Method, device and application for preventing maliciously brushing verification code

Abstract

This invention relates to a method for preventing malicious CAPTCHA scraping, applied on the server side. The method includes receiving a CAPTCHA request initiated by a user, parsing and obtaining the user's IP address, device ID, and mobile phone number; generating graded IP address behavior tags, graded device ID behavior tags, and graded mobile phone number behavior tags based on the current day's request behavior and historical behavior data for the IP address, device ID, and mobile phone number; different graded behavior tags have different upper limits for daily request thresholds; comparing the current day's request threshold with a preset threshold determines whether to proceed to the next verification step or directly issue a CAPTCHA. This invention employs different verification methods for CAPTCHA requests based on tag grades, enriching verification methods, improving verification security, and effectively limiting the scraping of mobile phone CAPTCHAs.

Description

Technical Field

[0001] This invention relates to the field of Internet application technology, and in particular to a method, apparatus and application for preventing malicious CAPTCHA scanning. Background Technology

[0002] With the continuous development and advancement of mobile communication and internet technologies, mobile applications are proliferating, and many have become widely known and used. Meanwhile, as a unique identifier for each individual, most mobile application systems bind users to their phone numbers and use them as usernames. Therefore, verifying the authenticity of phone numbers has become an indispensable step, and verifying phone numbers via SMS verification codes has become the mainstream trend. However, with the widespread adoption of SMS verification code verification, some problems have arisen, such as malicious spamming of SMS verification codes, especially on registration and login pages. Any user could freely and without authorization could spam SMS verification codes, which not only consumes resources but also affects the normal use of other users, impacting the user experience for legitimate users.

[0003] Current technologies typically prevent verification codes from being repeatedly refreshed and sent within a short period by having a front-end button expire and then resending it after 60 seconds. However, malicious users can bypass the web's click frequency limits by capturing exposed request interfaces and directly accessing the interface, resulting in a large backlog of requests. Because the verification code distribution platform performs extensive data queries and verifications during the time between sending the verification code request and receiving the code, this consumes a significant amount of bandwidth and puts pressure on the server's processing capacity. If this exceeds the server's capacity, the entire SMS delivery system will crash, affecting user login and registration, causing the entire platform to go down and resulting in unnecessary losses. Alternatively, verification can be implemented by identifying the input interval between the phone number and verification information to distinguish between automated tools; however, relying solely on time to identify malicious requests offers a low level of protection, is simplistic in its verification methods, and lacks sufficient security. Summary of the Invention

[0004] Therefore, the technical problem to be solved by the present invention is to overcome the problem of single verification and low security in the existing verification code anti-fraud methods.

[0005] To address the aforementioned technical problems, this invention provides a method for preventing malicious CAPTCHA scanning, comprising:

[0006] Receive a verification code request initiated by a user, parse it and obtain the user's IP address, device number and mobile phone number;

[0007] Verify the IP address, and generate a graded IP address behavior tag based on the IP address's daily request behavior and historical behavior data; obtain the corresponding daily request threshold for the IP address based on the grade of the graded IP address behavior tag; if the daily request threshold for the IP address is not greater than a first preset threshold, then perform human operation verification; if the daily request threshold for the IP address is not less than a second preset threshold, then perform mobile phone number verification; if the daily request threshold for the IP address is greater than the first preset threshold but less than the second preset threshold, then perform device number verification.

[0008] Verify the device ID, and generate a graded device ID behavior tag based on the device ID's request behavior and historical behavior data for the day; obtain the corresponding device ID's request threshold for the day based on the graded device ID behavior tag; if the device ID's request threshold for the day is not greater than a third preset threshold, then perform a real person operation verification; otherwise, perform a mobile phone number verification.

[0009] Verify the mobile phone number, obtain the mobile phone number's request behavior and historical behavior data for the current day, and generate a graded mobile phone number behavior tag; based on the graded mobile phone number behavior tag, obtain the corresponding mobile phone number's request threshold for the current day; if the mobile phone number's request threshold for the current day is not greater than a fourth preset threshold, then perform a real-person operation verification; if the mobile phone number's request threshold for the current day is not less than a fifth preset threshold, then issue a verification code to the user; if the mobile phone number's request threshold for the current day is greater than the fourth preset threshold but less than the fifth preset threshold, verify the time difference between two adjacent requests from the mobile phone number.

[0010] Wherein, the first preset threshold is greater than the third preset threshold, and the third preset threshold is greater than the fourth preset threshold.

[0011] In one embodiment of the present invention, verifying the time difference between two consecutive requests for the mobile phone number includes:

[0012] If the time difference is not greater than a preset time threshold, a frequent request prompt will be returned;

[0013] If the time difference is greater than a preset time threshold, a verification code will be sent.

[0014] In one embodiment of the present invention, the real-person operation verification includes sliding puzzle verification and point selection verification in the image.

[0015] In one embodiment of the present invention, the real-person operation verification includes:

[0016] If the real-person operation verification passes, a verification code will be issued to the user.

[0017] If the verification of the real user operation fails, the request to obtain the verification code is rejected, and a behavior tag is added to the user.

[0018] In one embodiment of the present invention, the daily request behavior of the IP address, the daily request behavior of the device number, and the daily request behavior of the mobile phone number include the number of requests per minute per day for the IP address, the number of requests per hour per day for the device number, and the total number of requests per day for the mobile phone number.

[0019] In one embodiment of the present invention, the historical behavior data of the IP address, the historical behavior data of the device number, and the historical behavior data of the mobile phone number include the browsing, clicking, commenting, consumption, and interaction behavior data of the IP address, the device number, and the mobile phone number on the APP, the Web, and the mini-program.

[0020] In one embodiment of the present invention, the graded IP address behavior tag, the graded device number behavior tag, and the graded mobile phone number behavior tag are all set with multiple grades, and different grades are set with different daily request thresholds.

[0021] In one embodiment of the present invention, the daily request threshold for IP address, the daily request threshold for device number, and the daily request threshold for mobile phone number all include the maximum number of requests per minute, the maximum number of requests per hour, and the maximum number of requests per day.

[0022] The present invention also provides a device for preventing malicious CAPTCHA scanning, comprising:

[0023] The user information acquisition module is used to parse and obtain the IP address, device number, and mobile phone number of the user who initiated the verification code acquisition request;

[0024] The information verification module is used to generate graded IP address behavior tags, graded device number behavior tags, and graded mobile phone number behavior tags, and to verify and output the verification results.

[0025] The real-person operation verification module is used to perform real-person operation verification on the graded IP address behavior tags, the graded device number behavior tags, and the graded mobile phone number behavior tags, and output the verification results.

[0026] The response module is used to respond to the verification result, reject the verification code acquisition request, or call the verification code program to issue the verification code.

[0027] This invention also provides an application of the method for preventing malicious CAPTCHA scraping as described above in the field of user registration and login verification.

[0028] The technical solution of the present invention has the following advantages compared with the prior art:

[0029] The method for preventing malicious verification code scraping described in this invention generates graded IP address behavior tags, graded device ID behavior tags, and graded mobile phone number behavior tags for users initiating verification code requests. Based on the tag grades, a corresponding daily request threshold is obtained. The daily request threshold is compared with a preset threshold to determine whether to proceed to the next verification step or directly issue a verification code. When the combined grade of the graded IP address behavior tag, graded device ID behavior tag, and graded mobile phone number behavior tag exceeds the corresponding preset threshold limit, a real-person operation verification is directly performed. By employing different verification methods for verification code requests based on tag grades, the verification methods are enriched, verification security is improved, and the scrapping of mobile verification codes is effectively limited. Attached Figure Description

[0030] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings, wherein...

[0031] Figure 1 This is a flowchart illustrating a method for preventing malicious CAPTCHA scanning according to an embodiment of the present invention.

[0032] Figure 2 This is a schematic diagram of the IP address verification process provided in an embodiment of the present invention;

[0033] Figure 3 This is a schematic diagram of the device number verification process provided in an embodiment of the present invention;

[0034] Figure 4 This is a schematic diagram of the mobile phone number verification process provided in an embodiment of the present invention. Detailed Implementation

[0035] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments described are not intended to limit the present invention.

[0036] Reference Figure 1 As shown, the method for preventing malicious CAPTCHA scanning of the present invention includes:

[0037] S1: Receive the user's verification code retrieval request, parse and obtain the user's IP address, device number and mobile phone number;

[0038] S2: Reference Figure 2As shown, the process verifies the IP address and generates a graded IP address behavior tag based on the IP address's daily request behavior and historical behavior data. Based on the grade of the graded IP address behavior tag, the corresponding daily request threshold for the IP address is obtained. If the daily request threshold for the IP address is not greater than a first preset threshold, then a real-person operation verification is performed. If the daily request threshold for the IP address is not less than a second preset threshold, then a mobile phone number verification is performed. If the daily request threshold for the IP address is greater than the first preset threshold but less than the second preset threshold, then a device number verification is performed.

[0039] S3: Reference Figure 3 As shown, the device ID is verified, and a graded device ID behavior tag is generated based on the device ID's request behavior on the current day and historical behavior data. Based on the graded device ID behavior tag, the corresponding device ID's request threshold for the current day is obtained. If the device ID's request threshold for the current day is not greater than a third preset threshold, then a real person operation verification is performed; otherwise, a mobile phone number verification is performed.

[0040] S4: Reference Figure 4 As shown, the system verifies the mobile phone number, obtains the mobile phone number's request behavior and historical behavior data for the current day, and generates a graded mobile phone number behavior tag; based on the graded mobile phone number behavior tag, it obtains the corresponding mobile phone number's request threshold for the current day; if the mobile phone number's request threshold for the current day is not greater than a fourth preset threshold, then a real-person operation verification is performed; if the mobile phone number's request threshold for the current day is not less than a fifth preset threshold, then a verification code is issued to the user; if the mobile phone number's request threshold for the current day is greater than the fourth preset threshold but less than the fifth preset threshold, the time difference between two adjacent requests from the mobile phone number is verified.

[0041] Wherein, the first preset threshold is greater than the third preset threshold, and the third preset threshold is greater than the fourth preset threshold; the time difference between two consecutive requests from the mobile number is checked, and if the time difference is not greater than a preset time threshold, a frequent request prompt is returned; if the time difference is greater than the preset time threshold, a verification code is sent.

[0042] Specifically, the daily request behavior of the IP address, the daily request behavior of the device ID, and the daily request behavior of the mobile phone number include the number of requests per minute, per hour, and total number of requests per day for the IP address, the device ID, and the mobile phone number; the historical behavior data of the IP address, the historical behavior data of the device ID, and the historical behavior data of the mobile phone number include the browsing, clicking, commenting, consumption, and interaction behavior data of the IP address, the device ID, and the mobile phone number on the APP, Web, and Mini Program platforms; the graded IP address behavior tags and the graded device IDs... Both the behavioral tags and the graded mobile phone number behavioral tags have multiple levels, with different levels having different daily request thresholds. The daily request thresholds for IP addresses, device numbers, and mobile phone numbers all include the maximum number of requests per minute, the maximum number of requests per hour, and the maximum number of requests per day. The methods for verifying real-person operation include sliding puzzle verification and point-and-click verification. If the real-person operation verification passes, the verification code delivery program is invoked to send a verification code to the user. If the real-person operation verification fails, the verification code acquisition request is rejected, and a tag is added to the user.

[0043] Specifically, when risk control indicators are tightened, verification code requests from users with severe risk levels can be directly rejected based on the severity of the risk level, such as IP address behavior tags, device behavior tags, and mobile phone number behavior tags. This reduces server processing pressure, ensures the normal operation of the SMS platform, protects the normal use of loyal and valid users, reduces false positives, and minimizes unnecessary losses.

[0044] In this embodiment, corresponding weights are obtained based on the tag levels of the graded IP address behavior tags, graded device number behavior tags, and graded mobile phone number behavior tags. The corresponding daily request threshold is then obtained based on these tag weights. The specific criteria for determining the daily request threshold are shown in Table 1.

[0045] Table 1. Tag Levels and Their Corresponding Daily Request Thresholds

[0046]

[0047]

[0048] This invention also provides a device for preventing malicious CAPTCHA acquisition, comprising: a user information acquisition module for parsing and acquiring the IP address, device ID, and mobile phone number of the user initiating the CAPTCHA acquisition request; an information verification module for generating graded IP address behavior tags, graded device ID behavior tags, and graded mobile phone number behavior tags, verifying them, and outputting the verification results; a real-person operation verification module for performing real-person operation verification on the graded IP address behavior tags, the graded device ID behavior tags, and the graded mobile phone number behavior tags, and outputting the verification results; and a response module for responding to the verification results, either rejecting the CAPTCHA acquisition request or calling the CAPTCHA program to issue the CAPTCHA.

[0049] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. A method for preventing malicious CAPTCHA scanning, characterized in that, Applications on the server side include: Receive a verification code request initiated by a user, parse it and obtain the user's IP address, device number and mobile phone number; Verify the IP address, and generate a graded IP address behavior tag based on the IP address's daily request behavior and historical behavior data; obtain the corresponding daily request threshold for the IP address based on the grade of the graded IP address behavior tag; if the daily request threshold for the IP address is not greater than a first preset threshold, then perform human operation verification; if the daily request threshold for the IP address is not less than a second preset threshold, then perform mobile phone number verification; if the daily request threshold for the IP address is greater than the first preset threshold but less than the second preset threshold, then perform device number verification. Verify the device ID, and generate a graded device ID behavior tag based on the device ID's request behavior and historical behavior data for the day; obtain the corresponding device ID's request threshold for the day based on the graded device ID behavior tag; if the device ID's request threshold for the day is not greater than a third preset threshold, then perform a real person operation verification; otherwise, perform a mobile phone number verification. Verify the mobile phone number, obtain the mobile phone number's request behavior and historical behavior data for the current day, and generate a graded mobile phone number behavior tag; based on the graded mobile phone number behavior tag, obtain the corresponding mobile phone number's request threshold for the current day; if the mobile phone number's request threshold for the current day is not greater than a fourth preset threshold, then perform a real-person operation verification; if the mobile phone number's request threshold for the current day is not less than a fifth preset threshold, then issue a verification code to the user; if the mobile phone number's request threshold for the current day is greater than the fourth preset threshold but less than the fifth preset threshold, verify the time difference between two adjacent requests from the mobile phone number. Wherein, the first preset threshold is greater than the third preset threshold, and the third preset threshold is greater than the fourth preset threshold; the graded IP address behavior tag, the graded device number behavior tag, and the graded mobile phone number behavior tag are all set with multiple levels, and different levels are set with different daily request thresholds; The verification of the time difference between two consecutive requests for the mobile number includes: if the time difference is not greater than a preset time threshold, a frequent request prompt is returned; if the time difference is greater than the preset time threshold, a verification code is sent. The process after verifying the real-person operation includes: if the real-person operation verification passes, a verification code is issued to the user; if the real-person operation verification fails, the verification code acquisition request is rejected, and a behavior tag is added to the user.

2. The method for preventing malicious CAPTCHA scanning according to claim 1, characterized in that, The real-person operation verification includes sliding puzzle verification and point selection verification in the picture.

3. The method for preventing malicious CAPTCHA scanning according to claim 1, characterized in that, The daily request behavior of the IP address, the daily request behavior of the device number, and the daily request behavior of the mobile phone number include the number of requests per minute, the number of requests per hour, and the total number of requests per day for the IP address, the device number, and the mobile phone number.

4. The method for preventing malicious CAPTCHA scanning according to claim 1, characterized in that, The historical behavior data of the IP address, the historical behavior data of the device number, and the historical behavior data of the mobile phone number include the browsing, clicking, commenting, consumption, and interaction data of the IP address, the device number, and the mobile phone number on the APP, Web, and mini-program platforms.

5. An apparatus based on the method for preventing malicious CAPTCHA scanning as described in any one of claims 1 to 4, characterized in that, include: The user information acquisition module is used to parse and obtain the IP address, device number, and mobile phone number of the user who initiated the verification code acquisition request; The information verification module is used to generate graded IP address behavior tags, graded device number behavior tags, and graded mobile phone number behavior tags, and to verify and output the verification results. The real-person operation verification module is used to perform real-person operation verification on the graded IP address behavior tags, the graded device number behavior tags, and the graded mobile phone number behavior tags, and output the verification results. The response module is used to respond to the verification result, reject the verification code acquisition request, or call the verification code program to issue the verification code.

6. The application of the method for preventing malicious CAPTCHA interception as described in any one of claims 1 to 4 in the field of user registration and login verification.

Images