WO2019080429A1 - 电子装置、访问请求控制方法和计算机可读存储介质 - Google Patents

电子装置、访问请求控制方法和计算机可读存储介质

Info

Publication number
WO2019080429A1
WO2019080429A1 PCT/CN2018/077669 CN2018077669W WO2019080429A1 WO 2019080429 A1 WO2019080429 A1 WO 2019080429A1 CN 2018077669 W CN2018077669 W CN 2018077669W WO 2019080429 A1 WO2019080429 A1 WO 2019080429A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
address
threshold
client
access request
Prior art date
Application number
PCT/CN2018/077669
Other languages
English (en)
French (fr)
Inventor
蔡俊
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2019080429A1 publication Critical patent/WO2019080429A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources

Definitions

  • the present application relates to the field of network technologies, and in particular, to an electronic device, an access request control method, and a computer readable storage medium.
  • IP blacklisting there are many ways to implement IP blacklisting, which are usually: 1. In the LINUX operating system, use iptables (IP packet filtering system) to add; 2. At the web server level, such as nginx, use its own deny module. Add; 3, at the network layer, use the network device configuration to intercept the IP address.
  • iptables IP packet filtering system
  • Add 3
  • the foregoing methods cannot implement the dynamic restriction on accessing IP, and need to be manually configured by the management personnel. When the violent flashing or malicious access occurs, the response is slow, causing network congestion and abnormal server access.
  • the main purpose of the present application is to provide an electronic device, an access request control method, and a computer readable storage medium, which are intended to implement dynamic restrictions on accessing a user's IP address, and to quickly respond to abnormal access situations such as violent flashing or malicious access.
  • an electronic device proposed by the present application includes a memory and a processor, and the memory stores an access request control system operable on the processor, where the access request control system is executed by the processor.
  • the access frequency is greater than the first threshold, rejecting the access request of the client, and setting the IP address to prohibit access within a preset time countdown;
  • the client's access request is allowed.
  • the application also provides an access request control method, the method comprising the steps of:
  • the access frequency is greater than the first threshold, rejecting the access request of the client, and setting a preset time-delayed access countdown to the IP address;
  • the client's access request is allowed.
  • the present application also provides a computer readable storage medium storing an access request control system, the access request control system being executable by at least one processor to cause the at least one processor to execute the following step:
  • the access frequency is greater than the first threshold, rejecting the access request of the client, and setting a preset time-delayed access countdown to the IP address;
  • the client's access request is allowed.
  • the technical solution of the present application compares the access frequency of the access user with the maximum frequency value allowed by the system by monitoring the access frequency of the access user's IP address, and sets the IP address of the access user whose access frequency exceeds the maximum frequency value to be forbidden. It cannot access the server for a while.
  • the access record of the IP address of the access user in the database After receiving the access request of the user, query the access record of the IP address of the access user in the database, and confirm whether the IP address has visited the server before; after confirming that the IP address has visited the server before, First confirm whether the IP address is in the forbidden state, if in the forbidden state, directly reject the access request of the IP address, if not in the prohibited state, compare the access frequency of the IP address with the maximum frequency value; If the access frequency of the IP address exceeds the maximum frequency value, the access to the IP address is too frequent, the abnormal access situation is determined, the access request of the IP address is denied, and the IP address is set to be disabled for a preset period of time.
  • the solution monitors the access frequency of the IP address of the access user and controls the access request of the IP address according to the access frequency of the IP address, thereby realizing the dynamic restriction on the IP address of the access user, thereby quickly responding to the violence.
  • Abnormal access situations such as flashing or malicious access ensure the smooth operation of the network and the normal operation of the server, avoiding the consumption of resources such as short messages by malicious requests, and reducing the cost of short messages.
  • FIG. 1 is a schematic flowchart of an embodiment of an access request control method according to an application of the present application
  • FIG. 2 is a schematic flowchart of a second embodiment of an access request control method according to the present application.
  • FIG. 3 is a schematic diagram of an operating environment of an embodiment of an access request control system according to the present application.
  • FIG. 4 is a program module diagram of an embodiment of an access request control system of the present application.
  • FIG. 5 is a schematic diagram of a program module of an embodiment of an access request control system according to the present application.
  • FIG. 1 is a schematic flowchart of an embodiment of an access request control method according to an application.
  • the access request control method includes:
  • Step S10 receiving an access request of the client to the server, extracting an IP address in the access request, and querying whether there is an access record of the IP address in the database;
  • the system When a client requests access to the server, the system receives the access request and extracts the IP address of the client from the access request; the system database stores a record of the IP address of the client that has accessed the server, and therefore, the system receives After the access request, the first step is to find out from the database whether there is an access record of the IP address of the currently accessed client.
  • the server is preferably configured based on Nginx+Lua
  • the database is a Redis database
  • the user client accesses the server through the network
  • the server utilizes nginx as a web service and a reverse proxy server.
  • Step S20 If there is an access record of the IP address in the database, analyze whether the IP address is within the period of prohibiting access to the countdown period;
  • the IP address is the IP address of the server that has been accessed before.
  • the system first analyzes whether the IP address is within the countdown period of the access prohibition, that is, whether the IP address is in the The access status is forbidden, that is, it is confirmed that there is abnormal access before the IP address and is placed in the IP blacklist.
  • the forbidden access status has a duration (for example, 2 hours), that is, it is forbidden for a period of time to be inaccessible, and is not permanently prohibited; when the prohibition period elapses (ie, the countdown ends), the system clears the forbidden access status of the IP address, the IP The address is removed from the IP blacklist.
  • Step S30 If the IP address is not within the period of prohibiting the access countdown period, compare the access frequency of the IP address with the preset first threshold value;
  • the access frequency of the IP address is further compared, and the access frequency of the IP address is compared with a preset first threshold in the system;
  • the first threshold is the highest frequency value that the system allows the user to access. If the user's access frequency does not exceed the first threshold, the user is considered to be a normal access. If the user's access frequency exceeds the highest frequency, the user is considered to be a non-user. Normal access (for example, violent brushing, malicious cyber attacks, etc.).
  • Step S40 If the access frequency is greater than the first threshold, reject the access request of the client, and set the IP address to prohibit access within a preset time countdown;
  • the system determines that the access frequency of the IP address exceeds the first threshold, that is, exceeds the highest frequency value allowed by the system, the system determines that the IP address is an abnormal access operation (for example, the user of the IP address may want to crawl the website) Content or malicious access to consume website traffic resources, etc.), so the system rejects the client's access request to protect the security of the website and avoid waste of resources; and the system sets the IP address to a preset duration (for example, 2 hours) The internal access control state (that is, the IP address is added to the IP blacklist), so that the IP address cannot access the server for the next preset time period, avoiding the system consuming too many resources to continuously process the frequent non-IP address. Normal access request.
  • an abnormal access operation for example, the user of the IP address may want to crawl the website
  • the system rejects the client's access request to protect the security of the website and avoid waste of resources
  • the system sets the IP address to a preset duration (for example
  • Step S50 If the access frequency is less than or equal to the first threshold, the access request of the client is allowed.
  • the system determines that the access frequency of the IP address does not exceed the highest frequency value allowed by the system (ie, the first threshold), and determines that the IP address is a normal access operation, the system allows the client to access the request, so that the client normally accesses the server.
  • Step S60 if the IP address is within the period of prohibiting access to the countdown period, the access request of the client is rejected.
  • the system directly rejects the access request of the client.
  • the access frequency of the access user is compared with the maximum frequency value allowed by the system, and the IP address of the access user whose access frequency exceeds the maximum frequency value is set to be prohibited. Make it inaccessible to the server for a while.
  • the access record of the IP address of the access user in the database After receiving the access request of the user, query the access record of the IP address of the access user in the database, and confirm whether the IP address has visited the server before; after confirming that the IP address has visited the server before, First confirm whether the IP address is in the forbidden state, if in the forbidden state, directly reject the access request of the IP address, if not in the prohibited state, compare the access frequency of the IP address with the maximum frequency value; If the access frequency of the IP address exceeds the maximum frequency value, the access to the IP address is too frequent, the abnormal access situation is determined, the access request of the IP address is denied, and the IP address is set to be disabled for a preset period of time.
  • the solution monitors the access frequency of the IP address of the access user and controls the access request of the IP address according to the access frequency of the IP address, thereby realizing the dynamic restriction on the IP address of the access user, thereby quickly responding to the violence.
  • Abnormal access situations such as flashing or malicious access ensure the smooth operation of the network and the normal operation of the server, avoiding the consumption of resources such as short messages by malicious requests, and reducing the cost of short messages.
  • the access request control method further includes:
  • Step S70 If there is no access record of the IP address in the database, the access request of the client is allowed.
  • the IP address is not the IP address of the previously visited user, and the system allows the client to access the request.
  • the access request control method of the embodiment further includes:
  • the access frequency of the IP address is determined by counting the number of accesses to the IP address, and only the number of accesses within the preset preset duration (for example, 20 minutes) of the IP address is obtained (the IP address is currently The number of visits minus the number of visits 20 minutes before the IP address) is obtained by dividing the number of visits by the preset duration. It is not necessary to go to the database to query the access record of the IP address.
  • the access request control method replaces the step S30 with:
  • Step S80 If the IP address is not in the no-access countdown period, determine the access frequency of the IP address, and determine the first threshold corresponding to the time interval to which the current time belongs according to the mapping relationship between the predetermined time interval and the first threshold. And comparing the determined access frequency to the determined size of the first threshold.
  • the mapping relationship between the time interval and the first threshold is set in the system in order to satisfy the access of more users in the time period of each time interval. Dividing into a plurality of time intervals, each time interval corresponding to a respective first threshold, and different first time values corresponding to different time intervals are different; in a time interval period in which the user is accessed, the corresponding first threshold is small (ie, allowed) The highest frequency value is small.
  • the access frequency of the IP address exceeds the first threshold, the access of the IP address is prohibited, and the access of the server to the server is restricted by the excessive access of the individual user (that is, the individual IP address). Too many, so that the server can make more current access users access normally; in the time interval period when the access users are less, the corresponding first threshold is larger (but the first threshold is still less than the system determines that the violence is violent or malicious Access the corresponding maximum frequency value) so that individual users can be satisfied as much as possible in the case of sufficient access to satisfy the current number of users accessed. More normal access requests.
  • the application also proposes an access request control system.
  • FIG. 3 is a schematic diagram of an operating environment of a preferred embodiment of the access request control system 10 of the present application.
  • the access request control system 10 is installed and operated in the electronic device 1.
  • the electronic device 1 may be a computing device such as a desktop computer, a notebook, a palmtop computer, and a server.
  • the electronic device 1 may include, but is not limited to, a memory 11, a processor 12, and a display 13.
  • Figure 3 shows only the electronic device 1 with components 11-13, but it should be understood that not all illustrated components may be implemented, and more or fewer components may be implemented instead.
  • the memory 11 may be an internal storage unit of the electronic device 1 in some embodiments, such as a hard disk or memory of the electronic device 1.
  • the memory 11 may also be an external storage device of the electronic device 1 in other embodiments, such as a plug-in hard disk equipped on the electronic device 1, a smart memory card (SMC), and a secure digital (SD). Card, flash card, etc.
  • the memory 11 may also include both an internal storage unit of the electronic device 1 and an external storage device.
  • the memory 11 is used to store application software and various types of data installed in the electronic device 1, such as program code of the access request control system 10.
  • the memory 11 can also be used to temporarily store data that has been output or is about to be output.
  • the processor 12 in some embodiments, may be a Central Processing Unit (CPU), microprocessor or other data processing chip for running program code or processing data stored in the memory 11, such as performing access request control. System 10 and so on.
  • CPU Central Processing Unit
  • microprocessor or other data processing chip for running program code or processing data stored in the memory 11, such as performing access request control. System 10 and so on.
  • the display 13 may be, in some embodiments, an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch sensor, or the like.
  • the display 13 is for displaying information processed in the electronic device 1 and a user interface for displaying visualization, such as a business customization interface or the like.
  • the components 11-13 of the electronic device 1 communicate with one another via a system bus.
  • FIG. 4 is a program module diagram of an embodiment of the access request control system 10 of the present application.
  • the access request control system 10 can be divided into one or more modules, one or more modules being stored in the memory 11, and by one or more processors (the processor 12 in this embodiment) Executed to complete the application.
  • the access request control system 10 can be divided into a query module 101, an analysis module 102, a first comparison module 103, a disable module 104, an allow module 105, and a reject module 106.
  • a module referred to in this application refers to a series of computer program instruction segments capable of performing a specific function, and is more suitable than the program for describing the execution process of the access request control system 10 in the electronic device 1, wherein:
  • the query module 101 is configured to receive an access request of the client to the server, extract an IP address in the access request, and query whether there is an access record of the IP address in the database;
  • the system When a client requests access to the server, the system receives the access request and extracts the IP address of the client from the access request; the system database stores a record of the IP address of the client that has accessed the server, and therefore, the system receives After the access request, the first step is to find out from the database whether there is an access record of the IP address of the currently accessed client.
  • the server is preferably configured based on Nginx+Lua
  • the database is a Redis database
  • the user client accesses the server through the network
  • the server utilizes nginx as a web service and a reverse proxy server.
  • the analyzing module 102 is configured to analyze whether the IP address is within the period of prohibiting access countdown after confirming that the access record of the IP address exists in the database;
  • the IP address is the IP address of the server that has been accessed before.
  • the system first analyzes whether the IP address is within the countdown period of the access prohibition, that is, whether the IP address is in the The access status is forbidden, that is, it is confirmed that there is abnormal access before the IP address and is placed in the IP blacklist.
  • the forbidden access status has a duration (for example, 2 hours), that is, it is forbidden for a period of time to be inaccessible, and is not permanently prohibited; when the prohibition period elapses (ie, the countdown ends), the system clears the forbidden access status of the IP address, the IP The address is removed from the IP blacklist.
  • the first comparison module 103 is configured to compare the access frequency of the IP address with a preset first threshold after confirming that the IP address is not within the countdown period of the forbidden access;
  • the access frequency of the IP address is further compared, and the access frequency of the IP address is compared with a preset first threshold in the system;
  • the first threshold is the highest frequency value that the system allows the user to access. If the user's access frequency does not exceed the first threshold, the user is considered to be a normal access. If the user's access frequency exceeds the highest frequency, the user is considered to be a non-user. Normal access (for example, violent brushing, malicious cyber attacks, etc.).
  • the prohibiting module 104 is configured to reject the access request of the client when the access frequency is greater than the first threshold, and set the IP address to prohibit access during a countdown of a preset duration;
  • the system determines that the access frequency of the IP address exceeds the first threshold, that is, exceeds the highest frequency value allowed by the system, the system determines that the IP address is an abnormal access operation (for example, the user of the IP address may want to crawl the website) Content or malicious access to consume website traffic resources, etc.), so the system rejects the client's access request to protect the security of the website and avoid waste of resources; and the system sets the IP address to a preset duration (for example, 2 hours) The internal access control state (that is, the IP address is added to the IP blacklist), so that the IP address cannot access the server for the next preset time period, avoiding the system consuming too many resources to continuously process the frequent non-IP address. Normal access request.
  • an abnormal access operation for example, the user of the IP address may want to crawl the website
  • the system rejects the client's access request to protect the security of the website and avoid waste of resources
  • the system sets the IP address to a preset duration (for example
  • the enabling module 105 is configured to allow the access request of the client when the access frequency is less than or equal to the first threshold.
  • the system determines that the access frequency of the IP address does not exceed the highest frequency value allowed by the system (ie, the first threshold), and determines that the IP address is a normal access operation, the system allows the client to access the request, so that the client normally accesses the server.
  • the rejecting module 106 is configured to reject the access request of the client after confirming that the IP address is within the period of prohibiting access countdown.
  • the system directly rejects the access request of the client.
  • the access frequency of the access user is compared with the maximum frequency value allowed by the system, and the IP address of the access user whose access frequency exceeds the maximum frequency value is set to be prohibited. Make it inaccessible to the server for a while.
  • the access record of the IP address of the access user in the database After receiving the access request of the user, query the access record of the IP address of the access user in the database, and confirm whether the IP address has visited the server before; after confirming that the IP address has visited the server before, First confirm whether the IP address is in the forbidden state, if in the forbidden state, directly reject the access request of the IP address, if not in the prohibited state, compare the access frequency of the IP address with the maximum frequency value; If the access frequency of the IP address exceeds the maximum frequency value, the access to the IP address is too frequent, the abnormal access situation is determined, the access request of the IP address is denied, and the IP address is set to be disabled for a preset period of time.
  • the solution monitors the access frequency of the IP address of the access user and controls the access request of the IP address according to the access frequency of the IP address, thereby realizing the dynamic restriction on the IP address of the access user, thereby quickly responding to the violence.
  • Abnormal access situations such as flashing or malicious access ensure the smooth operation of the network and the normal operation of the server, avoiding the consumption of resources such as short messages by malicious requests, and reducing the cost of short messages.
  • the permission module 106 of the access request control system is further configured to: when the access record of the IP address is not in the confirmation database, allow the access request of the client.
  • the IP address is not the IP address of the previously visited user, and the system allows the client to access the request.
  • the permission module 106 is further configured to increase the number of accesses of the IP address of the client by one after allowing the client to access the request.
  • the access frequency of the IP address is determined by counting the number of accesses to the IP address, and only the number of accesses within the preset preset duration (for example, 20 minutes) of the IP address is obtained (the IP address is currently The number of visits minus the number of visits 20 minutes before the IP address) is obtained by dividing the number of visits by the preset duration. It is not necessary to go to the database to query the access record of the IP address.
  • FIG. 5 it is a program module diagram of a second embodiment of the access request control system 10 of the present application.
  • the first comparison module 103 is replaced with a second comparison module 107;
  • the second comparison module 107 is configured to determine an access frequency of the IP address after confirming that the IP address is not in the countdown period of the forbidden access, and determine a current time according to a mapping relationship between the predetermined time interval and the first threshold. The time interval corresponds to the first threshold, and compares the determined access frequency with the determined first threshold.
  • the mapping relationship between the time interval and the first threshold is set in the system in order to satisfy the access of more users in the time period of each time interval. Dividing into a plurality of time intervals, each time interval corresponding to a respective first threshold, and different first time values corresponding to different time intervals are different; in a time interval period in which the user is accessed, the corresponding first threshold is small (ie, allowed) The highest frequency value is small.
  • the access frequency of the IP address exceeds the first threshold, the access of the IP address is prohibited, and the access of the server to the server is restricted by the excessive access of the individual user (that is, the individual IP address). Too many, so that the server can make more current access users access normally; in the time interval period when the access users are less, the corresponding first threshold is larger (but the first threshold is still less than the system determines that the violence is violent or malicious Access the corresponding maximum frequency value) so that individual users can be satisfied as much as possible in the case of sufficient access to satisfy the current number of users accessed. Many times the normal access request.
  • the present application further provides a computer readable storage medium storing an access request control system, the access request control system being executable by at least one processor to cause the at least one process
  • the apparatus performs the access request control method in any of the above embodiments.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Power Engineering (AREA)
  • Computational Linguistics (AREA)
  • Data Mining & Analysis (AREA)
  • Databases & Information Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开一种电子装置、访问请求控制方法及存储介质，该方法包括：接收客户端对服务器的访问请求，提取IP地址，查询数据库中是否有该IP地址的访问记录；若有，则分析该IP地址是否在禁止访问的倒计时时段内；若该IP地址不在禁止访问的倒计时时段内，则比较该IP地址的访问频率与预设的第一阈值的大小；若所述访问频率大于所述第一阈值，则拒绝该访问请求，并设置该IP地址在预设时长的倒计时内禁止访问；若所述访问频率小于等于所述第一阈值，则允许该访问请求；若该IP地址在禁止访问的倒计时时段内，则拒绝该访问请求。本申请技术方案实现了对访问用户的IP地址的动态限制，能够快速响应暴力刷机或恶意访问等异常访问情况。

Description

电子装置、访问请求控制方法和计算机可读存储介质
本申请要求于2017年10月23日提交中国专利局、申请号为201710993385.X、发明名称为“电子装置、访问请求控制方法和计算机可读存储介质”的中国专利申请的优先权，其全部内容通过引用结合在申请中。
技术领域
本申请涉及网络技术领域，特别涉及一种电子装置、访问请求控制方法和计算机可读存储介质。
背景技术
目前，实现IP黑名单的方式有很多种，通常为：1、在LINUX操作系统内，利用iptables(IP信息包过滤系统)进行添加；2、在web服务器层面，如nginx内利用自身deny模块进行添加；3、在网络层，利用网络设备配置进行IP地址的拦截。但前述这些方式都无法实现对访问IP的动态限制，需要管理人员手工进行配置，在发生暴力刷机或者恶意访问情况时响应较慢，造成网络拥堵、服务器访问异常等情况。
发明内容
本申请的主要目的是提供一种电子装置、访问请求控制方法和计算机可读存储介质，旨在实现对访问用户的IP地址的动态限制，快速响应暴力刷机或恶意访问等异常访问情况。
为实现上述目的，本申请提出的电子装置，包括存储器和处理器，所述存储器上存储有可在所述处理器上运行的访问请求控制系统，所述访问请求控制系统被所述处理器执行时实现如下步骤：
接收客户端对服务器的访问请求，提取所述访问请求中的IP地址，查询数据库中是否有该IP地址的访问记录；
若数据库中有该IP地址的访问记录，则分析该IP地址是否在禁止访问的倒计时时段内；
若该IP地址不在禁止访问的倒计时时段内，则比较该IP地址的访问频率 与预设的第一阈值的大小；
若所述访问频率大于所述第一阈值，则拒绝所述客户端的访问请求，并设置该IP地址在预设时长的倒计时内禁止访问；
若所述访问频率小于等于所述第一阈值，则允许所述客户端的访问请求。
若该IP地址在禁止访问的倒计时时段内，则拒绝所述客户端的访问请求。
本申请还提出一种访问请求控制方法，该方法包括步骤：
接收客户端对服务器的访问请求，提取所述访问请求中的IP地址，查询数据库中是否有该IP地址的访问记录；
若数据库中有该IP地址的访问记录，则分析该IP地址是否在禁止访问倒计时时段内；
若该IP地址不在禁止访问倒计时时段内，则比较该IP地址的访问频率与预设的第一阈值的大小；
若所述访问频率大于所述第一阈值，则拒绝所述客户端的访问请求，并给该IP地址设置预设时长的禁止访问倒计时；
若所述访问频率小于等于所述第一阈值，则允许所述客户端的访问请求。
若该IP地址在禁止访问倒计时时段内，则拒绝所述客户端的访问请求。
本申请还提出一种计算机可读存储介质，所述计算机可读存储介质存储有访问请求控制系统，所述访问请求控制系统可被至少一个处理器执行，以使所述至少一个处理器执行以下步骤：
接收客户端对服务器的访问请求，提取所述访问请求中的IP地址，分析数据库中是否有该IP地址的访问记录；
若数据库中有该IP地址的访问记录，则分析该IP地址是否在禁止访问倒计时时段内；
若该IP地址不在禁止访问倒计时时段内，则比较该IP地址的访问频率与预设的第一阈值的大小；
若所述访问频率大于所述第一阈值，则拒绝所述客户端的访问请求，并给该IP地址设置预设时长的禁止访问倒计时；
若所述访问频率小于等于所述第一阈值，则允许所述客户端的访问请求。
若该IP地址在禁止访问倒计时时段内，则拒绝所述客户端的访问请求。
本申请技术方案，通过监测访问用户的IP地址的访问频率，将访问用户的 访问频率与系统允许的最大频率值比较，对访问频率超过最大频率值的访问用户的IP地址设置为禁止访问，使其在一段时间内不能访问服务器。具体的，在接收到用户的访问请求后，在数据库中查询该访问用户的IP地址的访问记录，确认该IP地址在前是否访问过服务器；在确认该IP地址在前访问过服务器后，再先确认该IP地址是否已经处于禁止状态中，如果在禁止状态中，则直接拒绝该IP地址的访问请求，如果没有在禁止状态中，则将该IP地址的访问频率与最大频率值比较；如果该IP地址的访问频率超过该最大频率值，则说明该IP地址的访问过于频繁，定为异常访问情况，拒绝该IP地址的访问请求，并将该IP地址设置为在预设时长内禁止访问；如果该IP地址的额访问频率没有超过最大频率，则确定该IP地址的访问属于正常情况，允许访问。本方案通过对访问用户的IP地址的访问频率的监测，并根据IP地址的访问频率来对IP地址的访问请求进行管控限制，实现了对访问用户的IP地址的动态限制，从而快速的响应暴力刷机或恶意访问等异常访问情况，保障了网络畅通和服务器的正常运行，避免了恶意请求对短信等资源的消耗，降低了短信成本。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图示出的结构获得其他的附图。
图1为本申请访问请求控制方法一实施例的流程示意图；
图2为本申请访问请求控制方法二实施例的流程示意图；
图3为本申请访问请求控制系统一实施例的运行环境示意图；
图4为本申请访问请求控制系统一实施例的程序模块图
图5为本申请访问请求控制系统二实施例的程序模块图。
本申请目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
具体实施方式
以下结合附图对本申请的原理和特征进行描述，所举实例只用于解释本申请，并非用于限定本申请的范围。
如图1所示，图1为本申请访问请求控制方法一实施例的流程示意图。
本实施例中，该访问请求控制方法包括：
步骤S10，接收客户端对服务器的访问请求，提取所述访问请求中的IP地址，查询数据库中是否有该IP地址的访问记录；
当有客户端请求访问服务器时，系统接收该访问请求，并从该访问请求提取出该客户端的IP地址；系统的数据库中存有访问过服务器的客户端的IP地址的记录，因此，系统在接收到访问请求后，首先是从数据库中查找是否具有当前访问客户端的IP地址的访问记录。本实施例中，服务器优选采用基于Nginx+Lua配置的，数据库为Redis数据库，用户客户端通过网络访问服务器，服务器利用nginx作为web服务和反向代理服务器。
步骤S20，若数据库中有该IP地址的访问记录，则分析该IP地址是否在禁止访问倒计时时段内；
当系统从数据库中查询到该IP地址的访问记录，说明该IP地址是之前已经访问过服务器的IP地址，系统则先分析该IP地址是否在禁止访问倒计时时段内，即确认该IP地址是否处于禁止访问状态，也即确认该IP地址之前是否有不正常访问情况而被置于IP黑名单中。该禁止访问状态具有时长期限(例如2小时)，即只是禁止一段时间不能访问，并非永久禁止；当禁止时长过去(即倒计时结束)后，系统则会清除该IP地址的禁止访问状态，该IP地址从IP黑名单中移除。
步骤S30，若该IP地址不在禁止访问倒计时时段内，则比较该IP地址的访问频率与预设的第一阈值的大小；
当确认该IP地址没有处于禁止访问倒计时时段内，即不是禁止访问状态后，则进一步比较该IP地址的访问频率大小，将该IP地址的访问频率与系统中预先设置的第一阈值进行比较；该第一阈值为系统作为允许用户访问的最高频率值，若用户的访问频率没超过该第一阈值，则认为用户为正常访问，若用户的访问频率超过该最高频率值，则认为用户为非正常访问(例如，暴力刷机、恶意网络攻击等)。
步骤S40，若所述访问频率大于所述第一阈值，则拒绝所述客户端的访问请求，并设置该IP地址在预设时长的倒计时内禁止访问；
当系统确定该IP地址的访问频率超过该第一阈值，即超过了系统允许的最高频率值，此时系统判定该IP地址为非正常访问操作(例如，该IP地址的用户可能想爬取网站内容或者恶意访问以耗费网站流量资源等)，故此时系统拒绝该客户端的访问请求，以保障网站的安全及避免资源的浪费；并且，系统将该IP地址设置为在预设时长(例如2小时)内为禁止访问状态(即将该IP地址加到IP黑名单)，使该IP地址在接下来的预设时长内都无法访问服务器，避免系统耗费过多资源持续处理该IP地址的频繁的非正常访问请求。
步骤S50，若所述访问频率小于等于所述第一阈值，则允许所述客户端的访问请求。
当系统确定该IP地址的访问频率没有超过系统允许的最高频率值(即第一阈值)，判定该IP地址为正常访问操作，系统则允许所述客户端的访问请求，使客户端正常访问服务器。
步骤S60，若该IP地址在禁止访问倒计时时段内，则拒绝所述客户端的访问请求。
如果该IP地址处于禁止访问状态中，即该IP地址的禁止访问限制时间还没有结束，系统则直接拒绝所述客户端的访问请求。
本实施例技术方案，通过监测访问用户的IP地址的访问频率，将访问用户的访问频率与系统允许的最大频率值比较，对访问频率超过最大频率值的访问用户的IP地址设置为禁止访问，使其在一段时间内不能访问服务器。具体的，在接收到用户的访问请求后，在数据库中查询该访问用户的IP地址的访问记录，确认该IP地址在前是否访问过服务器；在确认该IP地址在前访问过服务器后，再先确认该IP地址是否已经处于禁止状态中，如果在禁止状态中，则直接拒绝该IP地址的访问请求，如果没有在禁止状态中，则将该IP地址的访问频率与最大频率值比较；如果该IP地址的访问频率超过该最大频率值，则说明该IP地址的访问过于频繁，定为异常访问情况，拒绝该IP地址的访问请求，并将该IP地址设置为在预设时长内禁止访问；如果该IP地址的额访问频率没有超过最大频率，则确定该IP地址的访问属于正常情况，允许访问。本方案通过对访问用户的IP地址的访问频率的监测，并根据IP地址的访 问频率来对IP地址的访问请求进行管控限制，实现了对访问用户的IP地址的动态限制，从而快速的响应暴力刷机或恶意访问等异常访问情况，保障了网络畅通和服务器的正常运行，避免了恶意请求对短信等资源的消耗，降低了短信成本。
如图1所示，本实施例中，所述访问请求控制方法还包括：
步骤S70，若数据库中无该IP地址的访问记录，则允许所述客户端的访问请求。
当在数据库中没有查找到该IP地址的访问记录，说明该IP地址不是在前访问过的用户的IP地址，系统则允许所述客户端的访问请求。
进一步地，本实施例的访问请求控制方法在所述允许所述客户端的访问请求步骤之后，还包括：
使该客户端的IP地址的访问次数加1。
本实施例通过对IP地址的访问次数的统计，使IP地址的访问频率的确定，只需通过获取该IP地址最近的预设时长(例如20分钟)内的访问次数(将该IP地址当前的访问次数减去该IP地址20分钟前的访问次数)，再将访问次数除以该预设时长即可得到，不需要去数据库中查询IP地址的访问记录，更加简便。
本实施例中，所述访问请求控制方法将所述步骤S30替换为：
步骤S80，若该IP地址不在禁止访问倒计时时段内，则确定该IP地址的访问频率，及根据预先确定的时间区间与第一阈值的映射关系，确定当前时刻所属的时间区间对应的第一阈值，并比较确定的访问频率与确定的第一阈值的大小关系。
由于服务器在各个时间区间的时间段内的访问量会有差异，有的时间区间的时段内，服务器的访问用户很多，有的时间区间的时段内，服务器的访问用户很少。而服务器的处理能力是固定的，为了能尽可能满足每个时间区间的时段内的更多用户的访问，本实施例中，系统中设置了时间区间与第一阈值的映射关系表，将一天分为多个时间区间，各个时间区间分别对应各自 的第一阈值，不同时间区间对应的第一阈值不同；在访问用户非常多的时间区间时段内，对应的第一阈值较小(即允许的最高频率值较小)，当有IP地址的访问频率超过该第一阈值，则禁止该IP地址的访问，限制了个别用户(即个别IP地址)过于频繁的访问而对服务器的访问资源的占用过多，使服务器能使当前更多的访问用户进行正常访问；在访问用户较少的时间区间时段内，对应的第一阈值较大(但该第一阈值依然小于系统判定为暴力刷机或恶意访问所对应的最大频率值)，使在足够满足当前访问用户量的正常访问的情况下，尽可能的满足个别用户更多次的正常访问请求。
本申请还提出一种访问请求控制系统。
请参阅图3，是本申请访问请求控制系统10较佳实施例的运行环境示意图。
在本实施例中，访问请求控制系统10安装并运行于电子装置1中。电子装置1可以是桌上型计算机、笔记本、掌上电脑及服务器等计算设备。该电子装置1可包括，但不仅限于，存储器11、处理器12及显示器13。图3仅示出了具有组件11-13的电子装置1，但是应理解的是，并不要求实施所有示出的组件，可以替代的实施更多或者更少的组件。
存储器11在一些实施例中可以是电子装置1的内部存储单元，例如该电子装置1的硬盘或内存。存储器11在另一些实施例中也可以是电子装置1的外部存储设备，例如电子装置1上配备的插接式硬盘，智能存储卡(Smart Media Card,SMC)，安全数字(Secure Digital,SD)卡，闪存卡(Flash Card)等。进一步地，存储器11还可以既包括电子装置1的内部存储单元也包括外部存储设备。存储器11用于存储安装于电子装置1的应用软件及各类数据，例如访问请求控制系统10的程序代码等。存储器11还可以用于暂时地存储已经输出或者将要输出的数据。
处理器12在一些实施例中可以是一中央处理器(Central Processing Unit,CPU)，微处理器或其他数据处理芯片，用于运行存储器11中存储的程序代码或处理数据，例如执行访问请求控制系统10等。
显示器13在一些实施例中可以是LED显示器、液晶显示器、触控式液晶显示器以及OLED(Organic Light-Emitting Diode，有机发光二极管)触摸 器等。显示器13用于显示在电子装置1中处理的信息以及用于显示可视化的用户界面，例如业务定制界面等。电子装置1的部件11-13通过系统总线相互通信。
请参阅图4，是本申请访问请求控制系统10一实施例的程序模块图。在本实施例中，访问请求控制系统10可以被分割成一个或多个模块，一个或者多个模块被存储于存储器11中，并由一个或多个处理器(本实施例为处理器12)所执行，以完成本申请。例如，在图4中，访问请求控制系统10可以被分割成查询模块101、分析模块102、第一比较模块103、禁止模块104、允许模块105及拒绝模块106。本申请所称的模块是指能够完成特定功能的一系列计算机程序指令段，比程序更适合于描述访问请求控制系统10在电子装置1中的执行过程，其中：
查询模块101，用于接收客户端对服务器的访问请求，提取所述访问请求中的IP地址，查询数据库中是否有该IP地址的访问记录；
当有客户端请求访问服务器时，系统接收该访问请求，并从该访问请求提取出该客户端的IP地址；系统的数据库中存有访问过服务器的客户端的IP地址的记录，因此，系统在接收到访问请求后，首先是从数据库中查找是否具有当前访问客户端的IP地址的访问记录。本实施例中，服务器优选采用基于Nginx+Lua配置的，数据库为Redis数据库，用户客户端通过网络访问服务器，服务器利用nginx作为web服务和反向代理服务器。
分析模块102，用于在确认数据库中有该IP地址的访问记录后，分析该IP地址是否在禁止访问倒计时时段内；
当系统从数据库中查询到该IP地址的访问记录，说明该IP地址是之前已经访问过服务器的IP地址，系统则先分析该IP地址是否在禁止访问倒计时时段内，即确认该IP地址是否处于禁止访问状态，也即确认该IP地址之前是否有不正常访问情况而被置于IP黑名单中。该禁止访问状态具有时长期限(例如2小时)，即只是禁止一段时间不能访问，并非永久禁止；当禁止时长过去(即倒计时结束)后，系统则会清除该IP地址的禁止访问状态，该IP地址从IP黑名单中移除。
第一比较模块103，用于在确认该IP地址不在禁止访问倒计时时段内后，比较该IP地址的访问频率与预设的第一阈值的大小；
当确认该IP地址没有处于禁止访问倒计时时段内，即不是禁止访问状态后，则进一步比较该IP地址的访问频率大小，将该IP地址的访问频率与系统中预先设置的第一阈值进行比较；该第一阈值为系统作为允许用户访问的最高频率值，若用户的访问频率没超过该第一阈值，则认为用户为正常访问，若用户的访问频率超过该最高频率值，则认为用户为非正常访问(例如，暴力刷机、恶意网络攻击等)。
禁止模块104，用于在所述访问频率大于所述第一阈值时，拒绝所述客户端的访问请求，并设置该IP地址在预设时长的倒计时内禁止访问；
当系统确定该IP地址的访问频率超过该第一阈值，即超过了系统允许的最高频率值，此时系统判定该IP地址为非正常访问操作(例如，该IP地址的用户可能想爬取网站内容或者恶意访问以耗费网站流量资源等)，故此时系统拒绝该客户端的访问请求，以保障网站的安全及避免资源的浪费；并且，系统将该IP地址设置为在预设时长(例如2小时)内为禁止访问状态(即将该IP地址加到IP黑名单)，使该IP地址在接下来的预设时长内都无法访问服务器，避免系统耗费过多资源持续处理该IP地址的频繁的非正常访问请求。
允许模块105，用于在所述访问频率小于等于所述第一阈值时，允许所述客户端的访问请求。
当系统确定该IP地址的访问频率没有超过系统允许的最高频率值(即第一阈值)，判定该IP地址为正常访问操作，系统则允许所述客户端的访问请求，使客户端正常访问服务器。
拒绝模块106，用于在确认该IP地址在禁止访问倒计时时段内后，拒绝所述客户端的访问请求。
如果该IP地址处于禁止访问状态中，即该IP地址的禁止访问限制时间还没有结束，系统则直接拒绝所述客户端的访问请求。
本实施例技术方案，通过监测访问用户的IP地址的访问频率，将访问用户的访问频率与系统允许的最大频率值比较，对访问频率超过最大频率值的访问用户的IP地址设置为禁止访问，使其在一段时间内不能访问服务器。具体的，在接收到用户的访问请求后，在数据库中查询该访问用户的IP地址的访问记录，确认该IP地址在前是否访问过服务器；在确认该IP地址在前访问过服务器后，再先确认该IP地址是否已经处于禁止状态中，如果在禁止状态 中，则直接拒绝该IP地址的访问请求，如果没有在禁止状态中，则将该IP地址的访问频率与最大频率值比较；如果该IP地址的访问频率超过该最大频率值，则说明该IP地址的访问过于频繁，定为异常访问情况，拒绝该IP地址的访问请求，并将该IP地址设置为在预设时长内禁止访问；如果该IP地址的额访问频率没有超过最大频率，则确定该IP地址的访问属于正常情况，允许访问。本方案通过对访问用户的IP地址的访问频率的监测，并根据IP地址的访问频率来对IP地址的访问请求进行管控限制，实现了对访问用户的IP地址的动态限制，从而快速的响应暴力刷机或恶意访问等异常访问情况，保障了网络畅通和服务器的正常运行，避免了恶意请求对短信等资源的消耗，降低了短信成本。
具体的，本实施例中，所述访问请求控制系统的允许模块106还用于：在确认数据库中无该IP地址的访问记录时，允许所述客户端的访问请求。
当在数据库中没有查找到该IP地址的访问记录，说明该IP地址不是在前访问过的用户的IP地址，系统则允许所述客户端的访问请求。
进一步地，本实施例中，所述允许模块106还用于在允许所述客户端的访问请求之后，使该客户端的IP地址的访问次数加1。
本实施例通过对IP地址的访问次数的统计，使IP地址的访问频率的确定，只需通过获取该IP地址最近的预设时长(例如20分钟)内的访问次数(将该IP地址当前的访问次数减去该IP地址20分钟前的访问次数)，再将访问次数除以该预设时长即可得到，不需要去数据库中查询IP地址的访问记录，更加简便。
参阅图5，是本申请访问请求控制系统10二实施例的程序模块图。在本实施例中，将所述第一比较模块103替换为第二比较模块107；
所述第二比较模块107，用于在确认该IP地址不在禁止访问倒计时时段内后，确定该IP地址的访问频率，及根据预先确定的时间区间与第一阈值的映射关系，确定当前时刻所属的时间区间对应的第一阈值，并比较确定的访问频率与确定的第一阈值的大小关系。
由于服务器在各个时间区间的时间段内的访问量会有差异，有的时间区间的时段内，服务器的访问用户很多，有的时间区间的时段内，服务器的访问用户很少。而服务器的处理能力是固定的，为了能尽可能满足每个时间区间的时段内的更多用户的访问，本实施例中，系统中设置了时间区间与第一阈值的映射关系表，将一天分为多个时间区间，各个时间区间分别对应各自的第一阈值，不同时间区间对应的第一阈值不同；在访问用户非常多的时间区间时段内，对应的第一阈值较小(即允许的最高频率值较小)，当有IP地址的访问频率超过该第一阈值，则禁止该IP地址的访问，限制了个别用户(即个别IP地址)过于频繁的访问而对服务器的访问资源的占用过多，使服务器能使当前更多的访问用户进行正常访问；在访问用户较少的时间区间时段内，对应的第一阈值较大(但该第一阈值依然小于系统判定为暴力刷机或恶意访问所对应的最大频率值)，使在足够满足当前访问用户量的正常访问的情况下，尽可能的满足个别用户更多次的正常访问请求。
进一步地，本申请还提出一种计算机可读存储介质，所述计算机可读存储介质存储有访问请求控制系统，所述访问请求控制系统可被至少一个处理器执行，以使所述至少一个处理器执行上述任一实施例中的访问请求控制方法。
以上所述仅为本申请的优选实施例，并非因此限制本申请的专利范围，凡是在本申请的发明构思下，利用本申请说明书及附图内容所作的等效结构变换，或直接/间接运用在其他相关的技术领域均包括在本申请的专利保护范围内。

Claims (20)

  1. 一种电子装置，其特征在于，所述电子装置包括存储器和处理器，所述存储器上存储有可在所述处理器上运行的访问请求控制系统，所述访问请求控制系统被所述处理器执行时实现如下步骤：
    接收客户端对服务器的访问请求，提取所述访问请求中的IP地址，查询数据库中是否有该IP地址的访问记录；
    若数据库中有该IP地址的访问记录，则分析该IP地址是否在禁止访问的倒计时时段内；
    若该IP地址不在禁止访问的倒计时时段内，则比较该IP地址的访问频率与预设的第一阈值的大小；
    若所述访问频率大于所述第一阈值，则拒绝所述客户端的访问请求，并设置该IP地址在预设时长的倒计时内禁止访问；
    若所述访问频率小于等于所述第一阈值，则允许所述客户端的访问请求；
    若该IP地址在禁止访问的倒计时时段内，则拒绝所述客户端的访问请求。
  2. 如权利要求1所述的电子装置，其特征在于，所述处理器还用于执行所述访问请求控制系统，以实现步骤：
    若数据库中无该IP地址的访问记录，则允许所述客户端的访问请求。
  3. 如权利要求1所述的电子装置，其特征在于，于所述允许所述客户端的访问请求步骤之后，所述处理器还用于执行所述访问请求控制系统，以实现步骤：
    使该客户端的IP地址的访问次数加1。
  4. 如权利要求2所述的电子装置，其特征在于，于所述允许所述客户端的访问请求步骤之后，所述处理器还用于执行所述访问请求控制系统，以实现步骤：
    使该客户端的IP地址的访问次数加1。
  5. 如权利要1所述的电子装置，其特征在于，所述若该IP地址不在禁止访问的倒计时时段内，则比较该IP地址的访问频率与预设的第一阈值的大小的步骤替换为：
    若该IP地址不在禁止访问的倒计时时段内，则确定该IP地址的访问频率， 及根据预先确定的时间区间与第一阈值的映射关系，确定当前时刻所属的时间区间对应的第一阈值，并比较确定的访问频率与确定的第一阈值的大小关系。
  6. 如权利要2所述的电子装置，其特征在于，所述若该IP地址不在禁止访问的倒计时时段内，则比较该IP地址的访问频率与预设的第一阈值的大小的步骤替换为：
    若该IP地址不在禁止访问的倒计时时段内，则确定该IP地址的访问频率，及根据预先确定的时间区间与第一阈值的映射关系，确定当前时刻所属的时间区间对应的第一阈值，并比较确定的访问频率与确定的第一阈值的大小关系。
  7. 如权利要3或4所述的电子装置，其特征在于，所述若该IP地址不在禁止访问的倒计时时段内，则比较该IP地址的访问频率与预设的第一阈值的大小的步骤替换为：
    若该IP地址不在禁止访问的倒计时时段内，则确定该IP地址的访问频率，及根据预先确定的时间区间与第一阈值的映射关系，确定当前时刻所属的时间区间对应的第一阈值，并比较确定的访问频率与确定的第一阈值的大小关系。
  8. 一种访问请求控制方法，其特征在于，该方法包括步骤：
    接收客户端对服务器的访问请求，提取所述访问请求中的IP地址，查询数据库中是否有该IP地址的访问记录；
    若数据库中有该IP地址的访问记录，则分析该IP地址是否在禁止访问倒计时时段内；
    若该IP地址不在禁止访问倒计时时段内，则比较该IP地址的访问频率与预设的第一阈值的大小；
    若所述访问频率大于所述第一阈值，则拒绝所述客户端的访问请求，并给该IP地址设置预设时长的禁止访问倒计时；
    若所述访问频率小于等于所述第一阈值，则允许所述客户端的访问请求；
    若该IP地址在禁止访问倒计时时段内，则拒绝所述客户端的访问请求。
  9. 如权利要求8所述的访问请求控制方法，其特征在于，所述方法还包括步骤：
    若数据库中无该IP地址的访问记录，则允许所述客户端的访问请求。
  10. 如权利要求8所述的访问请求控制方法，其特征在于，于所述允许所述客户端的访问请求步骤之后，所述方法还包括步骤：
    使该客户端的IP地址的访问次数加1。
  11. 如权利要求9所述的访问请求控制方法，其特征在于，于所述允许所述客户端的访问请求步骤之后，所述方法还包括步骤：
    使该客户端的IP地址的访问次数加1。
  12. 如权利要求8所述的访问请求控制方法，其特征在于，所述若该IP地址不在禁止访问的倒计时时段内，则比较该IP地址的访问频率与预设的第一阈值的大小的步骤替换为：
    若该IP地址不在禁止访问倒计时时段内，则确定该IP地址的访问频率，及根据预先确定的时间区间与第一阈值的映射关系，确定当前时刻所属的时间区间对应的第一阈值，并比较确定的访问频率与确定的第一阈值的大小关系。
  13. 如权利要求9所述的访问请求控制方法，其特征在于，所述若该IP地址不在禁止访问的倒计时时段内，则比较该IP地址的访问频率与预设的第一阈值的大小的步骤替换为：
    若该IP地址不在禁止访问倒计时时段内，则确定该IP地址的访问频率，及根据预先确定的时间区间与第一阈值的映射关系，确定当前时刻所属的时间区间对应的第一阈值，并比较确定的访问频率与确定的第一阈值的大小关系。
  14. 如权利要求10或11所述的访问请求控制方法，其特征在于，所述若该IP地址不在禁止访问的倒计时时段内，则比较该IP地址的访问频率与预设的第一阈值的大小的步骤替换为：
    若该IP地址不在禁止访问倒计时时段内，则确定该IP地址的访问频率，及根据预先确定的时间区间与第一阈值的映射关系，确定当前时刻所属的时间区间对应的第一阈值，并比较确定的访问频率与确定的第一阈值的大小关系。
  15. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有访问请求控制系统，所述访问请求控制系统可被至少一个处理器执行， 以使所述至少一个处理器执行以下步骤：
    接收客户端对服务器的访问请求，提取所述访问请求中的IP地址，查询数据库中是否有该IP地址的访问记录；
    若数据库中有该IP地址的访问记录，则分析该IP地址是否在禁止访问倒计时时段内；
    若该IP地址不在禁止访问倒计时时段内，则比较该IP地址的访问频率与预设的第一阈值的大小；
    若所述访问频率大于所述第一阈值，则拒绝所述客户端的访问请求，并给该IP地址设置预设时长的禁止访问倒计时；
    若所述访问频率小于等于所述第一阈值，则允许所述客户端的访问请求。
    若该IP地址在禁止访问倒计时时段内，则拒绝所述客户端的访问请求。
  16. 如权利要求15所述的计算机可读存储介质，其特征在于，所述处理器还用于执行所述访问请求控制系统，以实现步骤：
    若数据库中无该IP地址的访问记录，则允许所述客户端的访问请求。
  17. 如权利要求15所述的计算机可读存储介质，其特征在于，于所述允许所述客户端的访问请求步骤之后，所述处理器还用于执行所述访问请求控制系统，以实现步骤：
    使该客户端的IP地址的访问次数加1。
  18. 如权利要求16所述的计算机可读存储介质，其特征在于，于所述允许所述客户端的访问请求步骤之后，所述处理器还用于执行所述访问请求控制系统，以实现步骤：
    使该客户端的IP地址的访问次数加1。
  19. 如权利要15所述的计算机可读存储介质，其特征在于，所述若该IP地址不在禁止访问的倒计时时段内，则比较该IP地址的访问频率与预设的第一阈值的大小的步骤替换为：
    若该IP地址不在禁止访问的倒计时时段内，则确定该IP地址的访问频率，及根据预先确定的时间区间与第一阈值的映射关系，确定当前时刻所属的时间区间对应的第一阈值，并比较确定的访问频率与确定的第一阈值的大小关系。
  20. 如权利要16或18所述的计算机可读存储介质，其特征在于，所述 若该IP地址不在禁止访问的倒计时时段内，则比较该IP地址的访问频率与预设的第一阈值的大小的步骤替换为：
    若该IP地址不在禁止访问的倒计时时段内，则确定该IP地址的访问频率，及根据预先确定的时间区间与第一阈值的映射关系，确定当前时刻所属的时间区间对应的第一阈值，并比较确定的访问频率与确定的第一阈值的大小关系。
PCT/CN2018/077669 2017-10-23 2018-02-28 电子装置、访问请求控制方法和计算机可读存储介质 WO2019080429A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710993385.XA CN108400963A (zh) 2017-10-23 2017-10-23 电子装置、访问请求控制方法和计算机可读存储介质
CN201710993385.X 2017-10-23

Publications (1)

Publication Number Publication Date
WO2019080429A1 true WO2019080429A1 (zh) 2019-05-02

Family

ID=63094333

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/077669 WO2019080429A1 (zh) 2017-10-23 2018-02-28 电子装置、访问请求控制方法和计算机可读存储介质

Country Status (2)

Country Link
CN (1) CN108400963A (zh)
WO (1) WO2019080429A1 (zh)

Families Citing this family (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109391686B (zh) * 2018-09-27 2022-04-12 网宿科技股份有限公司 访问请求的处理方法及cdn节点服务器
CN111866848B (zh) * 2019-04-28 2023-04-18 北京数安鑫云信息技术有限公司 一种移动基站识别方法、装置和计算机设备
CN110210251A (zh) * 2019-06-17 2019-09-06 阿里巴巴集团控股有限公司 数据查询方法、装置、设备及计算机可读存储介质
CN111770126B (zh) * 2019-06-28 2023-08-04 北京京东尚科信息技术有限公司 服务请求处理方法、装置及存储介质
CN114223177A (zh) * 2019-10-11 2022-03-22 深圳市欢太科技有限公司 访问控制方法、装置、服务器和计算机可读介质
CN110932988A (zh) * 2019-10-31 2020-03-27 北京三快在线科技有限公司 流量控制方法、装置、电子设备及可读存储介质
CN111010409B (zh) * 2020-01-07 2021-08-17 南京林业大学 加密攻击网络流量检测方法
CN111274029A (zh) * 2020-01-15 2020-06-12 北京奇艺世纪科技有限公司 集群调度方法及装置
CN111556109B (zh) * 2020-04-17 2021-05-18 北京达佳互联信息技术有限公司 请求处理方法、装置、电子设备和存储介质
CN114584334A (zh) * 2020-11-30 2022-06-03 夏普株式会社 信息处理装置及控制方法
CN112685682B (zh) * 2021-03-16 2021-07-09 连连（杭州）信息技术有限公司 一种攻击事件的封禁对象识别方法、装置、设备及介质
CN113242185B (zh) * 2021-05-28 2022-08-16 广州科语机器人有限公司 一种地图数据传输方法、清洁机器人、设备和存储介质
CN113486229B (zh) * 2021-07-05 2023-11-07 北京百度网讯科技有限公司 抓取压力的控制方法、装置、电子设备及可读存储介质
CN113765913A (zh) * 2021-09-02 2021-12-07 云宏信息科技股份有限公司 Tomcat服务器配置访问黑名单的方法、存储介质和Tomcat服务器
CN114338168A (zh) * 2021-12-29 2022-04-12 赛尔网络有限公司 Ip地址动态阻断方法、装置、设备及介质
CN114338205B (zh) * 2021-12-31 2024-03-01 广州方硅信息技术有限公司 目标ip地址的获取方法、装置、电子设备及存储介质
CN116089110B (zh) * 2022-07-01 2023-11-21 荣耀终端有限公司 控制进程交互的方法及相关装置
CN117221019B (zh) * 2023-11-09 2024-02-20 苏州元脑智能科技有限公司 访问控制方法、装置、电子设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102088477A (zh) * 2010-11-25 2011-06-08 互动在线（北京）科技有限公司 网站内容防采集系统和方法
US20120079592A1 (en) * 2010-09-24 2012-03-29 Verisign, Inc. Ip prioritization and scoring system for ddos detection and mitigation
US9392019B2 (en) * 2014-07-28 2016-07-12 Lenovo Enterprise (Singapore) Pte. Ltd. Managing cyber attacks through change of network address
CN106101080A (zh) * 2016-05-31 2016-11-09 乐视控股（北京）有限公司 页面访问控制方法和装置
CN106549932A (zh) * 2016-08-31 2017-03-29 北京安天电子设备有限公司 一种基于日志分析的主机安全防护方法及系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130018921A1 (en) * 2011-07-13 2013-01-17 International Business Machines Corporation Need-to-know information access using quantified risk
WO2014094212A1 (zh) * 2012-12-17 2014-06-26 华为技术有限公司 一种分时监听方法、设备及系统
CN103701709B (zh) * 2013-12-13 2015-07-01 北京京东尚科信息技术有限公司 一种流量控制方法及系统
CN105282047B (zh) * 2015-09-25 2020-04-14 小米科技有限责任公司 访问请求处理方法及装置
CN205921604U (zh) * 2016-07-05 2017-02-01 深圳市华博科技开发有限公司 一种分时段控制用户上网权限的网关

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120079592A1 (en) * 2010-09-24 2012-03-29 Verisign, Inc. Ip prioritization and scoring system for ddos detection and mitigation
CN102088477A (zh) * 2010-11-25 2011-06-08 互动在线（北京）科技有限公司 网站内容防采集系统和方法
US9392019B2 (en) * 2014-07-28 2016-07-12 Lenovo Enterprise (Singapore) Pte. Ltd. Managing cyber attacks through change of network address
CN106101080A (zh) * 2016-05-31 2016-11-09 乐视控股（北京）有限公司 页面访问控制方法和装置
CN106549932A (zh) * 2016-08-31 2017-03-29 北京安天电子设备有限公司 一种基于日志分析的主机安全防护方法及系统

Also Published As

Publication number Publication date
CN108400963A (zh) 2018-08-14

Similar Documents

Publication Publication Date Title
WO2019080429A1 (zh) 电子装置、访问请求控制方法和计算机可读存储介质
US7904956B2 (en) Access authorization with anomaly detection
US8850549B2 (en) Methods and systems for controlling access to resources and privileges per process
US11750623B2 (en) System and method for conducting a detailed computerized surveillance in a computerized environment
WO2015096695A1 (zh) 一种应用程序的安装控制方法、系统及装置
CN111274583A (zh) 一种大数据计算机网络安全防护装置及其控制方法
CN110417778B (zh) 访问请求的处理方法和装置
AU2013100355A4 (en) Device-specific content delivery
US20090013407A1 (en) Intrusion detection system/intrusion prevention system with enhanced performance
CN111709023B (zh) 一种基于可信操作系统的应用隔离方法及系统
US20230306119A1 (en) Intrusion detection
US10339307B2 (en) Intrusion detection system in a device comprising a first operating system and a second operating system
US11048809B1 (en) Systems and methods for detecting misuse of online service access tokens
US9122869B1 (en) Systems and methods for detecting client types
CN114244568B (zh) 基于终端访问行为的安全接入控制方法、装置和设备
US11251976B2 (en) Data security processing method and terminal thereof, and server
JP5069369B2 (ja) 統合されたアクセス認可
TW201822054A (zh) 網路攻擊模式之判斷裝置、判斷方法及其電腦程式產品
US20150058926A1 (en) Shared Page Access Control Among Cloud Objects In A Distributed Cloud Environment
US9219728B1 (en) Systems and methods for protecting services
TWI617939B (zh) 攻擊節點偵測裝置、方法及其電腦程式產品
WO2023151238A1 (zh) 一种勒索病毒检测方法及相关系统
CN114860481A (zh) 剪贴板保护方法、系统、存储介质及计算机设备
EP3915032A1 (en) Method for implementing system state aware security policies
WO2023201583A1 (zh) 网络系统防护方法、装置、计算机设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18870482

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 25/09/2020)

122 Ep: pct application non-entry in european phase

Ref document number: 18870482

Country of ref document: EP

Kind code of ref document: A1