WO2020056857A1 - 一种异常访问行为的识别方法及服务器 - Google Patents

一种异常访问行为的识别方法及服务器 Download PDF

Info

Publication number
WO2020056857A1
WO2020056857A1 PCT/CN2018/113029 CN2018113029W WO2020056857A1 WO 2020056857 A1 WO2020056857 A1 WO 2020056857A1 CN 2018113029 W CN2018113029 W CN 2018113029W WO 2020056857 A1 WO2020056857 A1 WO 2020056857A1
Authority
WO
WIPO (PCT)
Prior art keywords
client
access
access request
identification
unique identifier
Prior art date
Application number
PCT/CN2018/113029
Other languages
English (en)
French (fr)
Inventor
陈志勇
王凤杰
Original Assignee
网宿科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 网宿科技股份有限公司 filed Critical 网宿科技股份有限公司
Priority to EP18934417.9A priority Critical patent/EP3852327A4/en
Priority to US16/767,998 priority patent/US20210194906A1/en
Publication of WO2020056857A1 publication Critical patent/WO2020056857A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/146—Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/535—Tracking the activity of the user
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics

Definitions

  • the present invention relates to the field of Internet technologies, and in particular, to a method and a server for identifying abnormal access behavior.
  • the purpose of this application is to provide a method and a server for identifying abnormal access behavior, which can improve the accuracy of identifying abnormal access behavior.
  • the present application provides a method for identifying abnormal access behavior, the method includes: receiving an access request from a client, and generating an identification identifier of the client based on the access request; Describe the device fingerprint information of the client, and generate a unique identifier of the client based on the identification identifier and the device fingerprint information; and send the unique identifier to the client to identify the client based on the unique identifier Describes whether the client's access behavior is abnormal.
  • another aspect of the present application further provides a server, the server includes: an identification identifier generating unit, configured to receive an access request sent by a client, and generate an identification of the client based on the access request. Identification; a unique identification generating unit configured to obtain device fingerprint information of the client, and generate a unique identification of the client based on the identification identifier and the device fingerprint information; an access behavior identifying unit, configured to The identifier is issued to the client to identify whether the client's access behavior is abnormal based on the unique identifier.
  • the server includes a memory and a processor.
  • the memory is used to store a computer program.
  • the computer program is executed by the processor, the foregoing exception is implemented. Identification of access behavior.
  • the server when it receives an access request from a client, it can generate a client's identification based on the access request.
  • the identification identifier may be determined jointly by the access information in the access request and a randomly generated identification code.
  • the access information in the access request may include the client's IP address and user-agent information (usr-agent).
  • the device fingerprint information of the client After generating the identification of the client, the device fingerprint information of the client can be obtained.
  • the device fingerprint information can characterize a client in many ways.
  • the device fingerprint information may include information such as the language of the client, color depth, pixel ratio, screen resolution, browser language, operating system parameters, and CPU model.
  • the unique identifier of the client may be generated according to the identification identifier and the device fingerprint information.
  • the unique identifier can distinguish the client from other clients.
  • the server may feedback the unique identification to the client. For normal users, when they subsequently initiate access requests to the server, they will carry their own unique identifier; some malicious crawlers will not carry the unique identifier. If the malicious crawler carries the unique identifier, the server can also use the unique identifier Identification to determine the trajectory of the malicious crawler's access behavior, thereby effectively identifying the malicious crawler.
  • the server can determine whether the client that initiated the access request is abnormal based on the unique identifier. It can be seen from the above that the technical solution provided in this application can accurately characterize a client by combining the identification of the client with the fingerprint information of the device. Subsequently, by identifying the unique identifier, the client's access behavior trajectory can be tracked, and then it can be judged whether the client's access behavior is abnormal. According to the technical solution provided by this application, a normal user can be effectively distinguished from a malicious crawler, thereby improving the accuracy of identifying abnormal behaviors.
  • FIG. 1 is a schematic diagram of a server and a client system according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of a method for identifying abnormal access behavior in an embodiment of the present invention
  • FIG. 3 is a schematic diagram of a functional module of a server according to an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a server in an embodiment of the present invention.
  • An embodiment of the present application provides a method for identifying abnormal access behavior, and the method may be applied to a server.
  • the business of an enterprise can be provided by each server in a server cluster.
  • the server can feedback the corresponding enterprise business data to the client according to the access request initiated by the client.
  • the server in the server cluster may apply the technical solution provided in this application, and upon receiving an access request from the client, determine the client's access behavior.
  • the method for identifying abnormal access behavior provided by the present application may include the following steps.
  • S1 Receive an access request from a client, and generate an identification identifier of the client based on the access request.
  • the access request initiated by the client can be accelerated to a server in the server cluster after being accelerated by a CDN (Content Delivery Network).
  • the server may extract the access information of the client from the access request.
  • the access information may include at least an IP address of the client and user-agent information (User-Agent, UA) of the client.
  • User-Agent User-Agent
  • the combination of IP address and UA can often accurately represent the identity of a client.
  • different clients may have the same IP address and UA.
  • the egress IP addresses of the clients are the same.
  • an identification code of a specified length may be randomly generated.
  • the identification code of the specified length may be, for example, an 8-bit UUID (Universally Unique Identifier).
  • UUID Universally Unique Identifier
  • a client can be limited from the three dimensions of IP address, UA, and UUID.
  • the combination of the access information and the identification code may be represented by a key.
  • a preset encryption algorithm may be adopted to encrypt the combination of the identification code and the access information, and use the encrypted key as the identification identifier of the client.
  • the preset encryption algorithm may be DES (Data Encryption Standard), 3DES, DSA (Digital Signature Algorithm), MD5 (Message Digest Algorithm 5, Version 5 of the message digest algorithm) ), SHA (Secure Hash Algorithm), and other encryption algorithms.
  • the preset encryption algorithm can generate a key with a specified number of bits. For example, after the combination of the access information and the identification code is encrypted by the 3DES algorithm, a 16-bit key can be generated, and the 16-bit key can be used as the identification identifier of the client.
  • S3 Acquire device fingerprint information of the client, and generate a unique identifier of the client according to the identification identifier and the device fingerprint information.
  • the server may also combine some of the setting information of the client based on the identification. Specifically, the server may feed back corresponding response information to the client with respect to the access request sent by the client. When the response information is fed back to the client in response to the access request, the server may send a detection script to the client together.
  • the detection script may be a JavaScript script. After the script is received by the client, it can be automatically run in the client, and during the running process, the device fingerprint information of the client can be collected.
  • the device fingerprint information may include the language of the client, color depth, the ratio of the physical pixels of the device to the independent pixels of the device (PixelRatio), the resolution currently used on the screen, the resolution available on the screen, local time and GMT Time (Greenwich Mean Time), time difference, browser setting language, audio parameters, browser operating system and / or hardware platform, computer CPU model and other information. Because different users have different usage habits of the client, the device fingerprint information can limit the client from multiple dimensions set by the client itself.
  • the device fingerprint information and the identification identifier of the client can be further combined to jointly Qualifies the identity of the client.
  • the combination of the device fingerprint information and the identification mark may also be represented by a form of a key.
  • the server may encrypt the combination of the identification identifier and the device fingerprint information according to a preset encryption algorithm, thereby obtaining a key of a specified length, and using the key of the specified length as a unique identifier of the client.
  • the preset encryption algorithm may be one of multiple encryption algorithms described in step S1.
  • the combination of the device fingerprint information and the identification mark can also be encrypted by the 3DES algorithm, and then a 32-bit key can be generated, and the 32-bit key can be used as the unique identification mentioned above.
  • the number of digits of the identification mark and the unique identification can be set according to requirements during encryption, and it is not necessarily limited to only 16-bit identification marks and 32-bit unique identification.
  • S5 Send the unique identifier to the client to identify whether the client's access behavior is abnormal based on the unique identifier.
  • the unique identifier may be delivered to the client in the form of a cookie.
  • the purpose of this processing is that normal clients can support data in the form of cookies, and when the client subsequently initiates an access request to the server, it can usually carry a unique identifier in the form of a cookie so that the server can pass the unique Identification to identify and track client access behaviors.
  • the unique identifier issued by the server can be received, and when an access request is initiated to the server, the unique identifier can be carried in the access request.
  • the unique identifier issued by the receiving server will be rejected. Subsequently, when these malicious crawlers initiate an access request to the server again, the access request will not carry the unique identifier sent to it by the server.
  • the server may receive the access request sent by the client again, and identify whether the access request carries the unique identifier. If the access request does not carry the unique identifier, It indicates that the client refuses to receive the unique identifier sent to it by the server, and at this time, it can be directly determined that the access behavior of the client is abnormal.
  • part of the malicious crawler may disguise the access form of a normal client, and the unique identifier sent to it by the receiving server. And the subsequent identification request will also carry the unique identifier.
  • the server can identify the client's access request within a period of time based on the unique identifier carried in the access request, and analyze the client's access behavior based on the identified access request. Considering that malicious crawlers often initiate access requests to the server frequently in a short period of time, you can determine whether the client's access behavior is abnormal by calculating the access frequency of the client's access request. Specifically, if the access request sent by the client carries the unique identifier, the server may count the access frequency of the access request initiated by the client.
  • the server can count the number of access requests initiated by the client within a specified period of time, and then calculate the number of access requests initiated by the client within a unit time, so as to determine the access frequency of the client. Then, if the statistics of the access frequency is greater than or equal to a specified frequency threshold, it indicates that the client's access behavior is too frequent, so that it can still be determined that the client's access behavior is abnormal.
  • the specified frequency threshold may be set according to the access frequency of a normal user. For example, the specified frequency threshold may be an upper limit value of a normal user's access frequency, or a result of adding a certain degree of redundancy to the upper limit value.
  • the server of the enterprise considering that some of the resources in the server of the enterprise belong to sensitive resources, these sensitive resources are usually not accessed by the client through an external network. Clients of normal users usually do not access these sensitive resources, while malicious crawlers try to access the links they can get. In view of this, you can identify whether the client's access behavior is abnormal by judging whether the access request initiated by the client points to a sensitive target. Specifically, if the access request sent by the client carries the unique identifier, the server can identify the access target represented by the access request, and the access target can usually be determined by Uniform Resource Locator (URL) in the access request. Resource locator). If the access target belongs to a sensitive target, the server may determine that the access behavior of the client is abnormal.
  • URL Uniform Resource Locator
  • the user when a user initiates an access to a website resource, the user may generally enter the homepage address of the website in a browser, or may click a link in the current page to jump to the page to be accessed.
  • the user when a normal user accesses a website resource, for the homepage of the website, the user may directly enter the URL of the homepage, and for other pages on the website, the user may use the search results page on Baidu, Google, etc. Link, or jump to another page via the link shown on the homepage of the website. Therefore, the different pages visited by normal users often have a back-and-forth reference relationship.
  • Baidu For example, a user enters "XX technology” in Baidu, and then Baidu's search results page can appear with the official website address of the "XX technology". Users can access the homepage of "XX Technology" by clicking the official website address. There may be various services provided by the company on the homepage, so that users can access the details of the CDN server rental by clicking the "CDN server rental" link in it. In the above example, the user's access behavior is carried out through Baidu-Official Website Homepage-CDN server lease this access logic. There is often a reference relationship between pages. For example, what the user ultimately wants to access is the CDN server rental page, the reference page of this page is the official website homepage, and the reference page of the official website homepage is Baidu.
  • This reference relationship between pages can be recorded by accessing the referer field in the request.
  • the identifier of the first page of the official website can be recorded in the referer field.
  • the referer field can record the page identifier of Baidu.
  • a malicious crawler it does not access the final page through this layer-by-layer search method, but directly initiates access to the page through the access link leased by the CDN server. In other words, malicious crawlers often initiate access directly through the page address of the page to be accessed. Therefore, in the malicious crawler's access request, the referer field of the vast majority of access requests is an empty field, and there is no higher-level reference page.
  • the server can identify from the access request whether the access request has a request source.
  • the request source can be indicated by the referer field in the access request.
  • the server may identify the content of the referer field in the access request. If the referer field is empty, it is determined that the access request does not have the request source. If the referer field carries a page identifier, the server may send the The page pointed to by the page identifier serves as a request source of the access request.
  • the server may count the number of target access requests that do not have the request source from the access requests sent by the client within a specified period. If the counted number is greater than or equal to the specified number threshold, it indicates that Most of the access requests sent by the client within a specified period of time do not have corresponding reference pages, but directly initiate access based on the access address. This access behavior is similar to that of a malicious crawler. At this time, it can be determined that the access behavior of the client is abnormal.
  • the present application further provides a server, where the server includes:
  • An identification identifier generating unit configured to receive an access request sent by a client, and generate an identification identifier of the client based on the access request;
  • a unique identifier generating unit configured to obtain device fingerprint information of the client, and generate a unique identifier of the client according to the identification identifier and the device fingerprint information;
  • An access behavior identifying unit is configured to send the unique identification to the client to identify whether the access behavior of the client is abnormal based on the unique identification.
  • the identification mark generating unit includes:
  • An access information extraction module configured to extract access information of the client from the access request, where the access information includes at least an IP address of the client and user agent information of the client;
  • the encryption module is configured to randomly generate an identification code of a specified length, and encrypt a combination of the identification code and the access information to generate an identification identifier of the client.
  • the unique identifier generating unit includes:
  • a script issuing module is configured to issue a detection script to the client when the response information is fed back to the client in response to the access request, wherein the detection script is obtained when the detection script is run in the client.
  • Device fingerprint information of the client is configured to issue a detection script to the client when the response information is fed back to the client in response to the access request, wherein the detection script is obtained when the detection script is run in the client.
  • the access behavior identification unit includes:
  • An identification identification module configured to receive an access request sent by the client again, and identify whether the unique identifier is carried in the access request; if the unique identifier is not carried in the access request, determine the client's The access behavior is abnormal.
  • this application further provides a server.
  • the server includes a memory and a processor.
  • the memory is used to store a computer program.
  • the computer program is executed by the processor, the foregoing abnormal access behavior can be implemented. Identification method.
  • the server when it receives an access request from a client, it can generate a client's identification based on the access request.
  • the identification identifier may be determined jointly by the access information in the access request and a randomly generated identification code.
  • the access information in the access request may include the client's IP address and user-agent information (usr-agent).
  • the device fingerprint information of the client After generating the identification of the client, the device fingerprint information of the client can be obtained.
  • the device fingerprint information can characterize a client in many ways.
  • the device fingerprint information may include information such as the language of the client, color depth, pixel ratio, screen resolution, browser language, operating system parameters, and CPU model.
  • the unique identifier of the client may be generated according to the identification identifier and the device fingerprint information.
  • the unique identifier can distinguish the client from other clients.
  • the server may feedback the unique identification to the client. For normal users, when they subsequently initiate access requests to the server, they will carry their own unique identifier; some malicious crawlers will not carry the unique identifier. If the malicious crawler carries the unique identifier, the server can also use the unique identifier Identification to determine the trajectory of the malicious crawler's access behavior, thereby effectively identifying the malicious crawler.
  • the server can determine whether the client that initiated the access request is abnormal based on the unique identifier. It can be seen from the above that the technical solution provided in this application can accurately characterize a client by combining the identification of the client with the fingerprint information of the device. Subsequently, by identifying the unique identifier, the client's access behavior trajectory can be tracked, and then it can be judged whether the client's access behavior is abnormal. According to the technical solution provided in this application, a normal user can be effectively distinguished from a malicious crawler, thereby improving the accuracy of identifying abnormal behaviors.
  • each embodiment can be implemented by means of software plus a necessary universal hardware platform, and of course, can also be implemented by hardware.
  • the above-mentioned technical solution essentially or part that contributes to the existing technology can be embodied in the form of a software product, which can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic A disc, an optical disc, and the like include several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the methods described in various embodiments or certain parts of the embodiments.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Power Engineering (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Computer And Data Communications (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本发明公开了一种异常访问行为的识别方法及服务器，其中，所述方法包括：接收客户端发来的访问请求，并基于所述访问请求，生成所述客户端的辨认标识；获取所述客户端的设备指纹信息，并根据所述辨认标识和所述设备指纹信息，生成所述客户端的唯一标识；将所述唯一标识下发给所述客户端，以基于所述唯一标识，识别所述客户端的访问行为是否异常。本申请提供的技术方案，能够提高异常访问行为的识别精度。

Description

一种异常访问行为的识别方法及服务器 技术领域
本发明涉及互联网技术领域，特别涉及一种异常访问行为的识别方法及服务器。
背景技术
随着互联网技术的不断发展，网络安全问题日益凸显。目前，恶意的网络爬虫会频繁访问企业的服务器，给企业的服务器带来较大的负担。为了有效阻止恶意爬虫发起的访问请求，当前可以针对恶意爬虫的IP地址设置一定时段内的访问次数上限，当该IP地址发起的访问次数较高时，可以拒绝来自该IP地址的访问请求。
然而，这种方式可能会对正常的用户造成影响。例如，在NAT(Network Address Translation,网络地址转换)环境下，不同用户的出口IP都是相同的，从而会导致来自该出口IP的访问次数较高。按照现有的方式会将该出口IP误封，从而导致正常用户的访问失效。由此可见，目前针对恶意爬虫的防范方式不够精准，会对正常用户造成影响。
发明内容
本申请的目的在于提供一种异常访问行为的识别方法及服务器，能够提高异常访问行为的识别精度。
为实现上述目的，本申请一方面提供一种异常访问行为的识别方法，所述方法包括：接收客户端发来的访问请求，并基于所述访问请求，生成所述客户端的辨认标识；获取所述客户端的设备指纹信息，并根据所述辨认标识和所述设备指纹信息，生成所述客户端的唯一标识；将所述唯一标识下发给所述客户端，以基于所述唯一标识，识别所述客户端的访问行为是否异常。
为实现上述目的，本申请另一方面还提供一种服务器，所述服务器包括：辨认标识生成单元，用于接收客户端发来的访问请求，并基于所述访问请求， 生成所述客户端的辨认标识；唯一标识生成单元，用于获取所述客户端的设备指纹信息，并根据所述辨认标识和所述设备指纹信息，生成所述客户端的唯一标识；访问行为识别单元，用于将所述唯一标识下发给所述客户端，以基于所述唯一标识，识别所述客户端的访问行为是否异常。
为实现上述目的，本申请另一方面还提供一种服务器，所述服务器包括存储器和处理器，所述存储器用于存储计算机程序，所述计算机程序被所述处理器执行时，实现上述的异常访问行为的识别方法。
由上可见，本申请提供的技术方案，服务器在接收到客户端发来的访问请求时，可以基于该访问请求生成客户端的辨认标识。在实际应用中，该辨认标识可以由该访问请求中的访问信息和随机生成的识别码共同确定。访问请求中的访问信息可以包括客户端的IP地址和用户代理信息(usr-agent)。在生成客户端的辨认标识之后，可以获取客户端的设备指纹信息。该设备指纹信息可以从多方面表征一个客户端。例如，该设备指纹信息可以包括客户端的语言、色彩深度、像素比例、屏幕分辨率、浏览器语言、操作系统参数、CPU型号等信息。这样，通过上述的辨认标识和设备指纹信息，可以精确地确定一个客户端。在本申请中，可以根据所述辨认标识和所述设备指纹信息，生成所述客户端的唯一标识。该唯一标识可以将该客户端与其它客户端进行区分。后续，服务器可以将该唯一标识反馈给该客户端。对于正常用户而言，后续在向服务器发起访问请求时，都会带上自身的唯一标识；而部分恶意爬虫则不会携带该唯一标识，如果恶意爬虫携带了该唯一标识，服务器也可以通过该唯一标识来确定恶意爬虫的访问行为轨迹，从而有效地识别出恶意爬虫。这样，服务器可以基于该唯一标识，来判断发起访问请求的客户端是否存在异常。由上可见，本申请提供的技术方案，通过将客户端的辨认标识与设备指纹信息进行结合，从而可以精确地表征一个客户端。后续，通过对该唯一标识进行识别，从而可以追踪客户端的访问行为轨迹，进而能够判断客户端的访问行为是否存在异常。按照本申请提供的技术方案，能够有效地将正常用户与恶意爬虫进行区分，从而提高了异常行为的识别精度。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所 需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施方式中服务器和客户端的系统示意图；
图2是本发明实施方式中异常访问行为的识别方法示意图；
图3是本发明实施方式中服务器的功能模块示意图；
图4是本发明实施方式中服务器的结构示意图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施方式作进一步地详细描述。
本申请一个实施方式提供一种异常访问行为的识别方法，该方法可以应用于服务器中。请参阅图1，企业的业务可以由服务器集群中的各台服务器提供。服务器可以根据客户端发起的访问请求，向客户端反馈对应的企业业务数据。服务器集群中的服务器中可以应用本申请提供的技术方案，在接收到客户端发来的访问请求时，对客户端的访问行为进行判定。具体地，请参阅图2，本申请提供的异常访问行为的识别方法可以包括以下步骤。
S1：接收客户端发来的访问请求，并基于所述访问请求，生成所述客户端的辨认标识。
在本实施方式中，客户端发起的访问请求，可以通过CDN(Content Delivery Network，内容分发网络)加速之后，倒流至服务器集群中的服务器上。服务器接收到客户端发来的访问请求之后，可以从所述访问请求中提取所述客户端的访问信息。具体地，所述访问信息至少可以包括所述客户端的IP地址和所述客户端的用户代理信息(User-Agent，UA)。通常而言，IP地址和UA的组合，往往可以准确地表征一个客户端的身份。但考虑到在实际应用中，不同的客户端也有可能具备相同的IP地址和UA。例如，在NAT模式中，客户端的出口IP地址均相同，在NAT网络架构中，也有可能存在UA一致的客户端。因此，为了更加精准地表征客户端的身份，在本实施方式中可以随机生成指定长度的识别码。该指定长度的识别码例如可以是8位的UUID(Universally Unique Identifier，通用唯一识别码)。这样，通过将上述的访问信息和该指定长度的识别码进行组 合，从而可以从IP地址、UA以及UUID这三个维度来共同限定一个客户端。为了保证访问信息和识别码的组合的安全性，可以将访问信息和识别码的组合通过密钥的形式来表示。具体地，可以采用预设加密算法，对所述识别码和所述访问信息的组合进行加密，并将加密后的密钥作为所述客户端的辨认标识。在实际应用中，所述预设加密算法可以是DES(Data Encryption Standard，数据加密标准)、3DES、DSA(Digital Signature Algorithm，数字签名算法)、MD5(Message Digest Algorithm 5，信息摘要算法第五版)、SHA(Secure Hash Algorithm，安全散列算法)等加密算法中的一种。该预设加密算法可以生成指定位数的密钥。例如，通过3DES算法对访问信息和识别码的组合进行加密运算后，可以生成16位的密钥，该16位的密钥便可以作为该客户端的辨认标识。
S3：获取所述客户端的设备指纹信息，并根据所述辨认标识和所述设备指纹信息，生成所述客户端的唯一标识。
在本实施方式中，服务器在生成客户端的辨认标识之后，为了进一步提高对客户端的识别精度，还可以在上述辨认标识的基础上，结合客户端本身的一些设定信息。具体地，服务器针对客户端发来的所述访问请求，可以向客户端反馈对应的响应信息。在响应于所述访问请求向所述客户端反馈响应信息时，服务器可以一并向所述客户端下发检测脚本。该检测脚本可以是JavaScript的脚本，该脚本被客户端接收之后，可以在客户端中自动运行，并且在运行过程中，可以搜集客户端的设备指纹信息。所述设备指纹信息可以包括客户端的语言、色彩深度(colordepth)、设备物理像素和设备独立像素的比例(PixelRatio)、屏幕当前采用的分辨率、屏幕可用的分辨率、本地时间与GMT(Greenwich Mean Time，格林威治时间)的时间差、浏览器设置的语言、音频参数、浏览器的操作系统和/或硬件平台、计算机的CPU型号等信息。由于不同用户对于客户端的使用习惯均不相同，因此，设备指纹信息可以从客户端本身设置的多个维度对客户端进行限定。
在本实施方式中，通过向客户端下发检测脚本，并通过检测脚本的运行获取到客户端的设备指纹信息之后，可以进一步地将该设备指纹信息与所述客户端的辨认标识进行组合，从而共同限定该客户端的身份。同样地，为了保证组合的安全性，也可以将设备指纹信息与辨认标识的组合通过密钥的形式来表示。具体地，服务器可以按照预设加密算法对所述辨认标识和所述设备指纹信息的 组合进行加密，从而得到指定长度的密钥，并将所述指定长度的密钥作为所述客户端的唯一标识。在实际应用中，所述预设加密算法可以是步骤S1中描述的多种加密算法中的一种。例如，同样可以通过3DES算法对设备指纹信息与辨认标识的组合进行加密，然后可以生成32位的密钥，并将该32位的密钥作为上述的唯一标识。在实际应用中，辨认标识和唯一标识的位数可以在加密时按照需求进行设置，并不一定限定于只能生成16位的辨认标识和32位的唯一标识。
S5：将所述唯一标识下发给所述客户端，以基于所述唯一标识，识别所述客户端的访问行为是否异常。
在本实施方式中，在生成所述客户端的唯一标识之后，可以将该唯一标识通过cookie的形式下发给客户端。这样处理的目的在于，正常的客户端都能够支持cookie形式的数据，并且客户端后续在向服务器发起访问请求时，通常都可以带上该cookie形式的唯一标识，以便服务器通过访问请求中的唯一标识来对客户端的访问行为进行辨认和追踪。
在本实施方式中，对于正常用户的客户端而言，可以接收服务器下发的唯一标识，并且后续在向服务器发起访问请求时，可以在访问请求中携带该唯一标识。而对于部分恶意爬虫而言，会拒绝接收服务器下发的唯一标识。后续，这些恶意爬虫再次向服务器发起访问请求时，访问请求中便不会携带服务器向其下发的唯一标识。
鉴于此，在一个实施方式中，服务器可以再次接收所述客户端发来的访问请求，并识别所述访问请求中是否携带所述唯一标识，若所述访问请求中未携带所述唯一标识，表明客户端拒绝接收了服务器向其下发的唯一标识，此时可以直接判定所述客户端的访问行为存在异常。
在另一个实施方式中，部分恶意爬虫可能会伪装正常客户端的访问形式，接收服务器向其下发的唯一标识。并且在后续发起的访问请求中，也会携带该唯一标识。在这种情况下，服务器可以根据访问请求中携带的唯一标识，来识别出该客户端在一段时间内的访问请求，并根据识别出的访问请求，分析该客户端的访问行为。考虑到恶意爬虫往往会在短时间内向服务器频繁地发起访问请求，因此可以通过计算客户端发起访问请求的访问频率，来判断该客户端的访问行为是否存在异常。具体地，若所述客户端发来的访问请求中携带所述唯一标识，服务器可以统计所述客户端发起访问请求的访问频率。服务器可以在 指定时段内统计该客户端发起访问请求的次数，然后计算该客户端在单位时间内发起的访问请求的次数，从而可以确定出该客户端的访问频率。然后，若统计的所述访问频率大于或者等于指定频率阈值，则表明该客户端的访问行为过于频繁，从而仍可以判定所述客户端的访问行为存在异常。所述指定频率阈值可以是根据正常用户的访问频率进行设置的。例如，该指定频率阈值可以是正常用户的访问频率的上限值，或者在该上限值的基础上添加一定冗余度的结果。
在另一个实施方式中，考虑到企业的服务器中，有部分资源属于敏感资源，这些敏感资源通常不会被客户端通过外部网络的形式进行访问。正常用户的客户端通常不会访问这些敏感资源，而恶意爬虫则会对能够获取到的链接都尝试访问。鉴于此，可以通过判断客户端发起的访问请求是否指向敏感目标，来识别客户端的访问行为是否存在异常。具体地，若所述客户端发来的访问请求中携带所述唯一标识，服务器可以识别所述访问请求表征的访问目标，该访问目标通常可以通过对访问请求中的URL(Uniform Resource Locator，统一资源定位符)来识别。若所述访问目标属于敏感目标，服务器则可以判定所述客户端的访问行为存在异常。
在另一个实施方式中，用户在对网站资源发起访问时，通常可以在浏览器中输入网站的首页地址，或者可以在当前页面中点击某个链接，从而跳转至待访问的页面中。也就是说，正常用户在访问网站资源时，对于网站首页而言，用户可能会直接输入首页的网址，而对于网站中的其它页面而言，用户可能是通过百度、谷歌等搜索结果页面中的链接，或者通过网站首页中展示的链接跳转至其它页面的。因此，正常用户的访问的不同页面之间，往往是具备前后引用关系的。例如，用户在百度中输入“XX科技”，然后百度的搜索结果页面便可以出现该“XX科技”的官网地址。用户通过点击该官网地址，便可以访问“XX科技”的首页。首页中可能有该公司提供的各项业务，这样，用户通过点击其中的“CDN服务器租借”链接，便可以访问CDN服务器租借的详细内容。上述例子中，用户的访问行为是通过百度-官网首页-CDN服务器租借这个访问逻辑进行的。页面与页面之间往往存在引用关系。例如，用户最终想要访问的是CDN服务器租借页面，该页面的引用页面是官网首页，而官网首页的引用页面是百度。页面之间的这种引用关系，可以通过访问请求中的referer字段来记录。例如，上述针对CDN服务器租借页面的访问请求中，referer字段内便可以记录官网首 页的标识。相应地，针对官网首页的访问请求中，referer字段可以记录百度的页面标识。然而，对于恶意爬虫而言，其并不会通过这种逐层搜索的方式来访问最终的页面，而是直接通过CDN服务器租借的访问链接，对该页面发起访问。也就是说，恶意爬虫往往都是直接通过待访问页面的页面地址发起访问。因此，在恶意爬虫的访问请求中，绝大部分的访问请求的referer字段都是空字段，不存在上一级的引用页面。
鉴于此，在本实施方式中，若所述客户端发来的访问请求中携带所述唯一标识，服务器可以从所述访问请求中识别所述访问请求是否具备请求来源。该请求来源便可以通过访问请求中的referer字段表明。具体地，服务器可以识别所述访问请求中referer字段的内容，若所述referer字段为空，则确定所述访问请求不具备请求来源；若所述referer字段中携带页面标识，则可以将所述页面标识指向的页面作为所述访问请求的请求来源。
在本实施方式中，服务器可以从所述客户端在指定时段内发来的访问请求中统计不具备请求来源的目标访问请求的数量，若统计的所述数量大于或者等于指定数量阈值，则表示该客户端在指定时段内发来的访问请求中，大部分并没有对应的引用页面，而是直接根据访问地址发起访问的。这种访问行为与恶意爬虫的访问行为比较相似，此时，可以判定所述客户端的访问行为存在异常。
请参阅图3，本申请还提供一种服务器，所述服务器包括：
辨认标识生成单元，用于接收客户端发来的访问请求，并基于所述访问请求，生成所述客户端的辨认标识；
唯一标识生成单元，用于获取所述客户端的设备指纹信息，并根据所述辨认标识和所述设备指纹信息，生成所述客户端的唯一标识；
访问行为识别单元，用于将所述唯一标识下发给所述客户端，以基于所述唯一标识，识别所述客户端的访问行为是否异常。
在一个实施方式中，所述辨认标识生成单元包括：
访问信息提取模块，用于从所述访问请求中提取所述客户端的访问信息，所述访问信息至少包括所述客户端的IP地址和所述客户端的用户代理信息；
加密模块，用于随机生成指定长度的识别码，并对所述识别码和所述访问信息的组合进行加密，以生成所述客户端的辨认标识。
在一个实施方式中，所述唯一标识生成单元包括：
脚本下发模块，用于在响应于所述访问请求向所述客户端反馈响应信息时，向所述客户端下发检测脚本，其中，所述检测脚本在所述客户端中运行时，获取所述客户端的设备指纹信息。
在一个实施方式中，所述访问行为识别单元包括：
标识识别模块，用于再次接收所述客户端发来的访问请求，并识别所述访问请求中是否携带所述唯一标识，若所述访问请求中未携带所述唯一标识，判定所述客户端的访问行为存在异常。
请参阅图4，本申请还提供一种服务器，所述服务器包括存储器和处理器，所述存储器用于存储计算机程序，所述计算机程序被所述处理器执行时，可以实现上述的异常访问行为的识别方法。
由上可见，本申请提供的技术方案，服务器在接收到客户端发来的访问请求时，可以基于该访问请求生成客户端的辨认标识。在实际应用中，该辨认标识可以由该访问请求中的访问信息和随机生成的识别码共同确定。访问请求中的访问信息可以包括客户端的IP地址和用户代理信息(usr-agent)。在生成客户端的辨认标识之后，可以获取客户端的设备指纹信息。该设备指纹信息可以从多方面表征一个客户端。例如，该设备指纹信息可以包括客户端的语言、色彩深度、像素比例、屏幕分辨率、浏览器语言、操作系统参数、CPU型号等信息。这样，通过上述的辨认标识和设备指纹信息，可以精确地确定一个客户端。在本申请中，可以根据所述辨认标识和所述设备指纹信息，生成所述客户端的唯一标识。该唯一标识可以将该客户端与其它客户端进行区分。后续，服务器可以将该唯一标识反馈给该客户端。对于正常用户而言，后续在向服务器发起访问请求时，都会带上自身的唯一标识；而部分恶意爬虫则不会携带该唯一标识，如果恶意爬虫携带了该唯一标识，服务器也可以通过该唯一标识来确定恶意爬虫的访问行为轨迹，从而有效地识别出恶意爬虫。这样，服务器可以基于该唯一标识，来判断发起访问请求的客户端是否存在异常。由上可见，本申请提供的技术方案，通过将客户端的辨认标识与设备指纹信息进行结合，从而可以精确地表征一个客户端。后续，通过对该唯一标识进行识别，从而可以追踪客户端的访问行为轨迹，进而能够判断客户端的访问行为是否存在异常。按照本申请提供的技术方案，能够有效地将正常用户与恶意爬虫进行区分，从而提高了 异常行为的识别精度。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到各实施方式可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件来实现。基于这样的理解，上述技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行各个实施例或者实施例的某些部分所述的方法。
以上所述仅为本发明的较佳实施例，并不用以限制本发明，凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (15)

  1. 一种异常访问行为的识别方法，其特征在于，所述方法包括：
    接收客户端发来的访问请求，并基于所述访问请求，生成所述客户端的辨认标识；
    获取所述客户端的设备指纹信息，并根据所述辨认标识和所述设备指纹信息，生成所述客户端的唯一标识；
    将所述唯一标识下发给所述客户端，以基于所述唯一标识，识别所述客户端的访问行为是否异常。
  2. 根据权利要求1所述的方法，其特征在于，基于所述访问请求，生成所述客户端的辨认标识包括：
    从所述访问请求中提取所述客户端的访问信息，所述访问信息至少包括所述客户端的IP地址和所述客户端的用户代理信息；
    随机生成指定长度的识别码，并对所述识别码和所述访问信息的组合进行加密，以生成所述客户端的辨认标识。
  3. 根据权利要求1所述的方法，其特征在于，获取所述客户端的设备指纹信息包括：
    在响应于所述访问请求向所述客户端反馈响应信息时，向所述客户端下发检测脚本，其中，所述检测脚本在所述客户端中运行时，获取所述客户端的设备指纹信息。
  4. 根据权利要求1-3任意一项所述的方法，其特征在于，根据所述辨认标识和所述设备指纹信息，生成所述客户端的唯一标识包括：
    对所述辨认标识和所述设备指纹信息的组合进行加密，得到指定长度的密钥，并将所述指定长度的密钥作为所述客户端的唯一标识。
  5. 根据权利要求1所述的方法，其特征在于，将所述唯一标识下发给所述客户端包括：
    将所述唯一标识以cookie的形式下发给所述客户端。
  6. 根据权利要求1所述的方法，其特征在于，基于所述唯一标识，识别所述客户端的访问行为是否异常包括：
    再次接收所述客户端发来的访问请求，并识别所述访问请求中是否携带所述唯一标识，若所述访问请求中未携带所述唯一标识，判定所述客户端的访问行为存在异常。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    若所述客户端发来的访问请求中携带所述唯一标识，统计所述客户端发起访问请求的访问频率；
    若统计的所述访问频率大于或者等于指定频率阈值，判定所述客户端的访问行为存在异常。
  8. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    若所述客户端发来的访问请求中携带所述唯一标识，识别所述访问请求表征的访问目标；若所述访问目标属于敏感目标，判定所述客户端的访问行为存在异常。
  9. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    若所述客户端发来的访问请求中携带所述唯一标识，从所述访问请求中识别所述访问请求是否具备请求来源；
    从所述客户端在指定时段内发来的访问请求中统计不具备请求来源的目标访问请求的数量，若统计的所述数量大于或者等于指定数量阈值，判定所述客户端的访问行为存在异常。
  10. 根据权利要求9所述的方法，其特征在于，从所述访问请求中识别所述访问请求是否具备请求来源包括：
    识别所述访问请求中referer字段的内容，若所述referer字段为空，确定所述访问请求不具备请求来源；若所述referer字段中携带页面标识，将所 述页面标识指向的页面作为所述访问请求的请求来源。
  11. 一种服务器，其特征在于，所述服务器包括：
    辨认标识生成单元，用于接收客户端发来的访问请求，并基于所述访问请求，生成所述客户端的辨认标识；
    唯一标识生成单元，用于获取所述客户端的设备指纹信息，并根据所述辨认标识和所述设备指纹信息，生成所述客户端的唯一标识；
    访问行为识别单元，用于将所述唯一标识下发给所述客户端，以基于所述唯一标识，识别所述客户端的访问行为是否异常。
  12. 根据权利要求11所述的服务器，其特征在于，所述辨认标识生成单元包括：
    访问信息提取模块，用于从所述访问请求中提取所述客户端的访问信息，所述访问信息至少包括所述客户端的IP地址和所述客户端的用户代理信息；
    加密模块，用于随机生成指定长度的识别码，并对所述识别码和所述访问信息的组合进行加密，以生成所述客户端的辨认标识。
  13. 根据权利要求11所述的服务器，其特征在于，所述唯一标识生成单元包括：
    脚本下发模块，用于在响应于所述访问请求向所述客户端反馈响应信息时，向所述客户端下发检测脚本，其中，所述检测脚本在所述客户端中运行时，获取所述客户端的设备指纹信息。
  14. 根据权利要求11所述的服务器，其特征在于，所述访问行为识别单元包括：
    标识识别模块，用于再次接收所述客户端发来的访问请求，并识别所述访问请求中是否携带所述唯一标识，若所述访问请求中未携带所述唯一标识，判定所述客户端的访问行为存在异常。
  15. 一种服务器，其特征在于，所述服务器包括存储器和处理器，所述存 储器用于存储计算机程序，所述计算机程序被所述处理器执行时，实现如权利要求1至10中任一权利要求所述的方法。
PCT/CN2018/113029 2018-09-19 2018-10-31 一种异常访问行为的识别方法及服务器 WO2020056857A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18934417.9A EP3852327A4 (en) 2018-09-19 2018-10-31 PROCEDURE AND SERVER FOR IDENTIFYING EXCEPTIONAL ACCESS BEHAVIOR
US16/767,998 US20210194906A1 (en) 2018-09-19 2018-10-31 Method and server for recognizing abnormal access behavior

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811098879.2 2018-09-19
CN201811098879.2A CN109194671B (zh) 2018-09-19 2018-09-19 一种异常访问行为的识别方法及服务器

Publications (1)

Publication Number Publication Date
WO2020056857A1 true WO2020056857A1 (zh) 2020-03-26

Family

ID=64908694

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/113029 WO2020056857A1 (zh) 2018-09-19 2018-10-31 一种异常访问行为的识别方法及服务器

Country Status (4)

Country Link
US (1) US20210194906A1 (zh)
EP (1) EP3852327A4 (zh)
CN (1) CN109194671B (zh)
WO (1) WO2020056857A1 (zh)

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110210858A (zh) * 2019-05-31 2019-09-06 上海观安信息技术股份有限公司 一种基于智能终端识别的风控防护系统设计方法
CN110830445B (zh) * 2019-10-14 2023-02-03 中国平安财产保险股份有限公司 一种异常访问对象的识别方法及设备
CN111193714B (zh) * 2019-12-06 2022-10-04 武汉极意网络科技有限公司 一种验证码打码平台自动化追踪方法及系统
CN113922974B (zh) * 2020-06-22 2024-04-09 中移(苏州)软件技术有限公司 一种信息处理方法及系统、前端、服务端、存储介质
CN111818025B (zh) * 2020-06-23 2022-10-14 五八有限公司 一种用户终端的检测方法和装置
CN111970234A (zh) * 2020-06-30 2020-11-20 浙江远望信息股份有限公司 一种基于Cookie的NAT私网接入违规外联设备的取证方法
CN113660238B (zh) * 2021-08-10 2023-05-16 建信金融科技有限责任公司 人机识别方法、装置、系统、设备及可读存储介质
CN114943024B (zh) * 2022-05-31 2023-04-25 北京永信至诚科技股份有限公司 一种基于浏览器的指纹采集方法和装置
CN116232691A (zh) * 2023-01-10 2023-06-06 百度在线网络技术（北京）有限公司 异常访问的检测方法、装置、电子设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107426181A (zh) * 2017-06-20 2017-12-01 竞技世界（北京）网络技术有限公司 恶意Web访问请求的拦截方法及装置
CN107612926A (zh) * 2017-10-12 2018-01-19 成都知道创宇信息技术有限公司 一种基于客户端识别的一句话WebShell拦截方法
CN108429785A (zh) * 2018-01-17 2018-08-21 广东智媒云图科技股份有限公司 一种爬虫识别加密串的生成方法、爬虫识别方法及装置
US20180239693A1 (en) * 2017-02-21 2018-08-23 International Business Machines Corporation Testing web applications using clusters

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103384240B (zh) * 2012-12-21 2016-09-07 北京安天电子设备有限公司 一种p2p主动防御方法及系统
CN104811424B (zh) * 2014-01-26 2019-05-14 腾讯科技（深圳）有限公司 恶意用户识别方法及装置
CN104967629B (zh) * 2015-07-16 2018-11-27 网宿科技股份有限公司 网络攻击检测方法及装置
GB2537443B8 (en) * 2015-10-28 2017-05-17 Ayyeka Tech Ltd Method and system for identifying a network-connected sensor device based on electrical fingerprint
CN106713242B (zh) * 2015-11-17 2020-04-07 阿里巴巴集团控股有限公司 数据请求的处理方法及处理装置
CN108259482B (zh) * 2018-01-04 2019-05-28 平安科技（深圳）有限公司 网络异常数据检测方法、装置、计算机设备及存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180239693A1 (en) * 2017-02-21 2018-08-23 International Business Machines Corporation Testing web applications using clusters
CN107426181A (zh) * 2017-06-20 2017-12-01 竞技世界（北京）网络技术有限公司 恶意Web访问请求的拦截方法及装置
CN107612926A (zh) * 2017-10-12 2018-01-19 成都知道创宇信息技术有限公司 一种基于客户端识别的一句话WebShell拦截方法
CN108429785A (zh) * 2018-01-17 2018-08-21 广东智媒云图科技股份有限公司 一种爬虫识别加密串的生成方法、爬虫识别方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3852327A4 *

Also Published As

Publication number Publication date
US20210194906A1 (en) 2021-06-24
CN109194671B (zh) 2021-07-13
CN109194671A (zh) 2019-01-11
EP3852327A4 (en) 2021-09-08
EP3852327A1 (en) 2021-07-21

Similar Documents

Publication Publication Date Title
WO2020056857A1 (zh) 一种异常访问行为的识别方法及服务器
US11176573B2 (en) Authenticating users for accurate online audience measurement
US11206451B2 (en) Information interception processing method, terminal, and computer storage medium
EP2673708B1 (en) DISTINGUISH VALID USERS FROM BOTS, OCRs AND THIRD PARTY SOLVERS WHEN PRESENTING CAPTCHA
JP6068506B2 (ja) オンライン不正行為の検出の動的採点集計のシステムおよび方法
US20220303275A1 (en) System and Method for Handling User Requests for Web Services
US20180091355A1 (en) Single sign-on system and single sign-on method
CN104580316A (zh) 软件授权管理方法及系统
US9015817B2 (en) Resilient and restorable dynamic device identification
JP2019503533A (ja) 情報処理方法及びサーバ、コンピュータ記憶媒体
WO2017020585A1 (zh) 一种基于cdn的访问控制方法及相关设备
CN116324766A (zh) 通过浏览简档优化抓取请求
CN111241541A (zh) 一种根据请求数据防爬虫系统和方法
US11356478B2 (en) Phishing protection using cloning detection
US11139966B2 (en) Security code for integration with an application
CN106295366B (zh) 敏感数据识别方法及装置
GB2535579A (en) Preventing unauthorized access to an application server
JP6835507B2 (ja) 不正アクセス検出装置、不正アクセス検出方法およびコンピュータプログラム
CN112637171A (zh) 数据流量处理方法、装置、设备、系统和存储介质
CN112685706A (zh) 请求鉴权方法及相关设备
WO2018166365A1 (zh) 一种记录网站访问日志的方法和装置
CN114629671B (zh) 一种数据检测系统
US20230069731A1 (en) Automatic network signature generation
CN115208648B (zh) 一种登录令牌生成方法、装置、电子设备及存储介质
JP7279209B2 (ja) 不正行為の検出のためのクロスドメイン頻度フィルタ

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18934417

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018934417

Country of ref document: EP

Effective date: 20210412