Illegal request identification method and device

Abstract

The embodiment of the invention provides an illegal request identification method and device, and the method comprises the steps: receiving an access request for a certain interface, and analyzing aninterface identification from a uniform resource locator URL of the access request; carrying out minimum hash signature calculation on the URL, so as to obtain a MinHash signature of the URL; and determining the similarity between the MinHash signature of the URL and the MinHash signature of the target illegal URL corresponding to the predetermined interface identifier, and if the similarity is not less than a set similarity threshold, determining that the access request is an illegal request. According to the technical scheme provided by the invention, the URLs are converted into the minimumhash signatures to compare the similarity between the URLs, so that the illegal request identification efficiency is greatly improved.

Description

technical field [0001] The present invention relates to the field of computer technology, in particular to a method and device for identifying an illegal request. Background technique [0002] The website outputs data to users. At this time, some users use machines to simulate human web page access requests for various reasons. Such machine visits are generally large and frequent, and the core data of the website is crawled by criminals, or the core interface. Was heavily brushed. The anti-snatch system is a system that blocks these illegal requests. [0003] In the prior art, when identifying illegal requests, the number of visits of each Internet Protocol (Internet Protocol, IP) address in the past period of time will be counted. For an IP with an excessively high number of visits, it will be considered that the user of the IP is used. For illegal users, the IP will be banned to prevent access requests sent from the IP. In the prior art, if illegal users frequently chan...

AI Technical Summary

Problems solved by technology

In this prior art, if illegal users frequently change their IP addresses and send access requests through different IP addresses, it is impossible to accurately identify illegal requests; and this method of discrimination is not real-time enough, and must be detected after 10 minutes after the criminals request Only in this way can we discover its malicious behavior; and this kind of scheme is more likely to accidentally injure normal users

[0004] In the prior art, there is a method for identifying illegal requests by identifying illegal URLs and judging the distance between the strings of the URLs corresponding to the swiping IPs and the strings of illegal URLs. However, due to The calculation time for the distance of the URL string is too long, which leads to a longer time required to return the data to all users. This shortcoming is unacceptable in the Internet age; another point, this method will increase the load on the front-end machine, which is either It is necessary to increase the number of machines, or not to adopt this method for some interfaces, which greatly restricts the performance of this method.

Images