Method and apparatus for determining malicious access, and method and apparatus for intercepting malicious access

Abstract

The invention discloses a method and apparatus for determining a malicious access. The method comprises the following steps: determining a first time period when an access request of an IP address is received; counting the access frequency of the IP address in each sub time period; according to the access frequency of the IP address in each sub time period and an access frequency weight value configured to each sub time period, counting an weighing average value of the access frequency of the IP address in each sub time period; and comparing the weighing average value with a preset first access frequency threshold, and when the weighing average value is greater than the preset first access frequency threshold, determining that the IP address belongs to the malicious access. The invention also simultaneously discloses a method and apparatus for determining a malicious access. By using the methods and apparatus provided by the invention, the accuracy in determining the malicious access can be improved, access of the IP address of the malicious access is restricted, an over high server load is prevented, and at the same time, quite good application experience of users can be guaranteed.

Description

technical field [0001] The invention relates to the technical field of Internet security, in particular to a judgment method, interception method and device for malicious access. Background technique [0002] It is a very common problem that network applications are accessed by a large number of malicious programs; a large number of accesses by malicious programs in a short period of time may cause a sharp increase in server load or even stop responding; access to cold data by web crawlers will also bring pressure to the database server. Come on for extra stress. [0003] At present, the common practice in judging whether an IP address belongs to malicious access is to count the total number of visits of the IP address in the past period of time and compare it with a threshold. When the threshold is exceeded, the IP address is considered It belongs to malicious access, and corresponding restrictive measures are taken to limit the access of this IP address. [0004] However...

AI Technical Summary

Problems solved by technology

[0004] However, this approach is only a general way of judging, the accuracy is not enough, and it is likely to cause misjudgment

For example, in the past period of time, the user's account was hacked and accessed the server with high frequency. After the user retrieved the account, he restored the normal frequency of accessing the server. After the user retrieves the account, it is still considered that the total number of visits exceeds the threshold and will still be restricted, which greatly affects the user experience

Images