Request interception method based on client fingerprint identification

Abstract

The invention relates to a request interception method based on client fingerprint identification, which relates to the technical field of fingerprint identification, and comprises the following steps: collecting equipment information of a client, processing and analyzing the collected equipment information, extracting characteristics of the equipment information, performing encryption processing by using a Hash algorithm according to the extracted characteristics, generating an equipment fingerprint, and intercepting the equipment fingerprint. The method comprises the following steps of: establishing a black list fingerprint database and a white list fingerprint database, respectively storing known credible client fingerprints and known malicious client fingerprints, comparing and analyzing the generated client fingerprints with the fingerprints in the black list fingerprint database and the white list fingerprint database, and carrying out request interception judgment according to a fingerprint analysis result. The malicious request can be intercepted in advance, an attacker is prevented from performing unauthorized access and malicious operation, the legality of the client request can be accurately judged, and the false interception rate of the legal request is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of fingerprint identification, and more specifically, to a request interception method based on client fingerprint identification. Background Art

[0002] With the widespread popularity of the Internet around the world, the Internet has become an indispensable part of people's daily life and work. However, the accompanying network security issues are also becoming increasingly prominent. Threats such as cyber attacks, data leaks, and malware are constantly evolving, posing serious challenges to personal privacy, corporate secrets, and even national security. Traditional network security protection methods mainly rely on server-side security policies and firewalls. However, with the continuous upgrading of attack technologies, this single protection method can no longer meet the multi-level needs of modern network security.

[0003] Traditional server-side security strategies usually include firewalls, intrusion detection systems, intrusion prevention systems, and antivirus software. These tools mainly detect and block known attack behaviors through rule matching and signature recognition. However, these methods are powerless in the face of increasingly complex and changing network attacks. For example, attacks targeting zero-day vulnerabilities, new malware, and advanced persistent threats can often bypass traditional protection mechanisms, posing huge risks to network security.

[0004] Therefore, client-based fingerprint recognition and interception technology came into being. It is a more reliable and secure request interception method that can help us better identify and intercept malicious requests, improve network security, and prevent attackers from unauthorized access and malicious operations. Compared with traditional IP addresses or session cookies, device fingerprints are more difficult to tamper with or forge, which improves the reliability and security of the system's client authentication. Summary of the invention

[0005] The present invention aims at the technical problems existing in the prior art and provides a request interception method based on client fingerprint identification to solve the problems raised in the above background technology.

[0006] The technical solution of the present invention to solve the above technical problem is as follows: a request interception method based on client fingerprint recognition, specifically comprising the following steps:

[0007] Step 101: Collect device information of the client, process and analyze the collected device information, and extract its features;

[0008] Step 102: Based on the features extracted in step 101, a hash algorithm is used to perform encryption processing to generate a device fingerprint;

[0009] Step 103: Establish a blacklist and whitelist fingerprint library to store known trusted client fingerprints and known malicious client fingerprints respectively, compare and analyze the generated client fingerprint with the fingerprints in the blacklist and whitelist fingerprint library, and make a request interception decision based on the result of the fingerprint analysis.

[0010] In a preferred embodiment, in step 101, the device information of the client is collected, and the collected device information is processed and analyzed to extract its features. The specific steps are as follows:

[0011] Step A1, collecting various information related to the device, including hardware information, operating system information, browser information and network information;

[0012] The hardware information includes: CPU processor type, core number, clock speed information; GPU graphics processing unit model, manufacturer, video memory size information; physical memory capacity, usage information; storage hard disk capacity, remaining space information;

[0013] The operating system information includes: the specific version number of the operating system; the default language setting of the system; the currently set system time zone, and the number of bits of the operating system;

[0014] The browser information includes: a browser identification string used to identify the browser type and version; a list of installed browser plug-ins, and a list of available fonts;

[0015] The network information includes: the public IP address of the client and the DNS server information used;

[0016] Step A2, process and process device information: process and analyze the collected device information to extract the following features: including the bit number, version number, language, time zone of the operating system; the version number, user agent string, plug-in list, font of the browser; the resolution setting of the screen; the IP address and DNS setting of the network information.

[0017] In a preferred embodiment, in step 102, according to the features extracted in step 101, a hash algorithm is used to perform encryption processing to generate a unique device fingerprint, and the specific steps are as follows:

[0018] Step B1: The device information is represented as D, which includes the characteristics of various aspects of hardware information, operating system information, browser information and network information. The specific calculation formula is as follows:

[0019] D=f1,f2,...,f n

[0020] Where D represents device information, f n Represents the nth feature extracted;

[0021] Step B2, generate device fingerprint: convert each feature into its hash value, and concatenate these hash values ​​together to form a unique device fingerprint string. The specific calculation formula is as follows:

[0022] FP=Hash(f1)||Hash(f2)||...||Hash(f n )

[0023] Among them, FP represents device fingerprint, Hash represents hash function, (f1,f2,...,f n ) represents each feature extracted from the device information, and || represents the string concatenation operation.

[0024] In a preferred embodiment, in step 103, a blacklist and whitelist fingerprint library is established to store known trusted client fingerprints and known malicious client fingerprints respectively, and the generated client fingerprint is compared and analyzed with the fingerprints in the blacklist and whitelist fingerprint library. According to the result of the fingerprint analysis, a request interception determination is made. The specific steps are as follows:

[0025] Step C1: Establish a blacklist and whitelist fingerprint library on the server side. The whitelist library stores known trusted client fingerprints, and the blacklist library stores known malicious client fingerprints. Each fingerprint entry should contain corresponding metadata information, including client type, authority, recording time, and malicious behavior description.

[0026] The whitelist library stores known trusted client fingerprints, including fingerprint information of verified devices without abnormal behavior; the update mechanism of the whitelist library is to manually add fingerprint information of trusted devices through the trust evaluation mechanism, and maintain the ability to respond to new threats through dynamic updates and management;

[0027] The blacklist library stores known malicious client fingerprints including: operating system version, browser information, and IP address features of malicious devices; the update mechanism of the blacklist library is to add the fingerprint of a device to the blacklist when a high match is detected between the fingerprint of the device and the fingerprint in the blacklist, and update the metadata information in the blacklist by increasing the number of accesses and the most recent access time of the device;

[0028] Step C2, fingerprint matching calculation: Use the Hamming distance to compare the similarity between the device fingerprint and the blacklist and whitelist fingerprint database. The specific calculation formula is as follows:

[0029]

[0030] Among them, Matching Score represents the matching score, HD(FP,FP library) is the device fingerprint FP and the fingerprint FP in the blacklist and whitelist database library The Hamming distance represents the number of different characters at each position, and n is the length of the device fingerprint, which is determined by the number of features;

[0031] Step C3, fingerprint comparison and analysis: the generated device fingerprint is compared with the fingerprints in the blacklist and whitelist fingerprint libraries. When the device fingerprint matches the fingerprint in the whitelist library, the request is allowed to pass; when the device fingerprint matches the fingerprint in the blacklist library, it is determined to be a malicious request, the request is immediately intercepted, and the corresponding blacklist fingerprint metadata is updated; when the device fingerprint does not match the fingerprints in both the whitelist library and the blacklist library, the core data items of the request are verified and the QPS is checked, and the final interception decision is made based on the above inspection results.

[0032] In a preferred embodiment, in the fingerprint comparison and analysis of step C3, when the device fingerprint does not match the fingerprints in the whitelist library and the blacklist library, the core data items of the request are verified and the QPS check is performed, and the final interception decision is made based on the above check results, further including the following steps:

[0033] Step C301, verify information metadata: When the fingerprint does not hit the blacklist, verify the core data items of the request to check whether there are key fields missing, whether the IP address and geographical location are reasonable, and check the geographical location of the IP address to determine whether it is within the expected range to prevent requests from untrusted areas;

[0034] Step C302, user behavior analysis and device trust evaluation: Analyze user behavior patterns, including request frequency and access time period; evaluate the trust of the device, and score it based on the device's hardware information and usage history factors. If the behavior pattern and device trust are low, it is judged as a virtual forged terminal request and intercepted;

[0035] Step C303, QPS check: record the number of requests per second (QPS) requested by the device, set a threshold X for access frequency, and detect whether there are abnormal requests. When the number of requests from the device in one second exceeds the set threshold, add the device fingerprint to the blacklist and block subsequent requests;

[0036] Step C304, comprehensive decision: Based on the above inspection results, if the fingerprint matches the blacklist, the information metadata verification fails, the user behavior is abnormal, or the QPS exceeds the limit, the request is intercepted and the blacklist is updated. Otherwise, the device fingerprint is added to the whitelist and the request is allowed to pass.

[0037] The beneficial effects of the present invention are as follows: collecting device information of the client, processing and analyzing the collected device information, extracting its features, using a hash algorithm to perform encryption processing based on the extracted features, generating device fingerprints, and establishing a black and white list fingerprint library to store known trusted client fingerprints and known malicious client fingerprints respectively, which can effectively identify and distinguish legitimate clients from malicious clients, compare and analyze the generated client fingerprints with the fingerprints in the black and white list fingerprint library, and make a request interception judgment based on the result of the fingerprint analysis. When the fingerprint of the client matches the record in the black list library, the request will be intercepted immediately, and corresponding security measures will be taken, including blocking access and recording abnormal behavior. When the fingerprint matches the fingerprint in the white list library, the request is allowed to continue. Through the automated fingerprint generation and comparison process, the workload of manual review and processing is reduced, the operation and maintenance cost is reduced, malicious requests can be intercepted in advance, and attackers are prevented from performing unauthorized access and malicious operations. Network security risks can be effectively reduced, and the false interception rate of legitimate requests can be reduced, providing an important guarantee for establishing a more secure and reliable network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 is a flow chart of the method of the present invention;

[0039] Figure 2 It is a request interception determination flow chart of the present invention. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0041] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, "plurality" means two or more, unless otherwise clearly and specifically defined.

[0042] In the description of the present application, the term "for example" is used to mean "used as an example, illustration or description". Any embodiment described as "for example" in the present application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any technician in the field to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes will not be elaborated in detail to avoid unnecessary details to obscure the description of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in the present application.

[0043] Example 1

[0044] This embodiment provides Figure 1 A request interception method based on client fingerprint identification is shown, which specifically includes the following steps:

[0045] Step 101: Collect device information of the client, process and analyze the collected device information, and extract its features;

[0046] Step 102: Based on the features extracted in step 101, a hash algorithm is used to perform encryption processing to generate a device fingerprint;

[0047] Step 103: Establish a blacklist and whitelist fingerprint library to store known trusted client fingerprints and known malicious client fingerprints respectively, compare and analyze the generated client fingerprint with the fingerprints in the blacklist and whitelist fingerprint library, and make a request interception decision based on the result of the fingerprint analysis.

[0048] Preferably, in step 101, the device information of the client is collected, and the collected device information is processed and analyzed to extract its features. The specific steps are as follows:

[0049] Step A1, collecting various information related to the device, including hardware information, operating system information, browser information and network information;

[0050] The hardware information includes: CPU processor type, core number, clock speed information; GPU graphics processing unit model, manufacturer, video memory size information; physical memory capacity, usage information; storage hard disk capacity, remaining space information;

[0051] The operating system information includes: the specific version number of the operating system; the default language setting of the system; the currently set system time zone, and the number of bits of the operating system;

[0052] The browser information includes: a browser identification string used to identify the browser type and version; a list of installed browser plug-ins, and a list of available fonts;

[0053] The network information includes: the public IP address of the client and the DNS server information used;

[0054] Step A2, process and process device information: process and analyze the collected device information to extract the following features: including the bit number, version number, language, time zone of the operating system; the version number, user agent string, plug-in list, font of the browser; the resolution setting of the screen; the IP address and DNS setting of the network information.

[0055] Preferably, in step 102, according to the features extracted in step 101, a hash algorithm is used to perform encryption processing to generate a unique device fingerprint, and inputs of different lengths are mapped to hash values ​​of fixed length to achieve compression and unique identification of device information. The specific steps are as follows:

[0056] Step B1: The device information is represented as D, which includes the characteristics of various aspects of hardware information, operating system information, browser information and network information. The specific calculation formula is as follows:

[0057] D=f1,f2,...,f n

[0058] Where D represents device information, f n Represents the nth feature extracted;

[0059] Step B2, generate device fingerprint: convert each feature into its hash value, and concatenate these hash values ​​together to form a unique device fingerprint string. The specific calculation formula is as follows:

[0060] FP=Hash(f1)||Hash(f2)||...||Hash(f n )

[0061] Among them, FP represents device fingerprint, Hash represents hash function, (f1,f2,...,f n ) represents each feature extracted from the device information, and || represents the string concatenation operation.

[0062] Preferably, in step 103, a blacklist and whitelist fingerprint library is established to store known trusted client fingerprints and known malicious client fingerprints respectively, so as to quickly identify and block access of these clients, prevent potential attacks and data leakage, compare and analyze the generated client fingerprint with the fingerprint in the blacklist and whitelist fingerprint library, and make a request interception judgment based on the result of the fingerprint analysis. The specific steps are as follows:

[0063] Step C1: Establish a blacklist and whitelist fingerprint library on the server side. The whitelist library stores known trusted client fingerprints, and the blacklist library stores known malicious client fingerprints. Each fingerprint entry should contain corresponding metadata information, including client type, authority, recording time, and malicious behavior description.

[0064] The whitelist library stores known trusted client fingerprints, including fingerprint information of verified devices without abnormal behavior. Through the whitelist mechanism, trusted clients can quickly pass the verification process, reduce unnecessary security checks, improve user experience, and effectively distinguish between legitimate users and malicious users, avoiding unnecessary interference and access interruption to legitimate users. The update mechanism of the whitelist library is to manually add fingerprint information of trusted devices through the administrator according to the trust evaluation mechanism, and maintain the ability to respond to new threats through dynamic updates and management.

[0065] The blacklist library stores known malicious client fingerprints including: operating system version, browser information, and IP address characteristics of malicious devices;

[0066] Step C2, fingerprint matching calculation: Using the Hamming distance to compare the similarity between the device fingerprint and the blacklist and whitelist fingerprint database helps to identify devices that are similar but not identical to known malicious device fingerprints and improves recognition accuracy. The specific calculation formula is as follows:

[0067]

[0068] Among them, Matching Score represents the matching score, HD(FP,FP library ) is the device fingerprint FP and the fingerprint FP in the blacklist and whitelist database library The Hamming distance represents the number of different characters at each position, and n is the length of the device fingerprint, which is determined by the number of features;

[0069] Step C3, fingerprint comparison and analysis: the generated device fingerprint is compared with the fingerprints in the blacklist and whitelist fingerprint libraries. When the device fingerprint matches the fingerprints in the whitelist library, the request is allowed to pass; when the device fingerprint matches the fingerprints in the blacklist library, it is determined to be a malicious request, the request is immediately intercepted, and the corresponding blacklist fingerprint metadata is updated. By updating the blacklist fingerprint metadata in real time, it can quickly adapt to emerging threats and malicious devices, and improve the security response speed and efficiency; when the device fingerprint does not match the fingerprints in the whitelist library and the blacklist library, the core data items of the request are verified and the QPS is checked. The final interception decision is made based on the above inspection results, which can reduce false interceptions and improve system reliability and user experience;

[0070] Among them, the update mechanism of the blacklist library is that when it is detected that the fingerprint of a certain device has a high match with the fingerprint in the blacklist, the fingerprint of the device is added to the blacklist. By increasing the number of accesses and the most recent access time of the device, the metadata information in the blacklist is updated, and the blacklist and whitelist are dynamically updated to timely incorporate the latest threat intelligence and trust information, so as to quickly respond to newly emerging malicious clients and attack methods.

[0071] Preferably, in the fingerprint comparison and analysis of step C3, when the device fingerprint does not match the fingerprints in the whitelist library and the blacklist library, the core data items of the request are verified and the QPS check is performed, and the final interception decision is made based on the above check results, further including the following steps:

[0072] Step C301, verify information metadata: when the fingerprint does not hit the blacklist, verify the core data items of the request, check whether there are key fields missing, whether the IP address and geographical location are reasonable, and check the geographical location of the IP address to determine whether it is within the expected range, prevent requests from untrusted areas, make real-time judgments based on actual request behavior, and flexibly handle various legal requests to avoid affecting normal user use due to the limitations of static blacklists and whitelists;

[0073] Step C302, user behavior analysis and device trust evaluation: Analyze user behavior patterns, including request frequency and access time period; evaluate the trust of the device, and score it based on the device's hardware information and usage history factors. If the behavior pattern and device trust are low, it is judged as a virtual forged terminal request and intercepted;

[0074] Step C303, QPS check: the QPS is the number of requests per second. A threshold X of access frequency is set, and the number of requests per second requested by the device is recorded to detect whether there are abnormal requests. When the number of requests of the device within one second exceeds the set threshold, the device fingerprint is added to the blacklist and subsequent requests are intercepted, avoiding blind interception of legitimate traffic, effectively utilizing system resources, and improving the operating efficiency of the entire system;

[0075] Step C304, comprehensive decision: Based on the above inspection results, when the fingerprint matches the blacklist, the information metadata verification fails, the user behavior is abnormal, and the QPS exceeds the limit, the request is intercepted and the blacklist is updated. Otherwise, the device fingerprint is added to the whitelist and the request is allowed to pass. By recording the results of each core data item verification and QPS check in detail, it is helpful for subsequent security audits and problem tracking, meeting compliance requirements, and making interception decisions based on comprehensive data from various aspects, so that each interception can be traced, improving the transparency and explainability of system decisions.

[0076] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0077] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0078] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0079] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0080] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0081] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0082] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A request interception method based on client fingerprint recognition, characterized in that: The specific steps include: Step 101: Collect device information of the client, process and analyze the collected device information, and extract its features; Step 102: Based on the features extracted in step 101, a hash algorithm is used to perform encryption processing to generate a device fingerprint; Step 103: Establish a blacklist and whitelist fingerprint library to store known trusted client fingerprints and known malicious client fingerprints respectively, compare and analyze the generated client fingerprint with the fingerprints in the blacklist and whitelist fingerprint library, and make a request interception decision based on the result of the fingerprint analysis.

2. According to claim 1, a request interception method based on client fingerprint recognition is characterized in that: In step 101, the device information of the client is collected, and the collected device information is processed and analyzed to extract its features. The specific steps are as follows: Step A1, collecting various information related to the device, including hardware information, operating system information, browser information and network information; Step A2, process and process device information: process and analyze the collected device information to extract the following features: including the bit number, version number, language, time zone of the operating system; the version number, user agent string, plug-in list, font of the browser; the resolution setting of the screen; the IP address and DNS setting of the network information.

3. According to the request interception method based on client fingerprint recognition according to claim 1, it is characterized in that: In step 102, according to the features extracted in step 101, a hash algorithm is used to perform encryption processing to generate a device fingerprint. The specific steps are as follows: Step B1: The device information is represented as D, which includes the characteristics of various aspects of hardware information, operating system information, browser information and network information. The specific calculation formula is as follows: D=f1,f2,...,f n Where D represents device information, f n Represents the nth feature extracted; Step B2, generate device fingerprint: convert each feature into its hash value, and concatenate these hash values ​​together to form a unique device fingerprint string.

4. According to the request interception method based on client fingerprint identification according to claim 3, it is characterized in that: In the step B2 of generating the device fingerprint, the specific calculation formula of the device fingerprint string is as follows: FP=Hash(f1)||Hash(f2)||...||Hash(f n ) Among them, FP represents device fingerprint, Hash represents hash function, (f1,f2,...,f n ) represents each feature extracted from the device information, and || represents the string concatenation operation.

5. According to the request interception method based on client fingerprint identification according to claim 1, it is characterized in that: In step 103, a blacklist and whitelist fingerprint library is established to store known trusted client fingerprints and known malicious client fingerprints respectively, and the generated client fingerprint is compared and analyzed with the fingerprints in the blacklist and whitelist fingerprint library. According to the result of the fingerprint analysis, a request interception judgment is made. The specific steps are as follows: Step C1: Establish a blacklist and whitelist fingerprint library on the server side, the whitelist library stores known trusted client fingerprints, and the blacklist library stores known malicious client fingerprints; Step C2, fingerprint matching calculation: use the Hamming distance to compare the similarity between the device fingerprint and the black and white list fingerprint database; Step C3, fingerprint comparison and analysis: the generated device fingerprint is compared with the fingerprints in the blacklist and whitelist fingerprint libraries. When the device fingerprint matches the fingerprint in the whitelist library, the request is allowed to pass; when the device fingerprint matches the fingerprint in the blacklist library, it is determined to be a malicious request, the request is immediately intercepted, and the corresponding blacklist fingerprint metadata is updated; when the device fingerprint does not match the fingerprints in both the whitelist library and the blacklist library, the core data items of the request are verified and the QPS is checked, and the final interception decision is made based on the above inspection results.

6. A request interception method based on client fingerprint identification according to claim 5, characterized in that: In the step C2 fingerprint matching calculation, the specific calculation formula is as follows: Among them, Matching Score represents the matching score, HD(FP,FP library ) is the device fingerprint FP and the fingerprint FP in the black and white list library library The Hamming distance is n, and n is the length of the device fingerprint, which is determined by the number of features.

7. A request interception method based on client fingerprint identification according to claim 5, characterized in that: In the fingerprint comparison and analysis step C3, when the device fingerprint does not match the fingerprints in the whitelist library and the blacklist library, the core data items of the request are verified and the QPS check is performed, and the final interception decision is made based on the above check results, which further includes the following steps: Step C301, verify information metadata: when the fingerprint does not hit the blacklist, verify the core data items of the request to check whether there are any key fields missing, and whether the IP address and geographic location are reasonable; Step C302, user behavior analysis and device trust evaluation: Analyze user behavior patterns, including request frequency and access time period; evaluate the trust of the device, and score it based on the device's hardware information and usage history factors. If the behavior pattern and device trust are low, it is judged as a virtual forged terminal request and intercepted; Step C303, QPS check: record the number of requests per second requested by the device, set a threshold X for access frequency, detect whether there are abnormal requests, and when the number of requests of the device in one second exceeds the set threshold, add the device fingerprint to the blacklist and intercept subsequent requests; Step C304, comprehensive decision: Based on the above inspection results, when the fingerprint matches the blacklist, the information metadata verification fails, the user behavior is abnormal, or the QPS exceeds the limit, the request is intercepted and the blacklist is updated. Otherwise, the device fingerprint is added to the whitelist and the request is allowed to pass.

Images