A method and device for processing requests and storage medium

Abstract

Embodiments of the present invention disclose a method and device for processing a request and a storage medium, which are used to effectively combat malicious access requests. Among them, a method for processing requests includes: determining at least two statistical dimensions from a preset multi-dimensional strategy according to an access request sent by a client, and the multi-dimensional strategy includes: a variety of different statistical dimensions and each statistical dimension For the corresponding attack rules, the statistical dimension is used to indicate the fields that need to be counted; at least two kinds of field contents are extracted from the access request, and at least two kinds of field contents correspond to at least two kinds of statistical dimensions one-to-one, and each kind of field contents can be used according to the unique identification access request; determine whether the respective occurrences of at least two kinds of field contents in the preset statistical period exceed the corresponding threshold; when the respective occurrences of at least two kinds of field contents exceed the corresponding threshold, according to at least The cracking rules corresponding to the two statistical dimensions crack down on access requests.

Description

technical field [0001] The present invention relates to the field of computer technology, in particular to a method and device for processing requests and a storage medium. Background technique [0002] In the early stage of distributed denial of service (Distributed Denial of Service, DDoS) attacks, most of them can be protected by the industry-renowned "black hole" (Collapsar) anti-denial of service attack system, so hackers have developed a new type of attack against After the HyperText Transfer Protocol (HTTP) DDOS attack, it was named Challenge Collapsar, claiming that black hole devices could not be defended, and the name CC has been used to this day. CC attack is a kind of DDOS attack, which occurs at the application layer of the seventh layer. What is different from DDOS at the network layer is that the Transmission Control Protocol (Transmission Control Protocol, TCP) connection has been established, and the attacking Internet Protocol (Internet Protocol, IP) is the...

AI Technical Summary

Problems solved by technology

[0004] At present, there are many mature attack modes, such as using a large number of proxy servers and controlling puppet machines to hide the real IP address of the attacker. When the client constantly changes the IP address to make a request, the attack method based on the IP address of the existing technology will fail

Images