Malicious IP address blocking processing method, device and equipment and storage medium

Abstract

This invention relates to the field of computer network technology, and discloses a method, apparatus, device, and storage medium for blocking malicious IP addresses. The method for blocking malicious IP addresses includes: establishing an IP address information database and configuring blocking policies; when an access request is received, obtaining the real IP address of the client originating from the access request; and blocking the real IP address based on the blocking policies. This invention blocks real client IP addresses, allows for flexible configuration of blocking policies, and avoids situations where blocking proxy server IP addresses would cause widespread access disruptions.

Description

Technical Field

[0001] This invention relates to the field of computer networks, and in particular to a method, apparatus, device, and storage medium for blocking malicious IP addresses. Background Technology

[0002] With the rapid development of the internet, its scale has grown exponentially, and internet security issues have become increasingly complex. Large website systems are frequently subjected to illegal attacks, with numerous malicious IP addresses accessing the network, consuming server resources, or attacking computer network bandwidth and connectivity, thus affecting normal website access. To quickly cut off the impact of illegal attacks on the network, it is necessary to promptly block access to the network by unauthorized users or the source of the attack. IP address blocking uses network technology to block specific IP addresses, denying them access and achieving the goal of resisting attacks.

[0003] In existing technologies, web servers operate at the application layer of the network. Current application-layer automatic blocking devices for malicious IP addresses primarily rely on IP address access behavior or threat intelligence databases for blocking. An IP address's access behavior triggers frequent security rules, leading to blocking; alternatively, malicious IP addresses imported into the threat intelligence database are directly blocked. The security rules for these existing blocking devices require security personnel to manually create them after analyzing network traffic and logs, and subsequent rules also require manual maintenance and updates. Simultaneously, threat intelligence databases need frequent updates to obtain the latest malicious IP address information. Applying the same blocking strategy to different malicious IP addresses results in a high false positive rate. Furthermore, most existing blocking devices block malicious IP addresses at the network layer, lacking flexibility. If a proxy is present in front of the web server, it can easily cause widespread inaccessibility, impacting business operations. Summary of the Invention

[0004] The main objective of this invention is to provide a method, apparatus, device, and storage medium for blocking malicious IP addresses, aiming to solve the technical problem that existing malicious IP blocking devices have a single blocking strategy and are prone to false blocking.

[0005] The first aspect of this invention provides a method for blocking malicious IP addresses, comprising:

[0006] Establish an IP address database and configure blocking policies;

[0007] When an access request is received, obtain the real IP address of the client from which the access request originated;

[0008] Based on the blocking strategy, the real IP address is blocked.

[0009] Optionally, in a first implementation of the first aspect of the present invention, establishing the IP address information database includes:

[0010] Obtain various tags and their corresponding IP address information. The tag categories include one or more of the following: address, ISP, IDC, anycast, threat intelligence, and custom.

[0011] An IP address information database is established based on each of the aforementioned tags and each of the aforementioned IP address information.

[0012] Optionally, in a second implementation of the first aspect of the present invention, the configuration blocking strategy includes:

[0013] Retrieve the IP address information of the matched object;

[0014] Based on the IP address information of the matched object, count the number of times the matched object accesses a certain path within a preset number of periods;

[0015] Obtain the matching action and configure the blocking strategy for the matching action to be executed when the number of requests to the matching object meets the preset blocking conditions.

[0016] Optionally, in a third implementation of the first aspect of the present invention, the configuration blocking strategy further includes:

[0017] When multiple blocking strategies are configured, the priority of each blocking strategy is configured.

[0018] Optionally, in a fourth implementation of the first aspect of the present invention, the step of blocking the real IP address based on the blocking strategy includes:

[0019] Based on the priority of each blocking strategy, the real IP address is judged in order from high priority to low priority to determine whether it meets each of the preset blocking conditions.

[0020] When the real IP address meets a certain preset blocking condition, the corresponding matching action is executed, and the judgment of subsequent preset blocking conditions is stopped.

[0021] Optionally, in a fifth implementation of the first aspect of the present invention, obtaining the real IP address of the client from which the access request originates when an access request is received includes:

[0022] When an access request is received, determine whether there is a proxy server in front of the application layer;

[0023] If there is no proxy server in front of the application layer, the IP address of the peer that establishes the connection will be used as the real IP address.

[0024] If there is a proxy server in front of the application layer, the default resolution method is used to obtain the real IP address.

[0025] Optionally, in a sixth implementation of the first aspect of the present invention, the step of obtaining the real IP address by applying a pre-defined resolution method if there is a proxy server in front of the application layer includes:

[0026] Determine whether the IP address of the peer establishing the connection is a trusted IP;

[0027] If the peer IP address of the established connection is an untrusted IP, then the peer IP address of the established connection will be used as the real IP address.

[0028] If the IP address of the peer establishing the connection is a trusted IP, then determine whether the proxy server is a network layer proxy server.

[0029] If the proxy server is a network layer proxy server, then the real IP address is obtained from the TCP packet;

[0030] If the proxy server is a non-network layer proxy server, then determine whether the header field of the access request is a custom header field;

[0031] If the header field of the access request is a custom header field, then the information in the header field is taken as the real IP address;

[0032] If the header field of the access request is not a custom header field, then the value of the X-Forwarded-For field of the header field of the access request is taken as the real IP address.

[0033] A second aspect of the present invention provides a device for blocking malicious IP addresses, comprising:

[0034] The configuration module is used to establish an IP address information database and configure blocking policies;

[0035] The processing module is used to obtain the real IP address of the client from which the access request originates when an access request is received.

[0036] The blocking module is used to block the real IP address based on the blocking strategy.

[0037] Optionally, in a first implementation of the second aspect of the present invention, the configuration module is specifically used for:

[0038] Obtain various tags and their corresponding IP address information. The tag categories include one or more of the following: address, ISP, IDC, anycast, threat intelligence, and custom.

[0039] An IP address information database is established based on each of the aforementioned tags and each of the aforementioned IP address information.

[0040] Optionally, in a second implementation of the second aspect of the present invention, the configuration module is further specifically used for:

[0041] Retrieve the IP address information of the matched object;

[0042] Based on the IP address information of the matched object, count the number of times the matched object accesses a certain path within a preset number of periods;

[0043] Obtain the matching action and configure the blocking strategy for the matching action to be executed when the number of requests to the matching object meets the preset blocking conditions.

[0044] Optionally, in a third implementation of the second aspect of the present invention, the configuration module is further specifically used for:

[0045] When multiple blocking strategies are configured, the priority of each blocking strategy is configured.

[0046] Optionally, in a fourth implementation of the second aspect of the present invention, the blocking module is specifically used for:

[0047] Based on the priority of each blocking strategy, the real IP address is judged in order from high priority to low priority to determine whether it meets each of the preset blocking conditions.

[0048] When the real IP address meets a certain preset blocking condition, the corresponding matching action is executed, and the judgment of subsequent preset blocking conditions is stopped.

[0049] Optionally, in a fifth implementation of the second aspect of the present invention, the processing module includes:

[0050] The judgment unit is used to determine whether there is a proxy server in front of the application layer when an access request is received;

[0051] The processing unit is used to treat the peer IP address of the established connection as the real IP address if there is no proxy server in front of the application layer.

[0052] The resolution unit is used to obtain the real IP address by applying a pre-defined resolution method if there is a proxy server in front of the application layer.

[0053] Optionally, in a sixth implementation of the second aspect of the present invention, the parsing unit is specifically used for:

[0054] Determine whether the IP address of the peer establishing the connection is a trusted IP;

[0055] If the peer IP address of the established connection is an untrusted IP, then the peer IP address of the established connection will be used as the real IP address.

[0056] If the IP address of the peer establishing the connection is a trusted IP, then determine whether the proxy server is a network layer proxy server.

[0057] If the proxy server is a network layer proxy server, then the real IP address is obtained from the TCP packet;

[0058] If the proxy server is a non-network layer proxy server, then determine whether the header field of the access request is a custom header field;

[0059] If the header field of the access request is a custom header field, then the information in the header field is taken as the real IP address;

[0060] If the header field of the access request is not a custom header field, then the value of the X-Forwarded-For field of the header field of the access request is taken as the real IP address.

[0061] A third aspect of the present invention provides an electronic device, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor invokes the instructions in the memory to cause the electronic device to execute the aforementioned method for blocking malicious IP addresses.

[0062] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the aforementioned method for blocking malicious IP addresses.

[0063] The technical solution provided by this invention establishes an IP address information database and configures blocking strategies. When an access request is received, the real IP address of the client originating from the access request is obtained. Based on the blocking strategy, the real IP address is blocked. This invention automatically obtains the real client IP address and blocks it, avoiding widespread access disruption caused by blocking proxy server IP addresses. Furthermore, it allows for flexible configuration of blocking strategies based on multi-dimensional information, overcoming the shortcomings of existing blocking devices that rely solely on IP address information. Attached Figure Description

[0064] Figure 1 This is a schematic diagram of one embodiment of the method for blocking malicious IP addresses in this invention.

[0065] Figure 2 This is a schematic diagram of another embodiment of the method for blocking malicious IP addresses in this invention;

[0066] Figure 3 This is a schematic diagram of one embodiment of the malicious IP address blocking and processing device in this invention.

[0067] Figure 4 This is a schematic diagram of one embodiment of the electronic device in this invention. Detailed Implementation

[0068] This invention provides a method, apparatus, device, and storage medium for blocking malicious IP addresses. It automatically obtains the real client IP address and blocks the real client IP address, avoiding the situation where blocking the proxy server IP address causes a large-scale inaccessibility. At the same time, it can flexibly configure the blocking strategy according to multi-dimensional information, overcoming the shortcomings of existing blocking devices that only block based on IP address information.

[0069] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” or “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0070] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 1 One embodiment of the method for blocking malicious IP addresses in this invention includes:

[0071] 101. Establish an IP address database and configure blocking policies;

[0072] It is understood that the executing entity of this invention can be a malicious IP address blocking device, a terminal, or a server; no specific limitation is made here. This embodiment of the invention will be described using a server as the executing entity as an example.

[0073] In this embodiment, IP (Internet Protocol) is a network layer protocol in the TCP / IP (Transmission Control Protocol / Internet Protocol) address system. IP stipulates that all devices on the network must have a unique IP address. The IP address information database is a basic IP address information database pre-established based on tags such as GeoIP, ISP, and IDC, storing various predefined tags and their corresponding IP address information. The blocking strategy refers to blocking specific IP addresses and restricting their access.

[0074] Optionally, in one embodiment, establishing the IP address information database includes:

[0075] Obtain various tags and their corresponding IP address information. The tag categories include one or more of the following: address, ISP, IDC, anycast, threat intelligence, and custom.

[0076] An IP address information database is established based on each of the aforementioned tags and each of the aforementioned IP address information.

[0077] Specifically, IP address information refers to a specific IP address or a class of IP addresses; GeoIP tags contain the address information of IP addresses, including longitude and latitude, city, province / state, country, country code, city code, and postal code; ISP (Internet Service Provider) tags refer to telecommunications operators such as China Telecom, China Mobile, and Great Wall Broadband that provide Internet access services to the public; IDC (Internet Data Center) is a central platform established by the telecommunications department or enterprises using existing Internet communication lines and bandwidth resources to create a standardized telecommunications professional-level computer room environment, providing comprehensive services such as server hosting, leasing, and related value-added services for enterprises and governments. Examples include the UCloud Ulanqab Data Center and the Beijing Dr. Peng Data Center, etc.; Anycast identifies a group of hosts providing specific services through an Anycast address on an IP network. At the same time, the service access party does not care which specific host provides the service, and the packets accessing this address can be routed by the IP network to any one of this group of targets. Most of these IP addresses are server IP addresses and rarely initiate external access actively; Threat intelligence tags include, but are not limited to, tags such as scanners, zombie hosts, home broadband, host operating systems, and host services. Among them, a scanner uses this type of IP address and uses programming languages or tools to automatically send TCP packets to detect hosts in the Internet network, record the open port conditions of the hosts, and sometimes also detect operating system information, application layer protocol information of a certain port, application layer service information, and vulnerability information of the operating system or service, etc.; A zombie host refers to a computer device infected with a zombie program virus and thus controlled by a hacker program. This computer device can be a terminal device or a cloud device, and it can launch a Denial of Service (DoS) attack or send spam at any time according to the hacker's commands and control instructions, making the computer or network unable to provide normal services; Home broadband refers to the IP addresses provided by ISPs to individual and household users, and these users can use these IP addresses to access the Internet; Host operating systems mean that there are many hosts in the Internet, and these hosts will all install operating systems, especially the hosts belonging to IDCs. Different operating systems will open some fixed ports or other characteristics, and the operating system installed on the host can be judged based on this information. For example, by scanning the port information of the host, or by judging the operating system of a host based on the different points of handling TCP packets by different operating systems, such as Windows, Linux, etc.; Host services mean that the hosts belonging to IDCs generally act as the server side of a certain service. Usually, their port information is scanned, and based on the common port information, or by sending different types of TCP packets to a certain port of this host and judging the service provided by the host according to the returned information. The IP addresses of server hosts also rarely initiate external access actively;Custom tags are user-defined tags, such as the exit IP address of the Shenzhen branch office area, the exit IP address of the Shanghai branch office area, etc. You can also set a custom tag based on trigger rules for a specific IP address, search for a tag, and assign other tags to the IP addresses under that tag.

[0078] Specifically, various tags and their corresponding IP address information are obtained, merged, and a database corresponding to the tags and IP address information is established, namely the IP address information database.

[0079] Optionally, in one embodiment, the configured blocking strategy includes:

[0080] Retrieve the IP address information of the matched object;

[0081] Based on the IP address information of the matched object, count the number of times the matched object accesses a certain path within a preset number of periods;

[0082] Obtain the matching action and configure the blocking strategy for the matching action to be executed when the number of requests to the matching object meets the preset blocking conditions.

[0083] Specifically, the matching object is the object that matches the current blocking policy. The action corresponding to the current blocking policy must be executed. The matching objects include a single IP address, IP addresses belonging to a certain CIDR (Classless Inter-Domain Routing) block, and IP addresses with a certain label; a single IP address N1.N2.N3.N4, where N1, N2, N3, and N4 can be any number between 0 and 255; IPs belonging to a certain CIDR block ABCD / N, where A, B, C, and D cannot be set and represent a decimal IP address, and N can be any number from 0 to 32, representing the number of bits in the prefix identifying the network in ABCD converted into a binary number. For example, 192.168.10.1 / 16 means that the prefix identifying the network has 16 bits, that is, 192.168 is the prefix, and 10.1 is the address of the specific host in this network. When N is 0, it can match all IP addresses, and when it is 32, it is equivalent to a single IP address.

[0084] Specifically, the system counts the number of requests made by the matched object to access / attack a certain path or file within N M-second periods. For example, it counts the number of requests made by the matched object to access a certain path or file within three consecutive 60-second periods as 5, 3, and 5 times. Alternatively, it counts the number of requests made by the matched object to access / attack a certain path or file within N M-second periods where the HTTP header field equals / contains / matches a certain string via regular expression. For example, if the matched object accesses a certain path or file within three consecutive 60-second periods, and the header field of these access requests contains a specific From field (setting the email address of the user sending the request), the number of requests is counted as 5, 2, and 5 times.

[0085] Specifically, matching actions include, but are not limited to, blocking such requests, enabling CAPTCHAs, limiting request rates, returning custom response codes and custom response content, and not processing requests but only logging them. Matching actions also include direct blocking; when the matching action for a target is direct blocking, there is no need to count the number of requests made by the target. Matching actions can also include additional actions, such as: additionally blocking the target and IP addresses belonging to the same CIDR block ABCD / N, and adding a tag (e.g., scanner IP, IDC data center IP, crawler pool IP) to the target (and IP addresses belonging to the same CIDR block ABCD / N).

[0086] Optionally, in one embodiment, the configured blocking strategy further includes:

[0087] When multiple blocking strategies are configured, the priority of each blocking strategy is configured.

[0088] Specifically, different blocking strategies can be set with different blocking times and methods. Network segments can also be blocked as needed. Multiple blocking strategies can be configured at the same time, and the priority of each blocking strategy can be configured to block from high priority to low priority.

[0089] 102. When an access request is received, obtain the real IP address of the client from which the access request originated;

[0090] In this embodiment, the real IP address of the client from which the access request originates is obtained based on the header information of the access request.

[0091] 103. Based on the blocking strategy, the real IP address is blocked.

[0092] In this embodiment, based on the configured blocking strategies, the number of access requests is counted, and it is determined whether blocking is required. If so, the corresponding matching action is executed to block the access.

[0093] In this embodiment of the invention, an IP address information database is established and a blocking strategy is configured. When an access request is received, the real IP address of the client originating from the access request is obtained. Based on the blocking strategy, the real IP address is blocked. This invention automatically obtains the real client IP address and blocks it, avoiding widespread access disruption caused by blocking proxy server IP addresses. Furthermore, it allows for flexible configuration of blocking strategies based on multi-dimensional information, overcoming the shortcomings of existing blocking devices that rely solely on IP address information.

[0094] Please see Figure 2 Another embodiment of the method for blocking malicious IP addresses in this invention includes:

[0095] 201. Establish an IP address information database and configure blocking policies;

[0096] Optionally, in one embodiment, a blacklist and whitelist are established. IP addresses of whitelisted labels are allowed to pass directly without being blocked, while IP addresses of blacklisted labels are blocked directly.

[0097] Optionally, in one embodiment, when updating the IP address information database, blocked IP addresses that had a certain tag in the IP address information database before the update but do not have that tag in the updated IP address information database are removed.

[0098] 202. When an access request is received, determine whether there is a proxy server in front of the application layer;

[0099] In this embodiment, the application layer is the highest layer in the OSI reference model of the network. It provides services to users and has user interface functions for network transmission. It is mainly responsible for communication between users and applications or between applications on the network. The application layer is the entry point for users or applications to access the network through the interface and protocol. The proxy server is a server that acts as an intermediary between personal networks and Internet service providers to obtain network information on behalf of network users. It is responsible for forwarding legitimate network information and controlling and registering the forwarding.

[0100] 203. If there is no proxy server in front of the application layer, the IP address of the peer that establishes the connection will be used as the real IP address.

[0101] In this embodiment, if there is no proxy server in front of the application layer, the IP address of the peer that establishes the connection is the real IP address of the host that sent the access request.

[0102] 204. If there is a proxy server in front of the application layer, then use the default resolution method to obtain the real IP address;

[0103] Optionally, in one embodiment, step 204 above includes:

[0104] Determine whether the IP address of the peer establishing the connection is a trusted IP;

[0105] If the peer IP address of the established connection is an untrusted IP, then the peer IP address of the established connection will be used as the real IP address.

[0106] If the IP address of the peer establishing the connection is a trusted IP, then determine whether the proxy server is a network layer proxy server.

[0107] If the proxy server is a network layer proxy server, then the real IP address is obtained from the TCP packet;

[0108] If the proxy server is a non-network layer proxy server, then determine whether the header field of the access request is a custom header field;

[0109] If the header field of the access request is a custom header field, then the information in the header field is taken as the real IP address;

[0110] If the header field of the access request is not a custom header field, then the value of the X-Forwarded-For field of the header field of the access request is taken as the real IP address.

[0111] Specifically, to prevent malicious IP address requests from being spoofed, a trusted IP address list can be configured. Only IP addresses in the trusted IP address list will have their transmitted information extracted to obtain the client's real IP address. IP addresses not in the trusted IP address list will be treated as the client's real IP address.

[0112] Specifically, for IP addresses in the trusted IP address list, it is determined whether the proxy server is a network layer proxy server. If the proxy server is a network layer proxy server, the client's real IP address is obtained through TOA (Type of Address, which is a method of placing the IP address and port in the option field of the last data packet in the TCP three-way handshake process). Otherwise (if the proxy server is not a network layer proxy server), it is determined whether the header field of the access request contains a custom request header field for transmitting IP address. If it does, the IP address in the custom request header field is taken as the real IP address. If it does not, the value of the X-Forwarded-For field in the header field of the access request is taken as the real IP address. Here, X-Forwarded-For (XFF) is an HTTP request header field used to identify the original IP address of the client connecting to the web server through an HTTP proxy or load balancer.

[0113] 205. Based on the blocking strategy, the real IP address is blocked.

[0114] Optionally, in one embodiment, adjustments are made based on the host's load. When the load is too high, coarse-grained blocking is implemented. For example, when the host's load exceeds a preset threshold, the matching target is expanded to IP addresses belonging to the same CIDR block ABCD / N to block malicious IP addresses to the greatest extent and reduce host resource consumption. When the host load is normal, the original blocking strategy is restored.

[0115] Optionally, in one embodiment, the blocked malicious IP addresses are synchronized to the network layer firewall or the front-end proxy server, so that the requests are intercepted at the network layer, reducing resource consumption.

[0116] Optionally, in one embodiment, step 205 includes:

[0117] Based on the priority of each blocking strategy, the real IP address is judged in order from high priority to low priority to determine whether it meets each of the preset blocking conditions.

[0118] When the real IP address meets a certain preset blocking condition, the corresponding matching action is executed, and the judgment of subsequent preset blocking conditions is stopped.

[0119] To facilitate understanding, the following example illustrates the sealing process:

[0120] In this embodiment, the following four blocking strategies are configured, with a priority order of ①>②>③>④:

[0121] ① IP addresses in the GeoIP tag of the blocked IP address database that have the country information of the United States;

[0122] ②If any IP address accesses the site 100 times within a 60-second period, that IP address will be automatically blocked for 1 hour;

[0123] ③ If any IP address triggers an attack more than 10 times within a 10-second period, all IP addresses under the CIDR block ABCD / 24 to which that IP address belongs will be automatically blocked for 24 hours;

[0124] ④ If any IP address does not access the network more than 10 times in three consecutive 60-second cycles, the IP address will be automatically blocked for 1 hour and a scanner tag will be added to the IP address.

[0125] At this point, if an IP address (1.1.1.1) accesses the application, the application first queries the GeoIP of that IP address. If the country information of the IP address is found to be the United States, it will be considered as triggering blocking policy ① and blocked, and the further evaluation of blocking policies ②, ③, and ④ will cease; otherwise, the access status of that IP address will be recorded.

[0126] If the IP address accesses the site 110 times within 60 seconds, including 20 attack behaviors, with each attack behavior occurring once every 3 seconds (matching blocking policy ②), then the IP address 1.1.1.1 will be blocked for 1 hour as a trigger of rule ② by the blocking device.

[0127] If the IP address accesses the site 100 times within 60 seconds, including 10 attack behaviors, and the attack behaviors occur within a consecutive 10 seconds (matching blocking policies ② and ③), then the IP address 1.1.1.1 will be considered as triggering rule ② by the blocking device and blocked for 1 hour (blocking policy ② has higher priority; after determining that blocking policy ② is met, the corresponding matching action is executed, and there is no need to judge blocking policies ③ and ④).

[0128] If the IP address accesses the site 50 times within 10 seconds, including 10 attack attempts, then the CIDR block 1.1.1.0 / 24 to which the IP address belongs will be considered as triggering rule ③ by the blocking device and blocked for 24 hours.

[0129] If the IP address accesses the network 5 times within 1 minute, then once within the next minute, and then 5 times within the next minute, the IP address 1.1.1.1 will be blocked for 1 hour as a trigger rule ④, and the IP address will be added to the scanner's tag.

[0130] In this embodiment of the invention, an IP address information database is established and a blocking strategy is configured. When an access request is received, it is determined whether there is a proxy server before the application layer. If there is no proxy server before the application layer, the IP address of the peer establishing the connection is taken as the real IP address. If there is a proxy server before the application layer, a pre-set resolution method is applied to obtain the real IP address. Based on the blocking strategy, the real IP address is blocked. This invention obtains the real client IP address through a pre-set resolution method and blocks the real client IP address, avoiding the situation where blocking the proxy server IP address would cause widespread inaccessibility. Blocking is performed based on precise IP address access behavior, which can count excessive / insufficient access requests from IP addresses. Compared with existing blocking devices, it can block IP addresses with significantly fewer accesses than normal accesses, thus resisting slow CC attacks from a large number of IP addresses. It can also count various HTTP header fields of IP address access requests and the frequency and proportion of response codes, realizing automatic blocking of malicious IPs exhibiting abnormal access behavior. At the same time, blocking strategies can be flexibly configured based on multi-dimensional information, and coarse-grained blocking can also be performed to improve efficiency.

[0131] The above describes the method for blocking malicious IP addresses in embodiments of the present invention. The following describes the apparatus for blocking malicious IP addresses in embodiments of the present invention. Please refer to [link / reference]. Figure 3 One embodiment of the malicious IP address blocking processing device in this invention includes:

[0132] Configuration module 301 is used to establish an IP address information database and configure blocking policies;

[0133] Processing module 302 is used to obtain the real IP address of the client from which the access request originates when an access request is received;

[0134] The blocking module 303 is used to block the real IP address based on the blocking strategy.

[0135] Optionally, the configuration module 301 is specifically used for:

[0136] Obtain various tags and their corresponding IP address information. The tag categories include one or more of the following: address, ISP, IDC, anycast, threat intelligence, and custom.

[0137] An IP address information database is established based on each of the aforementioned tags and each of the aforementioned IP address information.

[0138] Optionally, the configuration module 301 can also be specifically used for:

[0139] Retrieve the IP address information of the matched object;

[0140] Based on the IP address information of the matched object, count the number of times the matched object accesses a certain path within a preset number of periods;

[0141] Obtain the matching action and configure the blocking strategy for the matching action to be executed when the number of requests to the matching object meets the preset blocking conditions.

[0142] Optionally, the configuration module 301 can also be specifically used for:

[0143] When multiple blocking strategies are configured, the priority of each blocking strategy is configured.

[0144] Optionally, the blocking module 303 is specifically used for:

[0145] Based on the priority of each blocking strategy, the real IP address is judged in order from high priority to low priority to determine whether it meets each of the preset blocking conditions.

[0146] When the real IP address meets a certain preset blocking condition, the corresponding matching action is executed, and the judgment of subsequent preset blocking conditions is stopped.

[0147] Optionally, the processing module 302 includes:

[0148] The judgment unit 3021 is used to determine whether there is a proxy server in front of the application layer when an access request is received;

[0149] The processing unit 3022 is used to use the peer IP address of the established connection as the real IP address if there is no proxy server in front of the application layer.

[0150] The resolution unit 3023 is used to obtain the real IP address by applying a pre-defined resolution method if there is a proxy server in front of the application layer.

[0151] Optionally, the parsing unit 3023 is specifically used for:

[0152] Determine whether the IP address of the peer establishing the connection is a trusted IP;

[0153] If the peer IP address of the established connection is an untrusted IP, then the peer IP address of the established connection will be used as the real IP address.

[0154] If the IP address of the peer establishing the connection is a trusted IP, then determine whether the proxy server is a network layer proxy server.

[0155] If the proxy server is a network layer proxy server, then the real IP address is obtained from the TCP packet;

[0156] If the proxy server is a non-network layer proxy server, then determine whether the header field of the access request is a custom header field;

[0157] If the header field of the access request is a custom header field, then the information in the header field is taken as the real IP address;

[0158] If the header field of the access request is not a custom header field, then the value of the X-Forwarded-For field of the header field of the access request is taken as the real IP address.

[0159] In this embodiment of the invention, an IP address information database is established and a blocking strategy is configured. When an access request is received, the real IP address of the client originating from the access request is obtained. Based on the blocking strategy, the real IP address is blocked. This invention automatically obtains the real client IP address and blocks it, avoiding widespread access disruption caused by blocking proxy server IP addresses. Furthermore, it allows for flexible configuration of blocking strategies based on multi-dimensional information, overcoming the shortcomings of existing blocking devices that rely solely on IP address information.

[0160] above Figure 3 The malicious IP address blocking device in this embodiment of the invention will be described in detail from the perspective of modular functional entities. The electronic device in this embodiment of the invention will be described in detail from the perspective of hardware processing.

[0161] Figure 4 This is a schematic diagram of the structure of an electronic device 500 provided in an embodiment of the present invention. The electronic device 500 can vary significantly due to differences in configuration or performance, and may include one or more central processing units (CPUs) 510 (e.g., one or more processors) and a memory 520, and one or more storage media 530 (e.g., one or more mass storage devices) for storing application programs 533 or data 532. The memory 520 and storage media 530 can be temporary or persistent storage. The program stored in the storage media 530 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the electronic device 500. Furthermore, the processor 510 may be configured to communicate with the storage media 530 and execute the series of instruction operations in the storage media 530 on the electronic device 500.

[0162] Electronic device 500 may also include one or more power supplies 540, one or more wired or wireless network interfaces 550, one or more input / output interfaces 560, and / or one or more operating systems 531, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. Those skilled in the art will understand that... Figure 4 The illustrated electronic device structure does not constitute a limitation on the electronic device and may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0163] The present invention also provides an electronic device, the electronic device including a memory and a processor, the memory storing computer-readable instructions, which, when executed by the processor, cause the processor to perform the steps of the malicious IP address blocking method described in the above embodiments.

[0164] The present invention also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when the instructions are executed on a computer, cause the computer to perform the steps of the method for blocking malicious IP addresses.

[0165] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0166] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0167] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for blocking malicious IP addresses, characterized in that, The blocking of malicious IP addresses includes: Establish an IP address information database and configure blocking policies. The configuration of blocking policies includes: obtaining the IP address information of matching objects, where the matching objects include a single IP address, IP addresses belonging to the same CIDR block, or IP addresses with a specific label; based on the IP address information of the matching objects, counting the number of times the matching objects access a certain path within a preset number of periods; obtaining matching actions, where the matching actions include enabling CAPTCHAs, limiting request rates, or blocking requests, and configuring the blocking policy to execute the matching action when the number of requests from the matching objects meets preset blocking conditions; when multiple blocking policies are configured, configuring the priority of each blocking policy. When an access request is received, obtain the real IP address of the client from which the access request originated; Based on the blocking strategy, the real IP address is blocked; the blocking process includes: judging whether the real IP address meets each preset blocking condition in descending order of priority according to the priority of each blocking strategy; when the real IP address meets a preset blocking condition, the corresponding matching action is executed, and the judgment of subsequent preset blocking conditions is stopped; and an adjustment strategy is executed based on the host load, the adjustment strategy including: when the host load is greater than a preset threshold, expanding the matching object from the current blocking object to IP addresses belonging to the same CIDR block for blocking.

2. The method for blocking malicious IP addresses according to claim 1, characterized in that, The establishment of the IP address information database includes: Obtain various tags and their corresponding IP address information. The tag categories include one or more of the following: address, ISP, IDC, anycast, threat intelligence, and custom. An IP address information database is established based on each of the aforementioned tags and each of the aforementioned IP address information.

3. The method for blocking malicious IP addresses according to claim 1, characterized in that, When an access request is received, obtaining the real IP address of the client from which the access request originates includes: When an access request is received, determine whether there is a proxy server in front of the application layer; If there is no proxy server in front of the application layer, the IP address of the peer that establishes the connection will be used as the real IP address. If there is a proxy server in front of the application layer, the default resolution method is used to obtain the real IP address.

4. The method for blocking malicious IP addresses according to claim 3, characterized in that, If there is a proxy server in front of the application layer, the method of obtaining the real IP address using a pre-defined resolution method includes: Determine whether the IP address of the peer establishing the connection is a trusted IP; If the peer IP address of the established connection is an untrusted IP, then the peer IP address of the established connection will be used as the real IP address. If the IP address of the peer establishing the connection is a trusted IP, then determine whether the proxy server is a network layer proxy server. If the proxy server is a network layer proxy server, then the real IP address is obtained from the TCP packet; If the proxy server is a non-network layer proxy server, then determine whether the header field of the access request is a custom header field; If the header field of the access request is a custom header field, then the information in the header field is taken as the real IP address; If the header field of the access request is not a custom header field, then the value of the X-Forwarded-For field of the header field of the access request is taken as the real IP address.

5. A device for blocking malicious IP addresses, characterized in that, The malicious IP address blocking device includes: A configuration module is used to establish an IP address information database and configure blocking policies. The configuration of blocking policies includes: obtaining IP address information of matching objects, where the matching objects include a single IP address, IP addresses belonging to the same CIDR block, or IP addresses with a specific label; based on the IP address information of the matching objects, counting the number of requests the matching objects make to a certain path within a preset number of periods; obtaining matching actions, where the matching actions include enabling CAPTCHAs, limiting request rates, or blocking requests, and configuring the blocking policy to execute the matching action when the number of requests made by the matching objects meets preset blocking conditions; and configuring the priority of each blocking policy when multiple blocking policies are configured. The processing module is used to obtain the real IP address of the client from which the access request originates when an access request is received. The blocking module is used to block the real IP address based on the blocking strategy; including: judging whether the real IP address meets each preset blocking condition in descending order of priority according to the priority of each blocking strategy; when the real IP address meets a preset blocking condition, executing the corresponding matching action and stopping the judgment of subsequent preset blocking conditions; and executing a corresponding adjustment strategy based on the host load, the adjustment strategy including: when the host load is greater than a preset threshold, expanding the matching object from the current blocking object to block IP addresses belonging to the same CIDR block.

6. An electronic device, characterized in that, The electronic device includes: a memory and at least one processor, wherein the memory stores instructions; The at least one processor invokes the instructions in the memory to cause the electronic device to execute the method for blocking malicious IP addresses as described in any one of claims 1-4.

7. A computer-readable storage medium storing instructions thereon, characterized in that, When the instruction is executed by the processor, it implements the method for blocking malicious IP addresses as described in any one of claims 1-4.

Images