Access packet processing method, electronic device, storage medium and program product

Abstract

This application discloses an access message processing method, electronic device, storage medium, and program product. The access message processing method includes: matching a received first access message from a user with flow control rules; if the first access message matches the first flow control rule, sending a redirection message to the user, the redirection message being used to guide the user to access a relay website, the relay website being used to send a warning message to the user after receiving the user's access, the warning message indicating that the user is accessing a suspicious website; receiving a second access message to the suspicious website sent by the user after receiving the warning message; detecting the second access message to obtain a detection result; the detection result indicating whether to allow the second access message.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and particularly relates to an access message processing method, an electronic device, a storage medium and a program product. BACKGROUND

[0002] Currently, the interception / early warning system of traffic is mainly realized through two ways, one is to install software or plug-in in a terminal to detect the browsing behavior of a browser, and the other is to use a special device (such as a Deep Packet Inspection (DPI) device) to capture network traffic for identification. The way of using the DPI device to identify abnormal websites only supports processing two types of normal websites and abnormal websites, and there is no processing mechanism for suspected abnormal websites. That is, when a user accesses a normal webpage, the DPI performs a normal forwarding action and does not process it; when the user accesses an abnormal webpage, the DPI performs a blocking operation to prohibit the user's access. Due to the limitation of the processing action type in the control function of the DPI device, when the upper system considers that a certain type of webpage is suspected to have certain risks, if the DPI device still processes the traffic according to the control strategy of the abnormal webpage, the webpage will not be accessed. SUMMARY

[0003] Therefore, the present application provides an access message processing method, an electronic device, a storage medium and a program product.

[0004] The technical scheme of the present application is implemented as follows:

[0005] In one aspect, the present application provides an access message processing method applied to a first network, and the method comprises the following steps.

[0006] Matching a received first access message of a user with a traffic control rule;

[0007] If the first access message matches a first traffic control rule, a redirection message is sent to the user, the redirection message is used to guide the user to access a transfer website, the transfer website is used to send early warning information to the user after receiving the user's access, and the early warning information represents that the user is accessing a suspicious website;

[0008] Receiving a second access message of the suspicious website sent by the user after receiving the early warning information;

[0009] Detecting the second access message to obtain a detection result, and the detection result represents whether to release the second access message.

[0010] In the scheme, the second access message comprises one or more of a website address of the relay website, and an identification and a check code of the first traffic control rule, the check code comprising a device identification of a device where the first access message hits the first traffic control rule, and / or a timestamp of when the first access message hits the first traffic control rule, and the detecting the second access message comprises:

[0011] determining whether the second access message matches a second traffic control rule, the second traffic control rule being a white list rule, the white list rule comprising that a set field in the second access message contains the website address of the relay website;

[0012] Correspondingly, the detecting the second access message further comprises one or more of:

[0013] acquiring a traffic feature corresponding to the first traffic control rule based on the identification of the first traffic control rule, and determining whether the second access message matches the traffic feature;

[0014] determining whether a deep packet inspection (DPI) device corresponding to the device identification is an in-domain device, and / or determining whether the timestamp is within a set time interval.

[0015] In the scheme, in a case where the website address of the relay website matches the white list rule, if the second access message satisfies one or more of the following, the second access message is released:

[0016] the second access message matches the traffic feature;

[0017] the DPI device corresponding to the device identification is the in-domain device, and / or the timestamp is within the set time interval.

[0018] In the scheme, after the detecting the second access message, the method further comprises:

[0019] in a case where the second access message hits the second traffic control rule, associating and recording, in a set record table, an identification of the second traffic control rule, an identification of the first traffic control rule, and an operation type corresponding to the first traffic control rule, and updating a corresponding rule hit count;

[0020] in a case where the second access message does not hit the second traffic control rule, associating and recording, in the set record table, the identification of the first traffic control rule and the operation type corresponding to the first traffic control rule, and updating the corresponding rule hit count;

[0021] report the setting record table to an upper system, so that the upper system updates a flow control rule based on the setting record table.

[0022] In the above solution, after the setting record table is reported to the upper system, the method further includes:

[0023] receiving update information of a first flow control rule sent by the upper system, the upper system being configured to determine whether to update the first flow control rule based on a rule hit frequency in the setting record table.

[0024] In the above solution, the redirection message includes an access website, a website address of the transit website, an identifier of the first flow control rule, and a check code, the check code including a device identifier of a device where the first access message hits the first flow control rule and / or a time stamp when the first access message hits the first flow control rule.

[0025] In the above solution, the early warning information is an early warning page, and the early warning page includes options of continuing to access and stopping to access.

[0026] Embodiments of the present application further provide an electronic device, including a processor and a memory for storing a computer program capable of running on the processor, wherein the processor is configured to execute the steps in the above access message processing method when running the computer program.

[0027] Embodiments of the present application further provide a computer storage medium, having a computer program stored thereon, the computer program being executed by a processor to implement the steps in the above access message processing method.

[0028] Embodiments of the present application further provide a computer program product, including a computer program, the computer program being executed by a processor to implement the steps in the above access message processing method.

[0029] The embodiment of the present application matches the received first access message of the user with the flow control rule, if the first access message matches the first flow control rule, a redirection message is sent to the user, the redirection message is used to guide the user to access the transfer website, the transfer website is used to send the early warning information to the user after receiving the access of the user, and the early warning information represents that the user is accessing the suspicious website. The second access message of the suspicious website sent by the user after receiving the early warning information is received, the second access message is detected, and a detection result is obtained, the detection result represents whether to release the second access message. The embodiment of the present application performs the redirection operation on the access of the suspicious website, and combines the transfer website to send the early warning information to the user, so that the user can choose to continue to access or no longer access the suspicious website, the defect that the current DPI device cannot process the suspected abnormal webpage is made up, the access of the user to the suspicious website can be effectively prevented, and the risk that the user suffers from the malicious website attack is reduced. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 A flowchart of an access message processing method provided by the embodiment of the present application is shown in the figure.

[0031] Figure 2 A format diagram of a flow control rule provided by the embodiment of the present application is shown in the figure.

[0032] Figure 3 An information statistics format diagram of a setting record table provided by the embodiment of the present application is shown in the figure.

[0033] Figure 4 A setting record table provided by the embodiment of the present application is shown in the figure.

[0034] Figure 5 A structure diagram of a policy control system provided by the embodiment of the present application is shown in the figure.

[0035] Figure 6 Another structure diagram of a policy control system provided by the embodiment of the present application is shown in the figure.

[0036] Figure 7 A processing flowchart of the suspected abnormal webpage provided by the embodiment of the present application is shown in the figure.

[0037] Figure 8 A hardware composition structure diagram of an electronic device provided by the embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0038] With reference to the accompanying drawings, the technical solutions in the embodiments of the present application will be described clearly and completely. Obviously, the described embodiments are only some of the embodiments of the present application, but not all of them. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of the present application.

[0039] Currently, the interception / early warning system is mainly realized through two ways, one is to install software or plug-ins in the terminal to detect the browsing behavior of the browser, and the other is to use special equipment (such as DPI equipment) to capture network traffic for identification. Both of these two ways match the user's access to web pages with preset rules to determine whether the web page is an abnormal website. If it is confirmed to be an abnormal website, the web page is intercepted and access is prohibited; if it is suspected to be an abnormal website, the user is given a warning, and the user chooses whether to access; if it is a normal website, no processing is performed.

[0040] The way of using the interception software or plug-ins installed in the client to intercept and warn abnormal web pages can improve network security to a certain extent, but its effect is limited by whether the user actively installs and enables these tools. For terminals that do not install and enable the tools, the user still faces risks when browsing web pages.

[0041] The way of using DPI equipment to identify abnormal websites only supports processing of normal websites and abnormal websites, and has no processing mechanism for suspected abnormal websites. That is, when the user accesses a normal web page, the DPI performs normal forwarding actions and does not process; when the user accesses an abnormal web page, the DPI performs blocking operations to prohibit the user's access; when the user accesses a web page suspected to have risks, the DPI equipment has no appropriate processing action to process such traffic.

[0042] It can be seen that when using DPI equipment to intercept / early warning abnormal web pages, only normal websites and abnormal websites are supported. Due to the limitation of the type of processing actions in the control function of the DPI equipment, when the upper system considers that a certain type of web page is suspected to have certain risks, if the DPI equipment still processes the traffic according to the control strategy of the abnormal web page, the web page will not be accessed.

[0043] In view of the defects of the above related technologies, the embodiments of the present application provide an access message processing method, which can make up for the defect that the current DPI equipment cannot process suspected abnormal web pages. In order to describe the technical solutions of the present application, specific embodiments will be described below.

[0044] Figure 1 is a flowchart of an implementation process of an access message processing method provided by the embodiments of the present application. The method can be applied to a DPI equipment, and with reference to Figure 1 , the access message processing method comprises:

[0045] S101, match the received first access message of the user with a flow control rule.

[0046] DPI device is used to enhance the processing capacity of 4-7 layer protocol, can parse and identify high layer information according to pre-defined means, and intervene data flow as needed. DPI mainly has five logical functions: service identification, data multiplexing, log generation, analysis statistics, flow control.

[0047] Service identification: service identification refers to that the network device identifies the data flow passing through the device. The flow is identified according to the service used by the message, application layer protocol, tunnel protocol, message priority, five tuples and flow statistical characteristics.

[0048] Flow control: on the basis of service identification, the flow with certain characteristics is controlled, including: bandwidth adjustment, message discarding, priority modification, white list setting, or sending interference packets to achieve the purpose of interrupting connection or other specific purposes; similarly, the un-identified flow can also be controlled. In addition to relying on the identification ability of DPI, the implementation of flow control function also relies on the policy rules issued by the upper management system. These rules specify which operation should be performed on each flow, such as: forwarding, discarding, limiting speed or modifying priority, etc. The DPI device processes the flow according to these rules.

[0049] In the embodiment of the application, a large number of flow control rules are built in the DPI device, each flow control rule specifies which operation should be performed on the matched flow, such as: forwarding, discarding, limiting speed or modifying priority, etc. The flow control rules in the DPI device can be issued by the upper system and can be updated in real time. Among them, the DPI device is deployed in the network to collect and monitor the split flow of the user terminal or the DPI is deployed in series in the network.

[0050] Reference Figure 2 , Figure 2 is a format diagram of a flow control rule provided by the embodiment of the application. Among them, Rule_ID is the identification of the flow control rule, Priority is the priority of the flow control rule, Operation is the operation performed when the flow control rule is hit, and the remaining fields are message characteristics.

[0051] The embodiment adds a "redirect" control operation on the basis of retaining original control operations of a DPI device. The processing of the operation is to construct an http temporary redirect message to a certain website. The value is "redirectto xxx" when a policy is issued. "Xxx" can be a website URL or an IP address. The original forwarding, blocking, speed limiting, priority modification and other operations of the DPI are respectively indicated by "Permit", "Deny", "upstream cirxxx pirxxx" / "downstream cirxxx pirxxx"("xxx" is a speed limiting value), "DSCPxxx" / "TOS xxx"("xxx" is a message priority value) and the like.

[0052] As shown in Figure 2 The rule of Rule_ID=r1 is a redirection control rule. When the host of the message contains A, the message is redirected to the B website. The rule of Rule_ID=r2 is a whitelist rule (with the highest priority). When the referer of the message contains B, the traffic is allowed to pass. The rule of Rule_ID=r6 is a blocking control rule. When the host of the message contains Z, the message is discarded.

[0053] The first access message is traffic of user accessing a certain webpage. The first access message is matched with the traffic control rule.

[0054] In S102, if the first access message matches the first traffic control rule, a redirect message is sent to the user. The redirect message is used to guide the user to access a relay website. The relay website is used to send a warning information to the user after receiving the access of the user. The warning information represents that the user is accessing a suspicious website.

[0055] The first access message matches the first traffic control rule, which means that the first access message hits the rule of the suspected abnormal website. The first traffic control rule corresponds to a redirection operation. A redirect message is constructed and sent to the user, so as to redirect the user to the relay website.

[0056] The embodiment of the application adds a "redirect" control operation on the basis of retaining original control operations of a DPI device. The processing of the operation is to construct an http temporary redirect message to a certain website (relay website).

[0057] Here, the redirect message can be a 302 response message. The redirect message contains the website of the relay website and can also include the original access address, the identification (ID) of the first traffic control rule and the like.

[0058] The user terminal parses the received redirection message after receiving the redirection message, fills the address of the transit website into the host, and accesses the transit website. The transit website sends a pre-warning message to the user terminal to inform that the current access is to a suspected risky webpage.

[0059] For example, the transit website responds to the user terminal with a 200 OK message and contains a pop-up content. The pop-up content can include options of continuing access and stopping access.

[0060] S103, receiving a second access message for the suspected website sent by the user after receiving the pre-warning message.

[0061] If the user chooses to continue access, the user terminal accesses again to submit the second access message. Here, the submitted second access message can contain more information than the first access message, for example, it can include the website address of the transit website, the identification of the first traffic control rule hit last time, and the like.

[0062] S104, detecting the second access message to obtain a detection result; the detection result represents whether to release the second access message.

[0063] Here, the detection of the second access message can compare the source IP addresses of the first access message and the second access message, for example, to determine whether they are consistent. If they are not consistent, the second access message can be a fake message.

[0064] It can also be checked whether the DPI device identification carried in the second access message belongs to the in-domain DPI device to determine the legality of the second access message. If it does not belong, the second access message can be a fake message.

[0065] It can also be checked whether the DPI device identification carried in the second access message belongs to the in-domain DPI device to determine the legality of the second access message. If it does not belong, the second access message can be a fake message.

[0066] It can also be checked whether the timestamp carried in the second access message is within the set time interval.

[0067] The embodiment of the application matches the received first access message of the user with a flow control rule, if the first access message matches the first flow control rule, a redirection message is sent to the user, the redirection message is used to guide the user to access a relay website, the relay website is used to send a pre-warning information to the user after receiving the access of the user, the pre-warning information represents that the user is accessing a suspicious website. A second access message of the suspicious website sent by the user after receiving the pre-warning information is received, the second access message is detected to obtain a detection result, the detection result represents whether to release the second access message. The embodiment of the application performs a redirection operation on the access of the suspicious website, and combines the relay website to send the pre-warning information to the user, so that the user can choose to continue to access or no longer access the suspicious website, which makes up for the defect that the current DPI device cannot process suspected abnormal webpages, can effectively prevent the user from accessing the suspicious website, and reduces the risk of the user suffering from malicious website attacks.

[0068] In an embodiment, the second access message includes one or more of the following: a website address of the relay website, an identification of the first flow control rule, and a check code. The check code includes a device identification of a device where the first access message hits the first flow control rule, and / or a timestamp when the first access message hits the first flow control rule. The detection of the second access message includes:

[0069] Determining whether the second access message matches a second flow control rule, the second flow control rule being a white list rule, the white list rule being that a set field in the second access message contains the website address of the relay website.

[0070] Correspondingly, the detection of the second access message further includes one or more of the following:

[0071] Based on the identification of the first flow control rule, obtaining a flow feature corresponding to the first flow control rule, and determining whether the second access message matches the flow feature;

[0072] Determining whether a deep packet inspection (DPI) device corresponding to the device identification is an in-domain device, and / or determining whether the timestamp is within a set time interval.

[0073] That is, the second access message must include the website address of the relay website, and at least one of the identification of the first flow control rule and the check code can be added to the second access message.

[0074] In an embodiment, if the user chooses to continue accessing, a set field (such as the Referer field) is automatically added in the second access message. The embodiment adds the check code in the Referer, thereby increasing security. By checking the unique identifier of the device or the timestamp of the second access, the embodiment prevents illegal personnel from tampering with the Referer field to bypass the risk interception and early warning system. The embodiment adds the Rule ID in the Referer, thereby facilitating the association of the second access of the user with the first access behavior, and thereby facilitating statistical analysis.

[0075] The Referer field contains the previous URL address of the request initiation, that is, the page address before the user accesses the current page. In the embodiment, the Referer field includes url=B&ruleid=r1&C. B is the website address of the transit website, r1 is the identifier of the first traffic control rule, and C is the check code. The check code can include the timestamp (Timestamp) when the first traffic control rule is hit, and can also include the unique identifier value (DPI_ID) of the DPI device identifying the message. The identifier value of the DPI device can be assigned by the upper system or regularly updated uniformly, and the DPI devices in the same domain can distinguish the authenticity of the identifier from each other.

[0076] In an embodiment, the redirection message includes the access website address, the website address of the transit website, the identifier of the first traffic control rule, and the check code. The check code includes the device identifier of the device when the first access message hits the first traffic control rule, and / or the timestamp when the first access message hits the first traffic control rule.

[0077] For example, the location field of the redirection message follows the following format:

[0078] http: / / {website1}?url={website2}&ruleid={Rule_ID value}&{Verification}

[0079] where {website1} is the transit website address, {website2} is the suspicious website address, {Rule_ID value} is the ID value of the first traffic control rule, and {Verification} is the check code, which can be the unique identifier value of the DPI device or the timestamp. If {Rule_ID value} or {Verification} contains special characters, such as spaces or equal signs, hexadecimal representation is required. The positions of {Rule_ID value} or {Verification} can be flexibly set in any order; {Rule_ID value} cannot be empty, and {Verification} can be empty.

[0080] The embodiment checks the message carrying the Referer field by using Rule_ID and Verification when the message passes through the DPI device, so as to prevent illegal personnel from escaping the block by forging the referer field. If the Referer in the get or post message does not contain the Verification field, only the Rule_ID is checked; if the Referer in the get or post message does not contain both the Rule_ID and the Verification, it is indicated that the http request message is not linked by the redirection message constructed by the DPI device, and in this case, no check is needed.

[0081] For example, first, the DPI device checks whether the second access message hits the second traffic control rule, the second traffic control rule is a white list rule, and the white list rule checks whether the set field in the second access message contains the transit website address. If the second access message hits the white list rule, the Rule_ID and the verification code are checked respectively, and after the check, the traffic is allowed to pass.

[0082] In the verification Rule_ID, the Rule_ID is used to query the rule library to obtain the traffic characteristics corresponding to the rule, and is compared with the second access message to check whether they are consistent.

[0083] The Verification (verification code) is checked. If the DPI device unique identifier (DPI_ID) is used for verification, it is checked whether the ID belongs to the domain DPI device to determine the legality of the referer field; if the timestamp (Timestamp) is used for verification, the following judgment rules are followed: if the Timestamp is greater than or equal to the current system time, it is indicated that the referer field is a fake field; if the Timestamp is less than the current system time, and the difference between them is not greater than 5 minutes, it is determined that the referer is legal and effective; if the Timestamp is less than the current system time, and the difference between them is greater than 5 minutes, it is indicated that the referer has expired (5 minutes in the judgment rule is an example, which can be flexibly set).

[0084] The above two checks, any one of which does not pass, will redirect or directly intercept the message again.

[0085] The embodiment adds the verification code in the referer to increase the security, checks the device unique identifier or the timestamp of the second access, and prevents illegal personnel from tampering with the referer field to bypass the risk interception and early warning system. The Rule_ID is added in the referer, so as to associate the second access of the user with the first access behavior, and then statistical analysis is performed.

[0086] In an embodiment, in the case that the website address of the transit website matches the whitelist rule, if the second access message meets one or more of the following conditions, the second access message is released:

[0087] The second access message matches the traffic feature;

[0088] The device identifier corresponds to a domain device, and / or the timestamp is within a set time interval.

[0089] For example, if the website address of the transit website hits the whitelist rule, and the second access message matches the traffic feature, and the device identifier corresponds to a domain device, the second access message is released, and access is allowed.

[0090] In an embodiment, the pre-warning information is a pre-warning page, and the pre-warning page includes options of continuing access and stopping access. This allows the user to choose to continue access or not to access the suspicious website, which makes up for the current DPI device's inability to handle suspected abnormal web pages, effectively prevents user access to suspicious websites, and reduces the risk of user attacks by malicious websites.

[0091] In an embodiment, after detecting the second access message, the method further includes:

[0092] In the case that the second access message hits the second traffic control rule, the identifier of the second traffic control rule, the identifier of the first traffic control rule, and the operation type corresponding to the first traffic control rule are associated and recorded in a set record table, and the corresponding rule hit count is updated;

[0093] In the case that the second access message does not hit the second traffic control rule, the identifier of the first traffic control rule and the operation type corresponding to the first traffic control rule are associated and recorded in the set record table, and the corresponding rule hit count is updated;

[0094] The set record table is reported to an upper system, so that the upper system updates the traffic control rule based on the set record table.

[0095] The DPI device can periodically or according to a trigger condition feed back user access behavior information to the upper system, such as Figure 3 Figure 3 is a set record table information statistical format diagram provided by an embodiment of the application.

[0096] ​Rule_ID_2 is the ID of the white list rule matched by the traffic (not required, if not, leave it blank), Operation is the operation performed when the rule is matched, Times is the number of times the rule is matched. Note: this table item is only used to record the rule hit, and the Operation field is only used to record the processing action when the rule is matched.

[0097] When the traffic hits the white list rule (determined by whether the priority value is 1), if the matching condition of the rule is the Referer field, the white list rule ID is filled in Rule_ID_2, the value of the original ruleid is extracted from the Referer and filled in Rule_ID_1, and the Operation field is filled in. Each time the rule is matched, Times is incremented by 1; when the traffic hits the white list with a matching condition other than the Referer field or hits other control rules, only the Rule_ID_1 field needs to be filled in, the value of the matched rule ID is filled in, and the Operation field is filled in. Each time the rule is matched, Times is incremented by 1. (The purpose of filling in the Operation field in the table is to facilitate the upper system to distinguish the rule type, so as to perform statistical analysis on the table item.)

[0098] For example, in the table below, when the traffic hits the first traffic control rule r1 (the policy priority is not 1), the ID of the first traffic control rule (r1) is recorded in the Rule_ID_1 field, there is no Rule_ID_2, the action corresponding to the first traffic control rule Operation is redirect, and it is matched 10 times; when the traffic hits the second traffic control rule r2 (the policy priority is 1), the ID of the second traffic control rule (r2) is recorded in the Rule_ID_2 field, and the ID of the first traffic control rule is filled in Rule_ID_1, Operation is permit, and the white list is matched 2 times. Figure 3

[0099] In an embodiment, after the setting record table is reported to the upper system, the method further comprises:

[0100] receiving update information of the first traffic control rule sent by the upper system, the upper system being configured to determine whether to update the first traffic control rule based on the number of rule hits in the setting record table.

[0101] ​The upper layer system is used to issue traffic control rules to the policy module, and update the traffic control rules based on the data fed back by the policy module. For example, the basis for judging whether to update a certain rule is: continue access rate> threshold value, the threshold value can be defined as a reasonable value, and the continue access rate = continue access total number / hit total number x 100%. For the entries with the Operation field in the user access behavior information table being redirect, the upper layer system needs to calculate the continue access rate of the traffic. First, the traffic with the Operation value being redirect has the hit total number being the value of the Times field; second, according to the Rule_ID_1 value of the entry with the Operation value being redirect, find the Permit entry with the same Rule_ID_1 field value but the Rule_ID_2 field not being empty, and the sum of the Times values of the Permit entries is the continue access total number; finally, calculate the continue access rate according to the two values. The continue access rate is not involved in other types of traffic, so it does not need to be calculated (but the hit number of this type of traffic can also be used for statistical analysis in other aspects, so the DPI device still needs to report).

[0102] For example, in Figure 4 , the total hit number of the website of "Host contains A" (r1) is 10, and the continue access number is 2, so the continue access rate of the website is 20%. The total hit number of the website of "destination IP is Y and destination port is N" (r3) is 10, and the continue access number is 6, so the continue access rate of the website is 60%; the continue access rate of the other two types of traffic does not need to be calculated because the Rule_ID_1 field is not the same as the Rule_ID_1 of the entry with the Operation being redirect.

[0103] If the continue access rate is greater than the threshold value, the upper layer system updates the traffic control rule. For example, Figure 4 , the continue access rate of the rule r3 is 60%, and the threshold value is assumed to be 50%, so the rule r3 needs to be updated, and the upper layer system issues the updated rule to the DPI device.

[0104] The embodiment of the application introduces a behavior collection and feedback mechanism, improves the fault tolerance rate of the risk interception and early warning system, and at the same time enables the system to have a self-correction ability. The upper layer system can optimize the rules in real time according to the user access behavior fed back, and improve the accuracy of the rules.

[0105] Figure 5 is a structural schematic diagram of a policy control system provided by the embodiment of the application, which includes three modules of an upper layer system, a policy module and a DPI device. The policy issuing process is as shown in Figure 6As shown, the policy module receives control policies from different upper-layer systems, and converts the different formats of the policies into a unified format and issues the policies to the DPI devices managed by the policy module. The policy here refers to a traffic control rule.

[0106] The specific functions of the three modules are as follows:

[0107] The policy module is responsible for functions such as policy receiving / issuing and behavior collection. The policy module can receive traffic control, whitelist and other policies issued by the upper-layer system (the policies can be issued based on traffic features such as IP address, port number, five-tuple, URI, HOST, SNI, etc.), and issue the policies to all the DPI devices and transit stations managed by the policy module. The policy module receives user access behavior information fed back by all the DPI devices managed by the policy module (the specific behavior information format is described in the next module), and feeds back the information to the upper-layer system after summarizing the information.

[0108] The DPI device is responsible for traffic control rule matching, redirected message construction and sending, user behavior recording and message double-checking.

[0109] The upper-layer system is responsible for issuing policy rules to the policy module, and updating the policy rules by analyzing the user access behavior data fed back by the policy module.

[0110] The embodiment provides an abnormal webpage early warning scheme composed of a policy module, a DPI device, an upper-layer system and a transit station. The policy module is responsible for functions such as policy template format unification, policy issuing and user access behavior information collection. The DPI device is responsible for functions such as real-time matching of traffic and policies and feedback of user access behavior information. The upper-layer system is responsible for functions such as user behavior analysis, policy updating and policy issuing. The transit station is responsible for pushing a suitable pop-up window page according to different original access webpages. The scheme can realize early warning in the form of a pop-up window to a user terminal in the case that the content of a webpage is not determined to be abnormal, and can compensate for the defect that the current DPI device cannot process a suspected abnormal webpage, can effectively prevent the user terminal from accessing a malicious webpage domain name, and can reduce the risk of malicious website attacks on a user who does not install an interception software. At present, each operator has deployed a DPI device at each node, and the DPI device basically covers the whole network traffic. The DPI device can monitor the whole network traffic and intercept threats in the network.

[0111] Figure 7 is a processing flowchart for a suspected abnormal webpage provided by the embodiment of the application, and the processing flowchart comprises the following steps:

[0112] Step one: a user accesses a fraud website.

[0113] Step two: the DPI device discovers that traffic hits a rule of a suspected abnormal website. Figure 7If the location in the HTTP Response message matches the rule xxx, the HTTP Response message is constructed and sent to the user terminal.

[0114] The user accesses the fraudulent website A, and the DPI device (with a unique identifier C1) detects the host in the get / post message at time C2, which contains the keyword A of the suspected fraudulent website, i.e., the control policy r1 is hit. The DPI needs to send a 302 temporary redirection message to the user, which redirects the user to the relay station B. The location of the message is B?Url=A&ruleid=r1&C.

[0115] Step three: The user terminal accesses the relay station.

[0116] The user parses the received temporary redirection message, fills the address in the location into the host, and accesses the relay station. Figure 7 In this case, the location is K, and K=B?Url=A&ruleid=r1&C.

[0117] Step four: The relay station sends an abnormal website warning page to the user terminal.

[0118] The relay station sends a 200 OK message to the user terminal and includes the pop-up window content.

[0119] Step five: The user clicks continue to access according to his own needs, and the user terminal accesses the original webpage again; if the user clicks stop to access, the access to the website is closed.

[0120] If the user clicks continue to access, the user terminal submits the access request of the website A again, and adds the referer information url=B&ruleid=r1&C in the request message.

[0121] Step six: The DPI device checks the traffic hit whitelist, and respectively checks the Rule_ID and the verification code in the referer. After verification, the traffic is allowed to pass. The user can normally access the webpage.

[0122] The website matches the blocking rule r1, but the referer field in the access message hits the whitelist policy r2, i.e., the referer contains B; and the verification code C passes the verification: the DPI unique identifier C1 corresponds to the in-domain device, or the time stamp C2 is legal and effective. After verification, the traffic is allowed to pass.

[0123] Step seven: The DPI device reports the user access behavior information to the policy module, and the policy module reports the information to the upper system after summarizing, which is analyzed by the upper system and the policy is updated.

[0124] The embodiment of the application can realize the flexible interception of suspected abnormal webpage access in the form of a pop-up window. Through the application, the user can be effectively prevented from accessing a malicious webpage domain name, and the risk of malicious website attacks on users without installing interception software can be reduced.

[0125] It should be understood that the size of the serial number of each step in the above embodiment does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiment of the application.

[0126] It should be understood that when used in the specification and the appended claims, the terms "comprise" and "include" indicate the presence of described features, integers, steps, operations, elements, and / or components, but do not exclude one or more other features, integers, steps, operations, elements, components, and / or sets thereof.

[0127] It should be noted that the technical solutions described in the embodiments of the application can be combined arbitrarily without conflict.

[0128] In addition, in the embodiments of the application, "first", "second", and the like are used to distinguish similar objects, and do not necessarily describe a specific order or sequence.

[0129] The embodiment of the application provides an access message processing device, which comprises:

[0130] A matching module is configured to match the received first access message of a user with a flow control rule.

[0131] A sending module is configured to send a redirection message to the user if the first access message matches the first flow control rule, wherein the redirection message is used to guide the user to access a relay website, and the relay website is configured to send a warning information to the user after receiving the access of the user, and the warning information represents that the user is accessing a suspicious website.

[0132] A receiving module is configured to receive a second access message of the suspicious website sent by the user after receiving the warning information.

[0133] A detection module is configured to detect the second access message to obtain a detection result, wherein the detection result represents whether to release the second access message.

[0134] In an embodiment, the second access message comprises one or more of a website address of the relay website, and an identification of the first traffic control rule and a check code, the check code comprising a device identification of a device where the first access message hits the first traffic control rule, and / or a timestamp of when the first access message hits the first traffic control rule, and the detection module is specifically configured to:

[0135] determine whether the second access message matches a second traffic control rule, the second traffic control rule being a white list rule, the white list rule being that a set field in the second access message contains the website address of the relay website;

[0136] Correspondingly, the detection module is further configured to perform one or more of the following:

[0137] obtain a traffic feature corresponding to the first traffic control rule based on the identification of the first traffic control rule, and determine whether the second access message matches the traffic feature;

[0138] determine whether a deep packet inspection (DPI) device corresponding to the device identification is an in-domain device, and / or determine whether the timestamp is within a set time interval.

[0139] In an embodiment, in a case where the website address of the relay website matches the white list rule, if the second access message satisfies one or more of the following, the second access message is released:

[0140] the second access message matches the traffic feature;

[0141] the DPI device corresponding to the device identification is an in-domain device, and / or the timestamp is within a set time interval.

[0142] In an embodiment, the apparatus further comprises:

[0143] a recording module configured to, in a case where the second access message hits the second traffic control rule, record the identification of the second traffic control rule, the identification of the first traffic control rule, and an operation type corresponding to the first traffic control rule in a set record table in association, and update a corresponding rule hit count;

[0144] the recording module is further configured to, in a case where the second access message does not hit the second traffic control rule, record the identification of the first traffic control rule and the operation type corresponding to the first traffic control rule in the set record table in association, and update the corresponding rule hit count;

[0145] The reporting module is configured to report the setting record table to an upper-layer system, so that the upper-layer system updates a traffic control rule based on the setting record table.

[0146] In an embodiment, the apparatus further comprises:

[0147] The updating module is configured to receive update information of a first traffic control rule sent by the upper-layer system, and the upper-layer system is configured to determine whether to update the first traffic control rule based on a rule hit frequency in the setting record table.

[0148] In an embodiment, the redirection message comprises an access website, a website address of the transit website, an identifier of the first traffic control rule, and a verification code, and the verification code comprises a device identifier of a device in which the first access message hits the first traffic control rule, and / or a timestamp when the first access message hits the first traffic control rule.

[0149] In an embodiment, the pre-warning information is a pre-warning page, and the pre-warning page comprises options of continuing to access and stopping to access.

[0150] In actual application, the matching module, the sending module, the receiving module, and the detecting module can be implemented by a processor in an electronic device, such as a central processing unit (CPU), a digital signal processor (DSP), a microcontroller unit (MCU), or a field-programmable gate array (FPGA).

[0151] It should be noted that the access message processing apparatus provided in the above embodiments is only used for processing access messages, and the division of the above modules is used as an example. In actual application, the above processing can be completed by different modules according to needs, that is, the internal structure of the apparatus is divided into different modules to complete all or part of the above processing. In addition, the access message processing apparatus and the access message processing method provided in the above embodiments belong to the same concept, and the specific implementation process is described in the method embodiments, which will not be described here.

[0152] The access message processing apparatus can be in the form of an image file, which can be executed in the form of a container or a virtual machine to implement the access message processing method described in the present application. Of course, it is not limited to the form of an image file, and any software form that can implement the access message processing method described in the present application is within the protection scope of the present application.

[0153] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiments of the present application, the embodiments of the present application further provide an electronic device, and the above access message processing method is implemented by a processor of the electronic device.

[0154] Figure 8 A schematic diagram of the hardware composition structure of the electronic device of the embodiments of the present application is shown in the figure. The electronic device can be a DPI device, such as Figure 8 As shown in the figure, the electronic device includes:

[0155] The communication interface 801 can interact with other devices, such as network devices, etc.

[0156] The processor 802 is connected with the communication interface 801 to realize information interaction with other devices, and is used to run a computer program to execute the method provided by one or more technical solutions of the electronic device. The computer program is stored on the memory 803.

[0157] Of course, in actual application, various components in the electronic device are coupled together through the bus system 804. It can be understood that the bus system 804 is used to realize the connection and communication between the components. In addition to the data bus, the bus system also includes power bus, control bus and status signal bus. However, in order to clearly illustrate, various buses are marked as bus system 804 in the figure. Figure 8

[0158] The memory 803 in the embodiments of the present application is used to store various types of data to support the operation of the electronic device. Examples of these data include: any computer program used to operate on the electronic device.

[0159] In the present application, the electronic device can be a single hardware device, or a cluster composed of multiple hardware devices, such as a cloud computing platform. The so-called cloud computing platform is a cluster device that organizes multiple independent electronic device physical hardware resources into a pool of resources, and provides the required virtual resources and services to the outside.

[0160] The memory 803 in the embodiments of the present application is used to store various types of data to support the operation of the electronic device. Examples of these data include: any computer program used to operate on the electronic device.

[0161] ​It can be appreciated that the memory 803 can be a volatile memory or a nonvolatile memory, and can also include both volatile and nonvolatile memory. Among them, the nonvolatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a ferromagnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM). The magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM) used as an external cache. By way of example and not limitation, many forms of RAM can be used, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM). The memory described in the embodiments of the present application is intended to include but not limited to these and any other suitable types of memory.

[0162] The method disclosed in the embodiments of the present application can be applied to a processor or implemented by the processor. The processor can be an integrated circuit chip with a signal processing capability. In the implementation process, the steps of the method can be completed by hardware integrated logic circuit or software form of instructions in the processor. The processor can be a general processor, DSP, or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc. The processor can implement or execute the disclosed methods, steps and logic block diagrams in the embodiments of the present application. The general processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiments of the present application, the hardware decoding processor can be directly embodied to complete the execution, or the combination of hardware and software modules in the decoding processor can be used to complete the execution. The software module can be located in a storage medium, which is located in a memory. The processor reads the program in the memory and combines the hardware to complete the steps of the foregoing method.

[0163] In the example embodiments, the embodiments of the present application also provide a computer program product, which comprises a computer program. The computer program can be executed by the processor 802 of the electronic device to complete the steps of the access packet processing method disclosed in the embodiments of the present application.

[0164] Optionally, the processor implements the corresponding procedures realized by the electronic device in each method of the embodiments of the present application when executing the program. For brevity, details are not described herein.

[0165] In the example embodiments, the embodiments of the present application also provide a storage medium, i.e., a computer storage medium, specifically a computer readable storage medium, for example, a first memory for storing a computer program. The computer program can be executed by the processor of the electronic device to complete the steps of the foregoing method. The computer readable storage medium can be an FRAM, a ROM, a PROM, an EPROM, an EEPROM, a Flash Memory, a magnetic surface memory, an optical disc, or a CD-ROM, etc.

[0166] In the several embodiments provided in the present application, it should be understood that the disclosed device, electronic device and method can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the various components shown or discussed can be through some interfaces, indirect coupling or communication connection between the components, and can be electrical, mechanical or other forms.

[0167] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one place or distributed to multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the embodiment.

[0168] In addition, each functional unit in each embodiment of the present application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be realized in the form of hardware or in the form of hardware plus software functional unit.

[0169] Those skilled in the art can understand that all or part of the steps of the above-mentioned method embodiments can be completed by program instruction related hardware, and the above-mentioned program can be stored in a computer readable storage medium, and the program executes the steps including the above-mentioned method embodiments when executed; and the above-mentioned storage medium includes mobile storage device, ROM, RAM, magnetic disc or optical disc and various storage program codes.

[0170] Alternatively, the integrated units of the present application, if implemented in the form of software functional modules and sold or used as independent products, can also be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application can be embodied in the form of software products, which are stored in a storage medium and include a number of instructions for causing a computer device (which can be a personal computer, an electronic device, or a network device, etc.) to execute all or part of the methods described in the embodiments of the present application. The above-mentioned storage medium includes mobile storage device, ROM, RAM, magnetic disc or optical disc and various storage program codes.

[0171] It should be noted that the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0172] In addition, in the present application, "first", "second", etc. are used to distinguish similar objects, and do not necessarily describe a specific order or sequence.

[0173] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto, and any skilled person in the art can easily think of changes or replacements within the technical range disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method of processing access messages, characterized by, The method comprises: matching the received first access message of the user with a traffic control rule; if the first access message matches the first traffic control rule, sending a redirection message to the user, the redirection message being used to guide the user to access a relay website, the relay website being used to send a pre-warning information to the user after receiving the access of the user, the pre-warning information representing that the user is accessing a suspicious website; receiving a second access message of the suspicious website sent by the user after receiving the pre-warning information; detecting the second access message to obtain a detection result, the detection result representing whether to release the second access message, the second access message comprising one or more of a website address of the relay website, an identifier of the first traffic control rule and a verification code, the verification code comprising a device identifier of a device when the first access message hits the first traffic control rule, and / or a timestamp when the first access message hits the first traffic control rule, the detecting the second access message comprising: determining whether the second access message matches a second traffic control rule, the second traffic control rule being a white list rule, the white list rule being that a set field in the second access message contains the website address of the relay website; correspondingly, the detecting the second access message further comprises one or more of: obtaining a traffic feature corresponding to the first traffic control rule based on the identifier of the first traffic control rule, and determining whether the second access message matches the traffic feature; determining whether a deep packet inspection (DPI) device corresponding to the device identifier is an in-domain device, and / or determining whether the timestamp is within a set time interval.

2. The method of claim 1, wherein, In the case that the website address of the relay website matches the white list rule, if the second access message satisfies one or more of the following conditions, the second access message is released: the second access message matches the traffic feature; the DPI device corresponding to the device identifier is an in-domain device, and / or the timestamp is within the set time interval.

3. The method of claim 1, wherein, After the detecting the second access message, the method further comprises: in the case that the second access message hits the second traffic control rule, associating and recording the identifier of the second traffic control rule, the identifier of the first traffic control rule and an operation type corresponding to the first traffic control rule in a set record table, and updating a corresponding rule hit frequency; in the case that the second access message does not hit the second traffic control rule, associating and recording the identifier of the first traffic control rule and the operation type corresponding to the first traffic control rule in the set record table, and updating a corresponding rule hit frequency; reporting the set record table to an upper system, so that the upper system updates a traffic control rule based on the set record table.

4. The method of claim 3, wherein, After the reporting the set record table to the upper system, the method further comprises: receive update information of the first traffic control rule sent by the upper layer system, the upper layer system being configured to determine whether to update the first traffic control rule based on a rule hit number in the setting record table.

5. The method of claim 1, wherein, The redirection message comprises: an access website, a website of the transit website, an identifier of the first traffic control rule, and a verification code, the verification code comprising a device identifier of a device when the first access message hits the first traffic control rule, and / or a timestamp when the first access message hits the first traffic control rule.

6. The method of claim 1, wherein, The early warning information is an early warning page, and the early warning page comprises options of continuing to access and stopping to access.

7. An electronic device, comprising: Comprise: a processor and a memory for storing a computer program capable of running on the processor, wherein, the processor is configured to execute the steps of the access message processing method according to any one of claims 1 to 6 when running the computer program.

8. A computer storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to implement the steps of the access message processing method according to any one of claims 1 to 6.

9. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the access message processing method according to any one of claims 1 to 6. The computer program is executed by the processor to implement the steps of the access message processing method according to any one of claims 1 to 6.

Images