Abnormal access detection method and device, storage medium and electronic equipment

Abstract

The application provides an abnormal access detection method and device, a storage medium and an electronic device. In each sliding time window of a periodic cycle, when the access traffic of a target IP causes tokens in at least one of a first token bucket and a second token bucket to be depleted, the first depletion frequency of the target IP to the first token bucket and the second depletion frequency of the target IP to the second token bucket in the sliding time window are obtained; the tokens in the first token bucket and the second token bucket are consumed in sequence in response to the access of the target IP, the first token bucket is replenished with tokens at a first token issuance rate, the second token bucket is replenished with tokens at a second token issuance rate different from the first token issuance rate, and the first token bucket and the second token bucket are both configured to automatically perform a token filling operation when the tokens are depleted; and whether the access traffic of the target IP belongs to abnormal access is detected based on the first depletion frequency and the second depletion frequency. The method can improve the accuracy of abnormal access detection.

Description

Technical Field

[0001] This disclosure relates to a method, apparatus, storage medium, and electronic device for detecting abnormal access. Background Technology

[0002] The rapid development of internet technology has brought a plethora of applications that have made our lives more convenient. However, it has also spawned some gray industries, such as those involving data scraping and malicious attacks to obtain illicit profits. Measuring and evaluating the access volume of a single IP address within a given time period is an important reference standard for early warning and monitoring.

[0003] Traditional token bucket algorithms add tokens to the bucket at a constant rate. Access is considered legitimate as long as a token can be obtained from the bucket. However, this approach is prone to misidentifying occasional, short-duration, normal, high-frequency requests. It also fails to accurately identify continuous malicious traffic that does not exceed the peak size. Therefore, the accuracy of abnormal access detection in related implementations is relatively low. Summary of the Invention

[0004] In view of this, this application provides a method, apparatus, system, storage medium, and electronic device for detecting abnormal access, which can improve the accuracy of abnormal access detection.

[0005] To solve the above-mentioned technical problems, the technical solution of this application is implemented as follows:

[0006] In one embodiment, a method for detecting abnormal access is provided, the detection method comprising:

[0007] Within each sliding time window of the cycle, when the access traffic based on the target IP causes at least one of the first and second token buckets to run out of tokens, the first number of times the target IP runs out of the first token bucket and the second number of times it runs out of the second token bucket within the sliding time window are obtained; wherein, the tokens in the first and second token buckets are consumed sequentially in response to the access of the target IP, the first token bucket is replenished with tokens at a first token issuance rate, the second token bucket is replenished with tokens at a second token issuance rate different from the first token issuance rate, and both the first and second token buckets are configured to automatically perform a token filling operation when tokens are run out;

[0008] Based on the first exhaustion count and the second exhaustion count, it is determined whether the access traffic of the target IP is abnormal.

[0009] The step of detecting whether the access traffic of the target IP is abnormal based on the first exhaustion count and the second exhaustion count includes:

[0010] The first exhaustion count and the second exhaustion count are matched with a preset traffic range, wherein the traffic range is divided according to the token issuance rate of the first token bucket and the second token bucket;

[0011] Based on the matching results of the first exhaustion count and the second exhaustion count with the traffic range, it is determined whether the access traffic of the target IP belongs to abnormal access.

[0012] The traffic range is set for the first token bucket and the second token bucket respectively, and is implemented by a preset number of times.

[0013] Wherein, the sliding time window is a first time window and / or a second time window;

[0014] The second time window is a number of consecutive first time windows, and the flow ranges corresponding to the first time windows and the second time windows are different.

[0015] The method further includes:

[0016] In response to the access request corresponding to the target IP, tokens are obtained from the first token bucket and the second token bucket respectively based on the target IP;

[0017] In response to the first token bucket being exhausted, the system records one instance of the first token bucket being exhausted and the time of exhaustion for the target IP; and performs a first token bucket refill operation.

[0018] In response to the fact that the tokens in the second token bucket have been exhausted, the system records one instance of the second token bucket being exhausted for the target IP, along with the time of exhaustion; and then performs a second token bucket filling operation.

[0019] Wherein, after performing the second token bucket filling operation, the method further includes: allocating a token from the first token bucket to the target IP;

[0020] After performing the second token bucket filling operation, the method further includes: allocating tokens from the second token bucket to the target IP.

[0021] The method further includes:

[0022] An alarm is output in response to the detection that the access traffic to the target IP is abnormal.

[0023] In one embodiment, an abnormal access detection device is provided, the detection device comprising:

[0024] The acquisition unit is configured to, within each sliding time window of a periodic cycle, acquire the first number of times the target IP has exhausted tokens in the first token bucket and the second number of times it has exhausted tokens in the second token bucket within the sliding time window, based on the access traffic of the target IP; wherein, the tokens in the first token bucket and the second token bucket are consumed sequentially in response to the access of the target IP, the first token bucket is replenished with tokens at a first token issuance rate, the second token bucket is replenished with tokens at a second token issuance rate different from the first token issuance rate, and both the first token bucket and the second token bucket are configured to automatically perform a token filling operation when tokens are exhausted;

[0025] The detection unit is configured to perform an operation based on the first exhaustion count and the second exhaustion count to detect whether the access traffic of the target IP is abnormal.

[0026] In another embodiment, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements a method for detecting abnormal access.

[0027] In another embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements a method for detecting abnormal access.

[0028] As can be seen from the above technical solution, the above embodiments determine the number of times tokens are exhausted by using token buckets at two different rates to detect whether the access traffic of the target IP within the sliding time window is abnormal. Furthermore, by setting an automatic refill operation when the token bucket is exhausted, measurement can be performed over a constant duration. This solution can improve the accuracy of abnormal access detection. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 This is a schematic diagram of an access request processing flow in an embodiment of this application;

[0031] Figure 2 This is a schematic diagram of an abnormal access detection method in an embodiment of this application;

[0032] Figure 3This is a schematic diagram of another abnormal access detection method in an embodiment of this application;

[0033] Figure 4 This is a schematic diagram of the structure of an abnormal access detection device in an embodiment of this application;

[0034] Figure 5 This is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0035] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0036] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe the order or sequence of objects. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0037] The technical solution of the present invention will be described in detail below with reference to specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0038] The rapid development of internet technology has brought a plethora of applications that have made our lives more convenient. However, it has also spawned some gray industries, such as those involving data scraping and malicious attacks to obtain illicit profits. How to detect access from a single IP address within a given time period, in order to accurately detect abnormal access while avoiding the false positives on legitimate, high-frequency requests, is a pressing technical problem that needs to be solved.

[0039] Based on the above requirements, this application provides a method for detecting abnormal access. By analyzing the token bucket exhaustion status of two token buckets at different rates, the number of times each token bucket is exhausted is determined to identify whether the access traffic from the target IP within a sliding time window constitutes abnormal access. Furthermore, by configuring an automatic refill operation when the token bucket is exhausted, measurement can be performed over a constant duration. This solution improves the accuracy of abnormal access detection.

[0040] This application embodiment detects abnormal access while processing access requests. Prior to these processing steps, it establishes the basis for its implementation by configuring two token buckets: a first token bucket and a second token bucket. The first token bucket replenishes tokens at a first token issuance rate, while the second token bucket replenishes tokens at a second token issuance rate different from the first. Both the first and second token buckets are configured to automatically refill when tokens are exhausted. In related technical implementations, tokens are typically replenished according to the set replenishment rate. However, this application embodiment, while replenishing tokens according to the replenishment rate, also performs a token bucket refill operation when the token bucket is exhausted. This allows for measurement within a constant sliding time window. The specific implementation is as follows:

[0041] For the first token bucket, set the first token issuance rate and the maximum capacity of the first token bucket;

[0042] The first token bucket is replenished with tokens at the first token issuance rate, such as N tokens per minute at the first token issuance rate; N is an integer not less than 1; when the tokens in the first token bucket have reached the maximum capacity of the first token bucket, the excess tokens are discarded.

[0043] When a token is retrieved from the first token bucket for an access request, one token is retrieved at a time; when the first token bucket is exhausted, the first token bucket is filled and a token is allocated to the access request.

[0044] For the second token bucket, set the second token issuance rate and the maximum capacity of the second token bucket;

[0045] The second token bucket is replenished with tokens at the second token issuance rate, such as M tokens per minute at the second token issuance rate; M is an integer not less than 1; when the tokens in the second token bucket have reached the maximum capacity of the second token bucket, the excess tokens are discarded; since the first token issuance rate is not equal to the second token issuance rate, the number of tokens put into the token bucket per minute is not the same, that is, M and N are not the same.

[0046] When a token is retrieved from the second token bucket for an access request, one token is retrieved at a time; when the second token bucket is exhausted, a second token bucket fill operation is performed, and a token is allocated to the access request.

[0047] The issuance rates of the first and second tokens are different; there is no restriction on which is higher or lower. Here, we assume that the issuance rate of the first token is lower than that of the second token.

[0048] If a token can be obtained from the first token bucket, it means that the request rate of the accessing IP is less than the issuance rate of the first token bucket, or does not exceed the maximum capacity of the first token bucket.

[0049] If the first token bucket is exhausted, but tokens can be obtained from the second token bucket, it means that the request rate of the accessing IP is greater than the sending rate of the first token bucket and exceeds the maximum capacity of the first token bucket, but the request rate is less than the issuing rate of the second token bucket or does not exceed the maximum capacity of the second token bucket.

[0050] If the second token bucket is exhausted, it means that the request rate of the accessing IP is greater than the issuance rate of the second token bucket and exceeds the maximum capacity of the second token bucket.

[0051] The following description, in conjunction with the accompanying drawings, details the implementation of access request processing and abnormal access detection processes in the embodiments of this application.

[0052] See Figure 1 , Figure 1 This is a schematic diagram illustrating the processing flow of an access request in an embodiment of this application. The specific steps are as follows:

[0053] Step 101: In response to the access request corresponding to the target IP, obtain tokens from the first token bucket and the second token bucket respectively based on the target IP.

[0054] The target IP here is the IP address corresponding to the access request. This target IP address can be a specific access IP address or the IP address corresponding to all access requests, i.e., the IP address corresponding to the traffic access used for detection.

[0055] Upon receiving an access request, the system simultaneously retrieves tokens from both the first and second token buckets based on the target IP address of the access request.

[0056] Step 102: In response to the tokens in the first token bucket being exhausted, record the time when the first token bucket was exhausted for the target IP; perform the first token bucket refill operation; and allocate tokens from the first token bucket to the target IP. Proceed to step 106.

[0057] Each time the token is exhausted, it is recorded. In practice, it can be recorded one by one, along with the exhaust time; or it can be counted by incrementing the count by 1 according to the sliding time window. Both methods can count the number of times the corresponding IP exhaust token is exhausted in each sliding time window.

[0058] In this embodiment of the application, when the target IP does not obtain a token, it does not directly refuse to allocate a token to the target IP, but waits for the first token bucket to be filled before allocating a token to the target IP.

[0059] Step 103: In response to the tokens in the second token bucket being exhausted, record the time when the second token bucket was exhausted for the target IP; perform the second token bucket refill operation and allocate tokens from the second token bucket to the target IP. Proceed to step 106.

[0060] Each time the token is exhausted, it is recorded. In practice, this can be done by recording each exhaustion individually, along with the exhaustion time; alternatively, the count can be incremented by 1 according to a sliding time window. Both methods ensure that the number of token exhaustions for the corresponding IP within each sliding time window is counted. The counts can be recorded separately for the first and second token buckets.

[0061] In this embodiment of the application, when the target IP does not obtain a token, it does not directly refuse to allocate a token to the target IP, but waits for the second token bucket to be filled before allocating a token to the target IP.

[0062] Step 104: In response to the fact that the tokens in the first token bucket are not exhausted, allocate tokens from the first token bucket to the target IP. Proceed to step 106.

[0063] Step 105: In response to the fact that the tokens in the second token bucket are not exhausted, allocate tokens from the second token bucket to the target IP.

[0064] Step 106: Process the access request based on the tokens obtained from the first token bucket and the tokens obtained from the second token bucket.

[0065] This enables the acquisition of tokens from the first and second token buckets for an access request, allowing subsequent processing of the access request based on the two acquired tokens.

[0066] In this embodiment of the application, when acquiring token buckets, if the tokens in the token bucket are exhausted, the number of times the tokens are exhausted for each target IP is recorded for use when detecting abnormal access in the sliding time window. Regardless of whether the token buckets are exhausted, both token buckets will allocate tokens to the target IP. In this way, abnormal access can be detected only by the number of times the first token bucket is exhausted and the number of times the second token bucket is exhausted for the target IP. It is not necessary to determine whether to process access requests that have not acquired tokens, or whether there are blacklists and whitelists. This simplifies the process of detecting abnormal access and improves processing efficiency.

[0067] See Figure 2 , Figure 2 This is a schematic diagram of a method for detecting abnormal access in an embodiment of this application. The specific steps are as follows:

[0068] Step 201: In each sliding time window of the periodic cycle, when the access traffic based on the target IP causes at least one of the first and second token buckets to run out of tokens, obtain the first number of times the target IP runs out of the first token bucket and the second number of times it runs out of the second token bucket within the sliding time window; wherein, the tokens in the first and second token buckets are consumed one after another in response to the access of the target IP, the first token bucket replenishes tokens at a first token issuance rate, the second token bucket replenishes tokens at a second token issuance rate different from the first token issuance rate, and both the first and second token buckets are configured to automatically perform a token filling operation when tokens are run out.

[0069] In the specific implementation of this application embodiment, within each sliding time window, at least one token bucket in the first token bucket and the second token bucket is exhausted once. For the IP of the traffic that has exhausted the token bucket, an exhaustion count is obtained and an abnormal access detection is performed.

[0070] Step 202: Based on the first exhaustion count and the second exhaustion count, detect whether the access traffic of the target IP belongs to abnormal access.

[0071] In this embodiment, the number of times tokens are exhausted by two token buckets at different rates is determined to identify whether the access traffic from the target IP within the sliding time window is abnormal. Furthermore, by setting an automatic refill operation when the token bucket is exhausted, measurement can be performed over a constant duration. This scheme improves the accuracy of abnormal access detection.

[0072] In another embodiment,

[0073] The sliding time window is a first time window, and / or a second time window;

[0074] The second time window consists of several consecutive first time windows, and the flow ranges corresponding to the first and second time windows are different.

[0075] In practical implementation, a single-length sliding window, such as a first time window or a second time window, can be used, or a method of detecting simultaneously using both a first time window and a second time window can be used.

[0076] See Figure 3 , Figure 3 This is a schematic diagram of another abnormal access detection method in an embodiment of this application. The specific steps are as follows:

[0077] Step 301: In each sliding time window of the periodic cycle, when the access traffic based on the target IP causes at least one of the first and second token buckets to run out of tokens, obtain the first number of times the target IP runs out of the first token bucket and the second number of times it runs out of the second token bucket within the sliding time window; wherein, the tokens in the first and second token buckets are consumed one after another in response to the access of the target IP, the first token bucket replenishes tokens at a first token issuance rate, the second token bucket replenishes tokens at a second token issuance rate different from the first token issuance rate, and both the first and second token buckets are configured to automatically perform a token filling operation when tokens are run out.

[0078] In this embodiment of the application, during specific implementation, if at least one token bucket in the first and second token buckets is exhausted once within each sliding time window, an exhaustion count is triggered for the IP address whose traffic has exhausted the token bucket, and an abnormal access detection is performed. When both token buckets are exhausted simultaneously based on the same access, it is determined as a token bucket exhaustion.

[0079] When the access request exhausts the tokens in the first token bucket and / or the second token bucket, a token bucket exhaustion count and exhaustion time will be recorded. The exhaustion counts for the target IP will be obtained within the sliding window time to obtain the first exhaustion count and the second exhaustion count for the target IP.

[0080] Step 302: Match the first exhaustion count and the second exhaustion count with a pre-defined flow range; wherein the flow range is divided according to the token issuance rate of the first token bucket and the second token bucket.

[0081] The first exhaustion count is used to characterize the number of times the target IP's token consumption rate to the first token bucket exceeds the first token issuance rate or the maximum capacity of the first token bucket. The second exhaustion count is used to characterize the number of times the target IP's token consumption rate to the second token bucket exceeds the second token issuance rate or the maximum capacity of the second token bucket.

[0082] Step 303: Based on the matching results of the first exhaustion count and the second exhaustion count with the traffic range, determine whether the access traffic of the target IP belongs to abnormal access.

[0083] Steps 302 and 303 are used to detect whether the access traffic of the target IP is abnormal based on the first exhaustion count and the second exhaustion count.

[0084] Step 304: In response to the detection that the access traffic from the target IP is abnormal, an alarm is output.

[0085] The method of handling alarms after they are output is not limited in this embodiment of the application. For example, it can be that the number of alarms reaches a preset value within a preset time.

[0086] This embodiment uses the token bucket exhaustion status of two token buckets at different rates to determine the number of times each token bucket is exhausted, thereby detecting whether the access traffic from the target IP within a sliding time window constitutes abnormal access. Furthermore, by setting an automatic refill operation when the token bucket is exhausted, measurement can be performed over a constant duration. This scheme improves the accuracy of abnormal access detection and outputs an alarm based on the target IP when abnormal access is detected, allowing relevant personnel or equipment to take timely action.

[0087] In another embodiment,

[0088] The sliding time window is a first time window, and / or a second time window;

[0089] The second time window consists of several consecutive first time windows, and the flow ranges corresponding to the first and second time windows are different.

[0090] In practical implementation, a single-length sliding window, such as a first time window or a second time window, can be used, or a method of detecting simultaneously using both a first time window and a second time window can be used.

[0091] The following example demonstrates how to detect abnormal access during a specific time period, using a sliding time window as the first and second time windows, and configuring a corresponding traffic range for each time window:

[0092] The first time window corresponds to the first traffic interval, and the second time window corresponds to the second traffic interval.

[0093] Taking a second time window of 60 minutes and a first time window of 15 minutes as an example, where the second time window contains four consecutive first time windows; and the first and second traffic intervals are divided by the number of times; where the first traffic interval is from 0 to the first preset number of times (set for the first token bucket) and from 0 to the second preset number of times (set for the second token bucket); and the second traffic interval is from 0 to the third preset number of times (set for the first token bucket) and from 0 to the fourth preset number of times (set for the second token bucket).

[0094] Start detection. Within each 15-minute time window, when the first token bucket and / or the second token bucket are exhausted, obtain the first exhaustion count and the second exhaustion count corresponding to the target IP of the access traffic that exhausted the token bucket within this first time window.

[0095] The traffic range configuration can be set according to actual needs; it can also be updated as needed during use; in practice, it can be implemented by setting a preset number of times. The following example uses the preset number of times:

[0096] The first traffic range set for the first time window is 0 to the first preset number of times (set for the first token bucket) and 0 to the second preset number of times (set for the second token bucket);

[0097] When the first exhaustion count is greater than the first preset count, and / or the second exhaustion count is greater than the second preset count, the access traffic of the corresponding target IP is determined to be abnormal access;

[0098] Within the second time window, when the first token bucket and / or the second token bucket are exhausted, obtain the first exhaustion count and the second exhaustion count corresponding to the target IP whose token bucket is exhausted within this second time window;

[0099] The second flow range for the second time window is set to 0 to the third preset number of times (set for the first token bucket) and 0 to the fourth preset number of times (set for the second token bucket);

[0100] When the first exhaustion count is greater than the third preset count, and / or the second exhaustion count is greater than the fourth preset count, the access traffic of the corresponding target IP is determined to be abnormal access.

[0101] Here, when setting the first to fourth preset counts, the first preset count can be 3, the second preset count is 0, the third preset count is 10, and the fourth preset count is 3. However, in actual implementation, there is no limit to the number of preset counts. But usually, the third preset count is set to be greater than the first preset count, and the fourth preset count is greater than the second preset count.

[0102] This concludes the specific implementation of abnormal access detection based on two sliding time windows.

[0103] In this embodiment, by designing token bucket depletion scenarios with two different rates (taking the first token bucket issuance rate < the second token bucket sending rate as an example), the traffic IPs can be divided into three different intervals: "less than the first token bucket issuance rate / between the first token bucket issuance rate and the second token bucket issuance rate / greater than the second token bucket issuance rate." Since the traffic rate is instantaneous, judging the above three intervals by the depletion of the first and second token buckets can only indicate the access rate of the IPs within a certain period of time. To achieve measurement over a constant duration, the tokens in the bucket need to be refilled at the depletion moment, and the count needs to be performed within the corresponding sliding time window to observe whether the bucket is depleted of tokens next time. In this way, the "number of times exceeding the first token bucket issuance" and "number of times exceeding the second token bucket issuance" can be obtained in two different dimensions: constant duration and unit time window. By identifying the "number of times exceeding the first token bucket issuance" and "number of times exceeding the second token bucket issuance", problematic and abnormal IPs and IPs that need attention can be distinguished.

[0104] In related technologies, when implementing a single token bucket, due to the lack of counting, once a request exceeds the issuance rate of the second token bucket and exhausts the maximum capacity of the second token bucket, it will be classified into a range greater than the issuance rate of the second token bucket by the dual-speed dual-bucket token bucket. Without more detailed indicators, normal users who occasionally exceed the issuance rate of the second token bucket during active periods may be mistakenly penalized.

[0105] In the specific implementation of this application embodiment, not only is multiple sliding window counting used to avoid normal business access being mistakenly blocked, but a filling operation is also performed when the token bucket in the token bucket is exhausted, which can achieve measurement over a constant duration to improve the efficiency and accuracy of abnormal access detection.

[0106] All of the above-mentioned optional technical solutions can be combined in any way to form optional embodiments of this disclosure, and will not be described in detail here.

[0107] Based on the same inventive concept, this application also provides an abnormal access detection device. See also Figure 4 , Figure 4 This is a schematic diagram of an abnormal access detection device according to an embodiment of this application. The abnormal access detection device includes:

[0108] The acquisition unit 401 is configured to, within each sliding time window of the periodic cycle, when the access traffic of the target IP causes at least one of the first and second token buckets to run out of tokens, acquire the first number of times the target IP runs out of tokens in the first token bucket and the second number of times it runs out of tokens in the second token bucket within the sliding time window; wherein, the tokens in the first and second token buckets are consumed sequentially in response to the access of the target IP, the first token bucket is replenished with tokens at a first token issuance rate, the second token bucket is replenished with tokens at a second token issuance rate different from the first token issuance rate, and both the first and second token buckets are configured to automatically perform a token filling operation when tokens are exhausted;

[0109] The detection unit 402 is configured to perform an operation based on the first exhaustion count and the second exhaustion count to detect whether the access traffic of the target IP is abnormal.

[0110] In another embodiment,

[0111] The detection unit 402 is configured to, when performing the operation of detecting whether the access traffic of the target IP belongs to abnormal access based on the first exhaustion count and the second exhaustion count, match the first exhaustion count and the second exhaustion count with a preset traffic range, wherein the traffic range is divided according to the token issuance rate of the first token bucket and the second token bucket; and determine whether the access traffic of the target IP belongs to abnormal access based on the matching result of the first exhaustion count and the second exhaustion count with the traffic range.

[0112] In another embodiment, the traffic range is set for the first token bucket and the second token bucket respectively, and is implemented by a preset number of times.

[0113] In another embodiment, the sliding time window is a first time window and / or a second time window;

[0114] The second time window is a number of consecutive first time windows, and the flow ranges corresponding to the first time windows and the second time windows are different.

[0115] In another embodiment, the device further includes a recording unit 403 and a processing unit 404;

[0116] The acquisition unit 401 is configured to execute an access request in response to the target IP, and acquire tokens from the first token bucket and the second token bucket respectively based on the target IP;

[0117] Recording unit 403 is configured to, in response to the first token bucket being exhausted, record once for the target IP that the first token bucket has exhausted its tokens, and the time of exhaustion; and in response to the second token bucket being exhausted, record once for the target IP that the second token bucket has exhausted its tokens, and the time of exhaustion.

[0118] Processing unit 404 is configured to perform a first token bucket filling operation in response to the first token bucket being exhausted, and to perform a second token bucket filling operation in response to the second token bucket being exhausted.

[0119] In another embodiment,

[0120] Processing unit 404 is configured to allocate tokens from the first token bucket to the target IP after performing the second token bucket filling operation; and to allocate tokens from the second token bucket to the target IP after performing the second token bucket filling operation.

[0121] In another embodiment, the device further includes: an output unit 405;

[0122] Output unit 405 is configured to output an alarm in response to detecting that the access traffic of the target IP is abnormal.

[0123] The units in the above embodiments can be integrated into one unit or deployed separately; they can be merged into one unit or further divided into multiple sub-units.

[0124] In another embodiment, an electronic device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein a method for detecting abnormal access is implemented when the processor executes the program.

[0125] In another embodiment, a computer-readable storage medium is also provided, on which computer instructions are stored, which, when executed by a processor, enable a method for detecting abnormal access.

[0126] Figure 5 This is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention. Figure 5 As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other via the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute the following methods:

[0127] Within each sliding time window of the cycle, when the access traffic based on the target IP causes at least one of the first and second token buckets to run out of tokens, the first number of times the target IP runs out of the first token bucket and the second number of times it runs out of the second token bucket within the sliding time window are obtained; wherein, the tokens in the first and second token buckets are consumed one after another in response to the access of the target IP, the first token bucket is replenished with tokens at a first token issuance rate, the second token bucket is replenished with tokens at a second token issuance rate different from the first token issuance rate, and both the first and second token buckets are configured to automatically perform a token filling operation when tokens are run out;

[0128] Based on the first and second exhaustion counts, detect whether the access traffic of the target IP is abnormal.

[0129] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0130] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0131] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0132] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments disclosed in this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those shown in the drawings. For example, two blocks shown connectedly may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0133] Those skilled in the art will understand that the features described in the various embodiments and / or claims disclosed in this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, without departing from the spirit and teachings of this application, the features described in the various embodiments and / or claims of this application can be combined and / or combined in various ways, and all such combinations and / or combinations fall within the scope of this application.

[0134] This document uses specific embodiments to illustrate the principles and implementation methods of the present invention. The descriptions of these embodiments are merely illustrative of the method and core concepts of the present invention and are not intended to limit this application. Those skilled in the art can make changes to the specific implementation methods and application scope based on the ideas, spirit, and principles of the present invention. Any modifications, equivalent substitutions, or improvements made should be included within the scope of protection of this application.

Claims

1. A method for detecting abnormal access, characterized in that, The detection method includes: Within each sliding time window of the cycle, when the access traffic based on the target IP causes at least one of the first and second token buckets to run out of tokens, the first number of times the target IP runs out of the first token bucket and the second number of times it runs out of the second token bucket within the sliding time window are obtained; wherein, the tokens in the first and second token buckets are consumed sequentially in response to the access of the target IP, the first token bucket is replenished with tokens at a first token issuance rate, the second token bucket is replenished with tokens at a second token issuance rate different from the first token issuance rate, and both the first and second token buckets are configured to automatically perform a token filling operation when tokens are run out; Based on the first exhaustion count and the second exhaustion count, it is determined whether the access traffic of the target IP is abnormal.

2. The detection method according to claim 1, characterized in that, The step of detecting whether the access traffic of the target IP is abnormal based on the first exhaustion count and the second exhaustion count includes: The first exhaustion count and the second exhaustion count are matched with a preset traffic range, wherein the traffic range is divided according to the token issuance rate of the first token bucket and the second token bucket; Based on the matching results of the first exhaustion count and the second exhaustion count with the traffic range, it is determined whether the access traffic of the target IP belongs to abnormal access.

3. The detection method according to claim 2, characterized in that, The traffic range is set for the first token bucket and the second token bucket respectively, and is implemented by a preset number of times.

4. The detection method according to claim 2, characterized in that, The sliding time window is a first time window and / or a second time window; The second time window is a number of consecutive first time windows, and the flow ranges corresponding to the first time windows and the second time windows are different.

5. The detection method according to claim 1, characterized in that, The method further includes: In response to the access request corresponding to the target IP, tokens are obtained from the first token bucket and the second token bucket respectively based on the target IP; In response to the first token bucket being exhausted, the system records one instance of the first token bucket being exhausted and the time of exhaustion for the target IP; and performs a first token bucket refill operation. In response to the fact that the tokens in the second token bucket have been exhausted, the system records one instance of the second token bucket being exhausted for the target IP, along with the time of exhaustion; and then performs a second token bucket filling operation.

6. The detection method according to claim 5, characterized in that, After performing the first token bucket filling operation, the method further includes: allocating a token from the first token bucket to the target IP; After performing the second token bucket filling operation, the method further includes: allocating tokens from the second token bucket to the target IP.

7. The detection method according to any one of claims 1-6, characterized in that, The method further includes: An alarm is output in response to the detection that the access traffic to the target IP is abnormal.

8. A device for detecting abnormal access, characterized in that, The detection device includes: The acquisition unit is configured to, within each sliding time window of a periodic cycle, acquire the first number of times the target IP has exhausted tokens in the first token bucket and the second number of times it has exhausted tokens in the second token bucket within the sliding time window, based on the access traffic of the target IP; wherein, the tokens in the first token bucket and the second token bucket are consumed sequentially in response to the access of the target IP, the first token bucket is replenished with tokens at a first token issuance rate, the second token bucket is replenished with tokens at a second token issuance rate different from the first token issuance rate, and both the first token bucket and the second token bucket are configured to automatically perform a token filling operation when tokens are exhausted; The detection unit is configured to perform an operation based on the first exhaustion count and the second exhaustion count to detect whether the access traffic of the target IP is abnormal.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the method described in any one of claims 1-7.

Images