Request processing method, device, equipment and storage medium

Abstract

The present application discloses a request processing method, device, equipment and storage medium, which belongs to the field of network technology. The present application counts HTTP requests based on source IP addresses. Once the number of HTTP requests sent by the same source IP address within a counting period exceeds the threshold of a request processing rule, the gateway device writes the corresponding request processing rule instructions to the source IP address. Since the counting is performed in real time, it is possible to know in time which source IPs are sending abnormal traffic without delayed analysis, so that the source IP addresses can be restricted to different degrees based on different quantity restrictions, so that abnormal traffic can be more accurately identified and restricted, achieving the purpose of dynamically and quickly protecting the gateway, and laying a good foundation for information routing between different network devices.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a request processing method, device, equipment and storage medium. Background Art

[0002] With the development of computer technology, the types of various business systems are increasing, and they can provide different business services. Under normal circumstances, the sender will send a hypertext transfer protocol (HTTP) request to the business system according to the demand, and the gateway of the business system can process the request normally. When the sender is controlled by a hacker or the system program is abnormal, the sender will send a large number of HTTP requests to the business system, so that the business system gateway needs to consume a lot of resources to process these HTTP requests, and cannot process normal requests, thus failing to provide normal business services. In related technologies, the iptables tool is generally used to reject or limit the speed of HTTP requests at the network layer based on the Internet Protocol (IP) address, port number and network communication protocol of the HTTP request, so as to achieve the purpose of protecting the gateway.

[0003] In the above technology, iptables has the following problems in processing HTTP requests: iptables has a lag, and its processing method is generally to manually analyze the HTTP requests received before the failure of the gateway after the failure has occurred, so as to determine the HTTP request that caused the gateway failure, and thus determine the abnormal IP address. Then, in subsequent network communications, the HTTP request from the address can be rejected based on the abnormal IP address, and abnormal traffic cannot be identified and restricted in time. Summary of the invention

[0004] The embodiment of the present application provides a request processing method, apparatus, device and storage medium, which can timely identify and limit abnormal traffic, and achieve the purpose of dynamically and quickly protecting gateway devices. The technical solution is as follows:

[0005] In one aspect, a request processing method is provided, the method comprising:

[0006] Receiving a first HTTP request;

[0007] In response to the first HTTP request not hitting at least two request processing rules, forwarding the first HTTP request and counting based on the source IP address of the first HTTP request;

[0008] In response to the number of HTTP requests from the source IP address reaching a threshold of any request processing rule, an instruction corresponding to the request processing rule is written;

[0009] receiving a second HTTP request from the source IP address, and in response to determining that the second HTTP request hits the request processing rule based on the written instruction, executing restriction processing corresponding to the request processing rule;

[0010] The at least two request processing rules are used to indicate that different restriction processing is performed based on different sending times thresholds of the HTTP request within a counting period.

[0011] In one aspect, a request processing device is provided, the device comprising:

[0012] A receiving module, used for receiving a first HTTP request;

[0013] a forwarding module, configured to forward the first HTTP request in response to the first HTTP request not hitting at least two request processing rules;

[0014] A statistics module, used for counting based on the source IP address of the first HTTP request;

[0015] A writing module, used for writing instructions corresponding to any request processing rule in response to the number of HTTP requests from the source IP address reaching a threshold of any request processing rule;

[0016] The receiving module is used to receive a second HTTP request from the source IP address;

[0017] A restriction module, configured to execute restriction processing corresponding to the request processing rule in response to determining that the second HTTP request hits the request processing rule based on the written instruction;

[0018] The at least two request processing rules are used to indicate that different restriction processing is performed based on different sending times thresholds of the HTTP request within a counting period.

[0019] In some embodiments, the apparatus further comprises:

[0020] The judgment module is used to judge whether the first HTTP request hits the at least two request processing rules according to the target order, and the target order is used to represent the corresponding strictness of the request processing rules from large to small.

[0021] In some embodiments, the restriction module further includes:

[0022] A first counting module, used for counting the data packets of the source IP address;

[0023] The rejection module is used to discard the data packets received within the remaining time period of the first time period in response to the number of data packets sent by the source IP address within the first time period exceeding the first number.

[0024] In some embodiments, the restriction module further includes:

[0025] A second counting module, used for counting the number of connections maintained with the source IP address;

[0026] The interruption module is used for disconnecting the connections exceeding the second number in response to the number of connections exceeding the second number.

[0027] In some embodiments, the restriction module further includes:

[0028] A third counting module, used for counting the number of newly established connections with the source IP address within a first time period;

[0029] The rejection module is used to reject the establishment of a new connection with the source IP address in response to the number of newly established connections exceeding a third number.

[0030] In some embodiments, the at least two request processing rules include: at least one level of speed limit rule and a rejection rule, wherein the speed limit rule is used to limit the speed of sending HTTP requests from the source IP address, and the rejection rule is used to reject HTTP requests sent from the source IP address.

[0031] In some embodiments, the at least one level of speed limit rule is used to limit at least one of the number of connections that can be maintained between the source IP address and the gateway device, the number of new connections that can be established between the source IP address and the gateway device per second, and the number of data packets transmitted per second.

[0032] In some embodiments, the apparatus further comprises:

[0033] A start module, used to start the timer;

[0034] The deletion module is used to delete the instruction of the corresponding request processing rule in response to not receiving the HTTP request from the source IP address again within the second time period.

[0035] In some embodiments, the apparatus further comprises:

[0036] a detection module, for, in response to receiving any HTTP request, detecting, based on the source IP address of the HTTP request, whether it is the first time to receive an HTTP request from the source IP address of the HTTP request;

[0037] The start module is used to start a counter in response to the first receipt of an HTTP request from the source IP address of the HTTP request, and start a timer to record the statistical duration of the counter.

[0038] On the one hand, a computer-readable storage medium is provided, in which at least one computer program is stored. The at least one computer program is loaded and executed by a processor to implement the operations performed by the request processing method.

[0039] In one aspect, a computer program product is provided, the computer program product comprising at least one computer program, the at least one computer program being stored in a computer-readable storage medium. A processor of a computer device reads the at least one computer program from the computer-readable storage medium, and the processor executes the at least one computer program, so that the computer device implements the operations performed by the request processing method.

[0040] The technical solution provided in the embodiment of the present application counts HTTP requests based on the source IP address. Once the number of HTTP requests sent by the same source IP address within the counting period exceeds the threshold of a request processing rule, the gateway device writes the corresponding request processing rule instructions to the source IP address. Since the counting is performed in real time, it is possible to promptly know which source IPs are sending abnormal traffic without lagging analysis, thereby imposing different degrees of restrictions on the source IP address based on different quantity limits, thereby being able to more accurately identify and limit abnormal traffic, thereby achieving the purpose of dynamically and quickly protecting the gateway. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0042] Figure 1 It is a schematic diagram of an implementation environment of a request processing method provided in an embodiment of the present application;

[0043] Figure 2 It is a schematic diagram of the basic principle of a request processing method provided by an embodiment of the present application;

[0044] Figure 3 is a flowchart of a request processing method provided by an embodiment of the present application;

[0045] Figure 4 is a flowchart of a request processing method provided by an embodiment of the present application;

[0046] Figure 5 is a flowchart of a request processing method provided by an embodiment of the present application;

[0047] Figure 6 is a flowchart of a request processing method provided by an embodiment of the present application;

[0048] Figure 7 is a flowchart of a request processing method provided by an embodiment of the present application;

[0049] Figure 8 is a flowchart of a request processing method provided by an embodiment of the present application;

[0050] Fig. 9 is a structural diagram of a request processing device provided in an embodiment of the present application;

[0051] Fig.10 It is a structural diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present application clearer, the implementation mode of the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0053] In this application, the terms "first", "second", etc. are used to distinguish identical or similar items with basically the same effects and functions. It should be understood that there is no logical or temporal dependency between "first", "second", and "nth", nor is there any limitation on quantity and execution order.

[0054] Figure 1 is a schematic diagram of an implementation environment of a request processing method provided in an embodiment of the present application, see Figure 1 The implementation environment includes a network device 110 and a business system 120. The network device 110 is connected to the business system 120 via a wireless network or a wired network.

[0055] The network device 110 is a terminal or a server. The terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, an intelligent speaker, a smart watch, etc., which is not set in the embodiment of the present application. The server can be an independent physical server, or a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms. Optionally, the number of the above servers can be more or less, which is not limited in the present embodiment. Of course, the server can also include other functional servers to provide more comprehensive and diversified services.

[0056] The business system 120 includes a gateway device and a business server. The gateway device can be a host, a server, a router, etc. The business server can be any of the above servers, but is not limited thereto. It should be noted that the gateway device and the server can be on the same hardware device or on different hardware devices, which is not limited in this embodiment.

[0057] In related technologies, the network device 110 can also be called a source system relative to the business system, and can send HTTP requests to the business system. The business system 120 can also be called a target system relative to the network device, and can receive HTTP requests from the network device and provide corresponding services.

[0058] Based on the above implementation environment, Figure 2 Schematic diagram of the basic principle of a request processing method provided by an embodiment of the present application. The method can be applied to a gateway device. Figure 2, the network device sends an HTTP request to the business system, the gateway device in the business system receives the HTTP request, and determines whether the HTTP request hits the request processing rule. Among them, the request processing rule can also be called a business fuse rule, which is used to indicate how to perform different restriction processing on the HTTP request based on the different sending times threshold of the HTTP request within a counting cycle. In response to the HTTP request hitting any one of the restriction rules in the request processing rules, the gateway device performs corresponding restriction processing on the HTTP request. In response to the HTTP request not hitting the request processing rule, the gateway device forwards the HTTP request normally to the business server. Among them, the above-mentioned restriction processing includes but is not limited to: limiting the speed and rejecting the request. Among them, the way to limit the speed includes but is not limited to the following multiple dimensions: limiting the number of connections that can be maintained between the network device and the gateway device; limiting the number of new connections that can be established between the network device and the gateway device per second; limiting the number of data packets transmitted by the network device per second, etc.

[0059] In one possible implementation, the setting of request processing rules is divided into the following three strategies:

[0060] (1) Hierarchical tightening strategy: By setting multiple request processing rules, the speed at which the source system sends HTTP requests is gradually restricted from a single dimension. For example, multiple thresholds are set. As the threshold value increases, the request processing rules corresponding to the threshold will impose stricter restrictions on the HTTP requests sent by the network device.

[0061] The following is an example of a hierarchical tightening strategy that combines two-level speed limit rules and rejection rules.

[0062] The counting period is 10 seconds, and the request processing rules include:

[0063] The first rate limiting rule: in response to the number of HTTP requests sent by the network device reaching 100 within a counting cycle, the gateway device limits the number of data packets that can be sent by the network device per second to within 3000.

[0064] Second rate limit rule: In response to the number of HTTP requests sent by the network device reaching 500 within a counting cycle, the gateway device limits the number of data packets that can be sent by the network device per second to within 2000.

[0065] Rejection rule: In response to the number of HTTP requests sent by the network device reaching 1000 within a counting period, the gateway device rejects the HTTP requests sent by the network device.

[0066] The above rules can be implemented through triggers, instructions and timers. Among them, the trigger includes a counter and a threshold. The trigger threshold refers to the limit value of the number of HTTP requests in the above rules. For example, the trigger threshold of the above first speed limit rule is 100. The counter can count the number of HTTP requests sent from the same IP address in each counting cycle. If the number of HTTP requests sent by the IP address reaches the trigger threshold of one of the above rules, the gateway device executes the instruction corresponding to the trigger for the IP address. Among them, the instruction is the specific command content of the request processing rule. For example, the instruction of the above first speed limit rule is that the gateway device limits the number of data packets that can be sent by the network device per second to 3000. The counting cycle refers to the time period that the counter needs to continue to count the number of HTTP requests sent by the IP address. The statistical duration of the counter can be recorded by the timer. Whenever the timer reaches the counting cycle, the counter is cleared and the timer is reset at the same time.

[0067] It should be noted that the setting of the above-mentioned request processing rules is an exemplary description of the hierarchical tightening strategy. In some embodiments, the administrator can implement the hierarchical tightening strategy by setting more or fewer request processing rules. For example, the hierarchical tightening strategy can be implemented only through multiple levels of speed limit rules, or through one speed limit rule and one rejection rule. Of course, the hierarchical tightening strategy can also be implemented through multiple levels of speed limit rules and one rejection rule, which is not limited in this embodiment. The trigger threshold value, the value of the counting cycle and the content of the instruction in the request processing rules can be set accordingly according to different application scenarios, which is not limited in this embodiment.

[0068] (2) Parallel operation strategy: By setting multiple request processing rules, the speed of HTTP requests sent by the source system is limited from multiple dimensions at the same time. For example, multiple thresholds are set, and the request processing rules corresponding to different thresholds limit the HTTP requests sent by network devices from different dimensions.

[0069] The following is an example of a parallel operation strategy, which is implemented through three speed limit rules, as follows:

[0070] The counting period is 10 seconds, and the request processing rules include:

[0071] The third rate limit rule: in response to the number of HTTP requests sent by the network device reaching 100 within a counting cycle, after the number of data packets sent by the network device reaches 3000, the gateway device limits the number of data packets that can be sent by the network device per second to within 20.

[0072] Fourth rate limit rule: In response to the number of HTTP requests sent by the network device reaching 500 within a counting cycle, the number of new connections that can be established between the network device and the gateway device per second is limited to 1.

[0073] Fifth rate limit rule: In response to the number of HTTP requests sent by the network device reaching 1000 within a counting cycle, the number of connections that can be maintained between the network device and the gateway device is limited to 5.

[0074] The above rules can be implemented through triggers, instructions and timers. The specific implementation method is the same as the above hybrid strategy and will not be repeated here.

[0075] (3) Hybrid strategy: By setting multiple request processing rules, the speed of HTTP requests sent by the source system is gradually restricted from multiple dimensions. For example, multiple thresholds are set, and the business request rules corresponding to each threshold restrict the HTTP requests sent by network devices from multiple dimensions. As the threshold value increases, the restriction on HTTP requests sent by network devices in each dimension in the request processing rules corresponding to the threshold becomes more stringent.

[0076] The following is an example of a hybrid strategy that combines two-level rate limit rules and rejection rules.

[0077] The counting period is 10 seconds, and the request processing rules include:

[0078] The first hybrid speed limit rule: in response to the number of HTTP requests sent by the network device reaching 100 within a counting cycle, the number of connections that can be maintained between the network device and the gateway device is limited to 5, and after the number of data packets sent by the network device reaches 3000, the gateway device limits the number of data packets that can be sent by the network device per second to 20.

[0079] The second hybrid speed limit rule: in response to the number of HTTP requests sent by the network device reaching 500 within a counting cycle, the number of connections that can be maintained between the network device and the gateway device is limited to 1, and after the number of data packets sent by the network device reaches 2000, the gateway device limits the number of data packets that can be sent by the network device per second to less than 10.

[0080] Mixed rejection rule: In response to the number of HTTP requests sent by the network device reaching 1000 within a counting period, the gateway device rejects the HTTP requests sent by the network device.

[0081] The above rules can be implemented through triggers, instructions and timers. The specific implementation method is the same as the above hybrid strategy and will not be repeated here.

[0082] In some embodiments, any of the above strategies is provided with a corresponding jason file for defining each rule in the strategy, so that the gateway device can correctly execute the request processing rule. The following takes a possible implementation of a hybrid strategy as an example to illustrate the setting method of the jason file, as follows:

[0083]

[0084]

[0085] The description of each attribute included in the above jason file is shown in Table 1. Referring to Table 1, the first column in Table 1 indicates the attributes included in the jason file, the second column indicates the meaning of each attribute and the precautions when setting the attribute, and the third column indicates an example of each attribute.

[0086] In some embodiments, the business system administrator may also configure a whitelist to specify that certain IP addresses are not restricted by the request processing rules, thereby avoiding discarding request packets sent by certain specific systems.

[0087] It should be noted that the gateway device judges all request processing rules one by one. Once an HTTP request hits a request processing rule, the instruction of the request processing rule is immediately executed without further judgment. In some embodiments, the gateway device judges whether the HTTP request hits the request processing rule according to the target order, and the target order is used to indicate the corresponding strictness of the request processing rule from large to small. For example, the rejection rule is greater than the rate limit rule.

[0088] Table 1

[0089]

[0090] In some embodiments, the business system administrator configures global rules to implement restrictions on HTTP requests. The global rules are: in response to the data processing volume of the gateway device reaching the threshold of the gateway device, the gateway device rejects the HTTP request. The data processing volume includes but is not limited to the number of HTTP requests received by the gateway device, the number of connections maintained with the network device, and the number of data packets passing per second. The value of the gateway device threshold is determined by the performance of the gateway device. Different gateway devices have different values, which is not limited in this embodiment. When both request processing rules and global rules are configured at the same time, the judgment order can be to judge the global rules first and then the request processing rules. Of course, it can also be executed in other orders, which is not limited in this embodiment of the present application.

[0091] Figure 3is a flowchart of a request processing method provided by an embodiment of the present application. The method can be applied to a gateway device, see Figure 3 In one possible implementation, the embodiment includes the following steps.

[0092] 301. The gateway device receives a first HTTP request.

[0093] For the gateway device in the business system, any HTTP request sent by the source system will be first received by the gateway device and then perform subsequent processing.

[0094] 302. In response to the first HTTP request not hitting at least two request processing rules, the gateway device forwards the first HTTP request and counts based on the source IP address of the first HTTP request.

[0095] The at least two request processing rules are used to indicate that different restriction processing is performed based on different sending times thresholds of the HTTP request within a counting period.

[0096] 303. In response to the number of HTTP requests from the source IP address reaching a threshold of any request processing rule, the gateway device writes an instruction corresponding to the request processing rule.

[0097] When writing the instructions corresponding to the request processing rules, the gateway device writes the instructions corresponding to the request processing rules into the request processing process, and the request processing process is used to forward the HTTP requests received by the gateway device, determine whether the HTTP requests received by the gateway device hit the request processing rules, and perform restriction processing corresponding to the hit request processing rules on the HTTP requests received by the gateway device.

[0098] 304. The gateway device receives a second HTTP request from the source IP address, and in response to determining that the second HTTP request hits the request processing rule based on the written instruction, executes restriction processing corresponding to the request processing rule.

[0099] In the request processing process, for a certain source IP address, if an instruction corresponding to a certain request processing rule has been written, then the HTTP request from the source IP address hits the request processing rule corresponding to the instruction.

[0100] The technical solution provided in the embodiment of the present application counts HTTP requests based on the source IP address. Once the number of HTTP requests sent by the same source IP address within the counting period exceeds the threshold of a request processing rule, the gateway device writes the corresponding request processing rule instructions to the source IP address. Since the counting is performed in real time, it is possible to promptly know which source IPs are sending abnormal traffic without lagging analysis, thereby imposing different degrees of restrictions on the source IP address based on different quantity limits, thereby being able to more accurately identify and limit abnormal traffic, thereby achieving the purpose of dynamically and quickly protecting the gateway.

[0101] Figure 2 The example of the hierarchical tightening strategy is implemented by two-level speed limit rules and rejection rules. This embodiment takes the use of the first speed limit rule and the rejection rule to implement the hierarchical tightening strategy as an example. Figure 4 and Figure 5 to explain. Figure 4 and Figure 5 is a flowchart of a request processing method provided in an embodiment of the present application, the method is executed by a gateway device, see Figure 4 and Figure 5 , this embodiment includes the following steps.

[0102] 401. The gateway device receives a first HTTP request.

[0103] In some embodiments, in response to receiving any HTTP request, the gateway device detects whether it is the first time to receive an HTTP request from the source IP address according to the source IP address of the HTTP request, and in response to the first time to receive an HTTP request from the source IP address, starts a counter, and starts a timer to record the statistical duration of the counter. For the embodiment of the present application, the first HTTP request is any HTTP request received, which may be the initial HTTP request of the source IP address, that is, the first HTTP request from the source IP address, or may not be the initial HTTP request, which will not be described in detail here.

[0104] 402. In response to the first HTTP request not matching any request processing rule, the gateway device forwards the first HTTP request to the service server.

[0105] Among them, hitting any request processing rule means that, for the source IP address of the first HTTP request, an instruction corresponding to the request processing rule has been written in the request processing process, and the instruction is the restriction processing to be executed after the source IP address meets the execution conditions of the request processing rule.

[0106] In some embodiments, the gateway device determines whether the first HTTP request matches a request processing rule, including the following steps:

[0107] 402A, the gateway device determines whether the first HTTP request hits the rejection rule. In response to the first HTTP request not hitting the rejection rule, 402B is executed. In response to the first HTTP request hitting the rejection rule, the restriction processing corresponding to the rejection rule is executed.

[0108] Wherein, determining whether the first HTTP request hits the rejection rule includes: determining whether an instruction corresponding to the rejection rule has been written to the source IP address of the first HTTP request in the request processing process. In response to the instruction that the rejection rule has been written to the source IP address in the request processing process, the gateway device determines that the first HTTP request hits the rejection rule; in response to the instruction that the rejection rule has not been written to the source IP address in the request processing process, the gateway device determines that the first HTTP request does not hit the rejection rule.

[0109] 402B. The gateway device determines whether the first HTTP request hits the first speed limit rule. In response to the first HTTP request not hitting the first speed limit rule, the gateway device performs a subsequent forwarding process. In response to the first HTTP request hitting the first speed limit rule, the gateway device performs a restriction process corresponding to the first speed limit rule.

[0110] Wherein, determining whether the first HTTP request hits the first speed limit rule includes determining whether an instruction corresponding to the first speed limit rule has been written to the source IP address in the request processing process. In response to an instruction that the first speed limit rule has been written to the source IP address of the first HTTP request in the request processing process, the gateway device determines that the first HTTP request hits the first speed limit rule; in response to an instruction that the first speed limit rule has not been written to the source IP address in the request processing process, the gateway device determines that the first HTTP request does not hit the first speed limit rule.

[0111] 403. The gateway device counts based on the source IP address of the first HTTP request.

[0112] In some embodiments, the gateway device parses the first HTTP request to obtain a source IP address of the first HTTP request, and counts the number of HTTP requests sent from the source IP address through a counter corresponding to the source IP address.

[0113] 404. In response to the number of HTTP requests sent by the source IP address reaching the first rate limit rule threshold, the gateway device writes an instruction corresponding to the first rate limit rule into the request processing process.

[0114] In some embodiments, the gateway device obtains the number of HTTP requests obtained by counting the source IP address by the counter, and determines whether the number of HTTP requests reaches the threshold of each request processing rule. In response to the number of HTTP requests reaching the first speed limit rule threshold, the gateway device determines whether the instruction of the first speed limit rule has been written to the source IP address in the request processing process. In response to the instruction of the first speed limit rule not being written to the source IP address in the request processing process, the gateway device writes the instruction of the first speed limit rule into the request processing process.

[0115] It should be noted that the timer keeps running during the above process. In response to the duration counted by the timer reaching the counting period, the gateway device clears the counter and resets the timer. In response to not reaching the counting period, the timer and counter keep running.

[0116] 405. The gateway device receives a second HTTP request from the source IP address.

[0117] In some embodiments, the second HTTP request may be any HTTP request from the source IP address except the initial request, which will not be elaborated here.

[0118] 406. In response to determining that the second HTTP request hits the first speed limit rule based on the written instruction, the gateway device executes the restriction processing corresponding to the first speed limit rule to limit the speed of the HTTP request from the source IP address.

[0119] In some embodiments, the gateway device determines whether the first HTTP request matches the request processing rule. The determination process is as described in step 402 and will not be repeated here.

[0120] In some embodiments, limiting the rate of HTTP requests from the source IP address includes any of the following processing methods:

[0121] One processing method is: the gateway device counts the data packets sent by the source IP address, and in response to the number of data packets sent by the source IP address within a first time period exceeding a first number, discards the data packets received within the remaining time period of the first time period.

[0122] For example, the gateway device limits the number of data packets that can be sent by a certain source IP address to within 3,000 per second. If the number of data packets sent by the source IP address exceeds 3,000 within one second, the gateway device discards the data packets that exceed the limit within this period of time. It should be noted that the source IP address can resend the discarded data packets, that is, for the received data packets, the gateway device will send a confirmation message to the source IP address. The source IP address can determine whether the gateway device discards the data packet based on whether the confirmation message is received, and thus resend the data packet discarded by the gateway device.

[0123] Another processing method is: the gateway device counts the number of connections maintained with the source IP address, and in response to the number of connections exceeding a second number, the connections exceeding the second number are disconnected.

[0124] For example, the gateway device limits the number of connections that can be maintained by a certain source IP address to within 5. If the number of connections exceeds 5, the gateway device disconnects the excess connections.

[0125] Another processing method is: the gateway device counts the number of new connections with the source IP address within the first time period, and in response to the number of new connections exceeding a third number, the gateway device refuses to establish a new connection with the source IP address.

[0126] For example, the gateway device limits the number of new connections for a certain source IP address to 5. If the number of connections exceeds 5, the gateway device refuses to establish a new connection with the source IP address.

[0127] The above processing methods can all achieve rate limiting for HTTP requests from the source IP address. The embodiments of the present application do not limit which processing method is used.

[0128] 407. The gateway device continues counting based on the received HTTP request.

[0129] In the embodiment of the present application, the gateway device keeps running, and during its operation it can also receive HTTP requests from various source systems and execute corresponding steps. The embodiment of the present application focuses on HTTP requests that come from the same source IP address as the first HTTP request. When HTTP requests from the same source IP address are received, the counting of the corresponding counters will be triggered, which will not be elaborated here.

[0130] 408. In response to the number of HTTP requests sent by the source IP address reaching the rejection rule threshold, the gateway device writes an instruction corresponding to the rejection rule into the request processing process.

[0131] In some embodiments, the gateway device obtains the number of HTTP requests obtained by counting the source IP address by the counter, and determines whether the number of HTTP requests reaches the threshold of each request processing rule. In response to the number of HTTP requests reaching the rejection rule threshold, the gateway device determines whether the rejection rule instruction has been written to the source IP address in the request processing process. In response to the rejection rule instruction not being written to the source IP address in the request processing process, the gateway device writes the rejection rule instruction into the request processing process.

[0132] It should be noted that the timer keeps running during the above process. In response to the duration counted by the timer reaching the counting period, the gateway device clears the counter and resets the timer. In response to not reaching the counting period, the timer and counter keep running.

[0133] 409. The gateway device receives a third HTTP request from the source IP address.

[0134] In some embodiments, the third HTTP request may be any HTTP request from the source IP address except the initial request, which will not be elaborated here.

[0135] 410. In response to determining that the third HTTP request hits a rejection rule based on the written instruction, the gateway device rejects the third HTTP request.

[0136] In some embodiments, the gateway device determines whether the third HTTP request matches the request processing rule. The determination process is as described in step 402 and will not be repeated here.

[0137] In some embodiments, in response to determining that the third HTTP request hits a rejection rule based on the written instruction, the gateway device executes restriction processing corresponding to the rejection rule, rejects the third HTTP request, and stops the judgment process.

[0138] In some embodiments, for a source IP address that hits any request processing rule, the gateway device starts a timer, and in response to not receiving an HTTP request from the source IP address again within a second time period, deletes the corresponding request processing rule instruction. By timely deleting the request processing rule instruction based on the sending of the HTTP request, it is possible to avoid accidental damage to the source system that has returned to normal, and maintain normal business services.

[0139] The technical solution provided in the embodiment of the present application counts HTTP requests based on the source IP address. Once the number of HTTP requests sent by the same source IP address within the counting period exceeds the threshold of a request processing rule, the gateway device writes the corresponding request processing rule instructions to the source IP address. Since the counting is performed in real time, it is possible to promptly know which source IPs are sending abnormal traffic without lagging analysis, thereby imposing different degrees of restrictions on the source IP address based on different quantity limits, thereby being able to more accurately identify and limit abnormal traffic, thereby achieving the purpose of dynamically and quickly protecting the gateway.

[0140] Furthermore, the technical solution limits the speed at which abnormal IP addresses send HTTP requests from a single dimension, reduces the waste of gateway resources caused by abnormal traffic, and ensures that the gateway processes normal requests.

[0141] This embodiment uses Figure 2 As an example, the hybrid strategy is implemented by using two-level speed limit rules and rejection rules. Figure 6 and Figure 7 to explain. Figure 6 and Figure 7 is a flowchart of a request processing method provided in an embodiment of the present application, the method is executed by a gateway device, see Figure 6 and Figure 7 , this embodiment includes the following steps.

[0142] 601. The gateway device receives a first HTTP request.

[0143] This step performs the following Figure 4 The description of step 401 is omitted here.

[0144] 602. In response to the first HTTP request not matching any request processing rule, the gateway device forwards the first HTTP request to the service server.

[0145] Among them, hitting any request processing rule means that the instruction corresponding to the request processing rule has been written to the source IP address of the first HTTP request in the request processing process, and the instruction is the restriction processing to be executed after the source IP address meets the execution conditions of the request processing rule.

[0146] In some embodiments, the gateway device determines whether the first HTTP request hits the request processing rule. Figure 7 The request processing rule judgment step includes the following steps:

[0147] 602A, the gateway device determines whether the first HTTP request hits the mixed rejection rule. In response to the first HTTP request not hitting the mixed rejection rule, 602B is executed. In response to the first HTTP request hitting the mixed rejection rule, the restriction processing corresponding to the mixed rejection rule is executed.

[0148] Wherein, determining whether the first HTTP request hits the hybrid rejection rule includes: determining whether an instruction corresponding to the hybrid rejection rule has been written to the source IP address of the first HTTP request in the request processing process. In response to the instruction that the hybrid rejection rule has been written to the source IP address in the request processing process, the gateway device determines that the first HTTP request hits the hybrid rejection rule; in response to the instruction that the hybrid rejection rule has not been written to the source IP address in the request processing process, the gateway device determines that the first HTTP request does not hit the hybrid rejection rule.

[0149] 602B. The gateway device determines whether the first HTTP request hits the second hybrid speed limit rule. In response to the first HTTP request not hitting the second hybrid speed limit rule, step 602C is executed. In response to the first HTTP request hitting the second hybrid speed limit rule, the restriction processing corresponding to the second hybrid speed limit rule is executed.

[0150] Among them, judging whether the first HTTP request hits the second hybrid speed limit rule includes: judging whether an instruction corresponding to the second hybrid speed limit rule has been written to the source IP address of the first HTTP request in the request processing process. In response to the instruction that the second hybrid speed limit rule has been written to the source IP address in the request processing process, the gateway device judges that the first HTTP request hits the second hybrid speed limit rule, and in response to the instruction that the second hybrid speed limit rule has not been written to the source IP address in the request processing process, the gateway device judges that the first HTTP request does not hit the second hybrid speed limit rule.

[0151] 602C. The gateway device determines whether the first HTTP request hits the first hybrid speed limit rule. In response to the first HTTP request not hitting the first hybrid speed limit rule, the gateway device executes a subsequent forwarding process. In response to the first HTTP request hitting the first hybrid speed limit rule, the gateway device executes the restriction processing corresponding to the first hybrid speed limit rule.

[0152] Among them, judging whether the first HTTP request hits the first hybrid speed limit rule includes: judging whether an instruction corresponding to the first hybrid speed limit rule has been written to the source IP address of the first HTTP request in the request processing process. In response to the instruction that the first hybrid speed limit rule has been written to the source IP address in the request processing process, the gateway device judges that the first HTTP request hits the first hybrid speed limit rule; in response to the instruction that the first hybrid speed limit rule has not been written to the source IP address in the request processing process, the gateway device judges that the first HTTP request does not hit the first hybrid speed limit rule.

[0153] 603. The gateway device counts based on the source IP address of the first HTTP request.

[0154] In some embodiments, the gateway device parses the first HTTP request to obtain the source IP address of the first HTTP request, and counts the number of HTTP requests sent from the source IP address through a counter corresponding to the source IP address, see Figure 7 Steps for counting gateway devices.

[0155] 604. In response to the number of HTTP requests sent by the source IP address reaching the threshold of the first hybrid rate limit rule, the gateway device writes an instruction corresponding to the first hybrid rate limit rule into the request processing process.

[0156] In some embodiments, the gateway device obtains the number of HTTP requests obtained by counting the source IP address by the counter, and determines whether the number of HTTP requests reaches the threshold of each request processing rule. Figure 7 In response to the number of HTTP requests reaching the threshold of the first hybrid speed limit rule, the gateway device determines whether the instruction of the first hybrid speed limit rule has been written to the source IP address in the request processing process. In response to the instruction of the first hybrid speed limit rule not being written to the source IP address in the request processing process, the gateway device writes the instruction of the first hybrid speed limit rule into the request processing process, see Figure 7 The first mixed speed limit rule is written in step.

[0157] It should be noted that the timer keeps running during the above process. In response to the duration counted by the timer reaching the counting period, the gateway device clears the counter and resets the timer. In response to the counting period not being reached, the timer and the counter are kept running. See Figure 7 The counting cycle judgment step.

[0158] 605. The gateway device receives a second HTTP request from the source IP address.

[0159] In some embodiments, the second HTTP request may be any HTTP request from the source IP address except the initial request, which will not be elaborated here.

[0160] 606. In response to determining that the second HTTP request hits the first hybrid speed limit rule based on the written instruction, the gateway device executes the restriction processing corresponding to the first hybrid speed limit rule to limit the speed of the HTTP request from the source IP address.

[0161] In some embodiments, the gateway device determines whether the second HTTP request hits the request processing rule. Figure 7 In the request processing rule judgment step, the judgment process is as described in step 602 and will not be repeated here.

[0162] In some embodiments, limiting the rate of HTTP requests from the source IP address includes any of the following processing methods:

[0163] One processing method is: the gateway device counts the number of connections maintained with the source IP address and the number of data packets sent by the source IP address at the same time; in response to the number of connections maintained by the gateway device with the source IP address exceeding a first number, the connections exceeding the first number are disconnected; in response to the number of data packets sent by the source IP address exceeding a second number, the number of data packets sent by the source IP address within a first time duration is limited; in response to the number of data packets sent by the source IP address within a first time duration exceeds a third number, the data packets received within the remaining time duration of the first time duration are discarded.

[0164] For example: the gateway device limits the number of connections that can be maintained with a certain source IP address to 5, and after the number of packets sent by the source IP address reaches 3,000, the gateway device limits the number of packets that can be sent by the source IP address per second to 20. If the number of connections maintained with the source IP address exceeds 5, the gateway device disconnects the extra connections. If the number of packets sent by the source IP address exceeds 3,000, the gateway device limits the number of packets that can be sent by the source IP address per second to 20. If the number of packets sent by the source IP address exceeds 20 in one second, the gateway device discards the packets that exceed the limit during that period.

[0165] Another processing method is: the gateway device counts the number of connections maintained with the source IP address and the number of data packets sent by the source IP address at the same time. In response to the number of connections maintained by the gateway device with the source IP address exceeding a first number, the connections exceeding the first number are disconnected. In response to the number of data packets sent by the source IP address within a first time period exceeding a fourth number, the data packets received within the remaining time period of the first time period are discarded.

[0166] For example, the gateway device limits the number of connections that can be maintained with a source IP address to 5, and limits the number of data packets that can be sent by the network device per second to 3,000. If the number of connections maintained with the source IP address exceeds 5, the gateway device disconnects the extra connections. If the number of data packets sent by the source IP address in one second exceeds 3,000, the gateway device discards the data packets that exceed the limit during that period.

[0167] It should be noted that the source IP address can resend the discarded data packets, that is, for the received data packets, the gateway device will send a confirmation message to the source IP address. The source IP address can determine whether the gateway device discards the data packets based on whether the confirmation message is received, and thus resend the data packets discarded by the gateway device.

[0168] The above processing methods can all achieve speed limiting for HTTP requests from the source IP address. The embodiment of the present application adopts a two-dimensional speed limiting method in the above process. In some embodiments, more dimensions are also used for speed limiting, which are not limited here.

[0169] 607. The gateway device continues counting based on the received HTTP request.

[0170] In the embodiment of the present application, the gateway device keeps running, and during its operation, it can also receive HTTP requests from various source systems and execute corresponding steps. The embodiment of the present application focuses on HTTP requests from the same source IP address as the first HTTP request. When receiving HTTP requests from the same source IP address, the count of the corresponding counter will be triggered. See Figure 7 The steps for counting gateway devices are not described here.

[0171] 608. In response to the number of HTTP requests sent by the source IP address reaching the second hybrid rate limit rule threshold, the gateway device writes an instruction corresponding to the second hybrid rate limit rule into the request processing process.

[0172] In some embodiments, the gateway device obtains the number of HTTP requests obtained by counting the source IP address by the counter, and determines whether the number of HTTP requests reaches the threshold of each request processing rule. Figure 7 In response to the number of HTTP requests reaching the second hybrid speed limit rule threshold, the gateway device determines whether the second hybrid speed limit rule instruction has been written to the source IP address in the request processing process. In response to the fact that the second hybrid speed limit rule instruction has not been written to the source IP address in the request processing process, the gateway device writes the second hybrid speed limit rule instruction into the request processing process, see Figure 7The second mixed speed limit rule is written in step 1.

[0173] It should be noted that the timer keeps running during the above process. In response to the duration counted by the timer reaching the counting period, the gateway device clears the counter and resets the timer. In response to not reaching the counting period, the timer and counter keep running.

[0174] 609. The gateway device receives a third HTTP request from the source IP address.

[0175] In some embodiments, the third HTTP request may be any HTTP request from the source IP address except the initial request, which will not be elaborated here.

[0176] 610. In response to determining that the third HTTP request hits the second hybrid speed limit rule based on the written instruction, the gateway device executes the restriction processing corresponding to the second hybrid speed limit rule to limit the speed of the HTTP request from the source IP address.

[0177] In some embodiments, the gateway device determines whether the third HTTP request hits the request processing rule, see Figure 7 In the request processing rule judgment step, the judgment process is as described in step 602 and will not be repeated here.

[0178] In some embodiments, the method of speed limiting the HTTP request from the source IP address is as described in step 606 and will not be repeated here.

[0179] 611. The gateway device continues counting based on the received HTTP request.

[0180] See also Figure 7 The gateway device counting step, the execution content of this step is as described in step 607, and will not be repeated here.

[0181] 612. In response to the number of HTTP requests sent from the source IP address reaching the hybrid rejection threshold, the gateway device writes an instruction corresponding to the hybrid rejection rule into the request processing process.

[0182] In some embodiments, the gateway device obtains the number of HTTP requests obtained by counting the source IP address by the counter, and determines whether the number of HTTP requests reaches the threshold of each request processing rule. Figure 7In response to the number of HTTP requests reaching the hybrid rejection rule threshold, the gateway device determines whether the hybrid rejection rule instruction has been written to the source IP address in the request processing process. In response to the hybrid rejection rule instruction not being written to the source IP address in the request processing process, the gateway device writes the hybrid rejection rule instruction into the request processing process, see Figure 7 Mixed deny rule writing steps.

[0183] It should be noted that the timer keeps running during the above process. In response to the duration counted by the timer reaching the counting period, the gateway device clears the counter and resets the timer. In response to not reaching the counting period, the timer and counter keep running.

[0184] 613. The gateway device receives a fourth HTTP request from the source IP address.

[0185] In some embodiments, the fourth HTTP request may be any HTTP request from the source IP address except the initial request, which will not be elaborated here.

[0186] 614. In response to determining that the fourth HTTP request hits the hybrid rejection rule based on the written instruction, the gateway device performs restriction processing corresponding to the hybrid rejection rule to reject the fourth HTTP request.

[0187] In some embodiments, the gateway device determines whether the fourth HTTP request hits the request processing rule, see Figure 7 In the request processing rule judgment step, the judgment process is as described in step 602 and will not be repeated here.

[0188] In some embodiments, in response to determining that the fourth HTTP request hits the hybrid rejection rule based on the written instruction, the gateway device performs restriction processing corresponding to the hybrid rejection rule, rejects the fourth HTTP request, and stops the judgment process.

[0189] In some embodiments, for a source IP address that hits any request processing rule, the gateway device starts a timer, and in response to not receiving an HTTP request from the source IP address again within a second time period, deletes the corresponding request processing rule instruction. By timely deleting the request processing rule instruction based on the HTTP sending situation, it is possible to avoid accidental damage to the source system that has returned to normal, and maintain normal business services.

[0190] The technical solution provided in the embodiment of the present application counts HTTP requests based on the source IP address. Once the number of HTTP requests sent by the same source IP address within the counting period exceeds the threshold of a request processing rule, the gateway device writes the corresponding request processing rule instructions to the source IP address. Since the counting is performed in real time, it is possible to promptly know which source IPs are sending abnormal traffic without lagging analysis, thereby imposing different degrees of restrictions on the source IP address based on different quantity limits, thereby being able to more accurately identify and limit abnormal traffic, thereby achieving the purpose of dynamically and quickly protecting the gateway.

[0191] Furthermore, the technical solution limits the speed at which abnormal IP addresses send HTTP requests from multiple dimensions, reduces the waste of gateway resources caused by abnormal traffic, and ensures that the gateway processes normal requests.

[0192] The following embodiment processes requests based on another hybrid strategy. The specific content of the hybrid strategy is introduced as follows:

[0193] The counting period is 10 seconds, and the request processing rules include:

[0194] The third hybrid speed limit rule: in response to the number of HTTP requests sent by the network device reaching 100 within a counting cycle, the number of connections that can be maintained between the network device and the gateway device is limited to 5, and the gateway device limits the number of data packets that can be sent by the network device per second to 3000.

[0195] Fourth hybrid speed limit rule: In response to the number of HTTP requests sent by the network device reaching 500 within a counting cycle, the number of connections that can be maintained between the network device and the gateway device is limited to 1, and the gateway device limits the number of data packets that can be sent by the network device per second to 2000.

[0196] Fifth hybrid rate limit rule: in response to the number of HTTP requests sent by the network device reaching 1000 within a counting cycle, the gateway device limits the number of data packets that can be sent by the network device per second to within 1000.

[0197] Figure 8 is a flowchart of a request processing method provided in an embodiment of the present application, the method is executed by a gateway device, see Figure 8 , this embodiment includes the following steps.

[0198] 801. The gateway device receives a first HTTP request.

[0199] This step performs the following Figure 6 The description of step 601 is omitted here.

[0200] 802. In response to the first HTTP request not matching any request processing rule, the gateway device forwards the first HTTP request to the service server.

[0201] Among them, hitting any request processing rule means that, for the source IP address of the first HTTP request, an instruction corresponding to the request processing rule has been written into the request processing process, and the instruction is the restriction processing to be executed after the source IP address meets the execution conditions of the request processing rule.

[0202] In some embodiments, the gateway device determines whether the first HTTP request matches a request processing rule, including the following steps:

[0203] 802A, the gateway device determines whether the first HTTP request hits the fifth hybrid speed limit rule. In response to the first HTTP request not hitting the fifth hybrid speed limit rule, 802B is executed. In response to the first HTTP request hitting the fifth hybrid speed limit rule, the restriction processing corresponding to the fifth hybrid speed limit rule is executed.

[0204] Among them, judging whether the first HTTP request hits the fifth hybrid speed limit rule includes: judging whether an instruction corresponding to the fifth hybrid speed limit rule has been written to the source IP address of the first HTTP request in the request processing process. In response to the instruction that the fifth hybrid speed limit rule has been written to the source IP address in the request processing process, the gateway device judges that the first HTTP request hits the fifth hybrid speed limit rule, and in response to the instruction that the fifth hybrid speed limit rule has not been written to the source IP address in the request processing process, the gateway device judges that the first HTTP request does not hit the fifth hybrid speed limit rule.

[0205] 802B. The gateway device determines whether the first HTTP request hits the fourth hybrid speed limit rule. In response to the first HTTP request not hitting the fourth hybrid speed limit rule, step 802C is executed. In response to the first HTTP request hitting the fourth hybrid speed limit rule, the restriction processing corresponding to the fourth hybrid speed limit rule is executed.

[0206] Among them, judging whether the first HTTP request hits the fourth hybrid speed limit rule includes: judging whether an instruction corresponding to the fourth hybrid speed limit rule has been written to the source IP address of the first HTTP request in the request processing process. In response to the instruction that the fourth hybrid speed limit rule has been written to the source IP address in the request processing process, the gateway device judges that the first HTTP request hits the fourth hybrid speed limit rule, and in response to the instruction that the fourth hybrid speed limit rule has not been written to the source IP address in the request processing process, the gateway device judges that the first HTTP request does not hit the fourth hybrid speed limit rule.

[0207] 802C. The gateway device determines whether the first HTTP request hits the third hybrid speed limit rule. In response to the first HTTP request not hitting the third hybrid speed limit rule, the gateway device executes a subsequent forwarding process. In response to the first HTTP request hitting the third hybrid speed limit rule, the gateway device executes the restriction processing corresponding to the third hybrid speed limit rule.

[0208] Among them, judging whether the first HTTP request hits the third hybrid speed limit rule includes: judging whether an instruction corresponding to the third hybrid speed limit rule has been written to the source IP address of the first HTTP request in the request processing process. In response to the instruction that the third hybrid speed limit rule has been written to the source IP address in the request processing process, the gateway device judges that the first HTTP request hits the third hybrid speed limit rule; in response to the instruction that the third hybrid speed limit rule has not been written to the source IP address in the request processing process, the gateway device judges that the first HTTP request does not hit the third hybrid speed limit rule.

[0209] 803. The gateway device counts based on the source IP address of the first HTTP request.

[0210] This step performs the following Figure 6 The description of step 603 is omitted here.

[0211] 804. In response to the number of HTTP requests sent by the source IP address reaching the threshold of the third hybrid rate limit rule, the gateway device writes an instruction corresponding to the third hybrid rate limit rule into the request processing process.

[0212] In some embodiments, the gateway device obtains the number of HTTP requests obtained by counting the source IP address by the counter, and determines whether the number of HTTP requests reaches the threshold of each request processing rule. In response to the number of HTTP requests reaching the threshold of the third hybrid speed limit rule, the gateway device determines whether the instruction of the third hybrid speed limit rule has been written to the source IP address in the request processing process. In response to the instruction of the third hybrid speed limit rule not being written to the source IP address in the request processing process, the gateway device writes the instruction of the third hybrid speed limit rule into the request processing process.

[0213] It should be noted that the timer keeps running during the above process. In response to the duration counted by the timer reaching the counting period, the gateway device clears the counter and resets the timer. In response to not reaching the counting period, the timer and counter keep running.

[0214] 805. The gateway device receives a second HTTP request from the source IP address.

[0215] In some embodiments, the second HTTP request may be any HTTP request from the source IP address except the initial request, which will not be elaborated here.

[0216] 806. In response to determining that the second HTTP request hits the third hybrid speed limit rule based on the written instruction, the gateway device executes the restriction processing corresponding to the third hybrid speed limit rule to limit the speed of the HTTP request from the source IP address.

[0217] In some embodiments, the method by which the gateway device determines whether the second HTTP request matches the request processing rule is as described in step 802 and will not be repeated here.

[0218] In some embodiments, the method for limiting the rate of HTTP requests from the source IP address is as follows: Figure 6 The description of step 606 is omitted here.

[0219] 807. The gateway device continues counting based on the received HTTP request.

[0220] This step performs the following Figure 6 The description of step 607 is omitted here.

[0221] 808. In response to the number of HTTP requests sent by the source IP address reaching the fourth hybrid rate limit threshold, the gateway device writes an instruction corresponding to the fourth hybrid rate limit rule into the request processing process.

[0222] In some embodiments, the gateway device obtains the number of HTTP requests obtained by counting the source IP address by the counter, and determines whether the number of HTTP requests reaches the threshold of each request processing rule. In response to the number of HTTP requests reaching the threshold of the fourth hybrid speed limit rule, the gateway device determines whether the instruction of the fourth hybrid speed limit rule has been written to the source IP address in the request processing process. In response to the instruction of the fourth hybrid speed limit rule not being written to the source IP address in the request processing process, the gateway device writes the instruction of the fourth hybrid speed limit rule into the request processing process.

[0223] It should be noted that the timer keeps running during the above process. In response to the duration counted by the timer reaching the counting period, the gateway device clears the counter and resets the timer. In response to not reaching the counting period, the timer and counter keep running.

[0224] 809. The gateway device receives a third HTTP request from the source IP address.

[0225] In some embodiments, the third HTTP request may be any HTTP request from the source IP address except the initial request, which will not be elaborated here.

[0226] 810. In response to determining that the third HTTP request hits the fourth hybrid speed limit rule based on the written instruction, the gateway device executes the restriction processing corresponding to the fourth hybrid speed limit rule to limit the speed of the HTTP request from the source IP address.

[0227] In some embodiments, the gateway device determines whether the third HTTP request matches the request processing rule. The determination process is as described in step 802 and will not be repeated here.

[0228] In some embodiments, the method for limiting the rate of HTTP requests from the source IP address is as follows: Figure 6 The description of step 606 is omitted here.

[0229] 811. The gateway device continues counting based on the received HTTP request.

[0230] The execution content of this step is as described in the above step 807 and will not be repeated here.

[0231] 812. In response to the number of HTTP requests sent from the source IP address reaching the fifth hybrid rate limit threshold, the gateway device writes an instruction corresponding to the fifth hybrid rate limit rule into the request processing process.

[0232] In some embodiments, the gateway device obtains the number of HTTP requests obtained by counting the source IP address by the counter, and determines whether the number of HTTP requests reaches the threshold of each request processing rule. In response to the number of HTTP requests reaching the threshold of the fifth hybrid speed limit rule, the gateway device determines whether the instruction of the fifth hybrid speed limit rule has been written to the source IP address in the request processing process. In response to the instruction of the fifth hybrid speed limit rule not being written to the source IP address in the request processing process, the gateway device writes the instruction of the fifth hybrid speed limit rule into the request processing process.

[0233] It should be noted that the timer keeps running during the above process. In response to the duration counted by the timer reaching the counting period, the gateway device clears the counter and resets the timer. In response to not reaching the counting period, the timer and counter keep running.

[0234] 813. The gateway device receives a fourth HTTP request from the source IP address.

[0235] In some embodiments, the fourth HTTP request may be any HTTP request from the source IP address except the initial request, which will not be elaborated here.

[0236] 814. In response to determining that the fourth HTTP request hits the fifth hybrid speed limit rule based on the written instruction, the gateway device executes the restriction processing corresponding to the fifth hybrid speed limit rule to limit the speed of the HTTP request from the source IP address.

[0237] In some embodiments, the gateway device determines whether the fourth HTTP request matches the request processing rule. The determination process is as described in step 802 and will not be repeated here.

[0238] In some embodiments, the method for limiting the rate of HTTP requests from the source IP address is as described above. Figure 6 The description of step 606 is omitted here.

[0239] In some embodiments, for a source IP address that hits any request processing rule, the gateway device starts a timer, and in response to not receiving an HTTP request from the source IP address again within a second time period, deletes the corresponding request processing rule instruction. By timely deleting the request processing rule instruction based on the HTTP sending situation, it is possible to avoid accidental damage to the source system that has returned to normal, and maintain normal business services.

[0240] The technical solution provided in the embodiment of the present application counts HTTP requests based on the source IP address. Once the number of HTTP requests sent by the same source IP address within the counting period exceeds the threshold of a request processing rule, the gateway device writes the corresponding request processing rule instructions to the source IP address. Since the counting is performed in real time, it is possible to promptly know which source IPs are sending abnormal traffic without lagging analysis, thereby imposing different degrees of restrictions on the source IP address based on different quantity limits, thereby being able to more accurately identify and limit abnormal traffic, thereby achieving the purpose of dynamically and quickly protecting the gateway.

[0241] Furthermore, the technical solution limits the speed at which abnormal IP addresses send HTTP requests from multiple dimensions, reduces the waste of gateway resources caused by abnormal traffic, and ensures that the gateway processes normal requests.

[0242] Fig. 9 is a schematic diagram of a request processing device provided in an embodiment of the present application, see Fig. 9 , the device comprises:

[0243] Receiving module 901, used for receiving a first HTTP request;

[0244] A forwarding module 902, configured to forward the first HTTP request in response to the first HTTP request not matching at least two request processing rules;

[0245] A statistics module 903, configured to count based on the source IP address of the first HTTP request;

[0246] A writing module 904, configured to write an instruction corresponding to any request processing rule in response to the number of HTTP requests from the source IP address reaching a threshold of any request processing rule;

[0247] The receiving module 901 is used to receive a second HTTP request from the source IP address;

[0248] A restriction module 905, configured to execute restriction processing corresponding to the request processing rule in response to determining that the second HTTP request hits the request processing rule based on the written instruction;

[0249] The at least two request processing rules are used to indicate that different restriction processing is performed based on different sending times thresholds of the HTTP request within a counting period.

[0250] In some embodiments, the apparatus further comprises:

[0251] The judgment module is used to judge whether the first HTTP request hits the at least two request processing rules according to the target order, and the target order is used to represent the corresponding strictness of the request processing rules from large to small.

[0252] In some embodiments, the restriction module 905 further includes:

[0253] A first counting module, used for counting the data packets of the source IP address;

[0254] The rejection module is used to discard the data packets received within the remaining time period of the first time period in response to the number of data packets sent by the source IP address within the first time period exceeding the first number.

[0255] In some embodiments, the restriction module 905 further includes:

[0256] A second counting module, used for counting the number of connections maintained with the source IP address;

[0257] The interruption module is used for disconnecting the connections exceeding the second number in response to the number of connections exceeding the second number.

[0258] In some embodiments, the restriction module 905 further includes:

[0259] A third counting module, used for counting the number of newly established connections with the source IP address within a first time period;

[0260] The rejection module is used to reject the establishment of a new connection with the source IP address in response to the number of newly established connections exceeding a third number.

[0261] In some embodiments, the at least two request processing rules include: at least one level of speed limit rule and a rejection rule, wherein the speed limit rule is used to limit the speed of sending HTTP requests from the source IP address, and the rejection rule is used to reject HTTP requests sent from the source IP address.

[0262] In some embodiments, the at least one level of speed limit rule is used to limit at least one of the number of connections that can be maintained between the source IP address and the gateway device, the number of new connections that can be established between the source IP address and the gateway device per second, and the number of data packets transmitted per second.

[0263] In some embodiments, the apparatus further comprises:

[0264] A start module, used to start the timer;

[0265] The deletion module is used to delete the instruction of the corresponding request processing rule in response to not receiving the HTTP request from the source IP address again within the second time period.

[0266] In some embodiments, the apparatus further comprises:

[0267] a detection module, for, in response to receiving any HTTP request, detecting, based on the source IP address of the HTTP request, whether it is the first time to receive an HTTP request from the source IP address of the HTTP request;

[0268] The start module is used to start a counter in response to the first receipt of an HTTP request from the source IP address of the HTTP request, and start a timer to record the statistical duration of the counter.

[0269] In this technical solution, the gateway device is a computer device. Fig.10It is a structural diagram of a computer device provided in an embodiment of the present application. The computer device 1000 may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 1001 and one or more memories 1002, wherein at least one program code is stored in the one or more memories 1002, and the at least one program code is loaded and executed by the one or more processors 1001 to implement the methods provided in the above-mentioned various method embodiments. Of course, the computer device 1000 may also have components such as a wired or wireless network interface, a keyboard, and an input and output interface for input and output. The computer device 1000 may also include other components for implementing device functions, which will not be described in detail here.

[0270] In an exemplary embodiment, a computer-readable storage medium is also provided, such as a memory including at least one program code, and the at least one program code can be executed by a processor to complete the request processing method in the above embodiment. For example, the computer-readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), a magnetic tape, a floppy disk, an optical data storage device, etc.

[0271] In an exemplary embodiment, a computer program product is also provided, the computer program product includes at least one computer program, the at least one computer program is stored in a computer-readable storage medium. A processor of a computer device reads the at least one computer program from the computer-readable storage medium, and the processor executes the at least one computer program, so that the computer device performs the operations performed by the above-mentioned request processing method.

[0272] In some embodiments, the computer program involved in the embodiments of the present application may be deployed and executed on a computer device, or on multiple computer devices located at one location, or on multiple computer devices distributed at multiple locations and interconnected by a communication network. Multiple computer devices distributed at multiple locations and interconnected by a communication network may constitute a blockchain system.

[0273] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0274] The above are only optional embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A request processing method, characterized in that: The method comprises: Receiving a first HTTP request; In response to the first HTTP request not hitting at least two request processing rules, forwarding the first HTTP request and counting based on a source IP address of the first HTTP request; In response to the number of HTTP requests from the source IP address reaching a threshold of any request processing rule, an instruction corresponding to any request processing rule is written; any request processing rule includes a rate limit rule, and the rate limit rule is used to limit the rate at which the source IP address sends HTTP requests; receiving a second HTTP request from the source IP address, and in response to determining that the second HTTP request hits the request processing rule based on the written instruction, counting the number of connections maintained with the source IP address and the number of data packets sent by the source IP address; In response to the number of connections maintained with the source IP address exceeding a first number, disconnecting the connections exceeding the first number; In response to the data packets sent by the source IP address exceeding a second number, limiting the number of data packets sent by the source IP address within a first time period; In response to the number of data packets sent by the source IP address within the first time period exceeding a third number, the data packets received within the remaining time period of the first time period are discarded; in the process of restricting the HTTP request of the source IP address, the discarded data packets can be resent by the source IP address; Among them, the at least two request processing rules are used to indicate different restriction processing based on different sending number thresholds of HTTP requests within a counting period. The larger the number threshold corresponding to the request processing rule, the stricter the restriction processing on HTTP requests in each dimension in the request processing rule.

2. The method according to claim 1, characterized in that The method further comprises: Whether the first HTTP request hits the at least two request processing rules is judged according to the target order, and the target order is used to indicate the corresponding strictness of the request processing rules from large to small.

3. The method according to claim 1, characterized in that The method further comprises: The number of newly-established connections with the source IP address within a first duration is counted, and in response to the number of newly-established connections exceeding a fourth number, establishment of a new connection with the source IP address is refused.

4. The method according to claim 1, characterized in that: The at least two request processing rules also include a rejection rule, wherein the rejection rule is used to reject the HTTP request sent by the source IP address.

5. The method according to claim 4, characterized in that At least one level of speed limit rule is used to limit at least one of the number of connections that can be maintained between the source IP address and the gateway device, the number of new connections that can be established between the source IP address and the gateway device per second, and the number of data packets transmitted per second.

6. The method according to claim 1, characterized in that After executing the restriction processing corresponding to the request processing rule, the method further includes: A timer is started, and in response to not receiving an HTTP request from the source IP address again within a second time period, an instruction to delete a corresponding request processing rule.

7. The method according to claim 1, characterized in that The method further comprises: In response to receiving any HTTP request, based on the source IP address of the HTTP request, it is detected whether it is the first time that an HTTP request from the source IP address of the HTTP request is received. In response to the first time that an HTTP request from the source IP address of the HTTP request is received, a counter is started, and a timer is started to record the statistical duration of the counter.

8. A request processing device, characterized in that: The device comprises: A receiving module, used for receiving a first HTTP request; a forwarding module, configured to forward the first HTTP request in response to the first HTTP request not matching at least two request processing rules; A statistics module, configured to count based on a source IP address of the first HTTP request; A writing module, configured to write an instruction corresponding to any request processing rule in response to the number of HTTP requests from the source IP address reaching a threshold of any request processing rule; the any request processing rule includes a rate limit rule, and the rate limit rule is used to limit the rate at which the source IP address sends HTTP requests; The receiving module is used to receive a second HTTP request from the source IP address; a restriction module, configured to execute restriction processing corresponding to the request processing rule in response to determining that the second HTTP request hits the request processing rule based on the written instruction; The restriction module comprises: A first counting module, used for counting the number of data packets sent from the source IP address; A second counting module, used for counting the number of connections maintained with the source IP address; an interruption module, configured to disconnect the connections exceeding a first number in response to the number of connections maintained with the source IP address exceeding the first number; a rejection module, configured to limit the number of data packets sent by the source IP address within a first time period in response to the number of data packets sent by the source IP address exceeding a second number; discard data packets received within the remaining time period of the first time period in response to the number of data packets sent by the source IP address within the first time period exceeding a third number; in the process of restricting the HTTP request of the source IP address, the discarded data packets may be resent by the source IP address; Among them, the at least two request processing rules are used to indicate different restriction processing based on different sending number thresholds of HTTP requests within a counting period. The larger the number threshold corresponding to the request processing rule, the stricter the restriction processing on HTTP requests in each dimension in the request processing rule.

9. The device according to claim 8, characterized in that The device also includes: The judgment module is used to judge whether the first HTTP request hits the at least two request processing rules according to the target order, and the target order is used to represent the corresponding strictness of the request processing rules from large to small.

10. The device according to claim 8, characterized in that The restriction module comprises: A third counting module, used for counting the number of newly established connections with the source IP address within a first time period; The rejection module is used to reject the establishment of a new connection with the source IP address in response to the number of newly established connections exceeding a fourth number.

11. The device according to claim 8, characterized in that The at least two request processing rules also include a rejection rule, wherein the rejection rule is used to reject the HTTP request sent by the source IP address.

12. The device according to claim 11, characterized in that At least one level of speed limit rule is used to limit at least one of the number of connections that can be maintained between the source IP address and the gateway device, the number of new connections that can be established between the source IP address and the gateway device per second, and the number of data packets transmitted per second.

13. The device according to claim 8, characterized in that The device also includes: A start module, used to start the timer; The deletion module is used to delete the instruction of the corresponding request processing rule in response to not receiving the HTTP request from the source IP address again within the second time period.

14. The device according to claim 8, characterized in that The device also includes: a detection module, configured to detect, in response to receiving any HTTP request, whether it is the first time to receive an HTTP request from the source IP address of the HTTP request according to the source IP address of the HTTP request; The starting module is used to start a counter in response to receiving an HTTP request from a source IP address of the HTTP request for the first time, and start a timer to record the statistical duration of the counter.

15. A computer device, characterized in that: The computer device includes one or more processors and one or more memories, wherein at least one computer program is stored in the one or more memories, and the at least one computer program is loaded and executed by the one or more processors to implement the operations performed by the request processing method according to any one of claims 1 to claim 7.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one computer program, and the at least one computer program is loaded and executed by a processor to implement the operations performed by the request processing method according to any one of claims 1 to 7.

17. A computer program product, characterized in that The computer program product includes at least one computer program, which is stored in a computer-readable storage medium. The at least one computer program is read and executed from the computer-readable storage medium by a processor of a computer device to implement the operations performed by the request processing method according to any one of claims 1 to 7.

Images