Network address management method, device, computer readable medium and electronic device

Abstract

The embodiments of the present application provide a network address management method, device, computer-readable medium and electronic device. The network address management method includes: obtaining multiple first network addresses included in a blacklist, and multiple second network addresses included in both the blacklist and the whitelist; calculating the confidence of each first network address relative to the blacklist and the confidence of each second network address relative to the blacklist; determining the target confidence of each first network address relative to the whitelist based on the calculated multiple confidences and the confidence of each second network address relative to the whitelist; if there is a target network address with a target confidence greater than a preset threshold among the multiple first network addresses, the target network address is deleted from the blacklist. The technical solution of the embodiments of the present application can reduce the misblocking rate of network addresses in the blacklist.

Description

Technical Field

[0001] The present application relates to the field of computer and communication technology, and in particular to a network address management method, device, computer-readable medium and electronic device. Background Art

[0002] In recent years, the cost of network attacks has become lower and lower, and network attacks have become more frequent. In the face of such problems, service providers often choose to block the attack source Internet Protocol Address (IP address) through blacklists. When the attack source IP is identified, it is added to the blacklist. Although blocking the attack source IP through blacklists can ensure the security of the system to a certain extent, there is also the problem of misblocking the attack source IP. Summary of the invention

[0003] The embodiments of the present application provide a network address management method, device, computer-readable medium and electronic device, thereby reducing the misblocking rate of network addresses in the blacklist at least to a certain extent.

[0004] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0005] According to one aspect of an embodiment of the present application, a network address management method is provided, including: obtaining multiple first network addresses included in a blacklist, and multiple second network addresses included in the blacklist and the whitelist, the first network address and the second network address being network addresses that have initiated illegal access within a preset time period; calculating the confidence of each first network address relative to the blacklist and the confidence of each second network address relative to the blacklist; determining the target confidence of each first network address relative to the whitelist based on the calculated multiple confidences and the confidence of each second network address relative to the whitelist; if there is a target network address among the multiple first network addresses whose target confidence is greater than a preset threshold, deleting the target network address from the blacklist.

[0006] According to one aspect of an embodiment of the present application, a network address management device is provided, including: an acquisition unit, configured to acquire multiple first network addresses included in a blacklist, and multiple second network addresses commonly included in the blacklist and the whitelist, the first network address and the second network address being network addresses that have initiated illegal access within a preset time period; a calculation unit, configured to calculate the confidence of each first network address relative to the blacklist and the confidence of each second network address relative to the blacklist; a determination unit, configured to determine the target confidence of each first network address relative to the whitelist based on the calculated multiple confidences and the confidence of each second network address relative to the whitelist; a deletion unit, configured to delete the target network address from the blacklist if there is a target network address among the multiple first network addresses whose target confidence is greater than a preset threshold.

[0007] In some embodiments of the present application, based on the aforementioned scheme, the calculation unit is configured to: obtain the first time when each of the first network addresses was last deleted from the blacklist and the second time when each of the second network addresses was last deleted from the blacklist; calculate the confidence of each of the first network addresses relative to the blacklist based on the current calculation time and the first time, and calculate the confidence of each of the second network addresses relative to the blacklist based on the current calculation time and the second time.

[0008] In some embodiments of the present application, based on the aforementioned scheme, the determination unit includes: a first similarity determination subunit, configured to determine a first similarity between the blacklist and the whitelist based on the calculated multiple confidences and the confidences of the respective second network addresses relative to the whitelist; a first confidence determination subunit, configured to determine a target confidence of each first network address relative to the whitelist based on the first similarity and the confidences of the respective first network addresses relative to the blacklist.

[0009] In some embodiments of the present application, based on the aforementioned scheme, the first similarity determination subunit is configured to generate a first vector corresponding to the blacklist according to the confidence of each first network address relative to the blacklist, and the confidence of each second network address relative to the blacklist; generate a second vector corresponding to the whitelist according to the confidence of each second network address relative to the whitelist; calculate the cosine similarity between the first vector and the second vector, and use the calculated cosine similarity as the first similarity between the blacklist and the whitelist.

[0010] In some embodiments of the present application, based on the aforementioned scheme, the first confidence determination subunit is configured to calculate the product between the first similarity and the confidence of each first network address relative to the blacklist list, and use the calculated product as the target confidence of each first network address relative to the whitelist list.

[0011] In some embodiments of the present application, based on the aforementioned scheme, the determination unit includes: a vector matrix generation subunit, configured to generate a first vector matrix and a second vector matrix according to the calculated multiple confidences and the confidences of the respective second network addresses relative to the whitelist, the first vector matrix containing vectors corresponding to the respective first network addresses, and the second vector matrix containing vectors corresponding to the whitelist; a confidence generation subunit, configured to generate target confidences of the respective first network addresses relative to the whitelist according to the vectors corresponding to the respective first network addresses and the vectors corresponding to the whitelist.

[0012] In some embodiments of the present application, based on the aforementioned scheme, the vector matrix generation subunit is configured to: construct an original matrix based on the calculated multiple confidences and the confidences of the respective second network addresses relative to the whitelist list; perform singular value decomposition processing on the original matrix to generate the first vector matrix and the second vector matrix.

[0013] In some embodiments of the present application, based on the aforementioned scheme, the blacklist includes multiple lists, each blacklist corresponds to a different illegal access type, each blacklist includes at least one first network address, and the multiple blacklists and the whitelist together include at least one second network address; the calculation unit is configured to: calculate the confidence of each first network address relative to the blacklist where the each first network address is located, and the confidence of each second network address relative to the blacklist where the each second network address is located.

[0014] In some embodiments of the present application, based on the aforementioned scheme, the determination unit includes: a second similarity determination subunit, configured to determine the second similarity between each blacklist and the whitelist based on the calculated multiple confidences and the confidence of each second network address relative to the whitelist; a second confidence determination subunit, configured to determine the target confidence of each first network address relative to the whitelist based on the determined multiple second similarities and the confidence of each first network address relative to the blacklist in which the each first network address is located.

[0015] In some embodiments of the present application, based on the aforementioned scheme, the second confidence determination subunit is configured as: according to the determined multiple second similarities, weighted averaging is performed on the confidence of each first network address relative to the blacklist list in which each first network address is located, to obtain the weighted average value corresponding to each first network address; and the weighted average value corresponding to each first network address is used as the target confidence of each first network address relative to the whitelist list.

[0016] In some embodiments of the present application, based on the aforementioned scheme, the second confidence determination subunit is configured as: according to the determined multiple second similarities, selecting a blacklist list whose second similarity exceeds a similarity threshold from the multiple blacklist lists as a candidate blacklist list; according to the second similarity between the candidate blacklist list and the whitelist list, and the confidence of each first network address relative to the candidate blacklist list, determining the target confidence of each first network address relative to the whitelist list.

[0017] In some embodiments of the present application, based on the aforementioned scheme, the second confidence determination subunit is further configured to: perform weighted averaging processing on the confidence of each first network address relative to the candidate blacklist list according to the second similarity between the candidate blacklist list and the whitelist list, and obtain the weighted average value corresponding to each first network address; and use the weighted average value corresponding to each first network address as the target confidence of each first network address relative to the whitelist list.

[0018] According to one aspect of an embodiment of the present application, a computer-readable medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the network address management method as described in the above embodiment is implemented.

[0019] According to one aspect of an embodiment of the present application, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the network address management method as described in the above embodiments.

[0020] According to one aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the network address management method provided in the above various optional embodiments.

[0021] In the technical solutions provided in some embodiments of the present application, by obtaining multiple first network addresses included in a blacklist and multiple second network addresses included in both the blacklist and the whitelist, the first network address and the second network address are both network addresses that have initiated illegal access within a preset time period, and the confidence of each first network address relative to the blacklist and the confidence of each second network address relative to the blacklist are calculated, and then based on the calculated multiple confidences and the confidence of each second network address relative to the whitelist, the target confidence of each first network address relative to the whitelist is determined, and if there is a target network address among the multiple first network addresses whose target confidence is greater than a preset threshold, the target network address can be deleted from the blacklist. Compared with the technical solution of blindly collecting the network addresses of the attack source and adding them to the blacklist for blocking, the technical solution of the embodiment of the present application determines the target confidence of each first network address relative to the whitelist, and then deletes the target network address whose target confidence is greater than the preset threshold from the blacklist, thereby achieving effective management of the network addresses in the blacklist, not only controlling the magnitude of the network addresses in the blacklist, but also reducing the misblocking rate of the network addresses in the blacklist, so that the impact on normal business can be minimized.

[0022] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0024] Figure 1 A schematic diagram showing an exemplary system architecture to which the technical solution of the embodiments of the present application can be applied;

[0025] Figure 2 A flowchart of a network address management method according to an embodiment of the present application is shown;

[0026] Figure 3 A flowchart of a network address management method according to an embodiment of the present application is shown;

[0027] Figure 4 A flowchart of a network address management method according to an embodiment of the present application is shown;

[0028] Figure 5 A flowchart of a network address management method according to an embodiment of the present application is shown;

[0029] Figure 6 A flowchart of a network address management method according to an embodiment of the present application is shown;

[0030] Figure 7 A flowchart of a network address management method according to an embodiment of the present application is shown;

[0031] Figure 8 A flowchart of a network address management method according to an embodiment of the present application is shown;

[0032] Fig. 9 A flowchart of a network address management method according to an embodiment of the present application is shown;

[0033] Fig.10 A schematic diagram of an original matrix according to an embodiment of the present application is shown;

[0034] Fig.11 A schematic diagram of a first vector matrix according to an embodiment of the present application is shown;

[0035] Fig.12 A schematic diagram of a second vector matrix according to an embodiment of the present application is shown;

[0036] Fig.13 A matrix schematic diagram showing a first network address situation and a second network address situation included in a plurality of blacklists and a whitelist according to an embodiment of the present application is shown;

[0037] Fig.14 A schematic diagram of a confidence matrix according to an embodiment of the present application is shown;

[0038] Fig.15 A schematic diagram of a confidence matrix according to an embodiment of the present application is shown;

[0039] Fig.16 A logic diagram of a network address management method according to an embodiment of the present application is shown;

[0040] Fig.17 A block diagram of a network address management device according to an embodiment of the present application is shown;

[0041] Fig.18 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0042] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of the example embodiments to those skilled in the art.

[0043] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0044] It should be noted that the terms used in the specification and claims of this application and the above-mentioned drawings are only used to describe the embodiments and are not intended to limit the scope of this application. It should be understood that the terms "include", "comprises", "having", etc., when used in this article, specify the existence of the stated features, wholes, steps, operations, elements, components and / or their groups, but do not exclude the existence or addition of one or more of other features, wholes, steps, operations, elements, components and / or their groups.

[0045] It will be further understood that, although the terms "first", "second", "third", etc. may be used to describe various elements in this article, these elements should not be limited by these terms. These terms are only used to distinguish one element from another element. For example, without departing from the scope of the present invention, the first element may be referred to as the second element. Similarly, the second element may be referred to as the first element. As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0046] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0047] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0048] It should be noted that the "multiple" mentioned in this article refers to two or more. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0049] Figure 1 A schematic diagram of an exemplary system architecture to which the technical solution of the embodiments of the present application can be applied is shown.

[0050] like Figure 1 As shown, the system architecture 100 may include an access terminal 101, a switch 102, an intrusion detection system 103, and an accessed terminal 104. The switch 102 and the intrusion detection system 103 are located between the access terminal 101 and the accessed terminal 104, and the switch 102 is connected to the intrusion detection system 103. The switch 102 is used to receive the network traffic of the access terminal 101 and send the network traffic to the intrusion detection system 103 for detection. A blacklist is maintained in the database of the intrusion detection system 103, and the blacklist contains malicious network addresses. The malicious network address is a network address that initiates illegal access. After receiving the network traffic sent by the switch 102, if the intrusion detection system 103 detects that there is malicious traffic other than the malicious network address included in the blacklist in the network traffic, the new malicious network address corresponding to the malicious traffic can be added to the blacklist. By continuously updating the blacklist, the malicious network traffic is blocked to protect the accessed terminal 104 from network attacks.

[0051] The access terminal 101 and the accessed terminal 101 can both be computer devices, which can be composed of a server and a terminal device; the computer device can also be a server with a display function; or the computer device can also be a terminal device, which is not limited here. The terminal device can be an electronic device, including but not limited to a mobile phone, a tablet computer, a desktop computer, a laptop computer, a PDA, and a mobile internet device (MID).

[0052] The network address management method provided in the embodiment of the present application can be executed by the intrusion detection system 103. The database of the intrusion detection system 103 maintains not only a blacklist but also a whitelist.

[0053] In one embodiment of the present application, the intrusion detection system 103 can obtain multiple first network addresses included in the blacklist and multiple second network addresses included in the blacklist and the whitelist, where the first network address and the second network address are network addresses corresponding to illegal access initiated by the access terminal 101 within a preset time period, and then the intrusion detection system 103 can calculate the confidence of each first network address relative to the blacklist and the confidence of each second network address relative to the blacklist. Further, the intrusion detection system 103 can determine the target confidence of each first network address relative to the whitelist based on the calculated multiple confidences and the confidence of each second network address relative to the whitelist. Finally, if there is a target network address among the multiple first network addresses whose target confidence is greater than a preset threshold, the intrusion detection system 103 can delete the target network address from the blacklist.

[0054] It should be understood that Figure 1 The number of access terminals, switches, intrusion detection systems, and accessed terminals is only for illustration. Any number of access terminals, switches, intrusion detection systems, and accessed terminals may be provided as required. For example, the accessed terminal 104 may be a server cluster composed of multiple servers.

[0055] The implementation details of the technical solution of the embodiment of the present application are described in detail below:

[0056] Figure 2 A flowchart of a network address management method according to an embodiment of the present application is shown. The network address management method can be performed by an intrusion detection system. The intrusion detection system can be Figure 1 The intrusion detection system 103 shown in FIG. Figure 2 As shown, the method includes:

[0057] Step S210: acquiring a plurality of first network addresses included in the blacklist and a plurality of second network addresses included in both the blacklist and the whitelist, wherein the first network address and the second network address are network addresses that have initiated illegal access within a preset time period;

[0058] Step S220, calculating the confidence of each first network address relative to the blacklist, and the confidence of each second network address relative to the blacklist;

[0059] Step S230: determining a target confidence level of each first network address relative to the white list according to the calculated multiple confidence levels and the confidence level of each second network address relative to the white list;

[0060] Step S240: If there is a target network address whose target confidence is greater than a preset threshold among the multiple first network addresses, the target network address is deleted from the blacklist.

[0061] These steps are described in detail below.

[0062] In step S210, a plurality of first network addresses included in the blacklist and a plurality of second network addresses included in both the blacklist and the whitelist are obtained, wherein the first network address and the second network address are network addresses that have initiated illegal access within a preset time period.

[0063] In the specific implementation, multiple first network addresses included in the blacklist and multiple second network addresses included in the blacklist and the whitelist are obtained in advance, and the first network address and the second network address are network addresses that have initiated illegal access within a preset time period. Among them, illegal access refers to illegal users intending to use the Internet to steal other people's information or property, and using some malicious websites to publish false advertisements. These behaviors will pose a great threat to the personal information and economic property of users who normally use the Internet.

[0064] In order to obtain the first network address and the second network address, in this embodiment, the network traffic within a preset time period can be detected by an intrusion detection system. The preset time period can be set according to actual conditions, for example, the preset time period is set to 15 days.

[0065] Through the detection of network traffic, a set of network addresses Ls that have not initiated illegal access within a preset time period, a set of network addresses La that have initiated illegal access, and a set of network addresses Lw that are always unblockable are obtained, wherein the network addresses that are always unblockable may be, for example, test network addresses of network scenarios, content distribution network addresses, etc. Then, the intrusion detection system may add the network addresses in the network address set La to the blacklist list, and add the network addresses in the network address set Lw to the whitelist list.

[0066] It is worth mentioning that since the detection of malicious traffic by the intrusion detection system cannot be guaranteed to be completely accurate, some network addresses that are always unblockable may be added to the blacklist due to false detection, and some network addresses in the whitelist may indeed have illegal access behaviors. Therefore, in this case, the network address set La and the network address set Lw may have overlapping parts. For the convenience of description, the overlapping parts are recorded as the network address set Lt.

[0067] In this embodiment, the set obtained by subtracting the network address set Lt from the network address set La is the set of multiple first network addresses included in the blacklist, and the network address set Lt is the set of multiple second network addresses commonly included in the blacklist and the whitelist, so that the multiple first network addresses included in the blacklist and the multiple second network addresses commonly included in the blacklist and the whitelist can be obtained.

[0068] In step S220, the confidence level of each first network address relative to the blacklist and the confidence level of each second network address relative to the blacklist are calculated.

[0069] Confidence can be used to indicate the degree of confidence that a sample belongs to a certain category. The degree of confidence is usually expressed by the probability that a sample belongs to a certain category. The higher the probability, the greater the confidence that the sample belongs to a certain category.

[0070] Specifically in this embodiment, since each first network address included in the blacklist refers to a network address that has initiated illegal access within a preset time period, but since the intrusion detection system may not detect accurately, each first network address may be blocked by mistake. Therefore, the confidence of each first network address relative to the blacklist can be understood as the degree of credibility that each first network address has initiated illegal access within the preset time period. The higher the credibility, the smaller the possibility that each first network address is blocked by mistake.

[0071] Each second network address is included in both the whitelist and the blacklist, that is, each second network address is not only a network address that cannot be blocked, but also a network address detected by the intrusion detection system as having initiated illegal access within a preset time period. Therefore, the confidence level of each second network address relative to the blacklist can be understood as the degree of credibility of each second network address in initiating illegal access within the preset time period.

[0072] In step S230, a target confidence level of each first network address relative to the white list is determined according to the calculated multiple confidence levels and the confidence level of each second network address relative to the white list.

[0073] Since the whitelist is a collection of network addresses that are always unblockable, the confidence of each second network address relative to the whitelist can be understood as the degree of trust that each second network address belongs to the network addresses that are always unblockable. At the same time, since the whitelist contains each second network address, and only the network addresses that are always unblockable are added to the whitelist, it means that each second network address is indeed a network address that is always unblockable. Therefore, when the confidence value range is set to (0,1], it can be directly concluded that the confidence of each second network address relative to the whitelist is 1.

[0074] It is easy to understand that since the blacklist includes the first network address and the second network address, and the whitelist includes the second network address, it is possible to directly determine the confidence of each first network address relative to the blacklist, the confidence of each second network address relative to the blacklist, and the confidence of each second network address relative to the whitelist.

[0075] However, the whitelist does not include each first network address, that is, the confidence of each first network address relative to the whitelist cannot be directly determined. Therefore, in an embodiment, the target confidence of each first network address relative to the whitelist can be determined based on multiple known confidences, that is, the target confidence of each first network address relative to the whitelist can be determined based on the confidence of each first network address relative to the blacklist, the confidence of each second network address relative to the blacklist, and the confidence of each second network address relative to the whitelist.

[0076] The target confidence of each first network address relative to the whitelist can be understood as the degree of credibility of each first network address as a network address that cannot be blocked.

[0077] In step S240, if there is a target network address with a target confidence greater than a preset threshold among the multiple first network addresses, the target network address is deleted from the blacklist.

[0078] Since the confidence of each first network address relative to the blacklist is the degree of trust that each first network address has initiated illegal access within a preset time period, the higher the degree of trust, the less likely each first network address is to be blocked by mistake. However, in this embodiment, it is not directly and simply based on the confidence of each first network address relative to the blacklist to determine whether each first network address is blocked by mistake, but based on the calculated multiple confidences and the confidence of each second network address relative to the whitelist, the target confidence of each first network address relative to the whitelist is further determined, and then, by comparing the target confidence with the preset threshold, it is determined whether there is a target network address that is blocked by mistake among the multiple first network addresses.

[0079] Specifically, if there is a target network address with a target confidence greater than a preset threshold among the multiple first network addresses, it means that the target network address is a wrongly blocked network address, and thus it is directly deleted from the blacklist. The preset threshold can be set according to actual conditions.

[0080] Based on the technical solution of the above embodiment, by calculating the confidence of each first network address relative to the blacklist and the confidence of each second network address relative to the blacklist, and then according to the calculated multiple confidences and the confidence of each second network address relative to the whitelist, the target confidence of each first network address relative to the whitelist is determined, and then the target network address with a target confidence greater than a preset threshold can be deleted from the blacklist. Compared with the technical solution of blindly collecting the attack source network address and adding it to the blacklist for blocking, the technical solution of the embodiment of the present application determines the target confidence of each first network address relative to the whitelist, and then deletes the target network address with a target confidence greater than the preset threshold from the blacklist, thereby achieving effective management of the network addresses in the blacklist, not only controlling the magnitude of the network addresses in the blacklist, but also reducing the misblocking rate of the network addresses in the blacklist, so that the impact on normal business can be minimized.

[0081] In one embodiment of the present application, Figure 3 As shown, step S220 may specifically include steps S310 to S320, which are described in detail as follows:

[0082] Step S310: Obtain a first time when each first network address was last deleted from the blacklist and a second time when each second network address was last deleted from the blacklist.

[0083] It is easy to understand that, considering the possibility of mistaken blocking, the blacklist in the embodiment of the present application is constantly updated, and the update means that network addresses will be deleted from the blacklist, and may even be deleted multiple times.

[0084] In this embodiment, in order to calculate the confidence level, the first time when each first network address was last deleted from the blacklist and the second time when each second network address was last deleted from the blacklist may be acquired in advance.

[0085] Step S320: Calculate the confidence of each first network address relative to the blacklist according to the current calculation time and the first time, and calculate the confidence of each second network address relative to the blacklist according to the current calculation time and the second time.

[0086] After obtaining the first time and the second time, the confidence of each first network address relative to the blacklist can be calculated based on the current calculation time and the first time, and the confidence of each second network address relative to the blacklist can be calculated based on the current calculation time and the second time.

[0087] Specifically, the confidence level T(a) of each first network address relative to the blacklist can be calculated by the following formula: i ,B), and the confidence T(a) of each second network address relative to the blacklist is calculated by the following formula 2: j ,B):

[0088]

[0089]

[0090] Where t represents the current calculation time, t di Indicates the first time each first network address was last deleted from the blacklist, t dj represents the second time when each second network address was last deleted from the blacklist, and K represents a constant.

[0091] In one embodiment of the present application, Figure 4 As shown, determining the target confidence of each first network address relative to the whitelist list may specifically include steps S410 to S420, which are described in detail as follows:

[0092] Step S410: Determine a first similarity between the blacklist and the whitelist according to the calculated multiple confidences and the confidence of each second network address relative to the whitelist.

[0093] In order to determine the target confidence of each first network address relative to the whitelist, after calculating multiple confidences, the first similarity between the blacklist and the whitelist can be determined in advance based on the calculated multiple confidences and the confidence of each second network address relative to the whitelist.

[0094] In one embodiment of the present application, Figure 5 As shown, the method for determining the first similarity can be implemented through steps S510 to S530, which are described in detail as follows:

[0095] Step S510: Generate a first vector corresponding to the blacklist according to the confidence of each first network address relative to the blacklist and the confidence of each second network address relative to the blacklist.

[0096] In this embodiment, according to the confidence of each first network address relative to the blacklist, and the confidence of each second network address relative to the blacklist, a first vector corresponding to the blacklist can be generated. The elements in the first vector are the confidence of each first network address relative to the blacklist, and the confidence of each second network address relative to the blacklist, and the number of elements in the first vector is the number of confidences.

[0097] For example, assuming that the confidences of the first network addresses A, B, and C relative to the blacklist are A1, B1, and C1 respectively, and the confidences of the second network addresses D and E relative to the blacklist are D1 and E1 respectively, the first vector corresponding to the generated blacklist can be expressed as (A1, B1, C1, D1, E1).

[0098] Step S520: Generate a second vector corresponding to the white list according to the confidence of each second network address relative to the white list.

[0099] Similarly, according to the confidence of each second network address relative to the white list, a second vector corresponding to the white list can be generated. The elements in the second vector are the confidence of each first network address relative to the white list, and the confidence of each second network address relative to the white list, and the number of elements in the first vector is the number of confidences.

[0100] It should be noted that the confidence of each first network address relative to the whitelist is different from the target confidence of each first network address relative to the whitelist. The target confidence of each first network address relative to the whitelist is determined based on the confidence of each first network address relative to the blacklist, the confidence of each second network address relative to the blacklist, and the confidence of each second network address relative to the whitelist. Since the whitelist does not include each first network address, the confidence of each first network address relative to the whitelist is blank. When representing the first vector, 0 can be used to directly represent the confidence of each first network address relative to the whitelist.

[0101] Continuing with the example in step S510 , assuming that the confidences of the second network addresses D and E relative to the whitelist are D2 and E2 respectively, the second vector corresponding to the generated whitelist can be expressed as (0, 0, 0, D2, E2).

[0102] Step S530: Calculate the cosine similarity between the first vector and the second vector, and use the calculated cosine similarity as the first similarity between the blacklist and the whitelist.

[0103] After generating the first vector corresponding to the blacklist and the second vector corresponding to the whitelist, the cosine similarity between the first vector and the second vector may be calculated, and the calculated cosine similarity may be used as the first similarity between the blacklist and the whitelist.

[0104] Continue to see Figure 4 In step S420, a target confidence level of each first network address relative to the white list is determined based on the first similarity and the confidence level of each first network address relative to the black list.

[0105] Specifically, after calculating the first similarity between the blacklist and the whitelist, the target confidence of each first network address relative to the whitelist may be determined according to the first similarity and the confidence of each first network address relative to the blacklist.

[0106] The greater the first similarity between the blacklist and the whitelist, the closer the confidence of each first network address relative to the blacklist and the target confidence of each first network address relative to the whitelist will be.

[0107] In one embodiment of the present application, based on the first similarity and the confidence of each first network address relative to the blacklist, determining the target confidence of each first network address relative to the whitelist can specifically be performed by calculating the product between the first similarity and the confidence of each first network address relative to the blacklist, and then using the calculated product as the target confidence of each first network address relative to the whitelist.

[0108] In another embodiment of the present application, Figure 6 As shown, determining the target confidence of each first network address relative to the whitelist list may specifically include steps S610 to S620, which are described in detail as follows:

[0109] Step S610: Generate a first vector matrix and a second vector matrix based on the calculated multiple confidences and the confidence of each second network address relative to the whitelist, wherein the first vector matrix contains vectors corresponding to each first network address, and the second vector matrix contains vectors corresponding to the whitelist.

[0110] In this embodiment, since the confidence of each first network address relative to the blacklist, the confidence of each second network address relative to the blacklist, and the confidence of each second network address relative to the whitelist are all known, the first vector matrix and the second vector matrix can be generated based on the known multiple confidences.

[0111] The generated first vector matrix is ​​composed of vectors corresponding to each first network address and vectors corresponding to each second network address, and the generated second vector matrix is ​​composed of vectors corresponding to the blacklist and vectors corresponding to the whitelist.

[0112] For ease of description and understanding, if the first vector matrix is ​​represented by R1 (u1×v1), then u1 represents the sum of the number of first network addresses and the number of second network addresses, v1 represents the number of elements in the vector corresponding to the network address, wherein the number of elements in the vector corresponding to each first network address is the same as the number of elements in the vector corresponding to each second network address, and the elements in the vector corresponding to the network address can be determined based on the confidence level. If the second vector matrix is ​​represented by R2 (u2×v2), then u2 represents the number of elements in the vector corresponding to the list, wherein the number of elements in the vector corresponding to the blacklist is the same as the number of elements in the vector corresponding to the whitelist, and the elements in the list can also be determined based on the confidence level. v2 represents the number of list lists, including the blacklist and the whitelist, that is, v2=2.

[0113] In one embodiment of the present application, Figure 7 As shown, step S610 may specifically include:

[0114] Step S710: construct an original matrix according to the calculated multiple confidences and the confidence of each second network address relative to the whitelist;

[0115] Step S720: Perform singular value decomposition on the original matrix to generate a first vector matrix and a second vector matrix.

[0116] These steps are described in detail below:

[0117] In step S710, an original matrix is ​​constructed based on the calculated multiple confidences and the confidence of each second network address relative to the white list.

[0118] Specifically, according to the confidence of each first network address relative to the blacklist, the confidence of each second network address relative to the blacklist, and the confidence of each second network address relative to the whitelist, the original matrix R(u×v) can be constructed, wherein u is the number of network addresses, i.e., the sum of the number of first network addresses and the number of second network addresses, and v is the number of lists, including the blacklist and the whitelist, i.e., v=2.

[0119] Fig.10 A schematic diagram of an original matrix is ​​shown, where a1, a2…a m-1 、a m is the first network address, a m+1 …a m+p is the second network address, B represents the blacklist, and W represents the whitelist. m-1 、a m The confidence relative to the blacklist B is represented by the corresponding confidence. For example, the confidence of the first network address a1 relative to the blacklist B is represented by T(a1,B), and the confidence of the second network address a1 relative to the blacklist B is represented by T(a1,B). m+1 …a m+p The confidence level relative to the blacklist B is also expressed by the corresponding confidence level. For example, the first network address a m+1 The confidence relative to the blacklist B is expressed as T(a m+1 ,B). Since the first network addresses a1, a2…a m-1 、a m is not in the whitelist W, so there is no corresponding confidence level, so “ / ” is used to indicate that there is no corresponding confidence level. m+1 ....a m+p The network address is always unblockable. Therefore, when the confidence value range is set to (0,1], each second network address a m+1....a m+p The confidence level relative to the whitelist W is 1.

[0120] In step S720, singular value decomposition is performed on the original matrix to generate a first vector matrix and a second vector matrix.

[0121] Among them, singular value decomposition (SVD) is an important matrix decomposition in linear algebra, which can be used to decompose the matrix. The following is a brief introduction to the singular value decomposition method:

[0122] For the matrix R(u×v), through singular value decomposition, the matrix R(u×v) can be decomposed into three matrices, which can be expressed as R=UΣV T , where U is a left singular matrix, U is a u×u matrix, and the column vectors of U are u1, u2, ...u u is the left singular vector of the matrix R, Σ is a u×v matrix, and the diagonal elements σ1, σ2, ...σ r are the singular values ​​of the matrix R, and are arranged in descending order. V is the right singular value matrix. V is a v×v matrix. The column vectors of V are v1, v2, ...v v is the left singular vector of the matrix R, and T represents the transpose.

[0123] Specifically in this embodiment, after the original matrix R(u×v) is constructed through step S720, the original matrix R(u×v) can be decomposed into three matrices through singular value decomposition. Here, the three matrices are still U, Σ and V respectively.

[0124] Further, the first t singular values ​​of the matrix R are selected, and the diagonal matrix Σt×t=diag[σ1,σ2...σ t ], and then the left and right singular vectors corresponding to the first t singular values ​​are reconstructed into matrices U' and V', where U' is a u×t matrix and V' is a v×t matrix. Finally, the reconstructed matrix U' is used as the first vector matrix, the first vector matrix is ​​a u×t matrix, and the reconstructed matrix V' is used as the second vector matrix, the second vector matrix is ​​a v×t matrix.

[0125] See also Fig.11 and Fig.12 , schematically showing the first vector matrix and the second vector matrix respectively. In the first vector matrix, the vector corresponding to the first network address a1 is (x1, y1), the vector corresponding to the first network address a2 is (x2, y2), and the vector corresponding to the first network address a m-1 The corresponding vector is (x m-1 ,ym-1 ), first network address a m The corresponding vector is (x m ,y m ), first network address a m+1 The corresponding vector is (x m+1 ,y m+1 ), first network address a m+p The corresponding vector is (x m+p ,y m+p ). In the second vector matrix, the vector corresponding to the blacklist is (p1, q1), and the vector corresponding to the whitelist is (p2, q2).

[0126] Continue to see Figure 6 , step S620, generating a target confidence of each first network address relative to the white list according to the vector corresponding to each first network address and the vector corresponding to the white list.

[0127] Specifically, after obtaining the first vector matrix and the second vector matrix, the target confidence of each first network address relative to the whitelist list can be calculated based on the vectors corresponding to each first network address contained in the first vector matrix and the vectors corresponding to the whitelist list contained in the second vector matrix.

[0128] For example, assuming that the vector corresponding to each first network address is (1.40, -1.18) and the vector corresponding to the whitelist is (2.19, 0.73), the target confidence of each first network address relative to the whitelist can be calculated by multiplying the two vectors, that is, 1.40×(-1.18)+2.19×0.73=2.21.

[0129] In one embodiment of the present application, since illegal access can be of various types, such as DOS attacks, phishing attacks, etc., a DOS (Denial of Service) attack refers to an attack that causes DOS, the purpose of which is to make the target computer unable to provide normal services, and a phishing attack refers to a criminal fraud process that attempts to obtain personal sensitive information such as user names, passwords, and credit card details from electronic communications by disguising as a reputable legal media.

[0130] Therefore, in this embodiment, different illegal access types may have corresponding blacklists. Each blacklist contains at least one first network address, and multiple blacklists and whitelists contain at least one second network address. The first network address is the network address that has initiated illegal access of the illegal access type corresponding to the blacklist where the first network address is located within a preset time period, and the second network address is the network address that has initiated illegal access of the illegal access type corresponding to the blacklist where the second network address is located within a preset time period.

[0131] See also Fig.13 , Fig.13 A schematic diagram of a matrix showing a first network address and a second network address included in a plurality of blacklists and whitelists is shown. In the matrix, "1" indicates that the corresponding list includes the corresponding network address. n-1 is a blacklist, n is a positive integer greater than 2, W is a whitelist, a1, a2....a m-1 ,a m is the first network address, a m+1 ....a m+p For multiple blacklists B1, B2...B n-1 The second network address included together with the whitelist W, m is a positive integer greater than 2, and p is a positive integer greater than 1.

[0132] The first network address a1 is an illegal access of the illegal access type corresponding to the blacklist B1, the illegal access of the illegal access type corresponding to the blacklist B2, and the illegal access of the blacklist B1 within the preset time period. n The first network address a2 is the network address of the illegal access corresponding to the illegal access type of the blacklist list B2 initiated within the preset time period and the blacklist list B n-1 The network address of the illegal access of the corresponding illegal access type, the first network address a m-1 The first network address a is a network address that has initiated illegal access of the illegal access type corresponding to the blacklist B1 within a preset time period. m The illegal access type corresponding to the blacklist list B1 and the blacklist list B1 have been initiated within the preset time period. n The network address of the illegal access corresponding to the illegal access type. The second network address a m+1 Blacklist list B is initiated within the preset time period n The network address of the illegal access corresponding to the illegal access type, the second network address a m+pThe illegal access corresponding to the illegal access type in blacklist B2 and the illegal access type in blacklist B2 have been initiated within the preset time period. n The network address of the illegal access corresponding to the illegal access type.

[0133] In this embodiment, calculating the confidence of each first network address relative to the blacklist and the confidence of each second network address relative to the blacklist may specifically include: calculating the confidence of each first network address relative to the blacklist in which each first network address is located, and the confidence of each second network address relative to the blacklist in which each second network address is located.

[0134] Fig.14 Shown for Fig.13 A schematic diagram of the result of calculating the corresponding confidences of the multiple first network addresses and the multiple second network addresses in FIG. Fig.14 As shown, for each first network address a1, a2, ...a m-1 ,a m , the confidence of each first network address relative to the blacklist list where each first network address is located can be calculated. For example, since the blacklist list where the first network address a1 is located includes B1, B2 and B n Therefore, the confidence T(a1, B1) of the first network address a1 relative to the blacklist B1, the confidence T(a1, B2) of the first network address a1 relative to the blacklist B2, and the confidence T(a1, B2) of the first network address a1 relative to the blacklist B n The confidence level T(a1,B n ).

[0135] For each second network address a m+1 ....a m+p , the confidence of each second network address relative to the blacklist list where each second network address is located can be calculated. For example, since the second network address a m+p The blacklists include B2 and B n , therefore, the second network address a can be calculated m+p The confidence T(a) relative to the blacklist B2 m+p ,B2), the second network address a m+p Relative to blacklist B n The confidence level T(a m+p ,B n ).

[0136] If the corresponding network address is not in the corresponding list, the confidence is represented by " / ". m+1 ....a m+pThe network address is always unblockable. Therefore, when the confidence value range is set to (0,1], each second network address a m+1 ....a m+p The confidence level relative to the whitelist W is 1.

[0137] In one embodiment of the present application, Figure 8 As shown, in the case where the blacklist contains multiple addresses, determining the target confidence of each first network address relative to the whitelist may specifically include:

[0138] Step S810: determining a second similarity between each blacklist and the whitelist according to the calculated multiple confidences and the confidence of each second network address relative to the whitelist;

[0139] Step S820: Determine a target confidence level of each first network address relative to the white list based on the determined multiple second similarities and the confidence level of each first network address relative to the black list where the first network address is located.

[0140] These steps are described in detail below:

[0141] In step S810, a second similarity between each blacklist and the whitelist is determined according to the calculated multiple confidences and the confidence of each second network address relative to the whitelist.

[0142] In this embodiment, in order to determine the target confidence of each first network address relative to the whitelist, after calculating the confidence of each first network address relative to the blacklist where each first network address is located, and the confidence of each second network address relative to the blacklist where each second network address is located, the second similarity between each blacklist and the whitelist can be pre-determined based on the calculated multiple confidences and the confidence of each second network address relative to the whitelist.

[0143] In some embodiments, a method for determining the second similarity between each blacklist and the whitelist may be that, for the second similarity between any blacklist and the whitelist, first, a first target vector corresponding to the blacklist may be generated based on the confidence of each first network address and each second network address relative to the blacklist, and then, a second target vector corresponding to the whitelist may be generated based on the confidence of each first network address and each second network address relative to the whitelist, and then the cosine similarity between the first target vector and the second target vector may be calculated, thereby using the calculated cosine similarity as the similarity between the blacklist and the whitelist.

[0144] In step S820, a target confidence level of each first network address relative to the white list is determined based on the determined multiple second similarities and the confidence level of each first network address relative to the black list where the first network address is located.

[0145] Specifically, after determining the second similarities between each blacklist and the whitelist, the target confidence of each first network address relative to the whitelist can be determined based on the determined multiple second similarities and the confidence of each first network address relative to the blacklist in which the first network address is located.

[0146] In one embodiment of the present application, based on the determined multiple second similarities and the confidence of each first network address relative to the blacklist list where each first network address is located, determining the target confidence of each first network address relative to the whitelist list can specifically include: first, based on the determined multiple second similarities, performing weighted averaging processing on the confidence of each first network address relative to the blacklist list where each first network address is located to obtain the weighted average value corresponding to each first network address, and then using the weighted average value corresponding to each first network address as the target confidence of each first network address relative to the whitelist list.

[0147] For example, assuming that the second similarity between the blacklist B1 and the whitelist W is S1, the second similarity between the blacklist B2 and the whitelist W is S2, the second similarity between the blacklist B3 and the whitelist W is S3, and the first network address a1 is in the blacklists B1 and B2, the confidence of the first network address a1 relative to the blacklist B1 is calculated to be T(a1, B1), and the confidence of the first network address a1 relative to the blacklist B2 is T(a1, B2). Then, through weighted average processing, the weighted average value corresponding to the first network address a1 can be obtained as (S1×T(a1, B1)+S2×T(a1, B2)+S3×0) / 3, that is, the target confidence of the first network address a1 relative to the whitelist W is (S1×T(a1, B1)+S2×T(a1, B2)+S3×0) / 3.

[0148] In another embodiment of the present application, Fig. 9 As shown, according to the determined multiple second similarities and the confidence of each first network address relative to the blacklist list where each first network address is located, determining the target confidence of each first network address relative to the whitelist list can specifically include steps S910-step S920, which are now described in detail as follows:

[0149] Step S910: According to the determined multiple second similarities, a blacklist list having a second similarity exceeding a similarity threshold is selected from multiple blacklist lists as a candidate blacklist list.

[0150] In this embodiment, after determining the second similarity between each blacklist and the whitelist, a blacklist whose second similarity exceeds a similarity threshold may be first selected from the plurality of blacklists as a candidate blacklist.

[0151] It is understandable that the similarity between the candidate blacklist and the whitelist is higher than that of the non-candidate blacklist, and the higher the similarity, the closer the confidence of each first network address relative to the candidate blacklist and the confidence of each first network address relative to the whitelist. Therefore, in order to more accurately determine the target confidence of each first network address relative to the whitelist, the candidate blacklist with higher similarity can be directly selected and determined based on the candidate blacklist.

[0152] Step S920: Determine a target confidence level of each first network address relative to the white list based on the second similarity between the candidate black list and the white list and the confidence level of each first network address relative to the candidate black list.

[0153] It should be noted that each first network address has confidence only relative to the blacklist where the first network address is located. Therefore, if the candidate blacklist is the blacklist where the first network address is located, the confidence of the first network address relative to the candidate blacklist is the confidence of the first network address relative to the blacklist where the first network address is located. On the contrary, if the candidate blacklist is not the blacklist where the first network address is located, the confidence of the first network address relative to the candidate blacklist is 0.

[0154] In some embodiments, based on the second similarity between the candidate blacklist and the whitelist, and the confidence of each first network address relative to the candidate blacklist, determining the target confidence of each first network address relative to the whitelist may specifically include: based on the second similarity between the candidate blacklist and the whitelist, performing weighted averaging processing on the confidence of each first network address relative to the candidate blacklist to obtain the weighted average value corresponding to each first network address, and then using the weighted average value corresponding to each first network address as the target confidence of each first network address relative to the whitelist.

[0155] It should also be noted that, based on the calculated multiple confidences and the confidence of each second network address relative to the whitelist, not only the target confidence of each first network address relative to the whitelist can be determined, but also the confidence of each first network address relative to each blacklist, and the confidence of each second network address relative to each blacklist and whitelist. For details, please refer to Fig.14 and Fig.15 , in calculating Fig.14 In the case of the confidence results shown in FIG. 1 , the following can be further determined based on these known confidences: Fig.15 Confidence results shown.

[0156] Fig.16 A logic diagram of a network address management method according to an embodiment of the present application is shown. In this embodiment, the network address management method may specifically include:

[0157] S1. Obtain multiple first network addresses a included in the blacklist i , and a plurality of second network addresses a included in both the blacklist and the whitelist j The first network address and the second network address are network addresses that have initiated illegal access within a preset time period.

[0158] S2. Calculate each first network address a i The confidence T(a) relative to the blacklist B i , B) and each second network address a j The confidence T(a) relative to the blacklist B j ,B).

[0159] S3, based on the calculated multiple confidence levels T(a i ,B),T(a j , B) and each second network address a j The confidence T(a) relative to the whitelist W j ,W), determine each first network address a i The target confidence T(a) relative to the whitelist W i ,W).

[0160] S4. If there is a target confidence level T(a i ,W) is greater than the preset threshold ε of the target network address, the target network address is deleted from the blacklist to obtain an updated blacklist. Wherein, the above steps S1-S4 can be executed regularly, so as to complete the regular update of the blacklist.

[0161] The following describes an apparatus embodiment of the present application, which can be used to execute the network address management method in the above-mentioned embodiment of the present application. For details not disclosed in the apparatus embodiment of the present application, please refer to the above-mentioned embodiment of the network address management method of the present application.

[0162] Fig.17 A block diagram of a network address management device according to an embodiment of the present application is shown. Fig.17 As shown, a network address management device 1700 according to an embodiment of the present application includes: an acquisition unit 1702 , a calculation unit 1704 , a determination unit 1706 and a deletion unit 1708 .

[0163] Among them, the acquisition unit 1702 is configured to acquire multiple first network addresses included in the blacklist and multiple second network addresses included in the blacklist and the whitelist, the first network address and the second network address are network addresses that have initiated illegal access within a preset time period; the calculation unit 1704 is configured to calculate the confidence of each first network address relative to the blacklist and the confidence of each second network address relative to the blacklist; the determination unit 1706 is configured to determine the target confidence of each first network address relative to the whitelist based on the calculated multiple confidences and the confidence of each second network address relative to the whitelist; the deletion unit 1708 is configured to delete the target network address from the blacklist if there is a target network address among the multiple first network addresses whose target confidence is greater than a preset threshold.

[0164] In some embodiments of the present application, the calculation unit 1704 is configured to: obtain the first time when each of the first network addresses was last deleted from the blacklist and the second time when each of the second network addresses was last deleted from the blacklist; calculate the confidence of each of the first network addresses relative to the blacklist based on the current calculation time and the first time, and calculate the confidence of each of the second network addresses relative to the blacklist based on the current calculation time and the second time.

[0165] In some embodiments of the present application, the determination unit 1706 includes: a first similarity determination subunit, configured to determine the first similarity between the blacklist and the whitelist based on the calculated multiple confidences and the confidence of each second network address relative to the whitelist; a first confidence determination subunit, configured to determine the target confidence of each first network address relative to the whitelist based on the first similarity and the confidence of each first network address relative to the blacklist.

[0166] In some embodiments of the present application, the first similarity determination subunit is configured to generate a first vector corresponding to the blacklist based on the confidence of each first network address relative to the blacklist and the confidence of each second network address relative to the blacklist; generate a second vector corresponding to the whitelist based on the confidence of each second network address relative to the whitelist; calculate the cosine similarity between the first vector and the second vector, and use the calculated cosine similarity as the first similarity between the blacklist and the whitelist.

[0167] In some embodiments of the present application, the first confidence determination subunit is configured to calculate the product of the first similarity and the confidence of each first network address relative to the blacklist, and use the calculated product as the target confidence of each first network address relative to the whitelist.

[0168] In some embodiments of the present application, the determination unit 1706 includes: a vector matrix generation subunit, configured to generate a first vector matrix and a second vector matrix based on the calculated multiple confidences and the confidences of the respective second network addresses relative to the whitelist, the first vector matrix containing vectors corresponding to the respective first network addresses, and the second vector matrix containing vectors corresponding to the whitelist; a confidence generation subunit, configured to generate target confidences of the respective first network addresses relative to the whitelist based on the vectors corresponding to the respective first network addresses and the vectors corresponding to the whitelist.

[0169] In some embodiments of the present application, the vector matrix generation subunit is configured to: construct an original matrix based on the calculated multiple confidences and the confidences of the respective second network addresses relative to the whitelist list; perform singular value decomposition processing on the original matrix to generate the first vector matrix and the second vector matrix.

[0170] In some embodiments of the present application, the blacklist includes multiple lists, each blacklist corresponds to a different illegal access type, each blacklist includes at least one first network address, and the multiple blacklists and the whitelist together include at least one second network address; the calculation unit is configured to: calculate the confidence of each first network address relative to the blacklist where the each first network address is located, and the confidence of each second network address relative to the blacklist where the each second network address is located.

[0171] In some embodiments of the present application, the determination unit 1706 includes: a second similarity determination subunit, configured to determine the second similarity between each blacklist and the whitelist based on the calculated multiple confidences and the confidence of each second network address relative to the whitelist; a second confidence determination subunit, configured to determine the target confidence of each first network address relative to the whitelist based on the determined multiple second similarities and the confidence of each first network address relative to the blacklist in which the each first network address is located.

[0172] In some embodiments of the present application, the second confidence determination subunit is configured as: based on the determined multiple second similarities, performing weighted averaging processing on the confidence of each first network address relative to the blacklist list in which the each first network address is located, to obtain the weighted average value corresponding to the each first network address; and using the weighted average value corresponding to the each first network address as the target confidence of the each first network address relative to the whitelist list.

[0173] In some embodiments of the present application, the second confidence determination subunit is configured to: select a blacklist list whose second similarity exceeds a similarity threshold from the multiple blacklist lists as a candidate blacklist list based on the determined multiple second similarities; determine a target confidence of each first network address relative to the whitelist list based on the second similarity between the candidate blacklist list and the whitelist list, and the confidence of each first network address relative to the candidate blacklist list.

[0174] In some embodiments of the present application, the second confidence determination subunit is further configured to: perform weighted averaging processing on the confidence of each first network address relative to the candidate blacklist list according to the second similarity between the candidate blacklist list and the whitelist list, to obtain the weighted average value corresponding to each first network address; and use the weighted average value corresponding to each first network address as the target confidence of each first network address relative to the whitelist list.

[0175] Fig.18 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown.

[0176] It should be noted that Fig.18 The computer system 1800 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0177] like Fig.18As shown, the computer system 1800 includes a central processing unit (CPU) 1801, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 1802 or the program loaded from the storage part 1808 to the random access memory (RAM) 1803, such as executing the method described in the above embodiment. In RAM 1803, various programs and data required for system operation are also stored. CPU 1801, ROM 1802 and RAM 1803 are connected to each other through bus 1804. Input / output (I / O) interface 1805 is also connected to bus 1804.

[0178] The following components are connected to the I / O interface 1805: an input section 1806 including a keyboard, a mouse, etc.; an output section 1807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1808 including a hard disk, etc.; and a communication section 1809 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1809 performs communication processing via a network such as the Internet. A drive 1810 is also connected to the I / O interface 1805 as needed. A removable medium 1811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1810 as needed so that a computer program read therefrom is installed into the storage section 1808 as needed.

[0179] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 1809, and / or installed from a removable medium 1811. When the computer program is executed by a central processing unit (CPU) 1801, various functions defined in the system of the present application are executed.

[0180] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0181] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0182] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0183] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the above embodiment.

[0184] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0185] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0186] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the embodiments disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

[0187] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A network address management method, characterized in that: The method comprises: Acquire multiple first network addresses included in the blacklist, and multiple second network addresses included in both the blacklist and the whitelist, wherein the first network addresses and the second network addresses are network addresses that have initiated illegal access within a preset time period; Calculating the confidence of each first network address relative to the blacklist and the confidence of each second network address relative to the blacklist; Determining a target confidence level of each of the first network addresses relative to the white list according to the calculated multiple confidence levels and the confidence levels of each of the second network addresses relative to the white list; If there is a target network address whose target confidence is greater than a preset threshold among the multiple first network addresses, deleting the target network address from the blacklist to update the blacklist; Calculating the confidence of each first network address relative to the blacklist and the confidence of each second network address relative to the blacklist, including: According to the update of the blacklist, obtaining the first time when each first network address was last deleted from the blacklist and the second time when each second network address was last deleted from the blacklist; The confidence of each first network address relative to the blacklist is calculated according to the current calculation time and the first time, and the confidence of each second network address relative to the blacklist is calculated according to the current calculation time and the second time.

2. The method according to claim 1, characterized in that Determining a target confidence level of each of the first network addresses relative to the white list according to the calculated multiple confidence levels and the confidence levels of each of the second network addresses relative to the white list includes: Determining a first similarity between the blacklist and the whitelist according to the calculated multiple confidences and the confidences of the respective second network addresses relative to the whitelist; According to the first similarity and the confidence of each first network address relative to the blacklist, a target confidence of each first network address relative to the whitelist is determined.

3. The method according to claim 2, characterized in that Determining a first similarity between the blacklist and the whitelist according to the calculated multiple confidences and the confidences of the respective second network addresses relative to the whitelist includes: Generate a first vector corresponding to the blacklist according to the confidence of each first network address relative to the blacklist and the confidence of each second network address relative to the blacklist; Generate a second vector corresponding to the white list according to the confidence of each second network address relative to the white list; The cosine similarity between the first vector and the second vector is calculated, and the calculated cosine similarity is used as the first similarity between the blacklist and the whitelist.

4. The method according to claim 2, characterized in that: Determining, according to the first similarity and the confidence of each first network address relative to the blacklist, a target confidence of each first network address relative to the whitelist, including: The product of the first similarity and the confidence of each first network address relative to the blacklist is calculated, and the calculated product is used as the target confidence of each first network address relative to the whitelist.

5. The method according to claim 1, characterized in that Determining a target confidence level of each of the first network addresses relative to the white list according to the calculated multiple confidence levels and the confidence levels of each of the second network addresses relative to the white list includes: Generate a first vector matrix and a second vector matrix according to the calculated multiple confidences and the confidences of the respective second network addresses relative to the whitelist, wherein the first vector matrix includes vectors corresponding to the respective first network addresses, and the second vector matrix includes vectors corresponding to the whitelist; According to the vectors corresponding to the respective first network addresses and the vectors corresponding to the white list, a target confidence of the respective first network addresses relative to the white list is generated.

6. The method according to claim 5, characterized in that Generating a first vector matrix and a second vector matrix according to the calculated multiple confidences and the confidences of the respective second network addresses relative to the whitelist, including: Constructing an original matrix according to the calculated multiple confidences and the confidences of the respective second network addresses relative to the whitelist; Perform singular value decomposition processing on the original matrix to generate the first vector matrix and the second vector matrix.

7. The method according to claim 1, characterized in that The blacklist includes a plurality of lists, each of which corresponds to a different illegal access type, each of which includes at least one first network address, and the plurality of blacklists and the whitelist together include at least one second network address; Calculating the confidence of each first network address relative to the blacklist and the confidence of each second network address relative to the blacklist, including: The confidence of each first network address relative to the blacklist in which the first network address is located, and the confidence of each second network address relative to the blacklist in which the second network address is located are calculated.

8. The method according to claim 7, characterized in that Determining a target confidence level of each of the first network addresses relative to the white list according to the calculated multiple confidence levels and the confidence levels of each of the second network addresses relative to the white list includes: Determining a second similarity between each blacklist and the whitelist according to the calculated multiple confidences and the confidence of each second network address relative to the whitelist; According to the determined multiple second similarities and the confidence of each first network address relative to the blacklist list where the first network address is located, a target confidence of each first network address relative to the whitelist list is determined.

9. The method according to claim 8, characterized in that Determining a target confidence of each first network address relative to the whitelist according to the determined multiple second similarities and the confidence of each first network address relative to the blacklist in which the first network address is located, includes: According to the determined multiple second similarities, weighted average processing is performed on the confidences of the respective first network addresses relative to the blacklist list where the respective first network addresses are located, so as to obtain the weighted average values ​​corresponding to the respective first network addresses; The weighted average value corresponding to each of the first network addresses is used as the target confidence of each of the first network addresses relative to the white list.

10. The method according to claim 8, characterized in that Determining a target confidence of each first network address relative to the whitelist according to the determined multiple second similarities and the confidence of each first network address relative to the blacklist in which the first network address is located, includes: According to the determined multiple second similarities, selecting a blacklist list whose second similarity exceeds a similarity threshold from the multiple blacklist lists as a candidate blacklist list; According to the second similarity between the candidate blacklist and the whitelist, and the confidence of each first network address relative to the candidate blacklist, a target confidence of each first network address relative to the whitelist is determined.

11. The method according to claim 10, characterized in that Determining a target confidence of each first network address relative to the white list according to the second similarity between the candidate black list and the white list, and the confidence of each first network address relative to the candidate black list, comprises: According to the second similarity between the candidate blacklist and the whitelist, weighted average processing is performed on the confidence of each first network address relative to the candidate blacklist to obtain a weighted average value corresponding to each first network address; The weighted average value corresponding to each of the first network addresses is used as the target confidence of each of the first network addresses relative to the white list.

12. A network address management device, characterized in that: The device comprises: An acquisition unit is configured to acquire a plurality of first network addresses included in a blacklist and a plurality of second network addresses included in both the blacklist and the whitelist, wherein the first network addresses and the second network addresses are network addresses that have initiated illegal access within a preset time period; A calculation unit, configured to calculate the confidence of each first network address relative to the blacklist and the confidence of each second network address relative to the blacklist; a determining unit configured to determine a target confidence of each of the first network addresses relative to the whitelist based on the calculated multiple confidences and the confidence of each of the second network addresses relative to the whitelist; a deleting unit, configured to delete the target network address from the blacklist if there is a target network address whose target confidence is greater than a preset threshold among the multiple first network addresses, so as to update the blacklist; The calculation unit is configured to: obtain, based on an update of the blacklist, a first time when each of the first network addresses was last deleted from the blacklist and a second time when each of the second network addresses was last deleted from the blacklist; calculate, based on a current calculation time and the first time, a confidence level of each of the first network addresses relative to the blacklist, and calculate, based on the current calculation time and the second time, a confidence level of each of the second network addresses relative to the blacklist.

13. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network address management method according to any one of claims 1 to 11 is implemented.

14. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement the network address management method as described in any one of claims 1 to 11.

15. A computer program product, characterized in that It comprises a computer program carried on a computer-readable medium, wherein the computer program comprises a computer program for executing the network address management method according to any one of claims 1 to 11.

Images