Stealing Chain Protection Method, Device, Electronic Device and Computer Readable Storage Medium

Abstract

The present application provides a hotlink protection method, apparatus, electronic device, and computer-readable storage medium. A specific implementation of the method includes: receiving a resource access request; the resource access request is used to request to obtain a target static resource; determining whether there is target pre-path information matching the target static resource in a resource access model; multiple static resources and the pre-path information corresponding to each static resource are stored in the resource access model; if not, performing a hotlink protection operation on the resource access request. This method improves the security of the hotlink protection process, broadens the applicable scope, and improves the user experience.

Description

Technical Field

[0001] This application relates to the field of information security. Specifically, it relates to a method and apparatus for protecting against hotlinking, an electronic device, and a computer-readable storage medium. Background Art

[0002] Hotlinking refers to a situation where a server obtains resources from another server through certain technical means and then directly provides the service resources on the other server to users on its own website. This approach can reduce the burden on the hotlinker (the server itself), but increases the burden on the server whose resources are hotlinked (other servers). Here, the commonly hotlinked resources are generally static resources such as pictures, music, and software.

[0003] Protecting against hotlinking means that as a server, it uses certain technical means to prevent other servers from stealing its resources while not affecting the normal access of legitimate users. Currently, the common hotlink protection methods of WAF (Web Application Firewall) mainly fall into three categories: protection based on the source address of the http (HyperText Transfer Protocol) request (i.e., referer protection), protection based on signature information, and protection through login verification.

[0004] When protecting based on the source address of the http request, the request source can be identified through the request header. When the request source is not a legitimate source, it is determined that there may be a hotlinking behavior. However, the request will not be sent in two cases. One is when the source page uses a uniform resource locator (URL) that identifies a local file; the other is when the current requested page is obtained based on an http request, and its source page is obtained based on an https (Hypertext Transfer Protocol Secure) request (i.e., an http request sent over a secure transport layer).

[0005] When protecting based on signature information, a dynamic signature is usually inserted into the response header or response body. The insertion locations can include, for example, data stored on the user's local terminal (i.e., cookie), the URL of the resource, the file name, etc. The generating elements can include, for example, a timestamp, random characters, user session data, etc. When the WAF receives a request, it can determine whether the dynamic signature in the current request is legitimate.

[0006] When protecting through login verification, login authentication can be performed at irregular intervals during the user's access process. The authentication methods can include graphic authentication, username and password authentication, etc.

[0007] Regarding the anti-leeching method that protects based on the source address of the http request, the leecher can forge the referer information to avoid protection, with low security; regarding the anti-leeching method that protects based on the signature information, normal users cannot access anonymously, with a narrow scope of application; regarding the anti-leeching method that protects through login verification, the user experience is poor. Summary of the Invention

[0008] The purpose of the embodiments of the present application is to provide an anti-leeching method, device, electronic device and computer-readable storage medium, so as to improve the security of the anti-leeching process, broaden the scope of application and improve the user experience.

[0009] In a first aspect, the embodiments of the present application provide an anti-leeching method that can be applied to a firewall. The method includes: receiving a resource access request; the resource access request is used to request to obtain a target static resource; determining whether there is target pre-path information in the resource access model that matches the target static resource; multiple static resources and the pre-path information corresponding to each static resource are stored in the resource access model; if not, perform an anti-leeching protection operation on the resource access request. In this way, it is determined whether it is a leeching behavior through the target pre-path information. Since the target pre-path information cannot be forged, its security is higher; and since there is no need to authenticate through signatures or logins, normal users can also access anonymously, broadening the scope of application and improving the user experience.

[0010] Optionally, the resource access model is created in advance based on the following steps: obtaining multiple initial static resources on the target protected host; for each of the initial static resources, generating corresponding pre-path information according to the access path of the initial static resource; determining whether each initial static resource has been actually accessed, and determining the actually accessed initial static resources as valid resources; storing the valid resources and the corresponding pre-path information to obtain the resource access model. In this way, for a resource access request for which no target pre-path information is found in the resource access model, it can be regarded as having a leeching behavior, with relatively high security.

[0011] Optionally, generating corresponding pre-path information according to the access path of the initial static resource includes: determining the superior path, current path, and secondary path corresponding to the initial static resource; the superior path represents the path of the upper-level static resource to which the initial static resource belongs; the secondary path represents the path of the lower-level static resource embedded in the initial static resource; determining the access path according to the superior path, current path, and the secondary path. In this way, the superior path, current path, and secondary path of the initial static resource can be determined layer by layer to obtain its access path, ensuring the accuracy of the access path.

[0012] Optionally, determining whether each of the initial static resources is actually accessed includes: determining whether the response information for requesting to obtain the initial static resource indicates a successful response; if the response information indicates a successful response, determining that the initial static resource is actually accessed. In this way, determining whether the initial static resource is actually accessed through the response information can identify valid resources that may be stolen.

[0013] Optionally, obtaining a plurality of initial static resources on the target protected host includes: obtaining a plurality of static resources within a defined learning period to obtain the initial static resources. In this way, the judgment result of the resource access model can be made more credible.

[0014] Optionally, determining whether there is target pre-path information matching the target static resource in the resource access model includes: judging whether there is corresponding pre-path information according to the access path of the target static resource; if so, judging whether the target static resource is a valid resource; if so, determining the pre-path information corresponding to the target static resource as the target pre-path information. In this way, when judging whether there is a hotlinking behavior in the resource access request through the resource access model, a more accurate judgment result can be obtained, improving the security of the hotlinking protection process.

[0015] Optionally, after receiving the resource access request, the hotlinking protection method further includes: judging whether the source of the resource access request is a trusted source; if so, judging whether the host domain name accessed by the resource access request belongs to a preset protection domain; wherein, when the host domain name belongs to the preset protection domain, judging whether there is target pre-path information matching the target static resource in the resource access model. In this way, some resource access requests with hotlinking behavior can be screened out for protection first, optimizing the hotlinking protection process and reducing the processing pressure on the subsequent resource access model to a certain extent.

[0016] Second aspect, an embodiment of the present application provides a hotlink protection device applicable to a firewall. The device includes: a receiving module, configured to receive a resource access request, where the resource access request is used to request to obtain a target static resource; a path determination module, configured to determine whether there is target pre-path information matching the target static resource in a resource access model, where multiple static resources and pre-path information corresponding to each static resource are stored in the resource access model; a protection module, configured to perform a hotlink protection operation on the resource access request when it is determined that there is no target pre-path information matching the target static resource in the resource access model. In this way, it is determined whether it is a hotlinking behavior through the target pre-path information. Since the target pre-path information cannot be forged, its security is higher; and since authentication does not need to be performed through signatures or logins, normal users can also access anonymously, broadening the scope of application and improving the user experience.

[0017] Third aspect, an embodiment of the present application provides an electronic device, including a processor and a memory. The memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the steps in the method provided in the first aspect as described above are run.

[0018] Fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps in the method provided in the first aspect as described above are run.

[0019] Other features and advantages of the present application will be described in the subsequent description. And, some of them will become obvious from the description, or can be understood by implementing the embodiments of the present application. The objectives and other advantages of the present application can be achieved and obtained through the structures specifically pointed out in the written description, claims, and drawings. Description of the Drawings

[0020] To more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings required to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as limiting the scope. For those of ordinary skill in the art, other related drawings can be obtained based on these drawings without creative efforts.

[0021] Figure 1 It is a flowchart of a hotlink protection method provided by an embodiment of the present application;

[0022] Figure 2 It is a structural block diagram of a hotlink protection device provided by an embodiment of the present application;

[0023] Figure 3Schematic structural diagram of an electronic device for implementing a method for preventing hotlinking provided in an embodiment of the present application. Detailed implementation manners

[0024] Next, the technical solutions in the embodiments of the present application will be clearly and completely described with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Components of the embodiments of the present application usually described and illustrated in the accompanying drawings here can be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application claimed, but only represents selected embodiments of the present application. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative efforts belong to the scope of protection of the present application.

[0025] It should be noted that similar reference numerals and letters indicate similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of the present application, terms such as "first" and "second" are only used for differential description and cannot be understood as indicating or implying relative importance.

[0026] It should be noted that, without conflict, the embodiments in the present application or the technical features in the embodiments can be combined.

[0027] In the related art, there are problems of low security, narrow applicable range, and poor user experience in the process of preventing hotlinking. To solve this problem, the present application provides a method, device, electronic device, and computer-readable storage medium for preventing hotlinking. Further, the legality of a resource access request can be judged by analyzing the behavior of the resource access request, so as to achieve the purpose of preventing hotlinking. The behavior here may include, for example, the access behavior of the resource access request.

[0028] The above-mentioned method for preventing hotlinking judges through the access behavior of the resource access request. Since this access behavior cannot be forged, the security is relatively high. And it does not require authentication through signatures or logins. Subsequently, normal users can also access anonymously, broadening the applicable range and improving the user experience.

[0029] In some application scenarios, the above-mentioned method for preventing hotlinking can be applied to a firewall or other network elements with firewall functions. That is, the firewall or the network element with firewall functions analyzes the behavior of the resource access request and judges the legality of the resource access request. When it is illegal, it can be regarded as having a hotlinking behavior, and then protection can be carried out.

[0030] The defects existing in the solutions of the above related technologies are all the results obtained by the inventors through practice and careful research. Therefore, the process of discovering the above problems and the solutions proposed by the embodiments of the present invention below for the above problems should both be the contributions made by the inventors to the present invention during the process of the present invention.

[0031] Please refer to Figure 1 , which shows a flowchart of a hotlink protection method provided by an embodiment of the present application. As Figure 1 shown, the hotlink protection method includes the following steps 101 to step 103.

[0032] Step 101, receiving a resource access request; the resource access request is used to request to obtain a target static resource;

[0033] In some application scenarios, a firewall can receive a resource access request. The resource access request can be sent based on protocols such as http and https, for example.

[0034] The above resource access request can be used to request to obtain a target static resource. In some application scenarios, the resource access request can be sent by a client based on a user instruction, and then the above target static resource can include static resources such as image resources and text resources indicated by the client to obtain.

[0035] Step 102, determining whether there is target pre-path information in the resource access model that matches the target static resource; multiple static resources and the pre-path information corresponding to each static resource are stored in the resource access model;

[0036] The above resource access model can be created in advance. For example, multiple static resources can be obtained in advance. Then, for each static resource, the pre-path information of the static resource can be determined. Here, the pre-path information of the static resource can be regarded as the pre-level path information of the location where the static resource is located.

[0037] In some application scenarios, after the firewall obtains multiple static resources and determines the pre-path information corresponding to each static resource, the various static resources can be associated and stored in a database with the corresponding pre-path information, and this database is also the resource access model.

[0038] In these application scenarios, after the firewall receives a resource access request, it can determine whether there is target pre-path information in the resource access model that matches the target static resource. Specifically, it can first determine whether there is a target static resource in the resource access model. If it exists, the corresponding pre-path information can be further searched, and this pre-path information is also the target pre-path information.

[0039] Step 103: If not, perform anti-leeching protection operation on the resource access request.

[0040] In some application scenarios, after the firewall determines that there is no target pre-path information in the resource access model, it can confirm that the resource access request intends to perform a leeching behavior, and then can perform anti-leeching protection operations. The above anti-leeching protection operations can include operations such as interception and warning.

[0041] In this embodiment, the above steps 101 to 103 determine whether it is a leeching behavior through the target pre-path information. Since the target pre-path information cannot be forged, its security is higher; and since there is no need to authenticate through signatures or logins, normal users can also access anonymously, broadening the scope of application and improving the user experience.

[0042] In some alternative implementation manners, the resource access model is pre-created based on the following steps:

[0043] Step 1: Obtain multiple initial static resources on the target protected host;

[0044] In some application scenarios, when constructing the resource access model, multiple initial static resources on the target protected host can be obtained first. The above target protected host can be regarded as the server where the target static resources are located. The above initial static resources can be regarded as the static resources that the target protected host can provide. It should be noted that when constructing the resource access model, as many initial static resources as possible on multiple target protected hosts can be obtained to obtain a relatively complete resource access model.

[0045] Step 2: For each of the initial static resources, generate corresponding pre-path information according to the access path of the initial static resource;

[0046] After obtaining multiple initial static resources, the pre-path information of each initial static resource can be determined. Specifically, corresponding pre-path information can be generated according to the access path of each initial static resource.

[0047] In some alternative implementation manners, the generating corresponding pre-path information according to the access path of the initial static resource in Step 2 includes the following sub-steps:

[0048] Sub-step 21: Determine the upper path, current path, and secondary path corresponding to the initial static resource; the upper path represents the path of the upper-level static resource to which the initial static resource is attached; the secondary path represents the path of the lower-level static resource embedded in the initial static resource;

[0049] In some application scenarios, the static resources of each resource access request may come from other static resources or may embed other static resources. Therefore, the path of the superior static resource embedding the initial static resource can be determined as the superior path, and the path of the inferior static resource embedded in the initial static resource can be determined as the inferior path. The above current path is also the path of the current initial static resource.

[0050] Sub-step 22: Determine the access path according to the superior path, the current path, and the secondary path.

[0051] In these application scenarios, for the superior path, the current path, and the secondary path corresponding to the initial static resource, layer-by-layer in-depth analysis can be carried out to determine the access path of the initial static resource.

[0052] In this implementation, the superior path, the current path, and the secondary path of the initial static resource can be determined layer by layer to obtain its access path, ensuring the accuracy of the access path.

[0053] It should be noted that for each initial static resource, the path of the initial static resource can be recorded layer by layer, so that when determining the access path of a certain initial static resource, the corresponding position can be quickly located, improving the processing efficiency.

[0054] Step 3: Determine whether each of the initial static resources is actually accessed, and determine the initial static resources that have been actually accessed as valid resources;

[0055] In some application scenarios, there are invalid initial static resources, that is, when the resource access request requests to obtain a certain initial static resource, there is a situation where the server cannot provide the resource content corresponding to the initial static resource. Therefore, it can be determined whether each initial static resource is actually accessed, so as to determine whether it is a valid resource. In these application scenarios, if it is determined that a certain initial static resource can be actually accessed, then it can be determined that the initial static resource is a valid resource.

[0056] In some optional implementation manners, determining whether the initial static resource is actually accessed includes: determining whether the response information for requesting to obtain the initial static resource indicates a successful response; if the response information indicates a successful response, then determine that the initial static resource is actually accessed.

[0057] In some application scenarios, when the server receives a resource access request, it can make a response. If the response information indicates a successful response, then it can be determined that the initial static resource requested by the resource access request can be normally accessed.

[0058] For example, when there is an initial static resource requested by a certain resource access request in the server, it can return status information indicating its existence of the initial static resource and its ability to successfully send the initial static resource. Subsequently, if the status information is received, it can be determined that the initial static resource can be truly accessed. The above status information can include, for example, numbers, characters, or their combination, etc.

[0059] In these application scenarios, for example, the data packets interacting with the server can be filtered according to the server's port number, domain name, and trusted source by using the method of bypass monitoring or series monitoring. Subsequently, the above response information can be obtained from these data packets.

[0060] In this implementation manner, determining whether the initial static resource is truly accessed through the response information can identify the valid resources that can be stolen.

[0061] Step 4, store the valid resources and the corresponding preposed path information to obtain the resource access model.

[0062] In some application scenarios, the valid resources and the corresponding preposed path information can be associated and stored to obtain the resource access model. In this way, when the target static resource is received, the corresponding target preposed path information can be quickly and accurately found.

[0063] In this implementation manner, the resource access model can be constructed through the above steps 1 to 4. For a resource access request for which the target preposed path information cannot be found in the resource access model, it can be regarded as having a hotlinking behavior, and the security is relatively high.

[0064] It should be noted that the construction process of the above resource access model can be completed on the firewall or on other servers. The other servers here can include, for example, a proxy server. After the proxy server constructs the resource access model based on the above steps 1 to 4, it can apply the resource access model to the firewall.

[0065] In some optional implementation manners, the obtaining of multiple initial static resources on the target protection host includes: obtaining multiple static resources within a defined learning period to obtain the initial static resources.

[0066] In some application scenarios, in order to make the judgment result of the resource access model more credible, the business peak period can be defined as the learning period. The learning period can include, for example, 3 days, 5 days, etc. In these application scenarios, one or more learning periods can be predefined to be able to provide more appropriate data and obtain a relatively complete resource access model.

[0067] In some application scenarios, the construction process of the above resource access model can be reflected by creating a table. For example, after obtaining multiple initial static resources, an initial resource framework table can be constructed, which can record information such as the resource type, resource name, superior static resource, inferior static resource, and uniform resource identifier corresponding to the initial static resources. Specifically, each initial static resource can be compared with the static resources in the preset library table to determine whether there are superior static resources, inferior static resources, uniform resource identifiers, etc. that match the preset library table. If so, the path information of the initial static resource can be further obtained based on its response information. Then, the initial resource framework table can be constructed based on the resource name, resource type, and path information of each initial static resource.

[0068] After constructing the initial resource framework table, for each initial static resource, according to the access path of the initial static resource, corresponding pre-path information can be generated to obtain a resource access trace table.

[0069] For example, the resource name, resource type, and path information in the initial resource framework table can be traversed, and duplicate removal processing can be performed. The relevant information of the processed initial static resources can be sorted out

[0070] to construct a resource access trace table.

[0071] After constructing the resource access trace table, it can be determined whether each of the initial static resources has been actually accessed, and the initial static resources that have been actually accessed can be determined as valid resources, and then a valid resource access table can be obtained.

[0072] Then, the initial resource framework table, the resource access trace table, and the valid resource table are integrated,

[0073] and a resource access model can be obtained.

[0074] In some alternative implementation manners, the determination of whether there is target pre-path information matching the target static resource in the resource access model in step 102 above includes the following sub-steps:

[0075] Sub-step 1021: According to the access path of the target static resource, determine whether there is corresponding

[0076] pre-path information;

[0077] Sub-step 1022: When it is determined according to the access path of the target static resource that there is corresponding pre-path information, determine whether the target static resource is a valid resource;

[0078] Sub-step 1023: If it is determined that the target static resource is a valid resource, determine the preposed path information corresponding to the target static resource as the target preposed path information.

[0079] After constructing the resource access model using the above steps 1 to 4, the firewall can use it to determine whether there is a hotlinking behavior in the resource access request. Subsequently, the judgment processes of the above sub-steps 1021 to 1023 can be the same as or similar to the relevant parts of the above steps 1 to 4, which will not be elaborated here.

[0080] 5 In this implementation, when determining whether there is a hotlinking behavior in the resource access request through the resource access model

[0081] behavior, a relatively accurate judgment result can be obtained, improving the security of the hotlinking protection process.

[0082] In some optional implementation manners, after receiving the resource access request, the hotlinking protection method further includes: determining whether the source of the resource access request is a trusted source; if so, determining whether the host domain name accessed by the resource access request belongs to a preset protection domain; where

[0083] when the host domain name belongs to the preset protection domain, determining whether there is target preposed path information in the resource access model that matches the target 5 static resource.

[0084] In some application scenarios, after receiving the resource access request, the firewall can determine whether its source is a trusted source. For example, it can be determined whether the Internet Protocol Address (abbreviated as IP address) of the client that sends the resource access request is within a pre-set trusted list. If it is, the source of the resource access request can be regarded as a trusted source.

[0085] 0 Further, after the firewall confirms that the resource access request is sent by a trusted source, it can continue

[0086] to determine whether the host domain name accessed by the resource access request belongs to the preset protection domain. For example, a protection domain list in the form of an IP address or a domain name can be pre-set. In this way, after receiving the resource access request, it can be determined whether the host domain name it accesses is within the pre-set protection domain list. If it is, the above step 101 can be continued.

[0087] 5 In this implementation, by preferentially checking the source of the resource access request and the host

[0088] By judging the domain name, some resource access requests with hotlinking behavior can be screened out for protection first, optimizing the hotlinking protection process and reducing the processing pressure of the subsequent resource access model to a certain extent.

[0089] Please refer to Figure 2 , which shows the structural block diagram of a hotlinking protection device provided by an embodiment of the present application. The hotlinking protection device can be a module, a program segment or code on an electronic device. It should be understood that

[0090] This device corresponds to the above Figure 1 method embodiment and can execute Figure 1 each step involved in the method embodiment. The specific functions of this device can be seen in the above description. To avoid repetition, the detailed description is appropriately omitted here.

[0091] Optionally, the above hotlinking protection device includes a receiving module 201, a path judgment module 202, and a protection module 203. Among them, the receiving module 201 is used to receive a resource access request; the resource access

[0092] request is used to request to obtain a target static resource; the path judgment module 202 is used to judge whether there is target pre-path information matching the target static resource in the resource access model; multiple static resources and the corresponding pre-path information of each static resource are stored in the resource access model; the protection module 203 is used to perform a hotlinking protection operation on the resource access request when it is determined that there is no target pre-path information matching the target static resource in the resource access model.

[0093] Optionally, the resource access model is created based on the following steps in advance: obtaining multiple initial static resources on a target protection host; for each of the initial static resources, generating corresponding pre-path information according to the access path of the initial static resource; judging whether each of the initial static resources is actually accessed, and determining the initial static resources that have been actually accessed as valid resources; storing the valid resources and the corresponding pre-path information to obtain the resource access model.

[0094] Optionally, the generating corresponding pre-path information according to the access path of the initial static resource includes: determining the upper-level path, the current path, and the secondary path corresponding to the initial static resource; the upper-level path represents the path of the upper-level static resource to which the initial static resource belongs; the secondary path represents the path of the lower-level static resource embedded in the initial static resource; determining the access path according to the upper-level path, the current path, and the secondary path.

[0095] Optionally, the determining whether each of the initial static resources is actually accessed includes: determining whether the response information for requesting to obtain the initial static resource indicates a successful response; if the response information indicates a successful response, determining that the initial static resource is actually accessed.

[0096] Optionally, the obtaining a plurality of initial static resources on the target protection host includes: obtaining a plurality of static resources within a defined learning period to obtain the initial static resources.

[0097] Optionally, the path determination module 202 is further configured to: according to the access path of the target static resource, determine whether there is corresponding pre-path information; if so, determine whether the target static resource is a valid resource; if so, determine the pre-path information corresponding to the target static resource as the target pre-path information.

[0098] Optionally, after receiving the resource access request, the hotlink protection device further includes a determination module, and the determination module is configured to: determine whether the source of the resource access request is a trusted source; if so, determine whether the host domain name accessed by the resource access request belongs to a preset protection domain; wherein, when the host domain name belongs to the preset protection domain, determine whether there is target pre-path information matching the target static resource in the resource access model.

[0099] It should be noted that those skilled in the art can clearly understand that for the convenience and

[0100] conciseness of description, the specific working process of the device described above can refer to the corresponding process in the foregoing method embodiment, and will not be described herein again.

[0101] Please refer to Figure 3 , Figure 3 FIG. is a schematic structural diagram of an electronic device for implementing the hotlink protection method provided in an embodiment of the present application. The electronic device may include: at least one processor 301, such as a CPU, at least one communication interface 302, at least one memory 303, and at least one communication bus

[0102] 304. Among them, the communication bus 304 is used to realize the direct connection communication between these components. Among them, the communication interface 302 of the device in the embodiment of the present application is used to communicate signaling or data with other node devices. The memory 303 may be a high-speed RAM memory, or a non-volatile memory, such as at least one disk memory. The memory 303 may alternatively be at least one storage device located far from the foregoing processor. The memory 303 stores a meter

[0103] Computer-readable instructions, when executed by the processor 301, enable the electronic device to perform the above Figure 1 method process shown.

[0104] It can be understood that Figure 3 the structure shown is only illustrative, and the electronic device may further include more or fewer components than Figure 3 shown therein, or have a different configuration from Figure 3 shown therein. Figure 3 Each component shown therein may be implemented by hardware, software, or a combination thereof.

[0105] Embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it can execute the method process performed by the electronic device in the method embodiment as Figure 1 shown.

[0106] Embodiments of the present application provide a computer program product. The computer program product includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program

[0107] instructions. When the program instructions are executed by a computer, the computer can execute the methods provided in the above method embodiments. For example, the method may include: receiving a resource access request; the resource access request is used to request to obtain a target static resource; determining whether there is target pre-path information in the resource access model that matches the target static resource; the resource access model stores a plurality of static resources and the pre-path information corresponding to each static resource; if not, performing a hotlink protection operation on the resource access request.

[0108]

[0109] In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of the units is only a logical function division, and there may be other division methods in actual implementation. Also, for example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection between each other may be through some communication interfaces. The indirect coupling or communication connection of the device or unit may be in an electrical, mechanical, or other form.

[0110] ​In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or may be distributed across multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0111] Furthermore, in each embodiment of the present application, the various functional modules may be integrated together to form an independent part, or each module may exist alone, or two or more modules may be integrated to form an independent part.

[0112] In this document, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.

[0113] The above are only the embodiments of the present application and are not used to limit the protection scope of the present application. For those skilled in the art, the present application may have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included within the protection scope of the present application.

Claims

1. A method for protecting against hotlinking, characterized in that, Applied to a firewall, the method includes: Receiving a resource access request; the resource access request is used to request to obtain a target static resource; Determining whether there is target pre-path information matching the target static resource in a resource access model; multiple static resources and pre-path information corresponding to each static resource are stored in the resource access model; If not, performing a hotlink protection operation on the resource access request; Wherein, the resource access model is pre-created based on the following steps: Obtaining multiple initial static resources on a target protection host; For each of the initial static resources, generating corresponding pre-path information according to the access path of the initial static resource; Determining whether each of the initial static resources is actually accessed, and determining the initially static resources that have been actually accessed as valid resources; Storing the valid resources and the corresponding pre-path information to obtain the resource access model; Wherein, the generating corresponding pre-path information according to the access path of the initial static resource includes: Determining a superior path, a current path, and a secondary path corresponding to the initial static resource; the superior path represents the path of the upper-level static resource to which the initial static resource belongs; the secondary path represents the path of the lower-level static resource embedded in the initial static resource; Determining the access path according to the superior path, the current path, and the secondary path.

2. The method according to claim 1, wherein The determining whether each of the initial static resources is actually accessed includes: Determining whether the response information for requesting to obtain the initial static resource indicates a successful response; If the response information indicates a successful response, determining that the initial static resource is actually accessed.

3. The method according to claim 1, wherein The obtaining multiple initial static resources on a target protection host includes: Obtaining multiple static resources within a defined learning period to obtain initial static resources.

4. The method according to any one of claims 1 to 3, characterized in that, The determining whether there is target pre-path information matching the target static resource in the resource access model includes: Judging whether there is corresponding pre-path information according to the access path of the target static resource; If so, determining whether the target static resource is a valid resource; If so, determining the pre-path information corresponding to the target static resource as the target pre-path information.

5. The method according to any one of claims 1 to 3, characterized in that After receiving the resource access request, the method further includes: Determining whether the source of the resource access request is a trusted source; If so, determining whether the host domain name accessed by the resource access request belongs to a preset protection domain; Wherein, when the host domain name belongs to the preset protection domain, determining whether there is target pre-path information matching the target static resource in the resource access model.

6. A hotlink protection device, characterized in that, Applied to a firewall, the device includes: A receiving module, configured to receive a resource access request; the resource access request is used to request to obtain a target static resource; A path determination module, configured to determine whether there is target pre-path information matching the target static resource in the resource access model; multiple static resources and the corresponding pre-path information of each static resource are stored in the resource access model; wherein, the resource access model is created in advance based on the following steps: obtaining multiple initial static resources on a target protected host; for each of the initial static resources, generating corresponding pre-path information according to the access path of the initial static resource; determining whether each of the initial static resources is actually accessed, and determining the initial static resources that have been actually accessed as valid resources; storing the valid resources and the corresponding pre-path information to obtain the resource access model; wherein, generating corresponding pre-path information according to the access path of the initial static resource includes: determining the superior path, current path and secondary path corresponding to the initial static resource; the superior path represents the path of the upper-level static resource to which the initial static resource is attached; the secondary path represents the path of the lower-level static resource embedded in the initial static resource; determining the access path according to the superior path, current path and the secondary path. A protection module, configured to perform a hotlink protection operation on the resource access request when it is determined that there is no target pre-path information matching the target static resource in the resource access model.

7. An electronic device, characterized in that, It includes a processor and a memory, and the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the method according to any one of claims 1-5 is run.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, the method according to any one of claims 1-5 is run.

Images