Data request risk assessment method and device

Abstract

The present disclosure relates to a data request risk assessment method, device, computer equipment, storage medium and computer program product. The method comprises: when the request category corresponding to the data request to be processed is the target request category, obtaining the request content information and request attribute information of the data request; determining the risk category corresponding to the data request according to the request content information and the request attribute information; and processing the data request according to the request processing method corresponding to the risk category. The use of this method can improve the accuracy of data request risk assessment and ensure the security of the business system.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, and in particular to a risk assessment method, device, computer equipment and storage medium for data requests. Background Art

[0002] In the business system, content crawling, malicious registration, illegal login, etc. may threaten the security of the business system. Therefore, it is necessary to monitor the traffic of the business system to prevent risky traffic from entering the business system. In the prior art, custom rules can be used to set the request category that needs to be intercepted, and the request is intercepted when it is detected that the request is of the request category that needs to be intercepted.

[0003] However, this method cannot accurately judge risky data requests, which affects the security of the business system. Summary of the invention

[0004] Based on this, it is necessary to provide a risk assessment method, device, computer equipment, storage medium and computer program product for data requests that accurately judge risky data requests and improve the security of business systems in response to the above technical problems.

[0005] In a first aspect, an embodiment of the present disclosure provides a method for risk assessment of a data request. The method comprises:

[0006] When the request category corresponding to the data request to be processed is the target request category, obtaining request content information and request attribute information of the data request;

[0007] Determine a risk category corresponding to the data request according to the request content information and the request attribute information;

[0008] The data request is processed according to a request processing method corresponding to the risk category.

[0009] In one of the embodiments, determining the risk category corresponding to the data request according to the request content information and the request attribute information includes:

[0010] Obtaining preset risk category rules, wherein the risk categories include no-risk requests, risk requests, and limited-risk requests;

[0011] The request content information and the request attribute information are classified according to the risk classification rule to determine the risk category corresponding to the data request.

[0012] In one embodiment, the risk category rule is determined by:

[0013] Obtaining request content information, request attribute information, and corresponding risk categories of historical data requests, wherein the request content information includes the request time;

[0014] Determine, according to the request content information, the request attribute information and the risk category, an association relationship between the risk category and the request content information and the request attribute information;

[0015] A risk category rule is determined based on the association relationship.

[0016] In one embodiment, the risk category includes a limit risk request; and processing the data request according to a request processing method corresponding to the risk category includes:

[0017] In the case where the data request is a risk restriction request, obtaining a preset restriction rule;

[0018] The data request is subjected to request restriction processing according to the restriction rule based on the request content information and the request attribute information.

[0019] In one of the embodiments, when the request category corresponding to the data request to be processed is a target request category, obtaining the request content information of the data request further includes:

[0020] Obtain the sender address corresponding to the data request and the preset safe sender address;

[0021] In a case where the sender address does not belong to the preset safe sender address, the request category is determined to be a target request category.

[0022] In one embodiment, the request content information includes a sender address of the data request, and the request attribute information includes a request count; and determining the risk category corresponding to the data request according to the request content information and the request attribute information includes:

[0023] When the data request is sent from the same sending end address and the number of requests is greater than a preset number, it is determined that the risk category corresponding to the data request is a risk request.

[0024] In a second aspect, the present disclosure also provides a risk assessment device for data requests. The device includes:

[0025] an acquisition module, configured to acquire request content information and request attribute information of the data request when the request category corresponding to the data request to be processed is the target request category;

[0026] A determination module, configured to determine a risk category corresponding to the data request according to the request content information and the request attribute information;

[0027] A processing module is used to process the data request according to a request processing method corresponding to the risk category.

[0028] In one embodiment, the determining module includes:

[0029] An acquisition submodule is used to acquire preset risk category rules, wherein the risk categories include no-risk requests, risk requests, and limited-risk requests;

[0030] A determination submodule is used to classify the request content information and the request attribute information according to the risk classification rule to determine the risk category corresponding to the data request.

[0031] In one embodiment, the risk category rule determination module includes:

[0032] An acquisition submodule, used to acquire request content information, request attribute information and corresponding risk category of a historical data request, wherein the request content information includes a request time;

[0033] A first determination submodule, configured to determine, according to the request content information, the request attribute information and the risk category, an association relationship between the risk category and the request content information and the request attribute information;

[0034] The second determination submodule is used to determine the risk category rule according to the association relationship.

[0035] In one embodiment, the risk category includes a request to limit risk; and the processing module includes:

[0036] An acquisition submodule, used for acquiring preset restriction rules when the data request is a risk restriction request;

[0037] A determination submodule is used to perform request restriction processing on the data request according to the restriction rule based on the request content information and the request attribute information.

[0038] In one embodiment, the acquisition module also includes:

[0039] The acquisition submodule is used to obtain the sender address corresponding to the data request and the preset safe sender address;

[0040] The determination submodule is used to determine that the request category is a target request category when the sender address does not belong to the preset safe sender address.

[0041] In one embodiment, the request content information includes the sender address of the data request, and the request attribute information includes the number of requests; the determination module includes:

[0042] The determination submodule is used to determine that the risk category corresponding to the data request is a risk request when the data request is sent from the same sending end address and the number of requests is greater than a preset number.

[0043] In a third aspect, an embodiment of the present disclosure further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any one of the methods in the embodiments of the present disclosure are implemented.

[0044] In a fourth aspect, the embodiments of the present disclosure further provide a computer-readable storage medium, wherein a computer program is stored thereon, and when the computer program is executed by a processor, the steps of any one of the methods in the embodiments of the present disclosure are implemented.

[0045] In a fifth aspect, the embodiments of the present disclosure further provide a computer program product, wherein the computer program product includes a computer program, and when the computer program is executed by a processor, the steps of any one of the methods in the embodiments of the present disclosure are implemented.

[0046] In the disclosed embodiments, when processing a data request, after receiving the data request, when it is determined that the data request is of a target request category, request content information and request attribute information of the data request are obtained, and the risk category corresponding to the data request is determined based on the request content information and the request attribute information, and the data request to be processed is processed in a request manner corresponding to the risk category. By performing a risk assessment on requests of the target request category, an accurate judgment of the risk of the data request is achieved, and the risk category and processing method corresponding to the data request are obtained based on the content information and attribute information of the data request, thereby achieving a more fine-grained judgment and processing of the risk of the data request, further improving the accuracy of the risk judgment and assessment of the data request, ensuring the security of the business system while enhancing the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A diagram of an application environment of a risk assessment method for data request in one embodiment;

[0048] Figure 2 A schematic diagram of a flow chart of a risk assessment method for a data request in one embodiment;

[0049] Figure 3 A schematic diagram of a flow chart of a risk assessment method for a data request in one embodiment;

[0050] Figure 4 A flowchart of a method for determining risk category rules in one embodiment;

[0051] Figure 5 A schematic diagram of a flow chart of a risk assessment method for a data request in one embodiment;

[0052] Figure 6 A schematic diagram of a flow chart of a risk assessment method for a data request in one embodiment;

[0053] Figure 7 A structural block diagram of a risk assessment device for data request in one embodiment;

[0054] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure more clear, the embodiments of the present disclosure are further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the embodiments of the present disclosure and are not used to limit the embodiments of the present disclosure.

[0056] The risk assessment method for data requests provided in the embodiments of the present disclosure can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Among them, the terminal 102 can be but is not limited to various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0057] In one embodiment, Figure 2 As shown, a risk assessment method for data request is provided, and the method is applied to Figure 1 The terminal in is used as an example to illustrate, including the following steps:

[0058] Step S210, when the request category corresponding to the data request to be processed is the target request category, obtaining request content information and request attribute information of the data request;

[0059] Among them, under normal circumstances, in order to prevent risky traffic from entering the system and threatening system security, after receiving the data request, corresponding processing will be performed and the request will not be directly passed.

[0060] In an embodiment of the present disclosure, after receiving a data request, it is determined whether the data request is a target request category, wherein the target request category can be considered as a target request category that may be risky. When the data request is a target request category, it is necessary to further determine the data request. Obtain the request content information and request attribute information of the data request. In an example, the request content information may include but is not limited to the access address of the data request, the request sending end address, the request receiving end address, etc., and the request attribute information may include but is not limited to the request type, the request frequency, etc. In an example, when the request category corresponding to the data request is not the target request category, it can be considered that the data request at this time is not risky and the data request can be directly passed. In one possible implementation, it can be determined whether the data request is a target request category by analyzing and determining the IP address from which the data request is sent.

[0061] Step S220, determining a risk category corresponding to the data request according to the request content information and the request attribute information;

[0062] In the disclosed embodiment, after obtaining the request content information and the request attribute information, the risk category corresponding to the data request is determined according to the request content information and the request attribute information. In one example, the risk category classification rules can be set in advance, and different request content information and request attribute information correspond to different risk categories, wherein the number of risk categories is not limited in this embodiment, for example, the risk category can be set to risky request, risk-free request, and limited risk request. In another example, the risk category can also be determined by machine learning, the risk category of historical data requests can be divided and determined, and the corresponding risk category labels can be marked. The risk category identification model is trained using the association relationship between the request content information and the request attribute information of the historical data request and the corresponding risk category label, and the request content information and the request attribute information of the data request to be processed are input into the risk category identification model, and the risk category corresponding to the data request is obtained through the output of the risk category identification model.

[0063] Step S230: Process the data request according to the request processing method corresponding to the risk category.

[0064] In the embodiment of the present disclosure, after obtaining the risk request category corresponding to the data request, the request processing method corresponding to the risk category is determined, and the data request to be processed is processed according to the corresponding request processing method. In one example, the association between the request processing method and the risk category is determined in advance, wherein the association between the request processing method and the risk category can be determined by analyzing and processing historical data request information. In one example, the request processing method may include but is not limited to passing the request, rejecting the request, delaying the response request, sending a verification code, sending a prompt, etc.

[0065] In the disclosed embodiment, when processing a data request, after receiving the data request, when it is determined that the data request is of the target request category, the request content information and request attribute information of the data request are obtained, and the risk category corresponding to the data request is determined based on the request content information and the request attribute information, and the pending data request is processed in accordance with the request method corresponding to the risk category. By performing risk assessment on the request of the target request category, an accurate judgment of the risk of the data request is achieved, and the risk category and processing method corresponding to the data request are obtained based on the content information and attribute information of the data request, thereby achieving a more fine-grained judgment and processing of the risk of the data request, further improving the accuracy of the risk judgment and assessment of the data request, ensuring the security of the business system while enhancing the user experience. Through this embodiment, it is possible to achieve seamless access to multiple business systems, and at the same time, based on different business needs, support differentiated and flexibly configured risk control strategies.

[0066] In one embodiment, Figure 3 As shown, determining the risk category corresponding to the data request according to the request content information and the request attribute information includes:

[0067] Step S221, obtaining a preset risk category rule, wherein the risk category includes a no-risk request, a risk request, and a limited-risk request;

[0068] Step S222: classify the request content information and the request attribute information according to the risk classification rule to determine the risk category corresponding to the data request.

[0069] In the disclosed embodiment, when determining the risk category corresponding to the data request according to the request content information and the request attribute information, a preset risk category rule is obtained, wherein the risk category rule is generally the association relationship between the request content information and the request attribute information and the risk category. In this embodiment, the association relationship between the request content information and the request attribute information of the data request and the risk category is set in advance according to the actual application scenario. Under normal circumstances, the risk category of the data request can be divided according to the risk size of the data request. In this embodiment, the risk categories include risk-free request, risk request, and limited risk request. Among them, the risk-free request can be considered that the corresponding data request has no risk and will not threaten the system security; the risk request can be considered that the corresponding data request has a risk and will threaten the system security; the limited risk request can be considered that the corresponding data request may have a risk and may threaten the system security, and the request needs to be further restricted. The request content information and the request attribute information are classified according to the risk category rule to determine the risk category corresponding to the data request.

[0070] In the embodiment of the present disclosure, risk categories include risk-free requests, risk requests, and limited risk requests. The data requests are classified according to the request content information and request attribute information of the data requests and risk category rules to obtain the risk category corresponding to the data requests. The risk category can be determined according to the request content information and request attribute information of the data requests, thereby achieving a more fine-grained division of data request risks, improving the accuracy of risk judgment of data requests, and further ensuring the security of the business system.

[0071] In one embodiment, Figure 4 As shown, the method for determining the risk category rule includes:

[0072] Step S410, obtaining request content information, request attribute information and corresponding risk category of the historical data request, wherein the request content information includes the request time;

[0073] Step S420, determining an association relationship between the risk category and the request content information and the request attribute information according to the request content information, the request attribute information and the risk category;

[0074] Step S430, determining risk category rules according to the association relationship.

[0075] In the embodiment of the present disclosure, when determining the risk category rule, the request content information, request attribute information and corresponding risk category of the historical data request are obtained, wherein the request content information includes the request time, and the historical data request can be a request for part or all of the data within a preset historical period. The association relationship between the request content information, the request attribute information and the risk category is determined based on the information obtained. In one example, the association relationship can be determined by machine learning, that is, a risk category identification model is obtained by training according to the request content information, the request attribute information and the risk category label, and the request content information and the request attribute information are input into the risk category identification model, and the risk category is output through the model, so as to determine the association relationship between the risk category and the request information, wherein the risk category identification model can be one or more according to the difference in the request content information and the request attribute information. In this embodiment, considering that the risk assessment standards for data requests at different times are different, the request content information also includes the request time. When setting the risk category rule, considering the request time, a dynamic baseline strategy can be set, and a periodic risk category rule can be set based on the actual application scenario. After determining the association relationship, the risk category rule is obtained according to the association relationship.

[0076] The disclosed embodiment obtains risk category rules by analyzing and processing historical data request information, while taking into account the correlation between different request times and risks, so that the obtained risk category rules are more accurate and reliable, thereby improving the accuracy of subsequent risk category determination and ensuring the security of the business system.

[0077] In one embodiment, the risk category includes a risk restriction request; and processing the data request according to a request processing method corresponding to the risk category includes:

[0078] In the case where the data request is a risk restriction request, obtaining a preset restriction rule;

[0079] The data request is subjected to request restriction processing according to the restriction rule based on the request content information and the request attribute information.

[0080] In the disclosed embodiment, the risk category includes a restricted risk request, wherein the restricted risk category request can be considered as a data request that may be risky, and therefore, the data request needs to be further restricted. When the data request is a restricted risk request, a preset restriction rule is obtained, wherein the preset restriction rule is usually determined in advance based on the actual application scenario. Typically, the restriction rule includes the association between the request content information, the request attribute information, and the restriction category. In one example, the restriction rule can be directly set to the corresponding restriction rule through historical data, or it can be obtained through historical data using a machine learning algorithm. The data request is subjected to request restriction processing according to the restriction rules based on the request content information and the request attribute information. In one example, the restriction processing may include, but is not limited to, human-machine identification verification code, return error information, forced login, logout to login, delayed response, prompt information, data obfuscation, etc.

[0081] In the embodiment of the present disclosure, when the risk category is a restricted risk request, further analysis and segmentation is performed based on the request content information and request attribute information of the data request, and the corresponding restriction category is determined based on the request content information and request attribute information, and corresponding request restriction processing is performed on the data request, thereby enabling a further step of processing of the data request. In the case where there may be risks in the data request, the direct rejection of the security request is avoided, thereby ensuring the security of the business system while improving the user experience.

[0082] In one embodiment, Figure 5 As shown, when the request category corresponding to the data request to be processed is the target request category, obtaining the request content information of the data request also includes:

[0083] Step S202, obtaining a sender address corresponding to the data request and a preset safe sender address;

[0084] Step S204: when the sender address does not belong to the preset safe sender address, determine that the request category is a target request category.

[0085] In the embodiment of the present disclosure, after receiving a data request, the sender address corresponding to the data request is obtained, and the preset safe sender address is obtained, wherein the preset safe sender address is usually determined in advance according to the actual application scenario. In one example, the preset safe sender address can be determined according to the sender address of the risk-free request in the historical request, or it can be obtained by direct evaluation. In one example, the preset safe sender address can be stored in a whitelist, and when the sender address of the data request is obtained, it is directly determined whether it matches the safe sender address in the whitelist. When the sender address does not belong to the preset safe sender address, it can be considered that the corresponding data request has a risk or may have a risk, and the request category is determined to be a target request category, and further risk category judgment is required. In another example, a preset risk sender address can also be determined in advance. When the sender address of the data request is the preset risk sender address, the data request at this time can be considered to be a risk data request, and no further risk category judgment is required, and the data request is directly rejected.

[0086] In the disclosed embodiment, the data request is first judged by the sender address of the data request, so as to obtain data requests that are at risk or may be at risk for further analysis and processing, thereby reducing the workload of subsequent risk category judgment, improving the efficiency of risk assessment of data requests, and ensuring the accuracy of risk judgment of data requests, thereby improving the security of the business system.

[0087] In one embodiment, the request content information includes a sender address of the data request, and the request attribute information includes a request count; and determining the risk category corresponding to the data request according to the request content information and the request attribute information includes:

[0088] When the data request is sent from the same sending end address and the number of requests is greater than a preset number, it is determined that the risk category corresponding to the data request is a risk request.

[0089] In the disclosed embodiment, the request content information includes the sender address of the data request, and the request attribute information includes the number of requests. After obtaining the request content information and request attribute information of the data request, it is determined whether the data request is multiple identical data requests sent from the same sender address based on the sender address and the number of requests of the data request. If the number of requests sent by the data request to the same sender address is greater than the preset number, it can usually be considered that the frequency of data requests is too high and there is a risk. At this time, the risk category corresponding to the data request is determined to be a risk request, and the request is not approved to avoid threats to system security. In an example, the preset number is usually determined based on the actual application scenario. When the number of data requests is greater than the preset number, it can be considered that the frequency of data requests is too high and there is a risk.

[0090] The disclosed embodiment judges the sender address and the number of requests to judge data requests with too high request frequency as risky requests, thereby improving the efficiency of data request risk assessment, while ensuring the accuracy of risk assessment of data requests and improving the security of the business system.

[0091] Figure 6 FIG. 1 is a flow chart of a method for risk assessment of a data request according to an exemplary embodiment. Figure 6As shown, the request starts. After receiving the data request, the request category is first judged by the traffic analysis and risk assessment system. Among them, the identification method of the request category may include but is not limited to: through the IP asset library, realize the city-level request differentiation, classify and process the requests sent from different regions and cities, and identify the request category; through the docking business information library, realize the user category request differentiation according to the historical business information or the user list set by the evaluation; through the whitelist IP announced by the search engine and the search engine spider IP verified by rDNS, complete the information library collection of the white spider, based on the spider library, you can evaluate the collection of each search engine, and it is also convenient to release the spider of each engine based on the ROI of each search engine; through other risk libraries, comprehensive evaluation. In an example, the request category may include but is not limited to search engine spiders, malicious crawlers, normal traffic, attack traffic, etc. After the request category is identified as a safe request, the data request is marked, the subsequent judgment logic is skipped, and the request is passed; after the request category is identified as a request of other categories, further identification and determination are performed. Among them, for other types of requests, it can also be determined whether it is a spider request. If it is a preset search engine spider request, the data request is marked, the subsequent logic is skipped, and the request is passed. At the same time, in order to ensure the stability of the business system, the peak shaving and stabilization process is performed, and the quota is performed based on ROI. When other types of requests are not spider requests, the risk category of the data request is identified, wherein the identification method of the risk category may include but is not limited to: the rules support the configuration of real-time rules and offline rules, such as request frequency, request source, etc.; the strategy is more based on a comprehensive analysis of behavioral characteristics, such as frequent single requests, significant deviations from normal user request behavior, etc.; the introduction of data from third-party sources supports the access of more risk asset libraries, such as direct entry of malicious IPs collected based on honeypots. When the risk category is detected as a malicious risk, the request is rejected. When it is a risk of other categories, the corresponding risk response measures, that is, the corresponding restriction processing, can be executed according to the specific information of the data request. In an example, this embodiment supports the transparent transmission of risk tags to subsequent business systems, notifying the business system to execute risk response measures based on risk tags. In this embodiment, when the request category and risk category of a data request are identified, the identification result will be marked in the corresponding data request in the form of a label for back-end processing. In one example, in this embodiment, when processing a data request, it is also possible to conduct a refined analysis based on the traffic of the business system, that is, the data request, and continuously refine the risk control rules to further ensure the security of the business system. In another example, the request category and risk category of a data request can also be identified and judged through the log delivery module, background configuration, and external data source.

[0092] Through this embodiment, it is possible to maintain the agreed collaboration mechanism while decoupling the business, and realize collaboration with the back-end business nodes through specific tags; transmit risk information to the subsequent business system, and let the business system design the risk control page by itself, so as to avoid the problem of inconsistency between the design style of the risk control page of the business risk control node and the business site; it is also possible to implement differentiated risk control strategies down to the city level, and support different risk control strategies for different cities. For example, cities with dense proxy IPs all require login before completing business operations, which improves the accuracy of risk identification; and this embodiment supports dynamic baseline strategies, which can implement more flexible and effective risk control rules based on business periodicity; this embodiment also supports user-level risk control strategies, such as user-level request models, request delays, request redirections, etc., which improve the accuracy of risk identification, enhance user experience, and ensure the reliability and security of the business system; and through this embodiment, it is possible to complete collaborative-level strategy linkage with the internal system based on the agreement, and can introduce third-party data sources to complete linkage with the back-end and actual business.

[0093] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the accompanying drawings may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the steps or stages in other steps.

[0094] Based on the same inventive concept, the embodiment of the present disclosure also provides a data request risk assessment device for implementing the data request risk assessment method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of the risk assessment device for one or more data requests provided below can refer to the limitations of the data request risk assessment method above, and will not be repeated here.

[0095] In one embodiment, Figure 7 As shown, a risk assessment device for data request is provided, comprising:

[0096] An acquisition module 710 is used to acquire request content information and request attribute information of the data request when the request category corresponding to the data request to be processed is a target request category;

[0097] A determination module 720, configured to determine a risk category corresponding to the data request according to the request content information and the request attribute information;

[0098] The processing module 730 is used to process the data request according to the request processing method corresponding to the risk category.

[0099] In one embodiment, the determining module includes:

[0100] An acquisition submodule is used to acquire preset risk category rules, wherein the risk categories include no-risk requests, risk requests, and limited-risk requests;

[0101] A determination submodule is used to classify the request content information and the request attribute information according to the risk classification rule to determine the risk category corresponding to the data request.

[0102] In one embodiment, the risk category rule determination module includes:

[0103] An acquisition submodule, used to acquire request content information, request attribute information and corresponding risk category of a historical data request, wherein the request content information includes a request time;

[0104] A first determination submodule, configured to determine, according to the request content information, the request attribute information and the risk category, an association relationship between the risk category and the request content information and the request attribute information;

[0105] The second determination submodule is used to determine the risk category rule according to the association relationship.

[0106] In one embodiment, the risk category includes a request to limit risk; and the processing module includes:

[0107] An acquisition submodule, used for acquiring preset restriction rules when the data request is a risk restriction request;

[0108] A determination submodule is used to perform request restriction processing on the data request according to the restriction rule based on the request content information and the request attribute information.

[0109] In one embodiment, the acquisition module further includes:

[0110] The acquisition submodule is used to obtain the sender address corresponding to the data request and the preset safe sender address;

[0111] The determination submodule is used to determine that the request category is a target request category when the sender address does not belong to the preset safe sender address.

[0112] In one embodiment, the request content information includes the sender address of the data request, and the request attribute information includes the number of requests; the determination module includes:

[0113] The determination submodule is used to determine that the risk category corresponding to the data request is a risk request when the data request is sent from the same sending end address and the number of requests is greater than a preset number.

[0114] Each module in the risk assessment device for data request can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0115] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 8 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as data request data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a risk assessment method for data requests is implemented.

[0116] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the embodiment of the present disclosure, and does not constitute a limitation on the computer device to which the embodiment of the present disclosure is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0117] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0118] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0119] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0120] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of the present disclosure are all information and data authorized by the user or fully authorized by all parties.

[0121] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the embodiments of the present disclosure can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in the embodiments of the present disclosure may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited thereto. The processor involved in each embodiment provided in the embodiments of the present disclosure may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited thereto.

[0122] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0123] The above-described embodiments only express several implementation methods of the embodiments of the present disclosure, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the patent of the embodiments of the present disclosure. It should be pointed out that, for those of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the embodiments of the present disclosure, and these all belong to the protection scope of the embodiments of the present disclosure. Therefore, the protection scope of the embodiments of the present disclosure shall be subject to the attached claims.

Claims

1. A risk assessment method for data request, characterized in that: The method comprises: In the case where the request category corresponding to the data request to be processed is the target request category, the request content information and request attribute information of the data request are obtained, wherein the request categories include search engine spiders, malicious crawlers, normal traffic, and attack traffic, and the judgment method of whether the request category is the target request category includes: determining whether the data request is the target request category according to the IP address from which the data request is sent, realizing city-level request differentiation through the IP asset library, classifying and processing requests sent from different regions and cities, and identifying the request category; identifying the request category according to the user list set by historical business information or evaluation by docking with the business information library; completing the information library collection of the white spider through the whitelist IP announced by the search engine and the search engine spider IP verified by rDNS, and identifying the request category based on the information library; when the request category is the search engine spider, passing the data request, performing peak shaving and flow stabilization processing, and making quotas based on ROI; Determine a risk category corresponding to the data request according to the request content information and the request attribute information; The data request is processed according to a request processing method corresponding to the risk category.

2. The method according to claim 1, characterized in that The determining the risk category corresponding to the data request according to the request content information and the request attribute information includes: Obtaining preset risk category rules, wherein the risk categories include no-risk requests, risk requests, and limited-risk requests; The request content information and the request attribute information are classified according to the risk classification rule to determine the risk category corresponding to the data request.

3. The method according to claim 2, characterized in that The risk category rules are determined in the following ways: Obtaining request content information, request attribute information, and corresponding risk categories of historical data requests, wherein the request content information includes the request time; Determine, according to the request content information, the request attribute information and the risk category, an association relationship between the risk category and the request content information and the request attribute information; A risk category rule is determined based on the association relationship.

4. The method according to claim 1, characterized in that: The risk category includes a risk restriction request; and the processing of the data request according to the request processing method corresponding to the risk category includes: In the case where the data request is a risk restriction request, obtaining a preset restriction rule; The data request is subjected to request restriction processing according to the restriction rule based on the request content information and the request attribute information.

5. The method according to claim 1, characterized in that In a case where the request category corresponding to the data request to be processed is a target request category, obtaining request content information of the data request, further comprising: Obtain the sender address corresponding to the data request and the preset safe sender address; In a case where the sender address does not belong to the preset safe sender address, the request category is determined to be a target request category.

6. The method according to claim 1, characterized in that The request content information includes the sender address of the data request, and the request attribute information includes the number of requests; and determining the risk category corresponding to the data request according to the request content information and the request attribute information includes: When the data request is sent from the same sending end address and the number of requests is greater than a preset number, it is determined that the risk category corresponding to the data request is a risk request.

7. A risk assessment device for data request, characterized in that: The device comprises: An acquisition module is used to acquire request content information and request attribute information of the data request when the request category corresponding to the data request to be processed is a target request category, wherein the request category includes search engine spider, malicious crawler, normal traffic, and attack traffic, and a method for determining whether the request category is a target request category includes: determining whether the data request is a target request category according to the IP address from which the data request is sent, realizing city-level request differentiation through the IP asset library, classifying and processing requests sent from different regions and cities, and identifying request categories; identifying request categories according to historical business information or user lists set by evaluation through docking with a business information library; completing information collection of white spiders through the whitelist IP announced by the search engine and the search engine spider IP verified by rDNS, and identifying request categories based on the information library; when the request category is a search engine spider, passing the data request, performing peak shaving and stabilizing flow processing, and making quotas based on ROI; A determination module, configured to determine a risk category corresponding to the data request according to the request content information and the request attribute information; A processing module is used to process the data request according to a request processing method corresponding to the risk category.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the risk assessment method for data requests according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the risk assessment method for data request according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the risk assessment method for data request according to any one of claims 1 to 6 are implemented.

Images