A method, device, storage medium and gateway for defending against malicious attacks

Abstract

The present application discloses a method, device, storage medium and gateway for defending against malicious attacks, which calls the communication interface of the server and intercepts multiple audio requests sent by the client to the server within a preset time period. Each audio request is parsed to obtain the audio information corresponding to each audio request. The playback time of each audio is accumulated and summed to obtain the total audio duration. From the sending time points of each audio, a start time point and an end time point are selected. The time between the start time point and the end time point is counted to obtain the target duration. When the total audio duration is not less than the target duration, each audio is deleted. Using the scheme shown in the present application, it is possible to distinguish whether the audio sent by the client is a malicious attack disguised by criminals based on the playback time and timestamp of each audio sent by the client within the preset time period, and delete the audio belonging to the malicious attack, thereby preventing the server from being maliciously attacked by criminals.

Description

Technical Field

[0001] The present application relates to the field of intelligent customer service, and in particular to a method, device, storage medium and gateway for defending against malicious attacks. Background Art

[0002] With the rapid development of intelligent technology, more and more shopping websites are using digital human shopping guide customer service to provide shopping guide services to customers. Since the service objects of digital human shopping guide customer service are mainly Internet users, they need to be exposed to the Internet environment. Therefore, the servers that provide digital human shopping guide customer service are often attacked by criminals, thus affecting the normal operation of the entire digital human shopping guide customer service. How to prevent the server from being maliciously attacked by criminals has become an urgent problem to be solved in the field of intelligent customer service. Summary of the invention

[0003] The applicant discovered that the means by which criminals attack the server of the digital shopping guide customer service is mainly to forge the client's audio request in advance and send a large number of forged audio requests to the server, thereby increasing the server's workload in a short period of time and causing the server to be unable to work normally. To this end, it is only necessary to restrict the server from receiving these disguised audio requests and prevent the server from processing these disguised audio requests, so as to effectively prevent the server from being maliciously attacked by criminals.

[0004] The present application provides a malicious attack defense method, device, storage medium and gateway, the purpose of which is to prevent a server from being maliciously attacked by lawless elements.

[0005] In order to achieve the above objectives, this application provides the following technical solutions:

[0006] A method for defending against malicious attacks, comprising:

[0007] Calling the communication interface of the server to intercept multiple audio requests sent by the client to the server within a preset time period;

[0008] Parsing each of the audio requests to obtain audio information corresponding to each of the audio requests; the audio information includes the playing time and timestamp of the audio; the timestamp represents the time point when the client sends the audio to the server;

[0009] Accumulating and summing the playing time of each audio to obtain the total playing time of the audio;

[0010] From the sending time points of the audios, select the earliest sending time point as the starting time point;

[0011] From the sending time points of the audios, select the latest sending time point as the end time point;

[0012] Counting the time between the starting time point and the ending time point to obtain the target duration;

[0013] When the total duration of the audio is not less than the target duration, each of the audios is deleted, and the communication connection between the server and the client is disconnected.

[0014] Optionally, parsing each of the audio requests to obtain audio information corresponding to each of the audio requests includes:

[0015] Parsing each of the audio requests to obtain audio information and connection request information corresponding to each of the audio requests; the connection request information includes the IP address of the client;

[0016] When the total duration of the audio is not less than the target duration, after deleting each of the audios and disconnecting the communication connection between the server and the client, the method further includes:

[0017] The IP address of the client is stored in a preset blacklist.

[0018] Optionally, the accumulating and summing the playing durations of the respective audios to obtain a total audio duration includes:

[0019] Determine whether the IP address of the client is recorded in a preset blacklist;

[0020] When the IP address of the client is not recorded in the preset blacklist, the playing time of each audio is accumulated and summed to obtain the total audio time.

[0021] Optionally, also include:

[0022] In the case where the IP address of the client is recorded in the preset blacklist, each of the audios is deleted, and the communication connection between the server and the client is disconnected.

[0023] Optionally, also include:

[0024] When the total duration of the audio is less than the target duration, each of the audios is sent to the server, and a reply video corresponding to each of the audios fed back by the server is received.

[0025] Optionally, sending each of the audios to the server, and receiving a reply video corresponding to each of the audios fed back by the server, includes:

[0026] For each of the audios, determining whether the playing time of the audio is less than a preset time threshold;

[0027] When the playing time of the audio is less than the preset time threshold, marking the audio as valid audio;

[0028] Each of the valid audios is sent to the server, and a reply video corresponding to each of the valid audios fed back by the server is received.

[0029] Optionally, also include:

[0030] When the playing time of the audio is not less than the preset time threshold, the audio is marked as invalid audio and deleted.

[0031] A defense device for malicious attacks, comprising:

[0032] A request interception unit, used to call the communication interface of the server to intercept multiple audio requests sent by the client to the server within a preset time period;

[0033] A request parsing unit, configured to parse each of the audio requests to obtain audio information corresponding to each of the audio requests; the audio information includes a playing duration and a timestamp of the audio; the timestamp indicates a sending time point when the client sends the audio to the server;

[0034] A duration calculation unit, used to accumulate and sum the playing durations of the respective audios to obtain a total duration of the audios;

[0035] A start determination unit, configured to select the earliest sending time point from among the sending time points of the audios as the start time point;

[0036] A termination determination unit, configured to select the latest sending time point from the sending time points of the audio as the termination time point;

[0037] A time statistics unit, used to count the time between the starting time point and the ending time point to obtain a target duration;

[0038] The audio deletion unit is used to delete each audio and disconnect the communication connection between the server and the client when the total duration of the audio is not less than the target duration.

[0039] Optionally, the request parsing unit is specifically used to:

[0040] Parsing each of the audio requests to obtain audio information and connection request information corresponding to each of the audio requests; the connection request information includes the IP address of the client;

[0041] The audio deletion unit is also used for:

[0042] The IP address of the client is stored in a preset blacklist.

[0043] Optionally, the duration calculation unit is specifically used for:

[0044] Determine whether the IP address of the client is recorded in a preset blacklist;

[0045] When the IP address of the client is not recorded in the preset blacklist, the playing time of each audio is accumulated and summed to obtain the total audio time.

[0046] Optionally, the duration calculation unit is further used for:

[0047] In the case where the IP address of the client is recorded in the preset blacklist, each of the audios is deleted, and the communication connection between the server and the client is disconnected.

[0048] Optionally, also include:

[0049] The audio forwarding unit is used to send each audio to the server when the total duration of the audio is less than the target duration, receive the reply video corresponding to each audio fed back by the server, and send each reply video to the client.

[0050] Optionally, the audio forwarding unit is specifically used for:

[0051] For each of the audios, determining whether the playing time of the audio is less than a preset time threshold;

[0052] When the playing time of the audio is less than the preset time threshold, marking the audio as valid audio;

[0053] Each of the valid audios is sent to the server, and a reply video corresponding to each of the valid audios fed back by the server is received.

[0054] Optionally, the audio forwarding unit is also used for:

[0055] When the playing time of the audio is not less than the preset time threshold, the audio is marked as invalid audio and deleted.

[0056] A computer-readable storage medium includes a stored program, wherein the program executes the malicious attack defense method.

[0057] A gateway comprises: a processor, a memory and a bus; the processor and the memory are connected via the bus;

[0058] The memory is used to store programs, and the processor is used to run programs, wherein the malicious attack defense method is executed when the program is running.

[0059] The technical solution provided by the present application calls the communication interface of the server to intercept multiple audio requests sent by the client to the server within a preset time period. Each audio request is parsed to obtain audio information corresponding to each audio request. The audio information includes the playing time and timestamp of the audio. The timestamp represents the sending time point when the client sends the audio to the server. The playing time of each audio is accumulated and summed to obtain the total audio time. From the sending time points of each audio, the earliest sending time point is selected as the starting time point. From the sending time points of each audio, the latest sending time point is selected as the ending time point. The time between the starting time point and the ending time point is counted to obtain the target time. When the total audio time is not less than the target time, each audio is deleted and the communication connection between the server and the client is disconnected. Using the solution shown in the present application, it is possible to distinguish whether the audio sent by the client is a malicious attack disguised by criminals according to the playing time and timestamp of each audio sent by the client within the preset time period, and delete the audio belonging to the malicious attack, thereby effectively preventing the server from being maliciously attacked by criminals. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0061] Figure 1a A flowchart of a method for defending against malicious attacks provided in an embodiment of the present application;

[0062] Figure 1b A flowchart of a method for defending against malicious attacks provided in an embodiment of the present application;

[0063] Figure 2 A flowchart of another method for defending against malicious attacks provided in an embodiment of the present application;

[0064] Figure 3 A schematic diagram of the architecture of a malicious attack defense device provided in an embodiment of the present application;

[0065] Figure 4 A schematic diagram of an application environment provided for an embodiment of the present application. DETAILED DESCRIPTION

[0066] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0067] like Figure 1a and Figure 1b FIG. 1 is a flow chart of a method for defending against malicious attacks provided in an embodiment of the present application, comprising the following steps:

[0068] S101: calling a communication interface of a server to intercept multiple audio requests sent by a client to the server within a preset time period.

[0069] When a user applies for the digital human shopping guide customer service, an audio request will be sent to the server through the client.

[0070] S102: parse each audio request to obtain audio information and connection request information corresponding to each audio request.

[0071] The audio information includes the playing time and timestamp of the audio, and the timestamp represents the time point when the client sends the audio to the server.

[0072] In addition, the connection request information includes the IP address of the client.

[0073] S103: Determine whether the IP address of the client is recorded in the preset blacklist.

[0074] If the IP address of the client is recorded in the preset blacklist, execute S104, otherwise execute S105.

[0075] S104: For each audio, determine whether the playing time of the audio is less than a preset time threshold.

[0076] If the playing time of the audio is less than the preset time threshold, execute S106, otherwise execute S107.

[0077] S105: Delete each audio of the client, and disconnect the communication connection between the server and the client.

[0078] Among them, if the client's IP address is recorded in the preset blacklist, it means that the client may be forged by criminals, that is, the audio requests sent through the client's IP address are all malicious attacks on the server by criminals. In order to prevent the server from processing these audio requests that are attacks, the client's audio is deleted and the communication connection between the server and the client is disconnected.

[0079] S106: Identify the audio as valid audio.

[0080] After executing S106 , continue to execute S108 .

[0081] S107: Identify the audio as invalid audio.

[0082] Optionally, in order to avoid the server from processing invalid audio and reduce the server's workload, the invalid audio can be deleted.

[0083] S108: Accumulate and sum the playing time of each audio to obtain the total playing time of the audio.

[0084] S109: Selecting the earliest sending time point from the sending time points of each audio as the starting time point.

[0085] S110: Selecting the latest sending time point from the sending time points of each audio as the termination time point.

[0086] S111: Count the time between the start time point and the end time point to obtain the target duration.

[0087] S112: Determine whether the total audio duration is less than the target duration.

[0088] If the total audio duration is less than the target duration, execute S113; otherwise, execute S114.

[0089] S113: Determine that the client is a normal client, send each valid audio to the server, and receive a reply video corresponding to each valid audio fed back by the server.

[0090] After executing S113 , continue to execute S115 .

[0091] It should be noted that after receiving valid audio, the server will pre-call the preset semantic recognition algorithm to perform semantic recognition on the valid audio to obtain semantic information, and then call the preset artificial intelligence algorithm to intelligently reply to the semantic information to obtain reply information, and finally call the preset virtual character rendering algorithm to perform virtual character rendering on the reply information to obtain a reply video.

[0092] S114: Determine that the client is an abnormal client, delete each audio of the client, disconnect the communication connection between the server and the client, and store the IP address of the client in a preset blacklist.

[0093] Among them, according to existing common sense, the total audio duration of each audio sent by the user within the preset duration will definitely not be greater than the preset duration, unless a professional algorithm is used to simulate the generated audio. Therefore, if the total audio duration is not less than the target duration, it means that each audio sent by the client within the preset time is disguised by criminals and is a malicious attack on the server. Therefore, the client's IP address is stored in the preset blacklist and each audio of the client is deleted.

[0094] S115: Send each reply video to the client.

[0095] By using the scheme shown in this embodiment, it is possible to distinguish whether the audio sent by the client is a malicious attack disguised by criminals based on the playback duration and timestamp of each audio sent by the client within a preset time period, and delete the audio that is a malicious attack, thereby effectively preventing the server from being maliciously attacked by criminals.

[0096] It should be noted that S103 mentioned in the above embodiment is an optional implementation of the malicious attack defense method shown in this application. In addition, S114 mentioned in the above embodiment is also an optional implementation of the malicious attack defense method shown in this application. To this end, the process mentioned in the above embodiment can be summarized as follows: Figure 2 The method shown.

[0097] like Figure 2 FIG. 1 is a flow chart of another method for defending against malicious attacks provided in an embodiment of the present application, comprising the following steps:

[0098] S201: calling a communication interface of a server to intercept multiple audio requests sent by a client to the server within a preset time period.

[0099] S202: parse each audio request to obtain audio information corresponding to each audio request.

[0100] The audio information includes the playing time and timestamp of the audio, and the timestamp represents the time point when the client sends the audio to the server.

[0101] S203: Accumulate and sum the playing time of each audio to obtain the total playing time of the audio.

[0102] S204: Selecting the earliest sending time point from the sending time points of each audio as the starting time point.

[0103] S205: Selecting the latest sending time point from the sending time points of each audio as the termination time point.

[0104] S206: Count the time between the start time point and the end time point to obtain the target duration.

[0105] S207: When the total duration of the audio is not less than the target duration, delete each audio and disconnect the communication connection between the server and the client.

[0106] By using the scheme shown in this embodiment, it is possible to distinguish whether the audio sent by the client is a malicious attack disguised by criminals based on the playback duration and timestamp of each audio sent by the client within a preset time period, and delete the audio that is a malicious attack, thereby effectively preventing the server from being maliciously attacked by criminals.

[0107] Corresponding to the malicious attack defense method provided in the above-mentioned embodiment of the present application, the embodiment of the present application also provides a malicious attack defense device.

[0108] like Figure 3 FIG. 1 is a schematic diagram of the architecture of a malicious attack defense device provided in an embodiment of the present application, including:

[0109] The request interception unit 100 is used to call the communication interface of the server to intercept multiple audio requests sent by the client to the server within a preset time period.

[0110] The request parsing unit 200 is used to parse each audio request to obtain audio information corresponding to each audio request; the audio information includes the playing time and timestamp of the audio; the timestamp represents the sending time point when the client sends the audio to the server.

[0111] The request parsing unit 200 is specifically used to: parse each audio request to obtain audio information and connection request information corresponding to each audio request; the connection request information includes the IP address of the client.

[0112] The duration calculation unit 300 is used to accumulate and sum the playing duration of each audio to obtain the total duration of the audio.

[0113] Among them, the duration calculation unit 300 is specifically used to: determine whether the client's IP address is recorded in the preset blacklist; if the client's IP address is not recorded in the preset blacklist, accumulate and sum the playback duration of each audio to obtain the total audio duration.

[0114] The duration calculation unit 300 is also used to: when the IP address of the client is recorded in the preset blacklist, delete each audio and disconnect the communication connection between the server and the client.

[0115] The start determination unit 400 is used to select the earliest sending time point from the sending time points of each audio as the start time point.

[0116] The termination determination unit 500 is used to select the latest sending time point from the sending time points of each audio as the termination time point.

[0117] The time statistics unit 600 is used to count the time between the start time point and the end time point to obtain the target duration.

[0118] The audio deletion unit 700 is used to delete each audio and disconnect the communication connection between the server and the client when the total duration of the audio is not less than the target duration.

[0119] The audio deletion unit 700 is further used to store the IP address of the client into a preset blacklist.

[0120] The audio forwarding unit 800 is used to send each audio to the server when the total audio duration is less than the target duration, receive the reply video corresponding to each audio fed back by the server, and send each reply video to the client.

[0121] Among them, the audio forwarding unit 800 is specifically used to: for each audio, determine whether the playback time of the audio is less than the preset time threshold; when the playback time of the audio is less than the preset time threshold, mark the audio as valid audio; send each valid audio to the server, and receive the reply video corresponding to each valid audio fed back by the server.

[0122] The audio forwarding unit 800 is also used to: when the playing time of the audio is not less than a preset time threshold, mark the audio as invalid audio and delete the invalid audio.

[0123] By using the scheme shown in this embodiment, it is possible to distinguish whether the audio sent by the client is a malicious attack disguised by criminals based on the playback duration and timestamp of each audio sent by the client within a preset time period, and delete the audio that is a malicious attack, thereby effectively preventing the server from being maliciously attacked by criminals.

[0124] like Figure 4 As shown, the present application also provides an application environment schematic diagram, and the malicious attack defense method provided in the embodiment of the present application can be used for the following Figure 4 The interactive system 400 shown is specifically applied in a gateway 403. The interactive system 400 includes a terminal device 401, a server 402 and a gateway 403, and the server 402 communicates and interacts with the terminal device 401 through the gateway 403. The server 402 can be a traditional server or a cloud server, which is not specifically limited here.

[0125] The terminal device 401 may be any electronic device having a display screen, a data processing module, a camera, audio input / output and other functions, and supporting data input, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, self-service terminals and wearable electronic devices, etc. Specifically, data input may be based on voice input through a voice module on the electronic device, character input through a character input module, etc.

[0126] Among them, a client application can be installed on the terminal device 401, and the user can use the client application (such as APP, WeChat applet, etc.), wherein the conversation robot of this embodiment is also a client application configured in the terminal device 401. The user can register a user account on the server 402 based on the client application, and communicate with the server 402 based on the user account. For example, the user logs in to the user account on the client application, and inputs through the client application based on the user account, and can input text information or voice information, etc. After the client application receives the information input by the user, it can send the information to the gateway 403, and then the gateway forwards the information to the server 402, so that the server 402 can receive the information and process and store it. The server 402 can also receive the information and return a corresponding output information to the gateway 403 according to the information, and then the gateway 403 forwards the output information to the terminal device 401.

[0127] The present application also provides a computer-readable storage medium, which includes a stored program, wherein the program executes the malicious attack defense method provided by the present application.

[0128] The present application also provides a gateway, including: a processor, a memory, and a bus. The processor and the memory are connected via a bus, the memory is used to store programs, and the processor is used to run programs, wherein when the program is running, the malicious attack defense method provided by the present application is executed, including the following steps:

[0129] Calling the communication interface of the server to intercept multiple audio requests sent by the client to the server within a preset time period;

[0130] Parsing each of the audio requests to obtain audio information corresponding to each of the audio requests; the audio information includes the playing time and timestamp of the audio; the timestamp represents the time point when the client sends the audio to the server;

[0131] Accumulating and summing the playing time of each audio to obtain the total playing time of the audio;

[0132] From the sending time points of the audios, select the earliest sending time point as the starting time point;

[0133] From the sending time points of the audios, select the latest sending time point as the end time point;

[0134] Counting the time between the starting time point and the ending time point to obtain the target duration;

[0135] When the total duration of the audio is not less than the target duration, each of the audios is deleted, and the communication connection between the server and the client is disconnected.

[0136] Specifically, based on the above embodiment, parsing each of the audio requests to obtain audio information corresponding to each of the audio requests includes:

[0137] Parsing each of the audio requests to obtain audio information and connection request information corresponding to each of the audio requests; the connection request information includes the IP address of the client;

[0138] When the total duration of the audio is not less than the target duration, after deleting each of the audios and disconnecting the communication connection between the server and the client, the method further includes:

[0139] The IP address of the client is stored in a preset blacklist.

[0140] Specifically, based on the above embodiment, the playing time of each audio is accumulated and summed to obtain the total audio time, including:

[0141] Determine whether the IP address of the client is recorded in a preset blacklist;

[0142] When the IP address of the client is not recorded in the preset blacklist, the playing time of each audio is accumulated and summed to obtain the total audio time.

[0143] Specifically, based on the above embodiment, it also includes:

[0144] In the case where the IP address of the client is recorded in the preset blacklist, each of the audios is deleted, and the communication connection between the server and the client is disconnected.

[0145] Specifically, based on the above embodiment, it also includes:

[0146] When the total duration of the audio is less than the target duration, each of the audios is sent to the server, and a reply video corresponding to each of the audios fed back by the server is received.

[0147] Specifically, based on the above embodiment, sending each audio to the server and receiving a reply video corresponding to each audio fed back by the server includes:

[0148] For each of the audios, determining whether the playing time of the audio is less than a preset time threshold;

[0149] When the playing time of the audio is less than the preset time threshold, marking the audio as valid audio;

[0150] Each of the valid audios is sent to the server, and a reply video corresponding to each of the valid audios fed back by the server is received.

[0151] Specifically, based on the above embodiment, it also includes:

[0152] When the playing time of the audio is not less than the preset time threshold, the audio is marked as invalid audio and deleted.

[0153] If the functions described in the method of the embodiment of the present application are implemented in the form of software functional units and sold or used as independent products, they can be stored in a storage medium readable by a computing device. Based on this understanding, the part of the embodiment of the present application that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions to enable a computing device (which can be a personal computer, server, mobile computing device or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

[0154] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0155] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for defending against malicious attacks, characterized in that: include: Calling a communication interface of a server to intercept multiple audio requests sent by the same client to the server within a preset time period; Parsing each of the audio requests to obtain audio information and connection request information corresponding to each of the audio requests; the connection request information includes the IP address of the client; the audio information includes the playing time and timestamp of the audio; the timestamp indicates the time point when the client sends the audio to the server; Accumulating and summing the playing time of each audio to obtain the total playing time of the audio; From the sending time points of the audios, select the earliest sending time point as the starting time point; From the sending time points of the audios, select the latest sending time point as the end time point; Counting the time between the starting time point and the ending time point to obtain the target duration; If the total duration of the audio is not less than the target duration, determining that the audio in the multiple audio requests is audio simulated and generated using a professional algorithm, deleting each of the audio, and disconnecting the communication connection between the server and the client; The IP address of the client is stored in a preset blacklist.

2. The method according to claim 1, characterized in that The step of accumulating and summing the playing time of each audio to obtain the total audio time includes: Determine whether the IP address of the client is recorded in a preset blacklist; When the IP address of the client is not recorded in the preset blacklist, the playing time of each audio is accumulated and summed to obtain the total audio time.

3. The method according to claim 2, characterized in that Also includes: In the case where the IP address of the client is recorded in the preset blacklist, each of the audios is deleted, and the communication connection between the server and the client is disconnected.

4. The method according to claim 1, characterized in that: Also includes: When the total duration of the audio is less than the target duration, each of the audios is sent to the server, and a reply video corresponding to each of the audios fed back by the server is received; Each of the reply videos is sent to the client.

5. The method according to claim 4, characterized in that The sending of each audio to the server and receiving a reply video corresponding to each audio fed back by the server includes: For each of the audios, determining whether the playing time of the audio is less than a preset time threshold; When the playing time of the audio is less than the preset time threshold, marking the audio as valid audio; Each of the valid audios is sent to the server, and a reply video corresponding to each of the valid audios fed back by the server is received.

6. The method according to claim 5, characterized in that Also includes: When the playing time of the audio is not less than the preset time threshold, the audio is marked as invalid audio and deleted.

7. A device for defending against malicious attacks, characterized in that: include: A request interception unit, used to call the communication interface of the server to intercept multiple audio requests sent by the same client to the server within a preset time period; A request parsing unit, configured to parse each of the audio requests to obtain audio information and connection request information corresponding to each of the audio requests; The connection request information includes the IP address of the client; the audio information includes the playing time and timestamp of the audio; The timestamp represents the time point at which the client sends the audio to the server; A duration calculation unit, used to accumulate and sum the playing durations of the respective audios to obtain a total duration of the audios; A start determination unit, configured to select the earliest sending time point from among the sending time points of the audios as the start time point; A termination determination unit, configured to select the latest sending time point from the sending time points of the audio as the termination time point; A time statistics unit, used to count the time between the starting time point and the ending time point to obtain a target duration; An audio deletion unit is used to determine, when the total duration of the audio is not less than the target duration, that the audio in the multiple audio requests is audio simulated and generated using a professional algorithm, delete each of the audios, and disconnect the communication connection between the server and the client; and store the IP address of the client in a preset blacklist.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein the program, when executed by the computer device where it is located, executes the malicious attack defense method according to any one of claims 1 to 6.

9. A gateway, characterized in that: include: processor, memory, and bus; The processor is connected to the memory via the bus; The memory is used to store programs, and the processor is used to run programs, wherein the malicious attack defense method described in any one of claims 1 to 6 is executed when the program is run.

Images