WO2020037781A1 - 一种实现服务器防攻击方法及装置 - Google Patents

一种实现服务器防攻击方法及装置 Download PDF

Info

Publication number
WO2020037781A1
WO2020037781A1 PCT/CN2018/108243 CN2018108243W WO2020037781A1 WO 2020037781 A1 WO2020037781 A1 WO 2020037781A1 CN 2018108243 W CN2018108243 W CN 2018108243W WO 2020037781 A1 WO2020037781 A1 WO 2020037781A1
Authority
WO
WIPO (PCT)
Prior art keywords
request
type
address
server
source
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2018/108243
Other languages
English (en)
French (fr)
Inventor
庄晓川
刘懋林
张志明
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Wangsu Science and Technology Co Ltd
Original Assignee
Wangsu Science and Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Wangsu Science and Technology Co Ltd filed Critical Wangsu Science and Technology Co Ltd
Priority to US16/473,095 priority Critical patent/US20210344706A1/en
Priority to EP18910232.0A priority patent/EP3633948B1/en
Publication of WO2020037781A1 publication Critical patent/WO2020037781A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0254—Stateful filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the present invention relates to the field of computer technology, and in particular, to a method and device for implementing server anti-attack.
  • the server can protect against TCP SYN flood attacks at the kernel layer.
  • this protection method can only target ordinary SYN attacks launched using virtual IP addresses, and cannot prevent attacks launched using real IP addresses.
  • the embodiments of the present invention provide a method and a device for implementing server anti-attack to solve the technical problem that the prior art cannot prevent attacks initiated by using real IP addresses.
  • An embodiment of the present invention provides a method for implementing server anti-attack.
  • the method includes:
  • the server receives a first link request, where the first link request includes a source IP address of the request;
  • the server Determining, by the server, the target request type of the first link request according to the characteristic information of the first link request;
  • the characteristic information of the first link request includes at least one of request data, a request rule, and a request content;
  • the server determines that the number of requests consistent with the target request type initiated by the source IP address is greater than a preset threshold, determining the target attack type of the first link request according to the target request type, and rejecting the target attack type
  • the first link request is described, and the source IP address is added to a first set; the first set is used to store an IP address that the server refuses to access.
  • the server can adopt different anti-attack strategies to achieve the purpose of server anti-attack according to different request types, which can effectively improve the anti-attack ability of the entire server, effectively reduce the risk of the server being attacked, and thereby improve the service quality of the server , To ensure the continuity and stability of the services provided by the server, and improve the user's Internet experience.
  • the determining, by the server according to the characteristic information of the first link request, a target request type of the first link request includes:
  • the server determines that the request data cannot be assembled into a request format that can be recognized by the server, determines that the target request type of the first link request is a pan-SYN request;
  • the server determining the number of requests initiated by the source IP address within a first preset period and having a request type consistent with the target request type includes:
  • determining the target attack type of the first link request according to the target request type includes:
  • the server determines that the number of requests for the pan-SYN request initiated by the source IP address is greater than a first preset threshold, it determines that the target attack type of the first link request is a pan-SYN attack.
  • the determining, by the server according to the characteristic information of the first link request, a target request type of the first link request includes:
  • the server determines that the request data can be assembled into a request format recognized by the server, but the request rule does not conform to a preset rule, the server determines The target request type of the first link request is an illegal URL request;
  • the server determining the number of requests initiated by the source IP address within a first preset period and having a request type consistent with the target request type includes:
  • Determining, by the server, that the number of requests consistent with the target request type initiated by the source IP address is greater than a preset threshold, determining the target attack type of the first link request according to the target request type includes:
  • the server determines that the number of requests for the illegal URL request initiated by the source IP address is greater than a second preset threshold, and determines that a target attack type of the first link request is an illegal URL attack.
  • the determining, by the server according to the characteristic information of the first link request, a target request type of the first link request includes:
  • the server determines, according to the request data and request rules of the first link request, that the request data can be assembled into a request format that the server can recognize, and that the request rules conform to a preset rule, determining the first
  • the target request type of a link request is a candidate legitimate URL request
  • the server determines that the requested content is inconsistent with the content provided by the server according to the requested content of the first link request, determining that the candidate legitimate URL request is a first type legitimate URL request;
  • the server determining the number of requests initiated by the source IP address within a first preset period and having a request type consistent with the target request type includes:
  • Determining, by the server, the number of requests initiated by the source IP address within the first preset period and the request type is the first type of legitimate URL request
  • determining the target attack type of the first link request according to the target request type includes:
  • the server determines that the number of requests for the first type of legitimate URL request is greater than a third preset threshold, and determines that the target attack type of the first link request is a legitimate URL attack.
  • the method further includes:
  • the server determines that the requested content is consistent with the content provided by the server, determining that the candidate legitimate URL request is a second type of legitimate URL request;
  • the server determines that the source IP address is included in the second set, determining the number of requests for the second type of legitimate URL request initiated by the source IP address within a second preset period;
  • the two sets are used to store the IP addresses restricted by the server and the corresponding number of requests after the restrictions;
  • the server determines that the number of requests for the second type of legitimate URL request initiated by the source IP address within the second preset period is greater than the number of requests after the limit, determining the first link
  • the target attack type of the request is a legitimate URL attack, and the first link request is rejected, and the source IP address is added to the first set.
  • the method further includes:
  • the server determines that the number of requests initiated by the source IP address within the second preset period is less than or equal to the number of requests after the limit, it determines that the first link request is a legitimate request.
  • the method further includes:
  • the server determines that the source IP address is not included in the second set, determining the number of requests for a second type of legitimate URL request initiated by the source IP address within a third preset period;
  • the server determines that the number of requests for the second type of legitimate URL request initiated by the source IP address is greater than a fourth preset threshold within a third preset period, limiting the number of requests for the source IP address And adding the source IP address to the second set; the third preset period is earlier than the second preset period;
  • the server determines that the number of requests for the second type of legitimate URL request initiated by the source IP address within the third preset period is less than or equal to the fourth preset threshold, determining the first The link request is a legitimate request.
  • the server after the server receives the first link request, before determining a target request type of the first link request, the server further includes:
  • the server determines that the source IP address is not included in the first set.
  • An embodiment of the present invention provides a device for implementing server anti-attack.
  • the device includes:
  • a receiving unit configured to receive a first link request, where the first link request includes a source IP address of the originating request
  • a processing unit configured to determine a target request type of the first link request according to the characteristic information of the first link request; the characteristic information of the first link request includes at least one of request data, a request rule, and a request content And according to the target request type of the first link request, determining the number of requests initiated by the source IP address within a first preset period and having a request type consistent with the target request type; and if determined by If the number of requests initiated by the source IP address consistent with the target request type is greater than a preset threshold, determining the target attack type of the first link request according to the target request type, and rejecting the first link request, And adding the source IP address to a first set; the first set is used to store an IP address that the server refuses to access.
  • the processing unit is specifically configured to:
  • the request data of the first link request if it is determined that the request data cannot be assembled into a request format that can be recognized by the server, determine that the target request type of the first link request is a pan-SYN request; and determine that If the number of requests for the pan-SYN request initiated by the source IP address is greater than the number of requests for the pan-SYN request initiated by the source IP address within the first preset period; The first preset threshold determines that the target attack type of the first link request is a pan-SYN attack.
  • the processing unit is specifically configured to:
  • the request data and request rules of the first link request if it is determined that the request data can be assembled into a request format recognized by the server, but the request rule does not meet a preset rule, then the first The target request type of the link request is an illegal URL request; and it is determined that the source IP address is initiated by the source IP address within the first preset period, and the request type is the number of requests for the illegal URL request; and The number of requests for the illegal URL request initiated by the source IP address is greater than a second preset threshold, and it is determined that the target attack type of the first link request is an illegal URL attack.
  • the processing unit is specifically configured to:
  • the request data and request rules of the first link request if it is determined that the request data can be assembled into a request format recognized by the server, and the request rule meets a preset rule, the first link request is determined And the target request type is a candidate legitimate URL request; and according to the request content of the first link request, if it is determined that the requested content is inconsistent with the content provided by the server, determining that the candidate legitimate URL request is the first A type of legitimate URL request; and determining the number of requests initiated by the source IP address within the first preset period and the request type is the first type of legitimate URL request; and if determined by the source IP The number of requests for the first type of legitimate URL request initiated by the address is greater than a third preset threshold, and it is determined that the target attack type of the first link request is a legitimate URL attack.
  • the processing unit is further configured to:
  • the candidate legitimate URL request is a second type of legitimate URL request; if it is determined that the source IP address is included in the second set, it is determined that The number of requests for the second type of legitimate URL request initiated by the source IP address in the second preset period; the second set is used to store the IP address restricted by the server and the corresponding restricted IP address The number of requests; and if it is determined that the number of requests for the second type of legitimate URL request initiated by the source IP address within the second preset period is greater than the number of requests after the limit, determining the first The target attack type of the link request is a legitimate URL attack, and the first link request is rejected, and the source IP address is added to the first set.
  • the processing unit is further configured to:
  • the first link request is determined to be a legitimate request.
  • the processing unit is further configured to:
  • the source IP address determines the number of requests for the second type of legitimate URL request initiated by the source IP address in the third preset period; and if it is determined in the third preset period Assuming that the number of requests for the second type of legitimate URL request initiated by the source IP address within a period is greater than a fourth preset threshold, the number of requests for the source IP address is limited, and the source IP address is added To the second set; the third preset period is earlier than the second preset period; and if it is determined that the second type initiated by the source IP address is within the third preset period If the number of requests for legitimate URL requests is less than or equal to the fourth preset threshold, it is determined that the first link request is a legitimate request.
  • the processing unit after receiving the first link request, before the processing unit determines a target request type of the first link request, the processing unit is further configured to:
  • An embodiment of the present application further provides a device having the function of implementing the server attack defense method described above.
  • This function can be implemented by executing corresponding software through hardware.
  • the device includes: a processor, a transceiver, and a memory; the memory is used to store computer execution instructions, and the transceiver is used to implement the device to communicate with other The entity communicates.
  • the processor is connected to the memory through the bus. When the device is running, the processor executes the computer execution instructions stored in the memory, so that the device executes the server attack prevention method described above.
  • An embodiment of the present invention also provides a computer storage medium.
  • the storage medium stores a software program, and when the software program is read and executed by one or more processors, the implementation described in the foregoing various possible implementation manners is implemented. Server anti-attack method.
  • An embodiment of the present invention further provides a computer program product containing instructions, which when executed on a computer, causes the computer to execute the server attack prevention method described in the foregoing various possible implementation manners.
  • FIG. 1 is a system architecture diagram provided by an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of a server attack prevention method according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of a method for determining a target request type according to an embodiment of the present invention
  • FIG. 4 is a schematic diagram of an overall process involved in an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of an apparatus for implementing server attack prevention according to an embodiment of the present invention.
  • FIG. 1 exemplarily illustrates a system architecture diagram provided by an embodiment of the present invention.
  • the system 100 includes a server 101 and at least one client device, such as a client device 102, a client device 103, and a client device 104 shown in FIG. 1.
  • the server 101 may communicate with the client device 102, the client device 103, and the client device 104 over a network.
  • any client device of the client device 102, the client device 103, or the client device 104 may communicate with the server 101 Sending a link request, the server 101 may access the client device according to the link request, and return a response message to the client device.
  • the server may be multiple types of servers, such as an edge server in a CDN system.
  • different edge servers can resolve different domain name requests, that is, the server in the present invention can be an edge server used to analyze live broadcast services, or can also be used to analyze search services.
  • the edge server, or an edge server used for analyzing video services, is not specifically limited.
  • the client device may be multiple types of devices, such as a laptop computer, a smart phone, a tablet computer, a smart TV, and the like.
  • FIG. 2 exemplarily illustrates a schematic flowchart of a method for implementing server anti-attack provided by an embodiment of the present invention. As shown in FIG. 2, it specifically includes the following steps:
  • Step 201 The server receives a first link request.
  • Step 202 The server determines a target request type of the first link request according to the characteristic information of the first link request.
  • Step 203 The server determines, according to the target request type of the first link request, the number of requests initiated by the source IP address within a first preset period and having the same request type as the target request type.
  • Step 204 If the server determines that the number of requests consistent with the target request type initiated by the source IP address is greater than a preset threshold, it determines the target attack type of the first link request according to the target request type, and rejects The first link request, and adding the source IP address to a first set.
  • steps 202 to 204 may be performed using an auto-learn algorithm, and a specific execution method will be described below.
  • the server can adopt different anti-attack strategies to achieve the purpose of server anti-attack according to different request types, which can effectively improve the anti-attack ability of the entire server, effectively reduce the risk of the server being attacked, and thus improve the service quality of the server. , To ensure the continuity and stability of the services provided by the server, and improve the user's Internet experience.
  • the first link request may be a link request of a URL, that is, the form of the first link request may be: protocol name: //host.domain name / path / file name. Further, the first link request may include a source IP address of the request.
  • the client device 102 may send a first link request to the server 101, where the first link request sent by the client device 102 may include the IP address of the client device 102.
  • the server may first determine whether the IP address is included in the first set, and if the source IP address is not in the first set, step 202 may be performed; otherwise, the server may reject the first link request.
  • the first set may be used to store an IP address that the server refuses to access.
  • the feature information of the first link request may include various forms of content.
  • the feature information of the first link request may include request data; or, the feature information of the first link request may also include request rules; or, The characteristic information requested by the first link may further include the requested content; or, the characteristic information requested by the first link may further include the requested data and request rules; or the characteristic information requested by the first link may further include the requested data and requested content; or, The feature information of the first link request may further include a request rule and a request content; or, the feature information of the first link request may further include a request data, a request rule, and a request content, which are not specifically limited.
  • the server may determine the target request type of the first link request according to the characteristic information of the first link request.
  • FIG. 3 exemplarily illustrates a schematic flow chart corresponding to a method for determining a target request type provided by an embodiment of the present invention.
  • the specific steps include the following steps:
  • Step 301 The server determines whether the request data of the first link request can be assembled into a request format that can be recognized by the server according to the request data of the first link request. If the request data cannot be assembled into a request format that can be recognized by the server, then Go to step 302; otherwise, go to step 303.
  • the server considering that different servers use different services for parsing, for example, if the server is used for parsing live broadcast services, it can be determined whether the request data of the first link request can be assembled to be responsible for parsing.
  • the request format recognized by the server may include an HTTP URL format recognized by the server, or may be an RTMP format recognized by the server.
  • the standard HTTP request packet header generally consists of a request method, a request URL, a request protocol, and a request header.
  • the auto-learn algorithm can determine whether the request data of the first link request can be assembled into an HTTP complete header within a preset time period, and determine whether the first link request meets the standard
  • the HTTP protocol stipulates that if it can be assembled into a complete HTTP header and meets the requirements of the standard HTTP protocol, it is determined that the request data of the first link request can be assembled into an HTTP URL format recognized by the server; otherwise, the first link is determined
  • the requested request data cannot be assembled into an HTTP URL format that the server can recognize.
  • the auto-learn algorithm can determine whether the first byte is in the preset Whether the amount of data of 1536 bytes is received within the time period. If the amount of data of 1536 bytes is received, it is determined that the requested data of the first link request can be assembled into an RTMP format that can be recognized by the server; otherwise, the first The request data of a link request cannot be assembled into an RTMP format that the server can recognize.
  • the server in consideration of the number of first link requests received by the server, in order to improve the efficiency of the server, the server may judge the request data within a preset time period. If the time exceeds the preset time period, the server cannot determine If the request data can be assembled into a request format that can be recognized by the server, it can be considered that the request data cannot be assembled into a request format that can be recognized by the server.
  • Step 302 The server determines that the target request type of the first link request is a pan-SYN request.
  • the characteristic of the pan-SYN request is that the source IP address of the request is accessible. If the pan-SYN request is not further processed, the source IP address may appear to initiate a flood attack and transmit a large amount of junk data to the server Situation, thereby consuming the network card resources of the server, etc., and then affecting the transmission of normal business.
  • Step 303 The server determines whether the request rule of the first link request conforms to a preset rule. If the request rule does not conform to the preset rule, step 304 is performed; otherwise, step 305 is performed.
  • the preset rules may include multiple types of rules, such as a request domain name rule, a refer rule, a user-agent rule, a request parameter rule, a request policy rule (such as a timestamp anti-theft chain rule), and the like are not specifically limited.
  • the server may determine whether the request rule of the first link request conforms to the preset rule.
  • the server may determine the request of the first link request Whether the rule conforms to any one of the plurality of types of rules.
  • the server may also determine whether the request rule of the first link request is consistent with each type of rule, thereby improving the accuracy of the server in determining the target request type.
  • the auto-learn algorithm can be used to determine whether the request rule of the first link request conforms to a preset rule.
  • a preset rule such as service domain name rules (that is, the set of clients that the server can support), or request policy rules (that can be verified by the server) Algorithm).
  • service domain name rules that is, the set of clients that the server can support
  • request policy rules that can be verified by the server Algorithm.
  • MD5 timestamp anti-theft chain rule Take the MD5 timestamp anti-theft chain rule as an example.
  • the auto-learn algorithm determines that a certain MD5 timestamp anti-theft chain rule is set in a domain name, it can determine the first link request.
  • the request rule of a link request conforms to a preset rule.
  • Step 304 The server determines that the target request type of the first link request is an illegal URL request.
  • Step 305 The server determines that the target request type of the first link request is a candidate legitimate URL request.
  • step 306 the server determines whether the requested content of the first link request is consistent with the content provided by the server. If not, step 307 is performed; otherwise, step 308 is performed.
  • the server may be multiple types of servers.
  • the server may be a server for parsing a live broadcast service, that is, the content provided by the server is the content corresponding to the live broadcast service.
  • the requested content of the first link request is other types of content (for example, content corresponding to a search service), it can be considered that the requested content of the first link request is inconsistent with the content provided by the server.
  • the content provided by the server may refer to a resource set owned by an edge server and a central node server.
  • the auto-learn algorithm can be used to further determine whether the content of the request of the legitimate URL request is a resource owned by the server. If the server does not own the resource, it will further determine whether the entire network owns it according to the scheduling query. If the resource is not owned, it is judged as a resource not owned by the CDN, that is, the requested content is not consistent with the content provided by the server.
  • a threshold for requests that do not own a resource per unit time can be set. If a certain type of request is to periodically check whether the CDN owns the resource, its behavior is considered normal, but if a certain type of request is sent continuously within unit time If a large number of requests for resources do not exist, it is determined as an attack behavior;
  • Step 307 The server determines that the candidate legitimate URL request is a first type of legitimate URL request.
  • Step 308 The server determines that the candidate legitimate URL request is a first type of legitimate URL request.
  • the server may first determine the Whether the request rule of a link request conforms to a preset rule, and then judges whether the request data of the first link request can be assembled into a request format that can be recognized by the server; (2) determining the target request type provided in steps 301 to 308
  • the method is only an example. In other possible examples, if the characteristic information of the first link request includes the request data, the server may determine whether the request data of the first link request can be assembled into a request that the server can identify.
  • the server can determine whether the request data of the first link request can be assembled Into a request format that can be identified by the server, and to determine within the request of the first link request Whether the content is consistent with the content provided by the server to determine the target request type of the first link request.
  • step 203 and step 204 for different target request types, in the embodiment of the present invention, different defense measures can be adopted to improve the server's anti-attack capability.
  • the server may determine the number of requests initiated by the source IP address within the first preset period, and the request type is a pan-SYN request; further, the server may determine that the source IP address Whether the number of requests for the pan-SYN request initiated by the address is greater than the first preset threshold; if it is greater than the first preset threshold, it can be determined that the target attack type of the first link request is a pan-syn attack, and the first link request is rejected, and The source IP address is added to the first set; if it is less than or equal to the first preset threshold, only the first link request may be rejected, but the source IP address is not added to the first set.
  • the first set can be used to store the IP address that the server refuses to access. That is, if the subsequent server receives the second link request and determines that the IP address that initiated the second link request is in the first set, it can Deny access to this IP address directly, without performing the operations after step 201 above.
  • the server may determine the number of requests initiated by the source IP address within the first preset period, and the request type is an illegal URL request; further, the server may determine the number of requests by the source. Whether the number of requests for illegal URL requests initiated by the IP address is greater than the second preset threshold; if it is greater than the second preset threshold, it can be determined that the target attack type of the first link request is an illegal URL attack, and the first link request is rejected, and The source IP address is added to the first set; if it is less than or equal to the second preset threshold, only the first link request may be rejected, but the source IP address is not added to the first set.
  • the server may determine the number of requests initiated by the source IP address within the first preset period and the request type is the first type of legitimate URL request; further The server may determine whether the number of requests for the first type of legitimate URL request is greater than the third preset threshold. If it is greater than the third preset threshold, it may determine that the target attack type of the first link request is a legitimate URL attack and reject the first link. Request, and add the source IP address to the first set; if it is less than or equal to the third preset threshold, only the first link request may be rejected, but the source IP address is not added to the first set.
  • the server can determine whether the source IP address is included in the second set, and if the source IP address is included in the second set, the server can determine Number of requests for the second type of legitimate URL request initiated by the source IP address in a preset period, and then determining the number of requests for the second type of legitimate URL request initiated by the source IP address in the second preset period Whether it is greater than the limit of the number of requests, and if it is greater than that, the target attack type of the first link request is determined as a legitimate URL attack, the first link request is rejected, and the source IP address is added to the first set , Otherwise, determine that the first link request is a legitimate request.
  • the server may determine the number of requests for the second type of legitimate URL request initiated by the source IP address within the third preset period, and then determine the third preset period Whether the number of requests for the second type of legitimate URL request initiated by the source IP address is greater than the fourth preset threshold, and if it is greater than that, the number of requests for the source IP address is limited, and the source IP address is added to the first Two sets, otherwise, it is determined that the first link request is a legitimate request.
  • the second set may be used to store the IP address restricted by the server and the corresponding number of requests after the restriction; the third preset period is earlier than the second preset period.
  • Step 401 The server receives a first link request.
  • Step 402 The server determines whether the request data of the first link request can be assembled into a request format recognized by the server according to the request data of the first link request. If the request data cannot be assembled into a request format recognized by the server, then Go to step 403; otherwise, go to step 408.
  • Step 403 The server determines that the target request type of the first link request is a pan-SYN request.
  • the server may determine the number of requests initiated by the source IP address within the first preset period and the request type is a pan-SYN request.
  • the server may determine whether the number of requests for the pan-SYN request is greater than the first preset threshold, and if it is greater than the first preset threshold, execute step 406; otherwise, execute step 407.
  • Step 406 The server determines that the target attack type of the first link request is a pan-SYN attack, rejects the first link request, and adds the source IP address to the first set.
  • step 407 the server only rejects the first link request, but does not add the source IP address to the first set.
  • Step 408 The server determines whether the request rule of the first link request conforms to a preset rule. If the request rule does not conform to the preset rule, step 409 is performed; otherwise, step 414 is performed.
  • Step 409 The server determines that the target request type of the first link request is an illegal URL request.
  • the server may determine the number of requests initiated by the source IP address within the first preset period and the request type is an illegal URL request.
  • the server may determine whether the number of requests for illegal URL requests is greater than the second preset threshold, and if it is greater than the second preset threshold, step 412 is performed; otherwise, step 413 is performed.
  • Step 412 The server determines that the target attack type of the first link request is an illegal URL attack, rejects the first link request, and adds the source IP address to the first set.
  • step 413 the server only rejects the first link request, but does not add the source IP address to the first set.
  • Step 414 The server determines that the target request type of the first link request is a candidate legitimate URL request, and determines whether the content of the request of the first link request is consistent with the content provided by the server. If not, step 415 is performed; otherwise, step 420.
  • Step 415 The server determines that the target request type of the first link request is a first type legitimate URL request.
  • the server may determine the number of requests initiated by the source IP address within the first preset period and the request type is the first type of legitimate URL request.
  • the server may determine whether the number of requests for the first type of legitimate URL request is greater than a third preset threshold, and if it is greater than the third preset threshold, execute step 418; otherwise, execute step 419.
  • Step 418 The server determines that the target attack type of the first link request is a legitimate URL attack, rejects the first link request, and adds the source IP address to the first set.
  • step 419 the server only rejects the first link request, but does not add the source IP address to the first set.
  • Step 420 The server determines that the target request type of the first link request is a second type of legitimate URL request.
  • Step 421 The server determines whether the source IP address is included in the second set. If the source IP address is included in the second set, step 422 is performed; otherwise, step 426 is performed.
  • Step 422 The server determines the number of requests for the second type of legitimate URL request initiated by the source IP address within the second preset period.
  • step 423 the server determines whether the number of requests for the second type of legitimate URL request initiated by the source IP address within the second preset period is greater than the number of requests after the limit. If the number of requests is greater, step 424 is performed; otherwise, step 425 is performed.
  • Step 424 The server determines that the target attack type of the first link request is a legitimate URL attack, rejects the first link request, and adds the source IP address to the first set.
  • Step 425 The server determines that the first link request is a legitimate request.
  • Step 426 The server determines the number of requests for the second type of legitimate URL request initiated by the source IP address within the third preset period.
  • step 427 the server determines whether the number of requests for the second type of legitimate URL request initiated by the source IP address in the third preset period is greater than the fourth preset threshold, and if it is greater, executes step 428; otherwise, executes step 429.
  • Step 428 The server limits the number of requests for the source IP address, and adds the source IP address to the second set.
  • Step 429 The server determines that the first link request is a legitimate request.
  • FIG. 5 exemplarily shows a schematic structural diagram of an apparatus for implementing server anti-attack provided by an embodiment of the present invention.
  • the apparatus includes a receiving unit 501 and a processing unit 502; ,
  • the receiving unit 501 is configured to receive a first link request, where the first link request includes a source IP address of the originating request;
  • a processing unit 502 configured to determine a target request type of the first link request according to the characteristic information of the first link request; the characteristic information of the first link request includes at least one of request data, request rules, and request content One item; and according to the target request type of the first link request, determining the number of requests initiated by the source IP address within a first preset period and having a request type consistent with the target request type; and if determined The number of requests that are consistent with the target request type initiated by the source IP address is greater than a preset threshold, then the target attack type of the first link request is determined according to the target request type, and the first link request is rejected And adding the source IP address to a first set; the first set is used to store an IP address that the server refuses to access.
  • processing unit 502 is specifically configured to:
  • the request data of the first link request if it is determined that the request data cannot be assembled into a request format that can be recognized by the server, determine that the target request type of the first link request is a pan-SYN request; and determine that If the number of requests for the pan-SYN request initiated by the source IP address is greater than the number of requests for the pan-SYN request initiated by the source IP address within the first preset period; The first preset threshold determines that the target attack type of the first link request is a pan-SYN attack.
  • processing unit 502 is specifically configured to:
  • the request data and request rules of the first link request if it is determined that the request data can be assembled into a request format recognized by the server, but the request rule does not meet a preset rule, then the first The target request type of the link request is an illegal URL request; and it is determined that the source IP address is initiated by the source IP address within the first preset period, and the request type is the number of requests for the illegal URL request; and The number of requests for the illegal URL request initiated by the source IP address is greater than a second preset threshold, and it is determined that the target attack type of the first link request is an illegal URL attack.
  • processing unit 502 is specifically configured to:
  • the request data and request rules of the first link request if it is determined that the request data can be assembled into a request format recognized by the server, and the request rule meets a preset rule, the first link request is determined And the target request type is a candidate legitimate URL request; and according to the request content of the first link request, if it is determined that the requested content is inconsistent with the content provided by the server, determining that the candidate legitimate URL request is the first A type of legitimate URL request; and determining the number of requests initiated by the source IP address within the first preset period and the request type is the first type of legitimate URL request; and if determined by the source IP The number of requests for the first type of legitimate URL request initiated by the address is greater than a third preset threshold, and it is determined that the target attack type of the first link request is a legitimate URL attack.
  • processing unit 502 is further configured to:
  • the candidate legitimate URL request is a second type of legitimate URL request; if it is determined that the source IP address is included in the second set, it is determined that The number of requests for the second type of legitimate URL request initiated by the source IP address in the second preset period; the second set is used to store the IP address restricted by the server and the corresponding restricted IP address The number of requests; and if it is determined that the number of requests for the second type of legitimate URL request initiated by the source IP address within the second preset period is greater than the number of requests after the limit, determining the first The target attack type of the link request is a legitimate URL attack, and the first link request is rejected, and the source IP address is added to the first set.
  • processing unit 502 is further configured to:
  • the first link request is determined to be a legitimate request.
  • processing unit 502 is further configured to:
  • the source IP address determines the number of requests for the second type of legitimate URL request initiated by the source IP address in the third preset period; and if it is determined in the third preset period Assuming that the number of requests for the second type of legitimate URL request initiated by the source IP address within a period is greater than a fourth preset threshold, the number of requests for the source IP address is limited, and the source IP address is added To the second set; the third preset period is earlier than the second preset period; and if it is determined that the second type initiated by the source IP address is within the third preset period If the number of requests for legitimate URL requests is less than or equal to the fourth preset threshold, it is determined that the first link request is a legitimate request.
  • the processing unit 502 after receiving the first link request, before processing the target request type of the first link request, the processing unit 502 is further configured to:
  • An embodiment of the present application further provides a device having the function of implementing the server attack defense method described above.
  • This function can be implemented by executing corresponding software through hardware.
  • the device includes: a processor, a transceiver, and a memory; the memory is used to store computer execution instructions, and the transceiver is used to implement the device to communicate with other The entity communicates.
  • the processor is connected to the memory through the bus. When the device is running, the processor executes the computer execution instructions stored in the memory, so that the device executes the server attack prevention method described above.
  • An embodiment of the present invention also provides a computer storage medium.
  • the storage medium stores a software program, and when the software program is read and executed by one or more processors, the implementation described in the foregoing various possible implementation manners is implemented. Server anti-attack method.
  • An embodiment of the present invention further provides a computer program product containing instructions, which when executed on a computer, causes the computer to execute the server attack prevention method described in the foregoing various possible implementation manners.
  • the embodiments of the present invention may be provided as a method, a system, or a computer program product. Therefore, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk memory, CD-ROM, optical memory, etc.) containing computer-usable program code.
  • computer-usable storage media including, but not limited to, disk memory, CD-ROM, optical memory, etc.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to work in a particular manner such that the instructions stored in the computer-readable memory produce a manufactured article including an instruction device, the instructions
  • the device implements the functions specified in one or more flowcharts and / or one or more blocks of the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing device, so that a series of steps can be performed on the computer or other programmable device to produce a computer-implemented process, which can be executed on the computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more flowcharts and / or one or more blocks of the block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer And Data Communications (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明公开了一种实现服务器防攻击方法及装置。所述方法包括：服务器接收到第一链接请求后，可以根据第一链接请求的特征信息，确定所述第一链接请求的目标请求类型，并且可以根据第一链接请求的目标请求类型，确定在第一预设周期内由源IP地址发起的，且请求类型与目标请求类型一致的请求次数，进而可以在确定在请求次数大于预设阈值的情况下，确定第一链接请求的目标攻击类型，并拒绝第一链接请求，以及将源IP地址添加到第一集合中。如此，能够有效提升整个服务器的防攻击能力，有效降低服务器被攻击带来的风险，从而提升服务器的服务质量，保证服务器提供的服务的连续性和稳定性，提升用户的使用互联网体验。

Description

一种实现服务器防攻击方法及装置 技术领域
本发明涉及计算机技术领域，尤其涉及一种实现服务器防攻击方法及装置。
背景技术
随着互联网的发展，各种各样的网络平台层出不穷，而针对这些网络平台，网络恶意攻击也越来越多。以直播业务平台为例，绝大部分的直播提供厂商都会选择CDN系统进行直播加速。由于CDN系统中服务器的IP地址对外都是可见的，因此极易被黑客攻击，比如，黑客可以针对服务器发起大规模的SYN或者URL攻击，就可能导致服务器负载过高，从而影响节点的服务质量。
传统的CDN系统中，服务器可以在内核层针对TCP的SYN flood攻击进行一定防护。然而，这种防护手段只能针对采用虚拟IP地址发起的普通的SYN攻击，无法防止采用真实IP地址发起的攻击。
基于此，目前亟需一种实现服务器防攻击方法，用于解决现有技术无法防止采用真实IP地址发起的攻击的问题。
发明内容
本发明实施例提供一种实现服务器防攻击方法及装置，以解决现有技术无 法防止采用真实IP地址发起的攻击的技术问题。
本发明实施例提供一种实现服务器防攻击方法，所述方法包括：
服务器接收第一链接请求，所述第一链接请求包括发起请求的源IP地址；
所述服务器根据所述第一链接请求的特征信息，确定所述第一链接请求的目标请求类型；所述第一链接请求的特征信息包括请求数据、请求规则和请求内容中的至少一项；
所述服务器根据所述第一链接请求的目标请求类型，确定在第一预设周期内由所述源IP地址发起的，且请求类型与所述目标请求类型一致的请求次数；
所述服务器若确定由所述源IP地址发起的与所述目标请求类型一致的请求次数大于预设阈值，则根据所述目标请求类型确定所述第一链接请求的目标攻击类型，并拒绝所述第一链接请求，以及将所述源IP地址添加到第一集合中；所述第一集合用于存储所述服务器拒绝接入的IP地址。
如此，服务器可以根据不同的请求类型，采用不同的防攻击策略来实现服务器防攻击的目的，能够有效提升整个服务器的防攻击能力，有效降低服务器被攻击带来的风险，从而提升服务器的服务质量，保证服务器提供的服务的连续性和稳定性，提升用户的使用互联网体验。
在一种可能的实现方式中，所述服务器根据所述第一链接请求的特征信息，确定所述第一链接请求的目标请求类型，包括：
所述服务器根据所述第一链接请求的请求数据，若确定所述请求数据无法 组装成所述服务器能够识别的请求格式后，则确定所述第一链接请求的目标请求类型为泛SYN请求；
所述服务器确定在第一预设周期内由所述源IP地址发起的，且请求类型与所述目标请求类型一致的请求次数，包括：
所述服务器确定在所述第一预设周期内由所述源IP地址发起的，且请求类型为所述泛SYN请求的请求次数；
所述服务器若确定由所述源IP地址发起的与所述目标请求类型一致的请求次数大于预设阈值，则根据所述目标请求类型确定所述第一链接请求的目标攻击类型，包括：
所述服务器若确定由所述源IP地址发起的所述泛SYN请求的请求次数大于第一预设阈值，则确定所述第一链接请求的目标攻击类型为泛SYN攻击。
在一种可能的实现方式中，所述服务器根据所述第一链接请求的特征信息，确定所述第一链接请求的目标请求类型，包括：
所述服务器根据所述第一链接请求的请求数据和请求规则，若确定所述请求数据能够组装成所述服务器能够识别的请求格式，但所述请求规则不符合预设规则后，则确定所述第一链接请求的目标请求类型为非法URL请求；
所述服务器确定在第一预设周期内由所述源IP地址发起的，且请求类型与所述目标请求类型一致的请求次数，包括：
所述服务器确定在所述第一预设周期内由所述源IP地址发起的，且请求类 型为所述非法URL请求的请求次数；
所述服务器确定由所述源IP地址发起的与所述目标请求类型一致的请求次数大于预设阈值，则根据所述目标请求类型确定所述第一链接请求的目标攻击类型，包括：
所述服务器确定由所述源IP地址发起的所述非法URL请求的请求次数大于第二预设阈值，则确定所述第一链接请求的目标攻击类型为非法URL攻击。
在一种可能的实现方式中，所述服务器根据所述第一链接请求的特征信息，确定所述第一链接请求的目标请求类型，包括：
所述服务器根据所述第一链接请求的请求数据和请求规则，若确定所述请求数据能够组装成所述服务器能够识别的请求格式，且所述请求规则符合预设规则，则确定所述第一链接请求的目标请求类型为候选的合法URL请求；
所述服务器根据所述第一链接请求的请求内容，若确定所述请求内容与所述服务器提供服务的内容不一致，则确定所述候选的合法URL请求为第一类型合法URL请求；
所述服务器确定在第一预设周期内由所述源IP地址发起的，且请求类型与所述目标请求类型一致的请求次数，包括：
所述服务器确定在所述第一预设周期内由所述源IP地址发起的，且请求类型为所述第一类型合法URL请求的请求次数；
所述服务器若确定由所述源IP地址发起的与所述目标请求类型一致的请 求次数大于预设阈值，则根据所述目标请求类型确定所述第一链接请求的目标攻击类型，包括：
所述服务器确定所述第一类型合法URL请求的请求次数大于第三预设阈值，则确定所述第一链接请求的目标攻击类型为合法URL攻击。
在一种可能的实现方式中，所述方法还包括：
所述服务器若确定所述请求内容与所述服务器提供服务的内容一致，则确定所述候选的合法URL请求为第二类型合法URL请求；
所述服务器若确定所述源IP地址包含在第二集合中，则确定在第二预设周期内的由所述源IP地址发起的所述第二类型合法URL请求的请求次数；所述第二集合用于存储被所述服务器限制访问的IP地址以及对应的限制后的请求次数；
所述服务器若确定在所述第二预设周期内的由所述源IP地址发起的所述第二类型合法URL请求的请求次数大于所述限制后的请求次数，则确定所述第一链接请求的目标攻击类型为合法URL攻击，并拒绝所述第一链接请求，以及将所述源IP地址添加到所述第一集合中。
在一种可能的实现方式中，所述方法还包括：
所述服务器若确定在所述第二预设周期内的由所述源IP地址发起的请求次数小于或等于所述限制后的请求次数，则确定所述第一链接请求为合法请求。
在一种可能的实现方式中，所述方法还包括：
所述服务器若确定所述源IP地址不包含在第二集合中，则确定在第三预设周期内的由所述源IP地址发起的第二类型合法URL请求的请求次数；
所述服务器若确定在第三预设周期内由所述源IP地址发起的所述第二类型合法URL请求的请求次数大于第四预设阈值，则对所述源IP地址的请求次数进行限制，并将所述源IP地址添加到所述第二集合中；所述第三预设周期早于所述第二预设周期；
所述服务器若确定在所述第三预设周期内由所述源IP地址发起的所述第二类型合法URL请求的请求次数小于或等于所述第四预设阈值，则确定所述第一链接请求为合法请求。
在一种可能的实现方式中，所述服务器在接收到所述第一链接请求之后，在确定所述第一链接请求的目标请求类型之前，还包括：
所述服务器确定所述源IP地址不包含在所述第一集合中。
本发明实施例提供一种实现服务器防攻击装置，所述装置包括：
接收单元，用于接收第一链接请求，所述第一链接请求包括发起请求的源IP地址；
处理单元，用于根据所述第一链接请求的特征信息，确定所述第一链接请求的目标请求类型；所述第一链接请求的特征信息包括请求数据、请求规则和请求内容中的至少一项；并根据所述第一链接请求的目标请求类型，确定在第一预设周期内由所述源IP地址发起的，且请求类型与所述目标请求类型一致的 请求次数；以及若确定由所述源IP地址发起的与所述目标请求类型一致的请求次数大于预设阈值，则根据所述目标请求类型确定所述第一链接请求的目标攻击类型，并拒绝所述第一链接请求，以及将所述源IP地址添加到第一集合中；所述第一集合用于存储所述服务器拒绝接入的IP地址。
在一种可能的实现方式中，所述处理单元具体用于：
根据所述第一链接请求的请求数据，若确定所述请求数据无法组装成所述服务器能够识别的请求格式后，则确定所述第一链接请求的目标请求类型为泛SYN请求；并确定在所述第一预设周期内由所述源IP地址发起的，且攻击类型为所述泛SYN请求的请求次数；以及若确定由所述源IP地址发起的所述泛SYN请求的请求次数大于第一预设阈值，则确定所述第一链接请求的目标攻击类型为泛SYN攻击。
在一种可能的实现方式中，所述处理单元具体用于：
根据所述第一链接请求的请求数据和请求规则，若确定所述请求数据能够组装成所述服务器能够识别的请求格式，但所述请求规则不符合预设规则后，则确定所述第一链接请求的目标请求类型为非法URL请求；并确定在所述第一预设周期内由所述源IP地址发起的，且请求类型为所述非法URL请求的请求次数；以及若确定由所述源IP地址发起的所述非法URL请求的请求次数大于第二预设阈值，则确定所述第一链接请求的目标攻击类型为非法URL攻击。
在一种可能的实现方式中，所述处理单元具体用于：
根据所述第一链接请求的请求数据和请求规则，若确定所述请求数据能够组装成所述服务器能够识别的请求格式，且所述请求规则符合预设规则，则确定所述第一链接请求的目标请求类型为候选的合法URL请求；并根据所述第一链接请求的请求内容，若确定所述请求内容与所述服务器提供服务的内容不一致，则确定所述候选的合法URL请求为第一类型合法URL请求；并确定在所述第一预设周期内由所述源IP地址发起的，且请求类型为所述第一类型合法URL请求的请求次数；以及若确定由所述源IP地址发起的所述第一类型合法URL请求的请求次数大于第三预设阈值，则确定所述第一链接请求的目标攻击类型为合法URL攻击。
在一种可能的实现方式中，所述处理单元还用于：
若确定所述请求内容与所述服务器提供服务的内容一致，则确定所述候选的合法URL请求为第二类型合法URL请求；若确定所述源IP地址包含在第二集合中，则确定在第二预设周期内的由所述源IP地址发起的所述第二类型合法URL请求的请求次数；所述第二集合用于存储被所述服务器限制访问的IP地址以及对应的限制后的请求次数；以及若确定在所述第二预设周期内的由所述源IP地址发起的所述第二类型合法URL请求的请求次数大于所述限制后的请求次数，则确定所述第一链接请求的目标攻击类型为合法URL攻击，并拒绝所述第一链接请求，以及将所述源IP地址添加到所述第一集合中。
在一种可能的实现方式中，所述处理单元还用于：
若确定在所述第二预设周期内的由所述源IP地址发起的请求次数小于或等于所述限制后的请求次数，则确定所述第一链接请求为合法请求。
在一种可能的实现方式中，所述处理单元还用于：
若确定所述源IP地址不包含在第二集合中，则确定在第三预设周期内的由所述源IP地址发起的第二类型合法URL请求的请求次数；以及若确定在第三预设周期内由所述源IP地址发起的所述第二类型合法URL请求的请求次数大于第四预设阈值，则对所述源IP地址的请求次数进行限制，并将所述源IP地址添加到所述第二集合中；所述第三预设周期早于所述第二预设周期；以及若确定在所述第三预设周期内由所述源IP地址发起的所述第二类型合法URL请求的请求次数小于或等于所述第四预设阈值，则确定所述第一链接请求为合法请求。
在一种可能的实现方式中，所述处理单元在接收到所述第一链接请求之后，在确定所述第一链接请求的目标请求类型之前，还用于：
确定所述源IP地址不包含在所述第一集合中。
本申请实施例的还提供一种装置，该装置具有实现上文所描述的实现服务器防攻击方法的功能。该功能可以通过硬件执行相应的软件实现，在一种可能的设计中，该装置包括：处理器、收发器、存储器；该存储器用于存储计算机执行指令，该收发器用于实现该装置与其他通信实体进行通信，该处理器与该存储器通过该总线连接，当该装置运行时，该处理器执行该存储器存储的该计算机执行指令，以使该装置执行上文所描述的实现服务器防攻击方法。
本发明实施例还提供一种计算机存储介质，所述存储介质中存储软件程序，该软件程序在被一个或多个处理器读取并执行时实现上述各种可能的实现方式中所描述的实现服务器防攻击方法。
本发明实施例还提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述各种可能的实现方式中所描述的实现服务器防攻击方法。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍。
图1为本发明实施例提供的一种系统架构图；
图2为本发明实施例提供的一种实现服务器防攻击方法的流程示意图；
图3为本发明实施例提供的一种确定目标请求类型的方法所对应的流程示意图；
图4为本发明实施例中所涉及到的整体性流程的示意图；
图5为本发明实施例提供的一种实现服务器防攻击的装置的结构示意图。
具体实施方式
下面结合说明书附图对本申请进行具体说明，方法实施例中的具体操作方法也可以应用于装置实施例中。
图1示例性示出了本发明实施例提供的一种系统架构图。如图1所示，所述系统100包括服务器101和至少一个客户端设备，如图1中示出的客户端设备102、客户端设备103和客户端设备104。服务器101可以与客户端设备102、客户端设备103、客户端设备104通过网络进行通信，例如，客户端设备102、客户端设备103、客户端设备104中的任一客户端设备可以向服务器101发送链接请求，服务器101可以根据链接请求接入客户端设备，并向客户端设备返回响应消息。
本发明实施例中，服务器可以是多种类型的服务器，比如可以说CDN系统中的边缘服务器。进一步地，对于CDN系统而言，不同的边缘服务器可以解析不同的域名请求，也就是说，本发明中的服务器可以为用于解析直播业务的边缘服务器，或者也可以为用于解析搜索业务的边缘服务器，或者还可以为用于解析视频业务的边缘服务器，具体不做限定。
进一步地，客户端设备可以为多种类型的设备，例如笔记本电脑、智能手机、平板电脑、智能电视等。
基于图1所示的系统架构，图2示例性示出了本发明实施例提供的一种实现服务器防攻击方法的流程示意图。如图2所示，具体包括如下步骤：
步骤201，服务器接收第一链接请求。
步骤202，服务器根据所述第一链接请求的特征信息，确定所述第一链接请求的目标请求类型。
步骤203，服务器根据所述第一链接请求的目标请求类型，确定在第一预设周期内由所述源IP地址发起的，且请求类型与所述目标请求类型一致的请求次数。
步骤204，服务器若确定由所述源IP地址发起的与所述目标请求类型一致的请求次数大于预设阈值，则根据所述目标请求类型确定所述第一链接请求的目标攻击类型，并拒绝所述第一链接请求，以及将所述源IP地址添加到第一集合中。
需要说明的是，上述步骤202至步骤204可以采用auto-learn算法来执行，具体的执行方法将在下文中进行描述。
如此，服务器可以根据不同的请求类型，采用不同的防攻击策略来实现服务器防攻击的目的，能够有效提升整个服务器的防攻击能力，有效降低服务器被攻击带来的风险，从而提升服务器的服务质量，保证服务器提供的服务的连续性和稳定性，提升用户的使用互联网体验。
具体来说，步骤201中，第一链接请求可以是URL的链接请求，即第一链接请求的形式可以为：协议名：//主机.域名/路径/文件名。进一步地，第一链接请求可以包括发起请求的源IP地址。以图1中示出的系统架构为例，客户端设备102可以向服务器101发送第一链接请求，其中，客户端设备102所发送的第一链接请求中可以包括客户端设备102的IP地址。
在执行步骤202之前，服务器可以先判断IP地址是否包括在第一集合， 若源IP地址不在所述第一集合中，则可以执行步骤202；否则，服务器可以拒绝第一链接请求。其中，第一集合可以用于存储所述服务器拒绝接入的IP地址。
步骤202中，第一链接请求的特征信息可以包括多种形式的内容，比如，第一链接请求的特征信息可以包括请求数据；或者，第一链接请求的特征信息也可以包括请求规则；或者，第一链接请求的特征信息还可以包括请求内容；或者，第一链接请求的特征信息还可以包括请求数据和请求规则；或者第一链接请求的特征信息还可以包括请求数据和请求内容；或者，第一链接请求的特征信息可以还包括请求规则和请求内容；或者，第一链接请求的特征信息还可以包括请求数据、请求规则和请求内容，具体不做限定。
进一步地，由于对服务器发起请求的方式可以有多种，因此，确定请求类型能够更加有针对性地采取对应的防范措施，以提高服务器的防攻击能力。基于此，服务器可以根据第一链接请求的特征信息来确定第一链接请求的目标请求类型。
具体来说，以第一链接请求的特征信息包括请求数据、请求规则和请求内容为例，图3示例性示出了本发明实施例提供的一种确定目标请求类型的方法所对应的流程示意图。如图3所示，具体包括如下步骤：
步骤301，服务器根据第一链接请求的请求数据，判断第一链接请求的请求数据能否组装成所述服务器能够识别的请求格式，若请求数据无法组装成所 述服务器能够识别的请求格式，则执行步骤302；否则，执行步骤303。
本发明实施例中，考虑到不同的服务器所用于解析的业务也是不同的，举个例子，若服务器是用于解析直播业务的，则可以判断第一链接请求的请求数据能否组装成负责解析直播业务的服务器能够识别的请求格式；再举个例子，若服务器是用于解析搜索业务的，则可以判断第一链接请求的请求数据能否组装成负责解析搜索业务的服务器能够识别的请求格式。
进一步地，服务器能够识别的请求格式可以包括服务器能够识别的HTTPURL格式，或者也可以是服务器能够识别的RTMP格式。
以采用auto-learn算法执行上述步骤301为例，若第一链接请求为HTTPURL格式的请求，由于标准的HTTP请求报文头一般由请求方式、请求URL、请求协议以及请求头部组成，并且由\r\n\r\n结尾，因此，auto-learn算法可以通过判断第一链接请求的请求数据在预设时间段内能否组装成HTTP完整头部，并且判断第一链接请求是否符合标准的HTTP协议规定，若能够组装成HTTP完整头部，且符合标准的HTTP协议规定，则确定第一链接请求的请求数据能够组装成所述服务器能够识别的HTTP URL格式，否则，确定第一链接请求的请求数据不能组装成所述服务器能够识别的HTTP URL格式。
若第一链接请求为RTMP格式的请求，由于RTMP标准请求的第一个字节为03并且后续为1536个字节的请求数据，因此，auto-learn算法可以通过判断首个字节在预设时间段内是否收到1536个字节的数据量，若收到1536个字 节的数据量，则确定第一链接请求的请求数据能够组装成所述服务器能够识别的RTMP格式，否则，确定第一链接请求的请求数据不能组装成所述服务器能够识别的RTMP格式。
本发明实施例中，考虑到服务器接收到的第一链接请求的数量，为了提高服务器的效率，服务器可以在预设时间段内对请求数据进行判断，若超出预设时间段内，服务器无法确定请求数据能否组装成所述服务器能够识别的请求格式，则可以认为请求数据无法组装成所述服务器能够识别的请求格式。
步骤302，服务器确定第一链接请求的目标请求类型为泛SYN请求。
本发明实施例在，泛SYN请求的特点是发起请求的源IP地址是可通的，若不对泛SYN请求做进一步处理，则可能出现源IP地址通过发起flood攻击，并且向服务器传输大量垃圾数据的情况，从而消耗服务器的网卡资源等，进而影响正常业务的传输。
步骤303，服务器判断第一链接请求的请求规则是否符合预设规则，若请求规则不符合预设规则，则执行步骤304；否则，执行步骤305。
预设规则可以包括多种类型的规则，比如请求域名规则、refer规则、user-agent规则、请求参数规则、请求策略规则(如时间戳防盗链规则)等，具体不做限定。
进一步地，在预设规则包括多种类型的规则的情况下，服务器判断第一链接请求的请求规则是否符合预设规则的方式有多种，一个示例中，服务器可以 判断第一链接请求的请求规则是否符合所述多种类型的规则中的任意一种。另一个示例中，服务器也可以判断第一链接请求的请求规则是否与每种类型的规则均符合，从而能够提高服务器判断目标请求类型的准确性。
以采用auto-learn算法执行上述步骤303为例，可以采用auto-learn算法来判断第一链接请求的请求规则是否符合预设规则。举个例子，采用auto-learn算法，在接收到第一链接请求后，可以根据预设规则，比如服务域名规则(即服务器可以支持的客户集合)，或者请求策略规则(即可通过服务器校验的算法)，以请求策略规则为MD5的时间戳防盗链规则为例，auto-learn算法在确定某个域名里面设定了一定的MD5的时间戳防盗链规则后，可以判断第一链接请求的host是否属于本服务器服务的域名集合，如果属于，则再次判断第一链接请求的URL携带的参数或者HTTP请求头的参数信息是否满足MD5的时间戳防盗链规则，如果能够满足，则可以确定第一链接请求的请求规则符合预设规则。
步骤304，服务器确定第一链接请求的目标请求类型为非法URL请求。
步骤305，服务器确定第一链接请求的目标请求类型为候选的合法URL请求。
步骤306，服务器判断第一链接请求的请求内容是否与服务器提供服务的内容一致，若不一致，则执行步骤307；否则，执行步骤308。
根据上文所述的内容，服务器可以为多种类型的服务器，比如，服务器可 以为用于解析直播业务的服务器，也就是说，该服务器提供的服务的内容为与直播业务对应的内容，若第一链接请求的请求内容为其它类型的内容(比如为与搜索业务对应的内容)，则可以认为第一链接请求的请求内容与服务器提供服务的内容不一致。
具体来说，以CDN服务器为例，服务器提供服务的内容(即全网CDN资源)可以是指的包括边缘服务器以及中心节点服务器所拥有的资源集合。当某个请求判定为合法URL请求后，采用auto-learn算法可以进一步判断该合法URL请求的请求内容是否是本服务器拥有的资源，如果本服务器不拥有，则进一步根据调度查询判断全网是否拥有该资源，如果都不拥有，则判断为CDN不拥有的资源，即认为请求内容与服务器提供服务的内容不一致。
进一步地，可以设定单位时间内请求不拥有资源的请求阈值，如果某类请求只是定期来查询CDN是否拥有该资源，则认为其行为是正常行为，但是如果某类请求是单位时间内持续发送大量不存在资源的请求，则定为攻击行为；
步骤307，服务器确定所述候选的合法URL请求为第一类型合法URL请求。
步骤308，服务器确定所述候选的合法URL请求为第一类型合法URL请求。
需要说明的是：(1)上述步骤编号仅为一种执行流程的示例性表示，本申请对各个步骤的先后顺序不做具体限定，例如，上述步骤301和步骤303中， 服务器可以先判断第一链接请求的请求规则是否符合预设规则，然后再判断第一链接请求的请求数据能否组装成所述服务器能够识别的请求格式；(2)步骤301至步骤308所提供的确定目标请求类型的方法仅为一种示例，在其它可能的示例中，若第一链接请求的特征信息包括请求数据时，服务器可以通过判断第一链接请求的请求数据能否组装成所述服务器能够识别的请求格式，来确定第一链接请求的目标请求类型是否为泛SYN请求；或者，若第一链接请求的特征信息包括请求数据和请求规则时，服务器可以通过判断第一链接请求的请求数据能否组装成所述服务器能够识别的请求格式，以及判断第一链接请求的请求内容是否与服务器提供服务的内容一致，来确定第一链接请求的目标请求类型。
步骤203和步骤204中，针对不同的目标请求类型，本发明实施例中可以采用不同的防范措施以提高服务器的防攻击能力。
一个示例中，若目标请求类型为泛SYN请求，则服务器可以确定在第一预设周期内由源IP地址发起的，且请求类型为泛SYN请求的请求次数；进而，服务器可以判断由源IP地址发起的泛SYN请求的请求次数是否大于第一预设阈值，若大于第一预设阈值，则可以确定第一链接请求的目标攻击类型为泛SYN攻击，并拒绝第一链接请求，以及将源IP地址添加到第一集合中；若小于或等于第一预设阈值，则可以只拒绝第一链接请求，但不将源IP地址添加到第一集合中。其中，第一集合可以用于存储服务器拒绝接入的IP地址，也就是说，若 后续服务器接收到第二链接请求后，若确定发起第二链接请求的IP地址在第一集合中，则可以直接拒绝该IP地址的接入，无需执行上述步骤201以后的操作。
需要说明的是，本领域技术人员可以根据经验和实际情况确定第一预设周期的时间长度，以及确定第一预设阈值的取值，具体不做限定。
又一个示例中，若目标请求类型为非法URL请求，则服务器可以确定在第一预设周期内由源IP地址发起的，且请求类型为非法URL请求的请求次数；进而，服务器可以判断由源IP地址发起的非法URL请求的请求次数是否大于第二预设阈值，若大于第二预设阈值，则可以确定第一链接请求的目标攻击类型为非法URL攻击，并拒绝第一链接请求，以及将源IP地址添加到第一集合中；若小于或等于第二预设阈值，则可以只拒绝第一链接请求，但不将源IP地址添加到第一集合中。
需要说明的是，本领域技术人员可以根据经验和实际情况确定第二预设阈值的取值，具体不做限定。
又一个示例中，若目标请求类型为第一类型合法URL请求，则服务器可以确定在第一预设周期内由源IP地址发起的，且请求类型为第一类型合法URL请求的请求次数；进而，服务器可以判断第一类型合法URL请求的请求次数是否大于第三预设阈值，若大于第三预设阈值，则可以确定第一链接请求的目标攻击类型为合法URL攻击，并拒绝第一链接请求，以及将源IP地址添加到第一集合中；若小于或等于第三预设阈值，则可以只拒绝第一链接请求，但不将源IP 地址添加到第一集合中。
需要说明的是，本领域技术人员可以根据经验和实际情况确定第三预设阈值的取值，具体不做限定。
又一个示例中，若目标请求类型为第二类型合法URL请求，则服务器可以判断源IP地址是否包含在第二集合中，若源IP地址包含在第二集合中，则服务器可以确定在第二预设周期内的由源IP地址发起的所述第二类型合法URL请求的请求次数，进而判断第二预设周期内由所述源IP地址发起的所述第二类型合法URL请求的请求次数是否大于限制后的请求次数，若大于，则确定第一链接请求的目标攻击类型为合法URL攻击，并拒绝所述第一链接请求，以及将所述源IP地址添加到所述第一集合中，否则，确定所述第一链接请求为合法请求。
进一步地，若源IP地址不包含在第二集合中，则服务器可以确定在第三预设周期内的由源IP地址发起的第二类型合法URL请求的请求次数，进而判断第三预设周期内由源IP地址发起的第二类型合法URL请求的请求次数是否大于第四预设阈值，若大于，则对源IP地址的请求次数进行限制，并将所述源IP地址添加到所述第二集合中，否则，确定所述第一链接请求为合法请求。其中，第二集合可以用于存储被所述服务器限制访问的IP地址以及对应的限制后的请求次数；第三预设周期早于所述第二预设周期。
为了更清楚地介绍上述实现服务器防攻击方法，下面结合图4，对本发明实施例中所涉及到的流程进行整体性说明。如图4所示，可以包括以下步骤：
步骤401，服务器接收第一链接请求。
步骤402，服务器根据第一链接请求的请求数据，判断第一链接请求的请求数据能否组装成所述服务器能够识别的请求格式，若请求数据无法组装成所述服务器能够识别的请求格式，则执行步骤403；否则，执行步骤408。
步骤403，服务器确定第一链接请求的目标请求类型为泛SYN请求。
步骤404，服务器可以确定在第一预设周期内由源IP地址发起的，且请求类型为泛SYN请求的请求次数。
步骤405，服务器可以判断泛SYN请求的请求次数是否大于第一预设阈值，若大于第一预设阈值，则执行步骤406；否则，执行步骤407。
步骤406，服务器确定第一链接请求的目标攻击类型为泛SYN攻击，并拒绝第一链接请求，以及将源IP地址添加到第一集合中。
步骤407，服务器只拒绝第一链接请求，但不将源IP地址添加到第一集合中。
步骤408，服务器判断第一链接请求的请求规则是否符合预设规则，若请求规则不符合预设规则，则执行步骤409；否则，执行步骤414。
步骤409，服务器确定第一链接请求的目标请求类型为非法URL请求。
步骤410，服务器可以确定在第一预设周期内由源IP地址发起的，且请求类型为非法URL请求的请求次数。
步骤411，服务器可以判断非法URL请求的请求次数是否大于第二预设阈 值，若大于第二预设阈值，则执行步骤412；否则，执行步骤413。
步骤412，服务器确定第一链接请求的目标攻击类型为非法URL攻击，并拒绝第一链接请求，以及将源IP地址添加到第一集合中。
步骤413，服务器只拒绝第一链接请求，但不将源IP地址添加到第一集合中。
步骤414，服务器确定第一链接请求的目标请求类型为候选的合法URL请求，并判断第一链接请求的请求内容是否与服务器提供服务的内容一致，若不一致，则执行步骤415；否则，执行步骤420。
步骤415，服务器确定第一链接请求的目标请求类型为第一类型合法URL请求。
步骤416，服务器可以确定在第一预设周期内由源IP地址发起的，且请求类型为第一类型合法URL请求的请求次数。
步骤417，服务器可以判断第一类型合法URL请求的请求次数是否大于第三预设阈值，若大于第三预设阈值，则执行步骤418；否则，执行步骤419。
步骤418，服务器确定第一链接请求的目标攻击类型为合法URL攻击，并拒绝第一链接请求，以及将源IP地址添加到第一集合中。
步骤419，服务器只拒绝第一链接请求，但不将源IP地址添加到第一集合中。
步骤420，服务器确定第一链接请求的目标请求类型为第二类型合法URL 请求。
步骤421，服务器判断源IP地址是否包含在第二集合中，若源IP地址包含在第二集合中，则执行步骤422；否则，执行步骤426。
步骤422，服务器确定在第二预设周期内的由源IP地址发起第二类型合法URL请求的请求次数。
步骤423，服务器判断第二预设周期内由源IP地址发起第二类型合法URL请求的请求次数是否大于限制后的请求次数，若大于，则执行步骤424；否则，执行步骤425。
步骤424，服务器确定第一链接请求的目标攻击类型为合法URL攻击，并拒绝所述第一链接请求，以及将所述源IP地址添加到所述第一集合中。
步骤425，服务器确定所述第一链接请求为合法请求。
步骤426，服务器确定在第三预设周期内的由源IP地址发起的第二类型合法URL请求的请求次数。
步骤427，服务器判断第三预设周期内由源IP地址发起的第二类型合法URL请求的请求次数是否大于第四预设阈值，若大于，则执行步骤428；否则，执行步骤429。
步骤428，服务器对源IP地址的请求次数进行限制，并将所述源IP地址添加到所述第二集合中。
步骤429，服务器确定所述第一链接请求为合法请求。
基于同样的发明构思，图5示例性示出了本发明实施例提供的一种实现服务器防攻击的装置的结构示意图，如图5所示，所述装置包括接收单元501和处理单元502；其中，
接收单元501，用于接收第一链接请求，所述第一链接请求包括发起请求的源IP地址；
处理单元502，用于根据所述第一链接请求的特征信息，确定所述第一链接请求的目标请求类型；所述第一链接请求的特征信息包括请求数据、请求规则和请求内容中的至少一项；并根据所述第一链接请求的目标请求类型，确定在第一预设周期内由所述源IP地址发起的，且请求类型与所述目标请求类型一致的请求次数；以及若确定由所述源IP地址发起的与所述目标请求类型一致的请求次数大于预设阈值，则根据所述目标请求类型确定所述第一链接请求的目标攻击类型，并拒绝所述第一链接请求，以及将所述源IP地址添加到第一集合中；所述第一集合用于存储所述服务器拒绝接入的IP地址。
在一种可能的实现方式中，所述处理单元502具体用于：
根据所述第一链接请求的请求数据，若确定所述请求数据无法组装成所述服务器能够识别的请求格式后，则确定所述第一链接请求的目标请求类型为泛SYN请求；并确定在所述第一预设周期内由所述源IP地址发起的，且攻击类型为所述泛SYN请求的请求次数；以及若确定由所述源IP地址发起的所述泛SYN请求的请求次数大于第一预设阈值，则确定所述第一链接请求的目标攻击类型 为泛SYN攻击。
在一种可能的实现方式中，所述处理单元502具体用于：
根据所述第一链接请求的请求数据和请求规则，若确定所述请求数据能够组装成所述服务器能够识别的请求格式，但所述请求规则不符合预设规则后，则确定所述第一链接请求的目标请求类型为非法URL请求；并确定在所述第一预设周期内由所述源IP地址发起的，且请求类型为所述非法URL请求的请求次数；以及若确定由所述源IP地址发起的所述非法URL请求的请求次数大于第二预设阈值，则确定所述第一链接请求的目标攻击类型为非法URL攻击。
在一种可能的实现方式中，所述处理单元502具体用于：
根据所述第一链接请求的请求数据和请求规则，若确定所述请求数据能够组装成所述服务器能够识别的请求格式，且所述请求规则符合预设规则，则确定所述第一链接请求的目标请求类型为候选的合法URL请求；并根据所述第一链接请求的请求内容，若确定所述请求内容与所述服务器提供服务的内容不一致，则确定所述候选的合法URL请求为第一类型合法URL请求；并确定在所述第一预设周期内由所述源IP地址发起的，且请求类型为所述第一类型合法URL请求的请求次数；以及若确定由所述源IP地址发起的所述第一类型合法URL请求的请求次数大于第三预设阈值，则确定所述第一链接请求的目标攻击类型为合法URL攻击。
在一种可能的实现方式中，所述处理单元502还用于：
若确定所述请求内容与所述服务器提供服务的内容一致，则确定所述候选的合法URL请求为第二类型合法URL请求；若确定所述源IP地址包含在第二集合中，则确定在第二预设周期内的由所述源IP地址发起的所述第二类型合法URL请求的请求次数；所述第二集合用于存储被所述服务器限制访问的IP地址以及对应的限制后的请求次数；以及若确定在所述第二预设周期内的由所述源IP地址发起的所述第二类型合法URL请求的请求次数大于所述限制后的请求次数，则确定所述第一链接请求的目标攻击类型为合法URL攻击，并拒绝所述第一链接请求，以及将所述源IP地址添加到所述第一集合中。
在一种可能的实现方式中，所述处理单元502还用于：
若确定在所述第二预设周期内的由所述源IP地址发起的请求次数小于或等于所述限制后的请求次数，则确定所述第一链接请求为合法请求。
在一种可能的实现方式中，所述处理单元502还用于：
若确定所述源IP地址不包含在第二集合中，则确定在第三预设周期内的由所述源IP地址发起的第二类型合法URL请求的请求次数；以及若确定在第三预设周期内由所述源IP地址发起的所述第二类型合法URL请求的请求次数大于第四预设阈值，则对所述源IP地址的请求次数进行限制，并将所述源IP地址添加到所述第二集合中；所述第三预设周期早于所述第二预设周期；以及若确定在所述第三预设周期内由所述源IP地址发起的所述第二类型合法URL请求的请求次数小于或等于所述第四预设阈值，则确定所述第一链接请求为合法请求。
在一种可能的实现方式中，所述处理单元502在接收到所述第一链接请求之后，在确定所述第一链接请求的目标请求类型之前，还用于：
确定所述源IP地址不包含在所述第一集合中。
本申请实施例的还提供一种装置，该装置具有实现上文所描述的实现服务器防攻击方法的功能。该功能可以通过硬件执行相应的软件实现，在一种可能的设计中，该装置包括：处理器、收发器、存储器；该存储器用于存储计算机执行指令，该收发器用于实现该装置与其他通信实体进行通信，该处理器与该存储器通过该总线连接，当该装置运行时，该处理器执行该存储器存储的该计算机执行指令，以使该装置执行上文所描述的实现服务器防攻击方法。
本发明实施例还提供一种计算机存储介质，所述存储介质中存储软件程序，该软件程序在被一个或多个处理器读取并执行时实现上述各种可能的实现方式中所描述的实现服务器防攻击方法。
本发明实施例还提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述各种可能的实现方式中所描述的实现服务器防攻击方法。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、 CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (18)

  1. 一种实现服务器防攻击方法，其特征在于，所述方法包括：
    服务器接收第一链接请求，所述第一链接请求包括发起请求的源IP地址；
    所述服务器根据所述第一链接请求的特征信息，确定所述第一链接请求的目标请求类型；所述第一链接请求的特征信息包括请求数据、请求规则和请求内容中的至少一项；
    所述服务器根据所述第一链接请求的目标请求类型，确定在第一预设周期内由所述源IP地址发起的，且请求类型与所述目标请求类型一致的请求次数；
    所述服务器若确定由所述源IP地址发起的与所述目标请求类型一致的请求次数大于预设阈值，则根据所述目标请求类型确定所述第一链接请求的目标攻击类型，并拒绝所述第一链接请求，以及将所述源IP地址添加到第一集合中；所述第一集合用于存储所述服务器拒绝接入的IP地址。
  2. 根据权利要求1所述的方法，其特征在于，所述服务器根据所述第一链接请求的特征信息，确定所述第一链接请求的目标请求类型，包括：
    所述服务器根据所述第一链接请求的请求数据，若确定所述请求数据无法组装成所述服务器能够识别的请求格式后，则确定所述第一链接请求的目标请求类型为泛SYN请求；
    所述服务器确定在第一预设周期内由所述源IP地址发起的，且请求类型与所述目标请求类型一致的请求次数，包括：
    所述服务器确定在所述第一预设周期内由所述源IP地址发起的，且请求类型为所述泛SYN请求的请求次数；
    所述服务器若确定由所述源IP地址发起的与所述目标请求类型一致的请求次数大于预设阈值，则根据所述目标请求类型确定所述第一链接请求的目标攻击类型，包括：
    所述服务器若确定由所述源IP地址发起的所述泛SYN请求的请求次数大于第一预设阈值，则确定所述第一链接请求的目标攻击类型为泛SYN攻击。
  3. 根据权利要求1所述的方法，其特征在于，所述服务器根据所述第一链接请求的特征信息，确定所述第一链接请求的目标请求类型，包括：
    所述服务器根据所述第一链接请求的请求数据和请求规则，若确定所述请求数据能够组装成所述服务器能够识别的请求格式，但所述请求规则不符合预设规则后，则确定所述第一链接请求的目标请求类型为非法URL请求；
    所述服务器确定在第一预设周期内由所述源IP地址发起的，且请求类型与所述目标请求类型一致的请求次数，包括：
    所述服务器确定在所述第一预设周期内由所述源IP地址发起的，且请求类型为所述非法URL请求的请求次数；
    所述服务器确定由所述源IP地址发起的与所述目标请求类型一致的请求次数大于预设阈值，则根据所述目标请求类型确定所述第一链接请求的目标攻击类型，包括：
    所述服务器确定由所述源IP地址发起的所述非法URL请求的请求次数大于第二预设阈值，则确定所述第一链接请求的目标攻击类型为非法URL攻击。
  4. 根据权利要求1所述的方法，其特征在于，所述服务器根据所述第一链接请求的特征信息，确定所述第一链接请求的目标请求类型，包括：
    所述服务器根据所述第一链接请求的请求数据和请求规则，若确定所述请求数据能够组装成所述服务器能够识别的请求格式，且所述请求规则符合预设规则，则确定所述第一链接请求的目标请求类型为候选的合法URL请求；
    所述服务器根据所述第一链接请求的请求内容，若确定所述请求内容与所述服务器提供服务的内容不一致，则确定所述候选的合法URL请求为第一类型合法URL请求；
    所述服务器确定在第一预设周期内由所述源IP地址发起的，且请求类型与所述目标请求类型一致的请求次数，包括：
    所述服务器确定在所述第一预设周期内由所述源IP地址发起的，且请求类型为所述第一类型合法URL请求的请求次数；
    所述服务器若确定由所述源IP地址发起的与所述目标请求类型一致的请求次数大于预设阈值，则根据所述目标请求类型确定所述第一链接请求的目标攻击类型，包括：
    所述服务器确定所述第一类型合法URL请求的请求次数大于第三预设阈值，则确定所述第一链接请求的目标攻击类型为合法URL攻击。
  5. 根据权利要求4所述的方法，其特征在于，所述方法还包括：
    所述服务器若确定所述请求内容与所述服务器提供服务的内容一致，则确定所述候选的合法URL请求为第二类型合法URL请求；
    所述服务器若确定所述源IP地址包含在第二集合中，则确定在第二预设周期内的由所述源IP地址发起的所述第二类型合法URL请求的请求次数；所述第二集合用于存储被所述服务器限制访问的IP地址以及对应的限制后的请求次数；
    所述服务器若确定在所述第二预设周期内的由所述源IP地址发起的所述第二类型合法URL请求的请求次数大于所述限制后的请求次数，则确定所述第一链接请求的目标攻击类型为合法URL攻击，并拒绝所述第一链接请求，以及将所述源IP地址添加到所述第一集合中。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    所述服务器若确定在所述第二预设周期内的由所述源IP地址发起的请求次数小于或等于所述限制后的请求次数，则确定所述第一链接请求为合法请求。
  7. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    所述服务器若确定所述源IP地址不包含在第二集合中，则确定在第三预设周期内的由所述源IP地址发起的第二类型合法URL请求的请求次数；
    所述服务器若确定在第三预设周期内由所述源IP地址发起的所述第二类型合法URL请求的请求次数大于第四预设阈值，则对所述源IP地址的请求次数 进行限制，并将所述源IP地址添加到所述第二集合中；所述第三预设周期早于所述第二预设周期；
    所述服务器若确定在所述第三预设周期内由所述源IP地址发起的所述第二类型合法URL请求的请求次数小于或等于所述第四预设阈值，则确定所述第一链接请求为合法请求。
  8. 根据权利要求1至7中任一项所述的方法，其特征在于，所述服务器在接收到所述第一链接请求之后，在确定所述第一链接请求的目标请求类型之前，还包括：
    所述服务器确定所述源IP地址不包含在所述第一集合中。
  9. 一种实现服务器防攻击装置，其特征在于，所述装置包括：
    接收单元，用于接收第一链接请求，所述第一链接请求包括发起请求的源IP地址；
    处理单元，用于根据所述第一链接请求的特征信息，确定所述第一链接请求的目标请求类型；所述第一链接请求的特征信息包括请求数据、请求规则和请求内容中的至少一项；并根据所述第一链接请求的目标请求类型，确定在第一预设周期内由所述源IP地址发起的，且请求类型与所述目标请求类型一致的请求次数；以及若确定由所述源IP地址发起的与所述目标请求类型一致的请求次数大于预设阈值，则根据所述目标请求类型确定所述第一链接请求的目标攻击类型，并拒绝所述第一链接请求，以及将所述源IP地址添加到第一集合中； 所述第一集合用于存储所述服务器拒绝接入的IP地址。
  10. 根据权利要求9所述的装置，其特征在于，所述处理单元具体用于：
    根据所述第一链接请求的请求数据，若确定所述请求数据无法组装成所述服务器能够识别的请求格式后，则确定所述第一链接请求的目标请求类型为泛SYN请求；并确定在所述第一预设周期内由所述源IP地址发起的，且攻击类型为所述泛SYN请求的请求次数；以及若确定由所述源IP地址发起的所述泛SYN请求的请求次数大于第一预设阈值，则确定所述第一链接请求的目标攻击类型为泛SYN攻击。
  11. 根据权利要求9所述的装置，其特征在于，所述处理单元具体用于：
    根据所述第一链接请求的请求数据和请求规则，若确定所述请求数据能够组装成所述服务器能够识别的请求格式，但所述请求规则不符合预设规则后，则确定所述第一链接请求的目标请求类型为非法URL请求；并确定在所述第一预设周期内由所述源IP地址发起的，且请求类型为所述非法URL请求的请求次数；以及若确定由所述源IP地址发起的所述非法URL请求的请求次数大于第二预设阈值，则确定所述第一链接请求的目标攻击类型为非法URL攻击。
  12. 根据权利要求9所述的装置，其特征在于，所述处理单元具体用于：
    根据所述第一链接请求的请求数据和请求规则，若确定所述请求数据能够组装成所述服务器能够识别的请求格式，且所述请求规则符合预设规则，则确定所述第一链接请求的目标请求类型为候选的合法URL请求；并根据所述第一 链接请求的请求内容，若确定所述请求内容与所述服务器提供服务的内容不一致，则确定所述候选的合法URL请求为第一类型合法URL请求；并确定在所述第一预设周期内由所述源IP地址发起的，且请求类型为所述第一类型合法URL请求的请求次数；以及若确定由所述源IP地址发起的所述第一类型合法URL请求的请求次数大于第三预设阈值，则确定所述第一链接请求的目标攻击类型为合法URL攻击。
  13. 根据权利要求12所述的装置，其特征在于，所述处理单元还用于：
    若确定所述请求内容与所述服务器提供服务的内容一致，则确定所述候选的合法URL请求为第二类型合法URL请求；若确定所述源IP地址包含在第二集合中，则确定在第二预设周期内的由所述源IP地址发起的所述第二类型合法URL请求的请求次数；所述第二集合用于存储被所述服务器限制访问的IP地址以及对应的限制后的请求次数；以及若确定在所述第二预设周期内的由所述源IP地址发起的所述第二类型合法URL请求的请求次数大于所述限制后的请求次数，则确定所述第一链接请求的目标攻击类型为合法URL攻击，并拒绝所述第一链接请求，以及将所述源IP地址添加到所述第一集合中。
  14. 根据权利要求13所述的装置，其特征在于，所述处理单元还用于：
    若确定在所述第二预设周期内的由所述源IP地址发起的请求次数小于或等于所述限制后的请求次数，则确定所述第一链接请求为合法请求。
  15. 根据权利要求13所述的装置，其特征在于，所述处理单元还用于：
    若确定所述源IP地址不包含在第二集合中，则确定在第三预设周期内的由所述源IP地址发起的第二类型合法URL请求的请求次数；以及若确定在第三预设周期内由所述源IP地址发起的所述第二类型合法URL请求的请求次数大于第四预设阈值，则对所述源IP地址的请求次数进行限制，并将所述源IP地址添加到所述第二集合中；所述第三预设周期早于所述第二预设周期；以及若确定在所述第三预设周期内由所述源IP地址发起的所述第二类型合法URL请求的请求次数小于或等于所述第四预设阈值，则确定所述第一链接请求为合法请求。
  16. 根据权利要求9至15中任一项所述的装置，其特征在于，所述处理单元在接收到所述第一链接请求之后，在确定所述第一链接请求的目标请求类型之前，还用于：
    确定所述源IP地址不包含在所述第一集合中。
  17. 一种计算机可读存储介质，其特征在于，所述存储介质存储有指令，当所述指令在计算机上运行时，使得计算机实现执行权利要求1至8中任一项所述的方法。
  18. 一种计算机设备，其特征在于，包括：
    存储器，用于存储程序指令；
    处理器，用于调用所述存储器中存储的程序指令，按照获得的程序执行如权利要求1至8任一权利要求所述的方法。
PCT/CN2018/108243 2018-08-22 2018-09-28 一种实现服务器防攻击方法及装置 Ceased WO2020037781A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US16/473,095 US20210344706A1 (en) 2018-08-22 2018-09-28 Method and apparatus for implementing server anti-attack
EP18910232.0A EP3633948B1 (en) 2018-08-22 2018-09-28 Anti-attack method and device for server

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810963244.8A CN108833450B (zh) 2018-08-22 2018-08-22 一种实现服务器防攻击方法及装置
CN201810963244.8 2018-08-22

Publications (1)

Publication Number Publication Date
WO2020037781A1 true WO2020037781A1 (zh) 2020-02-27

Family

ID=64150474

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/108243 Ceased WO2020037781A1 (zh) 2018-08-22 2018-09-28 一种实现服务器防攻击方法及装置

Country Status (4)

Country Link
US (1) US20210344706A1 (zh)
EP (1) EP3633948B1 (zh)
CN (1) CN108833450B (zh)
WO (1) WO2020037781A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114615072A (zh) * 2022-03-23 2022-06-10 国网山东省电力公司临清市供电公司 基于请求频率的安全态势感知方法、设备与系统

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109688136B (zh) * 2018-12-27 2021-08-13 深信服科技股份有限公司 一种伪造ip攻击行为的检测方法、系统及相关组件
CN111371881A (zh) * 2020-02-28 2020-07-03 北京字节跳动网络技术有限公司 服务调用方法及设备
CN112929379B (zh) * 2021-02-22 2023-03-24 深圳供电局有限公司 一种智能录波器远程运维指令防御方法及系统
CN115118464B (zh) * 2022-06-10 2024-07-09 深信服科技股份有限公司 一种失陷主机检测方法、装置、电子设备及存储介质
US11943202B1 (en) * 2022-09-15 2024-03-26 Uab 360 It Utilization of multiple exit internet protocol addresses in a virtual private network

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102769549A (zh) * 2011-05-05 2012-11-07 腾讯科技（深圳）有限公司 网络安全监控的方法和装置
CN103957195A (zh) * 2014-04-04 2014-07-30 上海聚流软件科技有限公司 Dns系统以及dns攻击的防御方法和防御装置
US20140373138A1 (en) * 2011-06-27 2014-12-18 Ahnlab, Inc. Method and apparatus for preventing distributed denial of service attack
CN106357628A (zh) * 2016-08-31 2017-01-25 东软集团股份有限公司 攻击的防御方法及装置
CN108206814A (zh) * 2016-12-20 2018-06-26 腾讯科技（深圳）有限公司 一种防御dns攻击的方法、装置及系统

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101077135B1 (ko) * 2009-10-22 2011-10-26 한국인터넷진흥원 웹 서비스 대상 응용계층 디도스 공격 탐지 및 대응 장치
CN107968765A (zh) * 2016-10-19 2018-04-27 腾讯科技（深圳）有限公司 一种网络入侵检测方法及服务器
CN108334774A (zh) * 2018-01-24 2018-07-27 中国银联股份有限公司 一种检测攻击的方法、第一服务器及第二服务器

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102769549A (zh) * 2011-05-05 2012-11-07 腾讯科技（深圳）有限公司 网络安全监控的方法和装置
US20140373138A1 (en) * 2011-06-27 2014-12-18 Ahnlab, Inc. Method and apparatus for preventing distributed denial of service attack
CN103957195A (zh) * 2014-04-04 2014-07-30 上海聚流软件科技有限公司 Dns系统以及dns攻击的防御方法和防御装置
CN106357628A (zh) * 2016-08-31 2017-01-25 东软集团股份有限公司 攻击的防御方法及装置
CN108206814A (zh) * 2016-12-20 2018-06-26 腾讯科技（深圳）有限公司 一种防御dns攻击的方法、装置及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3633948A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114615072A (zh) * 2022-03-23 2022-06-10 国网山东省电力公司临清市供电公司 基于请求频率的安全态势感知方法、设备与系统

Also Published As

Publication number Publication date
EP3633948B1 (en) 2021-11-03
EP3633948A1 (en) 2020-04-08
EP3633948A4 (en) 2020-05-13
CN108833450A (zh) 2018-11-16
US20210344706A1 (en) 2021-11-04
CN108833450B (zh) 2020-07-10

Similar Documents

Publication Publication Date Title
CN108833450B (zh) 一种实现服务器防攻击方法及装置
US11019383B2 (en) Internet anti-attack method and authentication server
CN105337966B (zh) 针对网络攻击的处理方法和装置
US10270792B1 (en) Methods for detecting malicious smart bots to improve network security and devices thereof
CN109194680B (zh) 一种网络攻击识别方法、装置及设备
CN103297433B (zh) 基于网络数据流的http僵尸网络检测方法及系统
JP7388613B2 (ja) パケット処理方法及び装置、デバイス、並びに、コンピュータ可読ストレージ媒体
CN110611723A (zh) 一种服务资源的调度方法及装置
KR20130014226A (ko) 공격 트래픽 형태별 특성에 따른 ｄｎｓ 플러딩 공격 탐지 방법
KR101200906B1 (ko) 네트워크 기반 고성능 유해사이트 차단 시스템 및 방법
CN111565203B (zh) 业务请求的防护方法、装置、系统和计算机设备
US20190124111A1 (en) Responding and processing method for dnssec negative response
CN108600145B (zh) 一种确定DDoS攻击设备的方法及装置
CN107690004A (zh) 地址解析协议报文的处理方法及装置
WO2023060881A1 (zh) 报文源地址识别方法及装置
CN110798402B (zh) 业务消息处理方法、装置、设备及存储介质
CN106790310B (zh) 分布式拒绝服务攻击防护与负载均衡一体化的方法和系统
CN112351082A (zh) Http请求报文的限流方法及装置
CN108667782B (zh) 一种用于DNS服务的DDoS攻击防御方法及系统
CN114553452B (zh) 攻击防御方法及防护设备
CN113992421A (zh) 一种报文处理方法、装置及电子设备
CN105939315A (zh) 一种http攻击防护方法及装置
CN111818038B (zh) 一种网络数据获取识别方法以及装置
CN114697088A (zh) 一种确定网络攻击的方法、装置及电子设备
CN109617893A (zh) 一种僵尸网络DDoS攻击的防护方法、装置及存储介质

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2018910232

Country of ref document: EP

Effective date: 20190923

NENP Non-entry into the national phase

Ref country code: DE