息组合所对应的分数，将所查找到的分数作为所述第一次打分分数；
    其中，所述网络请求对应的IP属性信息组合包括：所述网络请求对应的IP属性信息中的每种属性信息。
  6. 根据权利要求1所述的方法，其中，所述IP行为信息包括：IP行为走势信息、IP行为历史同期信息和IP行为同类对比信息；其中，
    所述IP行为走势信息为在当前第一预设周期内所统计的所述网络请求次数的变化信息；
    所述IP行为历史同期信息为在当前第一预设周期之前的第二预设周期内统计的所述网络请求次数的变化信息；
    所述IP行为同类对比信息包括：在当前第一预设周期之前的第三预设周期内统计的所述网络请求对应的两种同类对比信息，其中，所述两种同类对比信息包括：第一种同类对比信息为所述网络请求对应的IP地址的登录账号次数与注册账号次数的比值；第二种同类对比信息为所述网络请求对应的IP地址的登录账号成功次数与注册账号成功次数的比值。
  7. 根据权利要求6所述的方法，其中，在所述网络请求包括登录账号请求的情况下，所述IP行为同类对比信息还包括：第三种同类对比信息；
    其中，第三种同类对比信息为：在当前第一预设周期之前的第四预设周期内统计的、所述网络请求对应的登录账号在第一区域被成功登录的次数与在第二区域被成功登录的次数的比值。
  8. 根据权利要求6或7所述的方法，其中，所述根据所述IP行为信息，依据预设的第二打分规则，对所述网络请求进行第二次打分，得到第二次打分分数，包括：
    获取所述IP行为信息中的每一种行为信息的权重系数，其中，所述权重系数为0到1之间的正数；
    对所述IP行为信息中的每一种行为信息进行打分，其中，对每一种行为信息打分均在相同的满分制下进行；
    将所述每一种行为信息的分数乘以对应的权重系数，得到所述每一种行为信息的权重分数，将所述每一种行为信息的权重分数相加，得到所述第二 次打分分数。
  9. 根据权利要求8所述的方法，其中，在所述IP行为信息中包括IP行为同类对比信息的情况下，对所述IP行为信息中的每一种行为信息进行打分包括：对所述IP行为信息中的IP行为同类对比信息打分；其中，对所述IP行为信息中的IP行为同类对比信息打分包括：
    对所述IP行为同类对比信息中的每一种同类对比信息进行打分，其中，对每一种同类对比信息打分均在预先设定的满分制下进行；
    将所述每一种同类对比信息的分数乘以对应的权重系数，得到所述每一种同类对比信息的权重分数，将所述每一种同类对比信息的权重分数相加，得到所述IP行为信息中的IP行为同类对比信息的分数。
  10. 根据权利要求9所述的方法，其中，所述对所述IP行为同类对比信息中的每一种同类对比信息进行打分的步骤之前，所述方法还包括：
    当所述第一种同类对比信息小于第一预设值时，判定所述第一种同类对比信息的分数在第一分数段；当所述第一种同类对比信息小于第二预设值且不小于第一预设值时，判定所述第一种同类对比信息的分数在第二分数段；当所述第一种同类对比信息不小于第二预设值时，判定所述第一种同类对比信息的分数在第三分数段；其中，所述第一预设值小于所述第二预设值；
    当所述第二种同类对比信息小于第三预设值时，判定所述第二种同类对比信息的分数在第一分数段；当所述第二种同类对比信息小于第四预设值且不小于第三预设值时，判定所述第二种同类对比信息的分数在第二分数段；当所述第二种同类对比信息不小于第四预设值时，判定所述第二种同类对比信息的分数在第三分数段；其中，所述第三预设值小于所述第四预设值；
    当所述第三种同类对比信息小于第五预设值时，判定所述第三种同类对比信息的分数在第一分数段；当所述第三种同类对比信息小于第六预设值且不小于第五预设值时，判定所述第三种同类对比信息的分数在第二分数段；当所述第三种同类对比信息不小于第六预设值时，判定所述第三种同类对比信息的分数在第三分数段；其中，所述第五预设值小于所述第六预设值。
  11. 一种网络请求处理装置，所述装置包括：
    接收单元，设置为接收网络请求；其中，所述网络请求包括登录账号请求或注册账号请求；所述登录账号请求包括对应的登录账号；所述注册账号请求中包括对应的注册账号；
    IP属性信息获取单元，设置为获取所述网络请求对应的IP属性信息；
    第一打分单元，设置为根据所述IP属性信息，依据预设的第一打分规则，对所述网络请求进行第一次打分，得到第一次打分分数；
    第一判断单元，设置为判断第一次打分分数是否低于预设的第一分数阈值；
    阻断单元，设置为在第一次打分分数低于预设的第一分数阈值时，对所述网络请求进行阻断；
    IP行为信息获取单元，设置为在第一次打分分数不低于预设的第一分数阈值时，获取所述网络请求对应的IP行为信息；
    第二打分单元，设置为根据所述IP行为信息，依据预设的第二打分规则，对所述网络请求进行第二次打分，得到第二次打分分数；
    第二判断单元，设置为判断第二次打分分数是否低于预设的第二分数阈值；
    报警提醒单元，设置为在第二次打分分数低于预设的第二分数阈值时，对所述网络请求进行报警提醒。
  12. 根据权利要求11所述的装置，其中，所述IP属性信息获取单元获取的所述IP属性信息包括：地理位置属性信息、IDC属性信息、网络属性信息、应用属性信息和历史属性信息。
  13. 根据权利要求11所述的装置，其中，所述IP属性信息获取单元，包括：地理位置属性信息获取子单元、IDC属性信息获取子单元、网络属性信息获取子单元、应用属性信息获取子单元、历史属性信息获取子单元，其中，
    所述地理位置属性信息获取子单元，设置为获取所述网络请求对应的IP地址所属的省市县区信息；
    所述IDC属性信息获取子单元，设置为获取所述网络请求对应的IDC属性信息；根据获取的所述网络请求对应的IDC属性信息，判断所述网络请求对应的IP地址属于公网用户还是个人用户；
    所述网络属性信息获取子单元，设置为获取所述网络请求对应的网络属性信息；根据获取的所述网络请求对应的网络属性信息，判断所述网络请求对应的IP地址属于固定网络还是移动网络；
    所述应用属性信息获取子单元，设置为获取所述网络请求对应的应用属性信息；根据获取的所述网络请求对应的应用属性信息，判断所述网络请求对应的IP地址属于web服务器、代理服务器以及VPN服务器中的哪一种；
    所述历史属性信息获取子单元，设置为获取所述网络请求对应的历史属性信息；根据获取的所述网络请求对应的历史属性信息，判断所述网络请求对应的IP地址是否存在所述网络请求被阻断和/或报警提醒的记录，以及判断所述网络请求对应的IP地址是否存在登录账号被攻击的记录。
  14. 根据权利要求12所述的装置，其中，
    所述第一打分单元，设置为获取所述IP属性信息中的每一种属性信息的权重系数，其中，所述权重系数为0到1之间的正数；
    对所述IP属性信息中的每一种属性信息进行打分，其中，对每一种属性信息打分均在相同的满分制下进行；
    将所述每一种属性信息的分数乘以对应的权重系数，得到所述每一种属性信息的权重分数，将所述每一种属性信息的权重分数相加，得到所述第一次打分分数。
  15. 根据权利要求12所述的装置，其中，
    所述第一打分单元，设置为在预设的IP属性信息组合分值表中，查找所述网络请求对应的IP属性信息组合所对应的分数，将所查找到的分数作为所述第一次打分分数；
    其中，所述网络请求对应的IP属性信息组合包括：所述网络请求对应的IP属性信息中的每种属性信息。
  16. 根据权利要求11所述的装置，其中，所述IP行为信息获取单元获取的所述IP行为信息包括：IP行为走势信息、IP行为历史同期信息和IP行为同类对比信息；其中，
    所述IP行为走势信息为在当前第一预设周期内所统计的所述网络请求次数的变化信息；
    所述IP行为历史同期信息为在当前第一预设周期之前的第二预设周期内统计的所述网络请求次数的变化信息；
    所述IP行为同类对比信息包括：在当前第一预设周期之前的第三预设周期内统计的所述网络请求对应的两种同类对比信息，其中，所述两种同类对比信息包括：
    第一种同类对比信息为所述网络请求对应的IP地址的登录账号次数与注册账号次数的比值；
    第二种同类对比信息为所述网络请求对应的IP地址的登录账号成功次数与注册账号成功次数的比值。
  17. 根据权利要求16所述的装置，其中，在所述接收单元接收的网络请求包括登录账号请求的情况下，所述IP行为同类对比信息还包括：第三种同类对比信息；其中，第三种同类对比信息为：在当前第一预设周期之前的第四预设周期内统计的、所述网络请求对应的登录账号在第一区域被成功登录的次数与在第二区域被成功登录的次数的比值。
  18. 根据权利要求16或17所述的装置，其中，
    所述第二打分单元，设置为获取所述IP行为信息中的每一种行为信息的权重系数，其中，所述权重系数为0到1之间的正数；
    对所述IP行为信息中的每一种行为信息进行打分，其中，对每一种行为信息打分均在相同的满分制下进行；
    将所述每一种行为信息的分数乘以对应的权重系数，得到所述每一种行为信息的权重分数，将所述每一种行为信息的权重分数相加，得到所述第二次打分分数。
  19. 根据权利要求18所述的装置，其中，在所述IP行为信息中包括IP行为同类对比信息的情况下，所述第二打分单元包括打分子单元；
    所述打分子单元，设置为对所述IP行为信息中的IP行为同类对比信息打分；其中，对所述IP行为信息中的IP行为同类对比信息打分包括：
    对所述IP行为同类对比信息中的每一种同类对比信息进行打分，其中，对每一种同类对比信息打分均在预先设定的满分制下进行；
    将所述每一种同类对比信息的分数乘以对应的权重系数，得到所述每一种同类对比信息的权重分数，将所述每一种同类对比信息的权重分数相加，得到所述IP行为信息中的IP行为同类对比信息的分数。
  20. 根据权利要求19所述的装置，其中，所述打分子单元，还设置为在对所述IP行为同类对比信息中的每一种同类对比信息进行打分的步骤之前，
    当所述第一种同类对比信息小于第一预设值时，判定所述第一种同类对比信息的分数在第一分数段；当所述第一种同类对比信息小于第二预设值且不小于第一预设值时，判定所述第一种同类对比信息的分数在第二分数段；当所述第一种同类对比信息不小于第二预设值时，判定所述第一种同类对比信息的分数在第三分数段；其中，所述第一预设值小于所述第二预设值；
    当所述第二种同类对比信息小于第三预设值时，判定所述第二种同类对比信息的分数在第一分数段；当所述第二种同类对比信息小于第四预设值且不小于第三预设值时，判定所述第二种同类对比信息的分数在第二分数段；当所述第二种同类对比信息不小于第四预设值时，判定所述第二种同类对比信息的分数在第三分数段；其中，所述第三预设值小于所述第四预设值；
    当所述第三种同类对比信息小于第五预设值时，判定所述第三种同类对比信息的分数在第一分数段；当所述第三种同类对比信息小于第六预设值且不小于第五预设值时，判定所述第三种同类对比信息的分数在第二分数段；当所述第三种同类对比信息不小于第六预设值时，判定所述第三种同类对比信息的分数在第三分数段；其中，所述第五预设值小于所述第六预设值。
  21. 一种电子设备，包括处理器和存储器；
    存储器，设置为存放计算机程序；
    处理器，设置为执行存储器上所存放的程序时，实现权利要求1-10任一所述的方法步骤。
  22. 一种计算机可读存储介质，所述计算机可读存储介质内存储有计算机程序，所述计算机程序被处理器执行时实现权利要求1-10任一项所述的方法步骤。
  23. 一种应用程序，所述应用程序用于在运行时执行权利要求1-10任一项所述的方法步骤。
PCT/CN2018/105233 2017-09-14 2018-09-12 一种网络请求处理方法、装置、电子设备及存储介质 WO2019052469A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710831755.XA CN109510800B (zh) 2017-09-14 2017-09-14 一种网络请求处理方法、装置、电子设备及存储介质
CN201710831755.X 2017-09-14

Publications (1)

Publication Number Publication Date
WO2019052469A1 true WO2019052469A1 (zh) 2019-03-21

Family

ID=65722396

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/105233 WO2019052469A1 (zh) 2017-09-14 2018-09-12 一种网络请求处理方法、装置、电子设备及存储介质

Country Status (2)

Country Link
CN (1) CN109510800B (zh)
WO (1) WO2019052469A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110046079B (zh) * 2019-04-25 2024-03-12 广州方硅信息技术有限公司 网络请求检测方法、装置及设备
CN110233831A (zh) * 2019-05-21 2019-09-13 深圳壹账通智能科技有限公司 恶意注册的检测方法及装置
CN112733104B (zh) * 2021-01-11 2023-08-25 杭州迪普科技股份有限公司 账号注册请求处理方法及装置
CN113992358B (zh) * 2021-09-29 2023-07-07 杭州迪普科技股份有限公司 网络安全策略的分配方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8286239B1 (en) * 2008-07-24 2012-10-09 Zscaler, Inc. Identifying and managing web risks
CN103841094A (zh) * 2012-11-27 2014-06-04 阿里巴巴集团控股有限公司 判断邮件类型的方法及设备
CN104391979A (zh) * 2014-12-05 2015-03-04 北京国双科技有限公司 网络恶意爬虫识别方法及装置
CN105939350A (zh) * 2016-05-30 2016-09-14 北京京东尚科信息技术有限公司 网络访问控制方法和系统

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100106611A1 (en) * 2008-10-24 2010-04-29 Uc Group Ltd. Financial transactions systems and methods
US10326848B2 (en) * 2009-04-17 2019-06-18 Empirix Inc. Method for modeling user behavior in IP networks
US8719939B2 (en) * 2009-12-31 2014-05-06 Mcafee, Inc. Malware detection via reputation system
EP2740285A4 (en) * 2011-08-05 2015-05-20 Lg Electronics Inc TERMINALS WITH MULTIPLE ACCOMMODATION
CN103581263B (zh) * 2012-08-06 2016-12-21 华为技术有限公司 Url点击事件的识别方法、装置和服务器
CN106503562A (zh) * 2015-09-06 2017-03-15 阿里巴巴集团控股有限公司 一种风险识别方法及装置
CN106534043B (zh) * 2015-09-09 2020-04-24 阿里巴巴集团控股有限公司 一种流量处理方法，设备和系统
CN106603555A (zh) * 2016-12-29 2017-04-26 杭州迪普科技股份有限公司 一种防护撞库攻击的方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8286239B1 (en) * 2008-07-24 2012-10-09 Zscaler, Inc. Identifying and managing web risks
CN103841094A (zh) * 2012-11-27 2014-06-04 阿里巴巴集团控股有限公司 判断邮件类型的方法及设备
CN104391979A (zh) * 2014-12-05 2015-03-04 北京国双科技有限公司 网络恶意爬虫识别方法及装置
CN105939350A (zh) * 2016-05-30 2016-09-14 北京京东尚科信息技术有限公司 网络访问控制方法和系统

Also Published As

Publication number Publication date
CN109510800B (zh) 2020-11-27
CN109510800A (zh) 2019-03-22

Similar Documents

Publication Publication Date Title
US11652834B2 (en) Methods for using organizational behavior for risk ratings
US10936733B2 (en) Reducing inappropriate online behavior using analysis of email account usage data to select a level of network service
US9509715B2 (en) Phishing and threat detection and prevention
WO2019052469A1 (zh) 一种网络请求处理方法、装置、电子设备及存储介质
US9870464B1 (en) Compromised authentication information clearing house
US10116623B2 (en) Methods and systems for providing a token-based application firewall correlation
US11087334B1 (en) Method and system for identifying potential fraud activity in a tax return preparation system, at least partially based on data entry characteristics of tax return content
US20180196875A1 (en) Determining repeat website users via browser uniqueness tracking
WO2017067394A1 (zh) 客户服务方式的分配方法及系统
EP3610622B1 (en) Location-based detection of unauthorized use of interactive computing environment functions
JP2015167039A (ja) インターネット資源に関するリスクプロファイルを開発するシステムおよび方法
US20110185436A1 (en) Url filtering based on user browser history
US10282461B2 (en) Structure-based entity analysis
CN105989275B (zh) 用于认证的方法和系统
US10958684B2 (en) Method and computer device for identifying malicious web resources
US20190130123A1 (en) Monitoring and preventing unauthorized data access
US20150067772A1 (en) Apparatus, method and computer-readable storage medium for providing notification of login from new device
EP3533199A1 (en) Detection of fraudulent account usage in distributed computing systems
US10992972B1 (en) Automatic identification of impermissable account sharing
WO2017019717A1 (en) Dynamic attachment delivery in emails for advanced malicious content filtering
WO2019114246A1 (zh) 一种身份认证方法、服务器及客户端设备
US11630895B2 (en) System and method of changing the password of an account record under a threat of unlawful access to user data
US11568416B2 (en) Cryptocurrency transaction pattern based threat intelligence
US9723017B1 (en) Method, apparatus and computer program product for detecting risky communications
US20230135054A1 (en) System and Methods for Agentless Managed Device Identification as Part of Setting a Security Policy for a Device

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18856010

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18856010

Country of ref document: EP

Kind code of ref document: A1