Object access method and device, computer equipment, storage medium and program product

Abstract

The embodiment of the invention provides an object access method and device, computer equipment, a storage medium and a program product, which can be applied to various scenes such as cloud technology, artificial intelligence, intelligent transportation, Internet of Vehicles and the like. The method comprises the following steps: acquiring a network access request of at least one client in an internal network, wherein the network access request comprises an initial network address of an external access object in an external network; screening out at least one network address corresponding to the network access request from a preset reference address set to obtain a target reference address set; performing risk detection on the initial network address based on the target reference address set to obtain a risk detection result of the initial network address; determining a target network address of the external access object according to the risk detection result and the target reference address set; and sending the target network address to a corresponding client, so that the client accesses the external access object based on the target network address. According to the invention, the security and the access efficiency of network access by the client can be improved.

Description

Technical Field

[0001] The present application relates to the field of network communication technology, and specifically to an object access method, apparatus, computer equipment, storage medium and program product, wherein the storage medium is a computer-readable storage medium, and the program product is a computer program product. Background Art

[0002] With the development of network communications, mobile communication networks such as 5G networks are also increasingly widely used. When a client accesses an object through a mobile communication network, it needs to parse the IP address of the object and then access the network through the IP address. However, when a client accesses the network through an IP address, it may access a risky object, which will cause security issues in the client's network access.

[0003] In summary, the current client has the problem of low network access security. Summary of the invention

[0004] The embodiments of the present application provide an object access method, apparatus, computer equipment, storage medium and program product, which can improve the security and access efficiency of client network access.

[0005] An object access method, comprising:

[0006] Obtaining a network access request of at least one client in the internal network, the network access request including an initial network address of an external access object in the external network;

[0007] Filtering out at least one network address corresponding to the network access request from a preset reference address set to obtain a target reference address set;

[0008] Based on the target reference address set, the initial network address is subjected to risk detection to obtain the risk detection result of the initial network address;

[0009] Determine the target network address of the external access object based on the risk detection result and the target reference address set;

[0010] The target network address is sent to the corresponding client, so that the client accesses the external access object based on the target network address.

[0011] Accordingly, an embodiment of the present application provides an object access device, including:

[0012] An acquisition unit may be used to acquire a network access request of at least one client in the internal network, the network access request including an initial network address of an external access object in the external network;

[0013] A screening unit may be used to screen out at least one network address corresponding to the network access request from a preset reference address set to obtain a target reference address set;

[0014] The detection unit may be used to perform risk detection on the initial network address based on the target reference address set to obtain a risk detection result of the initial network address;

[0015] A determination unit, which can be used to determine a target network address of an external access object according to a risk detection result and a target reference address set;

[0016] The access unit may be used to send a target network address to a corresponding client, so that the client can access an external access object based on the target network address.

[0017] In some embodiments, the detection unit may be configured to match the initial network address with the network addresses in the target reference address set to obtain a matching result; and determine the risk detection result of the initial network address based on the matching result.

[0018] In some embodiments, the detection unit can be used to determine the risk detection result of the initial network address based on the target reference address matched by the initial network address in the target reference address set when the matching result is a successful match; when the matching result is a failed match, generate a prompt message and return the prompt message to the client so that the client can access the external access object based on the network access request.

[0019] In some embodiments, the target reference address set includes an abnormal reference address subset and a normal reference address subset. The detection unit can be used to filter out a network address that matches the initial network address in the target reference address set to obtain the target reference address; when the target reference address is a network address in the normal reference address subset, it is determined that there is no network risk for the initial network address; when the target reference address is a network address in the abnormal reference address subset, the initial network address is verified to obtain a risk detection result for the initial network address.

[0020] In some embodiments, the detection unit may be used to verify the initial network address to obtain a verification result of the initial network address; and determine a risk detection result of the initial network address based on the verification result.

[0021] In some embodiments, the detection unit can be used to obtain risk verification information for the initial network address, and calculate the correlation between the risk verification information and the initial network address; when the correlation is greater than or equal to a preset threshold, the verification result of the initial network address is determined to be a verification failure; when the correlation is less than the preset threshold, the verification result of the initial network address is determined to be a verification pass.

[0022] In some embodiments, the detection unit can be used to determine that the risk detection result of the initial network address is that the initial network address has a risk when the verification result is that the verification failed; when the verification result is that the verification passed, determine that the risk detection result of the initial network address is that the initial network address does not have a risk.

[0023] In some embodiments, the determination unit can be used to extract the target network address corresponding to the initial network address from the target reference address set to obtain the target network address of the external access object when the risk detection result is that the initial network address does not have a risk; when the risk detection result is that the initial network address does have a risk, extract the candidate network address that matches the initial network address from the preset reference address set to obtain the target network address of the external access object.

[0024] In some embodiments, the determination unit may be used to determine the network address category of the initial network address; based on the network address category, select candidate network addresses matching the initial network address from a preset reference address set to obtain a target network address of an external access object.

[0025] In some embodiments, the object access device includes a clustering unit, which can be used to obtain multiple candidate network addresses; cluster the candidate network addresses to obtain candidate network address sets of multiple categories; and construct a preset reference address set based on the candidate network address set.

[0026] In some embodiments, the object access device of the present application can be integrated into a cache server in an internal network; the acquisition unit can be used to determine the target network element corresponding to the cache server in the internal network; and receive a network access request from at least one client in the internal network through the target network element.

[0027] In some embodiments, the acquisition unit can be used to obtain the communication distance of at least one client in the internal network; based on the communication distance, determine the network interface corresponding to the client in the target network element of the internal network, and obtain the receiving network interface; and obtain the network access request sent by at least one client from the receiving network interface of the target network element.

[0028] In some embodiments, the access unit can be used to obtain the physical address of each network interface in the target network element; based on the physical address, the network interface corresponding to the client is filtered out in the network interface to obtain a sending network interface; through the sending network interface, the target network address is sent to the corresponding client, so that the client can access the external access object based on the target network address.

[0029] In addition, an embodiment of the present application also provides a computer device, including a memory and a processor; the memory stores a computer program, and the processor is used to run the computer program in the memory to execute any object access method provided in the embodiment of the present application.

[0030] In addition, an embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. The computer program is suitable for loading by a processor to execute any object access method provided in the embodiment of the present application.

[0031] In addition, an embodiment of the present application also provides a computer program product, including a computer program, which implements any object access method provided in the embodiment of the present application when the computer program is executed by a processor.

[0032] The present application can obtain a network access request of at least one client in an internal network, the network access request includes an initial network address of an external access object in an external network; filter out at least one network address corresponding to the network access request in a preset reference address set to obtain a target reference address set; perform risk detection on the initial network address based on the target reference address set to obtain a risk detection result of the initial network address; determine the target network address of the external access object based on the risk detection result and the target reference address set; send the target network address to the corresponding client so that the client can access the external access object based on the target network address. Since the present application can filter out a target reference address set corresponding to the network access request of a client in an internal network in a preset reference address set, the initial network address can be risk detected based on the target reference address set to obtain a risk detection result of the initial network address, and thus the target network address of the external access object with higher security can be quickly determined based on the risk detection result and the target reference address set, so that the client of the internal network can quickly and securely access the external access object based on the target network address, thereby improving the security and access efficiency of the client's network access. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0034] Figure 1 is a scenario diagram of an object access method provided in an embodiment of the present application;

[0035] Figure 2 1 is a flowchart of an object access method provided in an embodiment of the present application;

[0036] Figure 3 FIG2 is a second flow chart of the object access method provided in the embodiment of the present application;

[0037] Figure 4 is a schematic diagram of the sub-services included in the network address processing service provided in the embodiment of the present application;

[0038] Figure 5 is a schematic diagram of an application scenario of the intelligent remote control product provided in an embodiment of the present application;

[0039] Figure 6 A schematic diagram of nodes included in the UPF network element provided in an embodiment of the present application;

[0040] Figure 7 is a schematic diagram of the deployment of a computer device provided in an embodiment of the present application;

[0041] Figure 8 is a second schematic diagram of the deployment of a computer device provided in an embodiment of the present application;

[0042] Fig. 9 is a schematic diagram of clustering and similarity calculation provided in an embodiment of the present application;

[0043] Fig.10 It is a schematic diagram of the three major functions provided by the embodiment of the present application;

[0044] Fig.11 It is a schematic diagram of the test process in two test environments;

[0045] Fig.12 It is a schematic diagram of the structure under two test environments;

[0046] Fig.13 It is a schematic diagram of the test flow of this application;

[0047] Fig.14 is a schematic diagram of the structure of an object access device provided in an embodiment of the present application;

[0048] Fig.15 is a second schematic diagram of the structure of an object access device provided in an embodiment of the present application;

[0049] Fig.16 It is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0051] The embodiment of the present application provides an object access method, apparatus, computer device and computer readable storage medium. The object access apparatus can be integrated in a computer device, which can be a server or a terminal.

[0052] Among them, the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, network acceleration services (Content Delivery Network, CDN), and big data and artificial intelligence platforms. The terminal can be a smart phone, tablet computer, laptop computer, desktop computer, smart speaker, smart watch, car terminal, etc., but is not limited to this. The terminal and the server can be directly or indirectly connected via wired or wireless communication, and this application does not limit this.

[0053] For example, see Figure 1 Taking the object access device integrated in a computer device as an example, the computer device can obtain a network access request of at least one client in an internal network; filter out at least one network address corresponding to the network access request in a preset reference address set to obtain a target reference address set; perform risk detection on the initial network address based on the target reference address set to obtain a risk detection result of the initial network address; determine a target network address of an external access object based on the risk detection result and the target reference address set; and send the target network address to a corresponding client so that the client can access the external access object based on the target network address.

[0054] The internal network may refer to a local network of the computer device, for example, the internal network may include a local area network, specifically, the local area network may refer to a 5G core network. It should be noted here that the computer device may be deployed in the internal network.

[0055] The network access request includes the initial network address of the external access object in the external network. The network access request may refer to a request from a client in the internal network to access the external access object in the external network. The external network may include a public network, such as the Internet.

[0056] The external access object may refer to an object in an external network that can provide services to a client. For example, the external access object may include an application program. For example, the external access object may be characterized as a website.

[0057] The preset reference address set may include multiple preset reference addresses. The preset reference address set may refer to a set of network addresses used as an initial network address reference in the process of determining a target network address of an external access object.

[0058] The following are detailed descriptions. It should be noted that the description order of the following embodiments is not intended to limit the preferred order of the embodiments. The present application can be applied to the DNS protocol and can also be applied to the HttpDNS protocol.

[0059] This embodiment will be described from the perspective of an object access device, which can be specifically integrated in a computer device, which can be a server or a terminal. The terminal can include a tablet computer, a laptop computer, a personal computer (PC), a wearable device, a virtual reality device, or other smart devices that can acquire data.

[0060] like Figure 2 As shown, the specific process of the object access method is shown in steps S201 to S205:

[0061] S201: Obtain a network access request from at least one client in an internal network.

[0062] The network access request includes an initial network address of an external access object in the external network.

[0063] It should be noted here that the object access device can be integrated into a computer device, the computer device can be a cache server, and the cache server can be deployed in an internal network. It can be understood that the object access method of the present application can be applied to a cache server in an internal network. Based on this, in some application embodiments, the method for obtaining a network access request of at least one client in the internal network can be: determining a target network element corresponding to the cache server in the internal network; and receiving a network access request of at least one client in the internal network through the target network element.

[0064] The cache server may be bound to the target network element, and based on this, the cache server may identify the target network element corresponding to the cache server in the internal network based on the binding relationship between the cache server and the target network element.

[0065] After determining the target network element corresponding to the cache server in the internal network, the present application can receive a network access request from at least one client in the internal network through the target network element. Specifically, it can be: obtaining the communication distance of at least one client in the internal network; based on the communication distance, determining the network interface corresponding to the client in the target network element in the internal network, and obtaining the receiving network interface; obtaining the network access request sent by at least one client from the receiving network interface of the target network element.

[0066] The communication distance may refer to the communication distance between the client and the network element in the internal network, or the communication distance between the base station of the client and the network element in the internal network. The base station may refer to a base station that enables communication between the client and the network element. The target network element belongs to the network element. The network element may refer to an element such as a device in the internal network that can independently complete a certain transmission function.

[0067] Based on the above, in one example, based on the communication distance, the network interface corresponding to the client is determined in the target network element of the internal network, and the method for obtaining the receiving network interface can be: based on the communication distance, the target network element corresponding to the target communication distance is screened out among the network elements of the internal network; the network interface corresponding to the target network element and the client is identified; and the receiving network interface is screened out from the network interfaces according to the interface characteristic information of the network interface.

[0068] The target communication distance may refer to the minimum communication distance in the communication distance. It can be understood here that using the receiving network interface of the target network element with the minimum communication distance to obtain the network access request of the client can improve the transmission efficiency of the network access request, thereby improving the detection efficiency of the initial network address and the acquisition efficiency of the target network address, and further improving the network access efficiency of the client.

[0069] Specifically, in one example, a method for identifying the network interface corresponding to the target network element and the client may be: obtaining a preset mapping relationship between the target network element and the network interface; and identifying the network interface corresponding to the target network element and the client based on the preset mapping relationship and the target network element.

[0070] Based on the above, in one example, a method of obtaining a network access request sent by at least one client from a receiving network interface may be: obtaining a network access request sent by at least one client from the receiving network interface through an information receiving node corresponding to the receiving network interface.

[0071] The information receiving node may refer to a network node used by a computer device to receive a network access request sent by a client.

[0072] S202: Filter out at least one network address corresponding to the network access request from a preset reference address set to obtain a target reference address set.

[0073] In some application embodiments, at least one network address corresponding to a network access request is screened out from a preset reference address set, and a method for obtaining a target reference address set may be: determining the address type of the initial network address based on request feature information included in the network access request; and based on the address type, screening out at least one network address corresponding to the network access request from a preset reference address set to obtain a target reference address set.

[0074] Based on the above, in one example, the method for determining the address type of the initial network address according to the request characteristic information included in the network access request can be: identifying the request type of the network access request according to the request characteristic information included in the network access request; searching for the address type corresponding to the request type in the preset type set to obtain the address type of the initial network address.

[0075] The preset type set may include preset request types and preset address types having a corresponding relationship, the address type belongs to the preset address type, and the request type belongs to the preset request type.

[0076] The request characteristic information may be information characterizing the request type characteristics of the network access request, and the request characteristic information may be characterized as a keyword.

[0077] For example, the request type may include a game request type, a sports request type, and a technical request type. The game request type may refer to a network access request that requests a game service; the sports request type may refer to a network access request that requests a sports video service; and the technical request type may refer to a network access request that requests a technical knowledge push service.

[0078] Accordingly, the address type may include a game address type, a sports address type, and a technical address type. The game address type may refer to the type of the initial network address of the external access object when the external access object is an object providing game services; the sports address type may refer to the type of the initial network address of the external access object when the external access object is an object providing sports video services; and the technical address type may refer to the type of the initial network address of the external access object when the external access object is an object providing technical knowledge push services.

[0079] The request type and the address type may correspond one to one. For example, the address type corresponding to the game request type is the game address type; the address type corresponding to the sports request type is the sports address type; and the address type corresponding to the technical request type is the technical address type.

[0080] After determining the address type of the initial network address according to the request characteristic information included in the network access request, the present application can obtain a target reference address set based on the address type. Specifically, in one example, according to the address type, at least one network address corresponding to the network access request is filtered out from a preset reference address set. The target reference address set can be obtained by: according to the address type, filtering out at least one network address corresponding to the address type from a preset reference address set; and constructing a target reference address set based on at least one network address corresponding to the address type.

[0081] Specifically, the network address corresponding to the address type can carry address risk identification information. Based on this, in one example, the method of constructing a target reference address set according to at least one network address corresponding to the address type can be: classifying the network addresses according to the address risk identification information carried by each network address corresponding to the address type to obtain a classified address set; and generating a target reference address set based on the classified address set.

[0082] In the above, for example, the classified address set may include an abnormal reference address subset and a normal reference address subset. The address risk identification information may include address abnormal identification information and address normal identification information. The address abnormal identification information may refer to identification information that characterizes the network address as abnormal; the address normal identification information may refer to identification information that characterizes the network address as normal.

[0083] When the risk identification information of the network address is address anomaly identification information, the network address is determined to be a network address of an abnormal address type, based on which the network address of the abnormal address type can be used to construct an abnormal reference address subset.

[0084] When the risk identification information of the network address is the normal identification information of the address, the network address is determined to be a network address of a normal address type, based on which the network address of the normal address type can be used to construct a normal reference address subset.

[0085] In addition, before step S202, the present application may also construct a preset reference address set, which may be specifically: obtaining multiple candidate network addresses; clustering the candidate network addresses to obtain candidate network address sets of multiple categories; and constructing a preset reference address set based on the candidate network address set.

[0086] The candidate network address may be a network address obtained online in real time.

[0087] Based on the above, in one example, a clustering algorithm may be directly used to cluster the candidate network addresses to obtain a plurality of categories of candidate network address sets. The clustering algorithm may include an isolation forest anomaly recognition algorithm.

[0088] Furthermore, for example, the method of clustering candidate network addresses to obtain a set of candidate network addresses of multiple categories can be: classifying the candidate network addresses to obtain classified network addresses corresponding to each address type; clustering the classified network addresses corresponding to the address type to obtain a set of candidate network addresses corresponding to multiple categories.

[0089] Among them, the present application can obtain source information of candidate network addresses; classify the candidate network addresses according to the source information to obtain the classified network addresses corresponding to each address type.

[0090] The source information may be information representing a candidate external access object from which the candidate network address originates. The external access object may belong to the candidate external access object.

[0091] Among them, for each address type, a clustering algorithm such as the Isolation Forest Anomaly Recognition Algorithm can be used to cluster the classified network addresses corresponding to the address type to obtain a set of candidate network addresses corresponding to multiple categories.

[0092] The categories may include normal categories and abnormal categories. The candidate network address set of the normal category may be a network address set without security risks; the candidate network address set of the abnormal category may be a network address set with security risks.

[0093] Among them, according to the network address corresponding to each category, a set of candidate network addresses corresponding to the category can be constructed.

[0094] Based on the above, an actual example is used here to explain. For example, the present application can pull the candidate network address of each candidate external access object from the online, and obtain multiple candidate network addresses; then, based on the source information of the candidate network address, the candidate network address is classified and processed to obtain the classified network address corresponding to each address type, for example, the classified network address corresponding to the game address type, the classified network address corresponding to the sports address type, and the classified network address corresponding to the technical address type. Then, for each address type, the isolated forest anomaly recognition algorithm is used to cluster the classified network addresses corresponding to the address type to obtain a set of candidate network addresses of the normal category and a set of candidate network addresses of the abnormal category; for example, the isolated forest anomaly recognition algorithm is used to cluster the classified network addresses corresponding to the sports address type, so as to divide the classified network addresses corresponding to the sports address type into the network addresses corresponding to the normal category and the network addresses corresponding to the abnormal category, thereby obtaining a set of candidate network addresses of the normal category and a set of candidate network addresses of the abnormal category. The clustering of the classified network addresses corresponding to other address types is similar, and will not be repeated here.

[0095] In the above, the computer device may mark the network addresses in the candidate network address set with address risk identification information, for example, mark the network addresses corresponding to the normal category with address normal identification information, and mark the network addresses corresponding to the abnormal category with address abnormal identification information.

[0096] Furthermore, the present application can also package and send a normal category candidate network address set to the client. For example, when it is detected that the client accesses a target external access object, and the target external access object is an object that can provide a preset service to the client, in the address type, the target address type corresponding to the preset service is determined; the candidate network address set corresponding to the normal category in the target address type is extracted, and packaged and sent to the client. The candidate network address set corresponding to the normal category can be packaged and sent to the client at one time.

[0097] For example, when a user visits a sports event website through a client, a set of candidate network addresses corresponding to normal categories in the sports address type may be packaged and sent to the client at one time.

[0098] Based on this, it can be understood that the present application can avoid the client from repeatedly requesting the computer device for the network address of the candidate external access object of the same address type as the target external access object. Through the present application, the client can directly obtain the network address of the candidate external access object locally on the client's device to access the candidate external access object.

[0099] S203: Based on the target reference address set, perform risk detection on the initial network address to obtain a risk detection result of the initial network address.

[0100] It can be understood here that since the initial network address of the external access object may be risky, if the initial network address is not checked for risks and the external access object is accessed directly, the accessed external access object will be unsafe. Based on this, this application needs to perform risk detection on the initial network address.

[0101] In some application embodiments, based on the target reference address set, the initial network address is subjected to risk detection, and the method for obtaining the risk detection result of the initial network address can be: matching the initial network address with the network address in the target reference address set to obtain a matching result; and determining the risk detection result of the initial network address based on the matching result.

[0102] In an example, the network addresses in the target reference address set may be network addresses that all have risks.

[0103] In one example, the initial network address is matched with the network addresses in the target reference address set to obtain the matching result by: calculating the similarity between the initial network address and the network addresses in the target reference address set; and determining the matching result according to the similarity.

[0104] In the above, a similarity algorithm may be used to calculate the similarity between the initial network address and the network addresses in the target reference address set, wherein the similarity algorithm may be, for example, a cosine similarity algorithm, or a Gaussian kernel similarity algorithm, and so on.

[0105] The matching result may include a successful match and a failed match. Based on this, in one example, the matching result may be determined based on the similarity: when the similarity is greater than or equal to a preset similarity threshold, the matching result is determined to be a successful match; when the similarity is less than the preset similarity threshold, the matching result is determined to be a failed match.

[0106] In one example, the method for determining the risk detection result of the initial network address based on the matching result can be: when the matching result is a successful match, the risk detection result of the initial network address is determined based on the target reference address that matches the initial network address in the target reference address set; when the matching result is a failed match, a prompt message is generated and the prompt message is returned to the client so that the client can access the external access object based on the network access request.

[0107] In the above, the target reference address set includes an abnormal reference address subset and a normal reference address subset, the abnormal reference address subset includes at least one abnormal network address, and the normal reference address subset includes at least one normal network address. Based on this, in one example, based on the target reference address that matches the initial network address in the target reference address set, the method of determining the risk detection result of the initial network address can be: filtering out the network address that matches the initial network address in the target reference address set to obtain the target reference address; when the target reference address is a network address in the normal reference address subset, determining that the initial network address does not have a network risk; when the target reference address is a network address in the abnormal reference address subset, verifying the initial network address to obtain the risk detection result of the initial network address.

[0108] Among them, the network address matching the initial network address can be screened out according to the similarity between the initial network address and the network addresses in the target reference address set; and the network address matching the initial network address is used as the target reference address.

[0109] The present application may use the network address in the target reference address set that has the greatest similarity to the initial network address as the network address that matches the initial network address.

[0110] Based on the above, it can be understood here that when the target reference address is a network address in the abnormal reference address subset, it indicates that the initial network address may be a risky network address. Based on this, the present application performs a secondary verification on the initial network address to improve security. Based on this, in one example, the initial network address is verified to obtain the risk detection result of the initial network address. The method can be: verifying the initial network address to obtain the verification result of the initial network address; based on the verification result, determining the risk detection result of the initial network address.

[0111] Based on the above, in one example, the initial network address is verified, and a method for obtaining the verification result of the initial network address can be: obtaining risk verification information for the initial network address, and calculating the correlation between the risk verification information and the initial network address; when the correlation is greater than or equal to a preset threshold, determining that the verification result of the initial network address is a verification failure; when the correlation is less than the preset threshold, determining that the verification result of the initial network address is a verification pass.

[0112] The risk verification information may refer to information used to perform risk verification on the initial network address; specifically, the risk verification information may be a risky network address. The risk verification information may include multiple risk verification information. The present application may collect the risk verification information in advance and store the risk verification information locally on the computer device. In this way, the present application may extract the risk verification information locally from the computer device to improve the verification efficiency.

[0113] Based on the above, the present application may adopt a correlation function to calculate the correlation between the risk verification information and the initial network address. The correlation function may include a similarity function.

[0114] When the association function includes a similarity function, the similarity function is directly used to calculate the similarity between the risk verification information and the initial network address, and the similarity between the risk verification information and the initial network address is used as the association degree.

[0115] When the association function includes different similarity functions, for example, when the association function includes a first similarity function and a second similarity function, the first similarity function can be used to calculate the first similarity between the risk verification information and the initial network address; the second similarity function can be used to calculate the second similarity between the risk verification information and the initial network address; and the association degree between the risk verification information and the initial network address can be determined based on the first similarity and the second similarity.

[0116] The first similarity function may be a Gaussian kernel similarity function, and the second similarity function may be a cosine similarity function. The first similarity function and the second similarity function are exemplified herein, and the first similarity function and the second similarity function may be specifically set according to requirements.

[0117] Based on the above, in one example, according to the first similarity and the second similarity, the method for determining the correlation between the risk verification information and the initial network address can be: weighted fusion of the first similarity and the second similarity to obtain a weighted similarity; and using the weighted similarity as the correlation between the risk verification information and the initial network address.

[0118] Based on the above, in one example, based on the verification result, the method of determining the risk detection result of the initial network address can be: when the verification result is that the verification failed, the risk detection result of the initial network address is determined to be that the initial network address has a risk; when the verification result is that the verification passed, the risk detection result of the initial network address is determined to be that the initial network address does not have a risk.

[0119] In one example, when the matching result is a match failure, it means that the initial network address is in the target reference address set and there is no matching network address. Based on this, the present application can generate prompt information and return the prompt information to the client so that the client can access the external access object based on the network access request.

[0120] Based on the above, in one example, the prompt information is returned to the client so that the client can access the external access object based on the network access request. The method can be: returning the prompt information to the client so that the client sends the network access request to a public server in the external network for resolution, and obtains the resolution address corresponding to the network access request; in this way, the client can access the external access object based on the resolution address.

[0121] S204: Determine the target network address of the external access object according to the risk detection result and the target reference address set.

[0122] In some application embodiments, the method for determining the target network address of the external access object based on the risk detection result and the target reference address set can be: when the risk detection result is that the initial network address does not have a risk, the target network address corresponding to the initial network address is extracted from the target reference address set to obtain the target network address of the external access object; when the risk detection result is that the initial network address does have a risk, the candidate network address matching the initial network address is extracted from the preset reference address set to obtain the target network address of the external access object.

[0123] Based on the above, when the risk detection result is that there is no risk in the initial network address, it means that the target reference address in the target reference address set that matches the initial network address is safe. Based on this, in one example, the target network address corresponding to the initial network address is extracted from the target reference address set, and the method for obtaining the target network address of the external access object can be: according to the target reference address that matches the initial network address in the target reference address set, extract the target network address corresponding to the target reference address from the target reference address set; use the target network address corresponding to the target reference address as the target network address corresponding to the initial network address, and obtain the target network address of the external access object.

[0124] It can be understood here that the network address in the target reference address set includes a first network address and a second network address corresponding to the first network address, for example, the first network address is a domain name, and the second network address is an IP address. In an embodiment of the present application, the initial network address can be a domain name, and the target reference address can be a domain name. Based on this, when the target reference address is a domain name of an external access object, the target network address is an IP address corresponding to the domain name.

[0125] Based on the above, in one example, when the risk detection result is that the initial network address is at risk, it means that the target reference address in the target reference address set that matches the initial network address is unsafe. Based on this, the candidate network address that matches the initial network address is extracted from the preset reference address set, and the method for obtaining the target network address of the external access object can be: determining the network address category of the initial network address; based on the network address category, screening out the candidate network address that matches the initial network address in the preset reference address set to obtain the target network address of the external access object.

[0126] The network address category of the initial network address may be identified according to the category identification identifier carried by the initial network address.

[0127] Among them, for example, based on the network address category, candidate network addresses that match the initial network address are screened out from a preset reference address set, and a target network address of an external access object is obtained in a manner as follows: based on the network address category, in the address types of a preset reference address set, a candidate address type corresponding to the network address category is determined; based on the candidate address type, candidate network addresses that match the initial network address are screened out from the preset reference address set to obtain the target network address of the external access object.

[0128] Based on the above, according to the candidate address type, the candidate network address that matches the initial network address is filtered out in the preset reference address set, and the target network address of the external access object is obtained as follows: according to the candidate address type, in the preset reference address set, the normal network address corresponding to the candidate address type is filtered out; the normal network address is used as the candidate network address that matches the initial network address to obtain the target network address of the external access object.

[0129] The candidate network address matched by the initial network address may be used as the target network address of the external access object.

[0130] For example, when the network address category is a sports network address category, in the address type of the preset reference address set, the candidate address type corresponding to the network address category is determined to be the sports address type; then, in the preset reference address set, the normal network address corresponding to the sports address type is screened out; the normal network address corresponding to the sports address type is used as the target network address of the external access object.

[0131] S205: Send the target network address to the corresponding client, so that the client can access the external access object based on the target network address.

[0132] In some application embodiments, the target network address is sent to the corresponding client so that the client can access the external access object based on the target network address. The method can be: obtaining the physical address of each network interface in the target network element; based on the physical address, filtering out the network interface corresponding to the client in the network interface to obtain the sending network interface; sending the target network address to the corresponding client through the sending network interface, so that the client can access the external access object based on the target network address.

[0133] Based on the above, in one example, based on the physical address, the network interface corresponding to the client is filtered out from the network interface, and the method for obtaining the sending network interface can be: obtaining an interface mapping relationship set, the interface mapping relationship set including the mapping relationship between the preset physical address and the client; according to the physical address, filtering out the target preset physical address corresponding to the client from the preset physical address of the interface mapping relationship set; identifying the network interface corresponding to the target physical address, and using the network interface corresponding to the target physical address as the network interface corresponding to the client to obtain the sending network interface.

[0134] For example, the sending network interface may be identified based on identification information of the network interface corresponding to the client.

[0135] Based on the above, in one example, the target network address is sent to the corresponding client through the sending network interface so that the client can access the external access object based on the target network address. The method can be: sending the target network address to the information sending node corresponding to the sending network interface through the sending network interface; sending the target network address to the corresponding client through the information sending node so that the client can access the external access object based on the target network address.

[0136] The information sending node may refer to a network node used by a computer device to send a target network address.

[0137] The present application can obtain a network access request of at least one client in an internal network, the network access request includes an initial network address of an external access object in an external network; filter out at least one network address corresponding to the network access request in a preset reference address set to obtain a target reference address set; perform risk detection on the initial network address based on the target reference address set to obtain a risk detection result of the initial network address; determine the target network address of the external access object based on the risk detection result and the target reference address set; send the target network address to the corresponding client so that the client can access the external access object based on the target network address. Since the present application can filter out a target reference address set corresponding to the network access request of a client in an internal network in a preset reference address set, the initial network address can be risk detected based on the target reference address set to obtain a risk detection result of the initial network address, and thus the target network address of the external access object with higher security can be quickly determined based on the risk detection result and the target reference address set, so that the client of the internal network can quickly and securely access the external access object based on the target network address, thereby improving the security and access efficiency of the client's network access.

[0138] According to the method described in the above embodiment, the following is further described in detail with examples.

[0139] First of all, it should be noted that in the existing related technologies, when a client accesses the object to be accessed through a mobile communication network, it needs to resolve the IP address of the object to be accessed through a public server, and then access the network through the IP address. Since the client resolves the IP address of the object to be accessed through a public server, this will result in a slow resolution efficiency of the IP address, which in turn will result in a slow network access efficiency of the client. Not only that, when the client accesses the network through the IP address, it may access a risky object to be accessed, which will cause security issues in the client's network access.

[0140] Based on the above problems, Figure 3As shown, an object access method, the specific process is as follows: Steps S301 to S309:

[0141] In this embodiment, the object access device is specifically integrated in the cache server, which is a cache server. The cache server can provide a network address processing service to implement the object access method of the present application. Among them, the network address processing service can be deployed on one or more cache servers. Generally speaking, when the number of network access requests is small, the network address processing service can be deployed on one cache server; when the number of network access requests is large, the network address processing service can be deployed on multiple cache servers through distributed storage.

[0142] In the embodiment of the present application, the network address processing service can be referred to as a local DNS service. Figure 4 As shown, specifically, the network address processing service may include multiple sub-services, for example, the network address processing service may include a clustering sub-service, a security sub-service, and a redirection sub-service. For the clustering sub-service, the security sub-service, and the redirection sub-service. Among them, the clustering sub-service can be used at least to cluster the candidate network addresses to obtain a set of candidate network addresses of multiple categories; the security sub-service can be used at least to obtain a set of target reference addresses, calculate the similarity between the initial network address and the network addresses in the target reference address set, and determine the risk detection result of the initial network address; the redirection sub-service can be used at least to generate prompt information and return the prompt information to the client, so that the client can redirect the network access request to the public server of the external network for resolution based on the prompt information.

[0143] It should be noted here that in order to improve reliability, the network address processing service can integrate multiple algorithms, such as clustering algorithms, similarity functions, data update algorithms, data security assurance algorithms, and recommendation algorithms, etc., which can be set according to specific needs.

[0144] Based on the above, it should be noted that this application can be applied to the DNS protocol. This application can effectively support industrial Internet projects, cloud gaming projects, 5G remote driving and real-time twins, and intelligent remote control products and other projects that have strict requirements on network quality.

[0145] Among them, Figure 5As shown, for intelligent remote control products, the application scenarios of this application may include campus unmanned vehicle delivery, remote fault diagnosis, machine real-time status detection, and machine collaborative scheduling. Among them, the client can send a network access request to the base station through the client where the client is located; based on the network access request, the base station uses the object access method of this application to access the external access object corresponding to the network access request, so that the external access object provides services corresponding to the intelligent remote control product, such as campus unmanned vehicle delivery service, remote fault diagnosis service, machine real-time status detection service, machine collaborative scheduling service, etc.

[0146] This application can be developed on the target network element of the 5G core network, such as the UPF network element, using the dpdk technology and the vpp framework to implement the network address processing service, so that the network address processing service can at least provide the risk detection function of the initial network address, the modification function of the message, the forwarding function, etc., and integrate these functions into the UPF network element. It can be understood here that if Figure 6 As shown, the UPF network element of the present application may include an information receiving node and an information sending node. Among them, the information receiving node may also be called an uplink node, and the information receiving node may at least be used to receive a network access request and redirect the network access request; the information sending node may also be called a downlink node, and the information sending node may at least be used to send a target network address to a client.

[0147] Among them, the risk detection function can improve the security and reliability of the client's network.

[0148] Among them, the forwarding function can be responsible for redirecting the client's network access request to the cache server of the internal network of this application, and returning the response message of the cache server such as the target network address to the client. In this way, this application can avoid accessing the common network to complete the domain name resolution. This application can complete the domain name resolution and obtain the target network address through the internal network, thereby reducing latency, alleviating the network's resolution pressure, greatly improving the resolution efficiency, and thus improving the client's access efficiency.

[0149] Among them, this application also solves the problems of low versatility and weak scalability of existing related technologies. The network address processing service designed by this application is applicable to any 5G core network.

[0150] For example, Figure 7 As shown, the 5G core network may include multiple network elements, such as NSSF network element, UDM network element, UDR network element, NEF network element, NRF network element, AUSF network element, AMF network element, SMF network element, PCF network element, UPF network element and N3WF network element.

[0151] Among them, the NSSF network element can be used to determine the network slice instance that the client is allowed to access; the UDM network element can at least be used to uniformly manage data; the UDR network element can at least be used to implement the data warehousing function; the NEF network element can at least be used to implement the network openness function; the NRF network element can at least be used to enable network functions to discover each other and communicate through the API interface; the AUSF network element can at least be used to implement the authentication server function; the AMF network element can at least be used to provide user authentication and authorization functions; the SMF network element can at least be used to allocate and manage IP addresses; the PCF network element can at least be used to provide policy rules for control plane functions; the UPF network element can at least be responsible for processing user data packets and providing network functions; the N3WF network element can at least be used to enable the terminal to access the 5G core network from an untrusted non-3GPP network.

[0152] The present application can be designed on the network element with the shortest communication distance with the client, which can greatly improve the efficiency of obtaining the domain name, i.e., the target network address, and improve security. Among them, the network element with the shortest communication distance with the client can be a UPF network element. The present application uses the UPF network element to obtain the target network address. In simple terms, it can be: 1) The client sends a message such as a network access request, and the network access request is sent to the UPF network element through the base station. The network access request enters the UPF network element through the receiving network interface corresponding to the UPF network element, such as the N3 port. The UPF network element modifies the device IP of the processing device of the network access request and redirects the network access request to a locally built cache server with a network address processing service. Specifically, the UPF network element can receive the network access request of the N3 port through the information receiving node, modify the device IP of the processing device of the network access request through the information receiving node, and redirect the network access request to a locally built cache server with a network address processing service through the information receiving node, aiming to improve the efficiency of obtaining the target network address, reduce latency, and improve the quality of the user's Internet access. 2) The cache server receives the network access request forwarded by the UPF network element, performs risk detection and analysis on the network access request, and returns the resolved target network address to the client.

[0153] Based on the above, the present application further describes in detail the object access method provided by the present application using steps S301 to S309. Figure 8 As shown, the present application can be arranged with a client, a base station, a 5G core network, a cache server and a public server.

[0154] The client can at least send a network access request when accessing an external access object, and then receive a returned target network address.

[0155] Among them, the base station can at least be used to receive the client's network access request, send the network access request to the UPF network element, receive the target network address returned by the UPF network element, and send the target network address to the client.

[0156] Among them, the 5G core network can at least redirect the received network access requests to the cache server through the UPF network element.

[0157] Among them, the cache server can at least be arranged with a network address processing service to implement the object access method of the present application.

[0158] The public server can at least receive a network access request and resolve the domain name of the network access request when the target network address cannot be obtained from the cache server.

[0159] S301: The cache server obtains multiple candidate network addresses.

[0160] The present application obtains the network address in real time online and caches it locally to obtain multiple candidate network addresses, wherein the candidate network address may specifically be a domain name.

[0161] S302: The cache server clusters the candidate network addresses to obtain candidate network address sets of multiple categories.

[0162] Based on the above, the cache server can cluster the candidate network addresses through the clustering subservice in the network address processing service, using a clustering algorithm to obtain a plurality of categories of candidate network address sets. The clustering algorithm may include an isolation forest anomaly recognition algorithm.

[0163] For example, the present application can classify candidate network addresses through the clustering sub-service in the network address processing service to obtain classified network addresses corresponding to each address type; cluster the classified network addresses corresponding to the address type to obtain a set of candidate network addresses corresponding to multiple categories.

[0164] The categories may include a normal category and an abnormal category. The candidate network address set may include a normal category candidate network address set and an abnormal category candidate network address set.

[0165] Among them, for each address type, a clustering algorithm such as the Isolation Forest Anomaly Recognition Algorithm can be used to cluster the classified network addresses corresponding to the address type to obtain a set of candidate network addresses corresponding to multiple categories.

[0166] It can be understood here that the present application aims to exclude some abnormal external access objects and protect the client from potential malicious attacks by clustering a normal category candidate network address set and an abnormal category candidate network address set.

[0167] S303: The cache server constructs a preset reference address set based on the candidate network address set.

[0168] In one example, the network address in the candidate network address set may be a domain name, based on which the IP address corresponding to the domain name in the candidate network address set may be obtained; the domain name in the candidate network address set and the IP address corresponding to the domain name are associated to construct a preset reference address set.

[0169] S304: The cache server obtains a network access request from at least one client in the internal network.

[0170] The network access request includes an initial network address of the external access object in the external network. Specifically, the initial network address may be a domain name of the external access object.

[0171] In some application embodiments, a method for obtaining a network access request of at least one client in an internal network may be: determining a target network element corresponding to a cache server in the internal network; obtaining a communication distance of at least one client in the internal network; based on the communication distance, determining a network interface corresponding to the client in the target network element in the internal network, and obtaining a receiving network interface; and obtaining a network access request sent by at least one client from the receiving network interface of the target network element.

[0172] For example, based on the communication distance, the cache server filters out the target network element corresponding to the target communication distance among the network elements in the internal network, which may be the UPF network element; identifies the network interface corresponding to the target network element such as the UPF network element and the client; and according to the interface characteristic information of the network interface, filters out the receiving network interface from the network interface, which may be the N3 port.

[0173] There can be multiple network interfaces, for example Figure 7 As shown, the network interface may include an N2 port, an N3 port, an N4 port, an N6 port, and an N9 port.

[0174] The target communication distance may refer to the minimum communication distance in the communication distance. It can be understood here that using the receiving network interface of the target network element with the minimum communication distance to obtain the network access request of the client can improve the transmission efficiency of the network access request, thereby improving the detection efficiency of the initial network address and the acquisition efficiency of the target network address, and further improving the network access efficiency of the client.

[0175] Based on the above, in one example, a method for obtaining a network access request sent by at least one client from a receiving network interface may be: obtaining a network access request sent by at least one client from the receiving network interface through an information receiving node, i.e., an uplink node, corresponding to the receiving network interface, i.e., the N3 port.

[0176] S305: The cache server selects at least one network address corresponding to the network access request from the preset reference address set to obtain a target reference address set.

[0177] Based on the above, the cache server can determine the address type of the initial network address through the security sub-service in the network address processing service according to the request feature information included in the network access request; according to the address type, filter out at least one network address corresponding to the network access request in the preset reference address set to obtain the target reference address set.

[0178] Based on the above, in one example, the method for determining the address type of the initial network address according to the request characteristic information included in the network access request can be: identifying the request type of the network access request according to the request characteristic information included in the network access request; searching for the address type corresponding to the request type in the preset type set to obtain the address type of the initial network address.

[0179] The preset type set may include preset request types and preset address types having a corresponding relationship, the address type belongs to the preset address type, and the request type belongs to the preset request type.

[0180] Based on the above, in one example, according to the address type, at least one network address corresponding to the network access request is filtered out from the preset reference address set, and the target reference address set is obtained by: according to the address type, at least one network address corresponding to the address type is filtered out from the preset reference address set; and according to the at least one network address corresponding to the address type, a target reference address set is constructed.

[0181] Specifically, the network address corresponding to the address type can carry address risk identification information. Based on this, in one example, the method of constructing a target reference address set according to at least one network address corresponding to the address type can be: classifying the network addresses according to the address risk identification information carried by each network address corresponding to the address type to obtain a classified address set; and generating a target reference address set based on the classified address set.

[0182] Among them, the classified address set can be used as the target reference address set. Since the target reference address set can include a normal reference address subset and an abnormal reference address subset, based on this, the target reference address set can include a normal reference address subset and an abnormal reference address subset.

[0183] S306: The cache server matches the initial network address with the network addresses in the target reference address set to obtain a matching result.

[0184] Based on the above, the cache server can calculate the similarity between the initial network address and the network addresses in the target reference address set through the security sub-service in the network address processing service; and determine the matching result according to the similarity.

[0185] In the above, a similarity algorithm may be used to calculate the similarity between the initial network address and the network addresses in the target reference address set, wherein the similarity algorithm may be, for example, a cosine similarity algorithm.

[0186] The matching result may include a successful match and a failed match. Based on this, in one example, the matching result may be determined based on the similarity: when the similarity is greater than or equal to a preset similarity threshold, the matching result is determined to be a successful match; when the similarity is less than the preset similarity threshold, the matching result is determined to be a failed match.

[0187] S307: The cache server determines the risk detection result of the initial network address according to the matching result.

[0188] Based on the above, when the matching result is a successful match, the cache server can determine the risk detection result of the initial network address through the security sub-service in the network address processing service based on the target reference address that matches the initial network address in the target reference address set; when the matching result is a failed match, a prompt message is generated and returned to the client so that the client can access the external access object based on the network access request.

[0189] In the above, the target reference address set includes an abnormal reference address subset and a normal reference address subset, the abnormal reference address subset includes at least one abnormal network address, and the normal reference address subset includes at least one normal network address. Based on this, the cache server can filter out the network address that matches the initial network address in the target reference address set through the security sub-service in the network address processing service to obtain the target reference address; when the target reference address is a network address in the normal reference address subset, it is determined that there is no network risk for the initial network address; when the target reference address is a network address in the abnormal reference address subset, the initial network address is verified to obtain the risk detection result of the initial network address.

[0190] Based on the above, it can be understood here that when the target reference address is a network address in the abnormal reference address subset, it indicates that the initial network address may be a risky network address. Based on this, the present application performs a secondary verification on the initial network address to improve security. Based on this, in one example, the initial network address is verified to obtain the risk detection result of the initial network address. The method can be: verifying the initial network address to obtain the verification result of the initial network address; based on the verification result, determining the risk detection result of the initial network address.

[0191] Based on the above, in one example, the initial network address is verified, and a method for obtaining the verification result of the initial network address can be: obtaining risk verification information for the initial network address, and calculating the correlation between the risk verification information and the initial network address; when the correlation is greater than or equal to a preset threshold, determining that the verification result of the initial network address is a verification failure; when the correlation is less than the preset threshold, determining that the verification result of the initial network address is a verification pass.

[0192] For example, the risk verification information may include high-risk domain names in a high-risk domain name database. Based on this, the present application may use a similarity function to calculate the association between the high-risk domain name and the initial network address.

[0193] Based on the above, in one example, based on the verification result, the method of determining the risk detection result of the initial network address can be: when the verification result is that the verification failed, the risk detection result of the initial network address is determined to be that the initial network address has a risk; when the verification result is that the verification passed, the risk detection result of the initial network address is determined to be that the initial network address does not have a risk.

[0194] It is understandable that if Fig. 9 As shown, in order to ensure the security of the target network address, the present application can use the isolation forest anomaly recognition algorithm for clustering to obtain an abnormal reference address subset and a normal reference address subset. When the target reference address in the abnormal reference address subset matches the initial network address of the network access request, the initial network address is verified twice, that is, the similarity between the risk verification information and the initial network address is calculated using a similarity function, so as to reduce the probability of users accessing malicious external access objects such as malicious websites, thereby avoiding attacks from malicious external access objects.

[0195] In one example, when the matching result is a match failure, it means that the initial network address does not have a matching network address in the target reference address set. Based on this, the cache server can intercept the network access through the redirection subservice in the network address processing service, generate prompt information, and return the prompt information to the client, so that the client can redirect the network access request to the public server of the external network for resolution based on the prompt information, and obtain the resolution address corresponding to the network access request; in this way, the client can access the external access object based on the resolution address. The resolution address can be an IP address.

[0196] It can be understood here that the present application can configure and regulate the external access object that the client ultimately accesses through the redirection sub-service, thereby ensuring that the client's network access does not leave the campus.

[0197] Furthermore, in the present application, when the client sends a network access request to a public server of an external network for resolution, after obtaining the resolution address corresponding to the network access request, the client can send the resolution address to the cache server; after the cache server receives the resolution address, it can perform a security check on the resolution address; when the resolution address check passes, it means that the external access object corresponding to the resolution address is non-malicious. In this case, the resolution address and the initial network address corresponding to the resolution address can be associated and placed in a preset reference address set.

[0198] Among them, the address verification information of the resolved address can be obtained; the address verification information is used to verify the resolved address. Specifically, the target similarity between the address verification information and the resolved address can be calculated; when the target similarity is greater than or equal to a threshold, it is determined that the verification of the resolved address fails; when the target similarity is less than the threshold, it is determined that the verification of the resolved address fails.

[0199] S308: The cache server determines the target network address of the external access object according to the risk detection result and the target reference address set.

[0200] The target network address may be an IP address corresponding to the domain name of the external access object.

[0201] In some application embodiments, the method for determining the target network address of the external access object based on the risk detection result and the target reference address set can be: when the risk detection result is that the initial network address does not have a risk, the target network address corresponding to the initial network address is extracted from the target reference address set to obtain the target network address of the external access object; when the risk detection result is that the initial network address does have a risk, the candidate network address matching the initial network address is extracted from the preset reference address set to obtain the target network address of the external access object.

[0202] Based on the above, when the risk detection result is that there is no risk in the initial network address, it means that the target reference address in the target reference address set that matches the initial network address is safe. Based on this, in one example, the target network address corresponding to the initial network address is extracted from the target reference address set, and the method for obtaining the target network address of the external access object can be: according to the target reference address that matches the initial network address in the target reference address set, extract the target network address corresponding to the target reference address from the target reference address set; use the target network address corresponding to the target reference address as the target network address corresponding to the initial network address, and obtain the target network address of the external access object.

[0203] Based on the above, in one example, when the risk detection result is that the initial network address is at risk, it means that the target reference address in the target reference address set that matches the initial network address is unsafe. Based on this, the candidate network address that matches the initial network address is extracted from the preset reference address set, and the method for obtaining the target network address of the external access object can be: determining the network address category of the initial network address; based on the network address category, determining the candidate address type corresponding to the network address category in the address type of the preset reference address set; according to the candidate address type, screening out the normal network address corresponding to the candidate address type in the preset reference address set; using the normal network address as the candidate network address that matches the initial network address, to obtain the target network address of the external access object.

[0204] S309: The cache server sends the target network address to the corresponding client, so that the client accesses the external access object based on the target network address.

[0205] In some application embodiments, the target network address is sent to the corresponding client so that the client can access the external access object based on the target network address. The method can be: obtaining the physical address of each network interface in the target network element; based on the physical address, filtering out the network interface corresponding to the client in the network interface to obtain the sending network interface; sending the target network address to the corresponding client through the sending network interface, so that the client can access the external access object based on the target network address.

[0206] For example, the present application can obtain an interface mapping relationship set, which includes a mapping relationship between a preset physical address and a client; based on the physical address, filter out the target preset physical address corresponding to the client from the preset physical address of the interface mapping relationship set; identify the network interface corresponding to the target physical address as the N6 port, and use the network interface corresponding to the target physical address as the network interface corresponding to the client to obtain the sending network interface.

[0207] Based on the above, for example, the present application can send the target network address to the information sending node, i.e., the downstream node, corresponding to the sending network interface N6 port by sending the network interface N6 port; and send the target network address to the corresponding client through the information sending node, i.e., the downstream node, so that the client can access the external access object based on the target network address.

[0208] In summary, it is understandable that if Fig.10 As shown, the object access method implemented in this application has the following three main functions:

[0209] Function 1: Acceleration. Specifically, this application develops network address processing services on the UPF network element with the shortest communication distance with the client, which can avoid the client's network access request being transmitted to the public server of the external network. Therefore, compared with the traditional domain name resolution process, this application can greatly reduce the data transmission time and improve the network access efficiency of the client.

[0210] Function 2: Security assurance. Specifically, since this application relies on a locally built network address processing service, all network access request messages will be processed by the network address processing service. This application performs risk detection on the initial network address of the network access request through the network address processing service, which can avoid malicious attacks on public servers in the external network to a certain extent. In addition, this application designs a clustering algorithm on the network address processing service to analyze the cached network addresses and obtain a subset of abnormal reference addresses to filter high-risk domain names, thereby reducing potential threats to the client and greatly improving security.

[0211] Function three: Disaster recovery and redirection. The redirection sub-service and the interception of network access designed in this application can determine the external access object that the client ultimately accesses. Based on this, for example, this application can apply function three to load balancing. For example, when the external server where the external access object currently accessed by the client is located is overloaded, the redirection sub-service can be used to redirect the client's access to another external server with the external access object; for another example, the client's access can be redirected to the main page of the preset service; for another example, considering security requirements, the client is not allowed to access the external network, and the redirection sub-service can be used to redirect all user-side access to the services on the enterprise's internal network.

[0212] In order to reflect the advantages of this application, the object access method of this application can be tested. Before testing, this application needs to complete the construction of the network address processing service of this application. This application can deploy the network address processing service based on the open source application container engine Docker. The network address processing service runs on the cache server. The cache server and the UPF network element are independent machines, and the two can be connected through a wired network.

[0213] For comparison, the present application needs to prepare two test environments, namely, the 5G core network in which the present application develops the network address processing service, and the 5G core network in which the existing related technology does not develop the network address processing service. The test process can be as follows 1) to 3).

[0214] 1) In the above two test environments, the client initiates a network access request to the 5G core network; the base station receives the network access request initiated by the client and sends the network access request to the UPF network element.

[0215] 2) If Fig.11 and Fig.12 As shown, in two test environments, for this application, the UPF network element sends a network access request to the cache server; the cache server can start the network address processing service; then the network access request is processed by the network address processing service to obtain the target network address; the cache server returns the target network address to the client, so that the client can access the external access object through the target network address. Specifically, the cache server processes the network access request through the network address processing service to obtain the target network address; and the cache server returns the target network address to the client, so that the client can access the external access object through the target network address. For details, please refer to the following steps S1 to S8.

[0216] Regarding the existing related technologies, the existing related technologies do not have a network address processing service. Based on this, the 5G core network does not start the network address processing service; then the 5G core network sends a network access request to a public server of the public network; the public server responds to the network access request.

[0217] 3) In order to calculate the time taken to obtain the target network address in the two test environments, it is necessary to capture packets on the client side. For example, the packet capture software is started on the client side of the client to capture packets, and then the time taken to obtain the target network address in the two test environments can be obtained by parsing and analyzing the packet capture data of the packet capture software. The packet capture software can include wireshark and tcpdump. Wireshark can be the packet capture software corresponding to the Windows client, and tcpdump can refer to the packet capture software corresponding to the Linux client.

[0218] Among them, steps S1 to S8 are as follows: Fig.13 As shown:

[0219] S1. The client initiates a network access request for website A and sends the network access request to the UPF network element.

[0220] For example, the client starts surfing the Internet and prepares to access website A through a network access request.

[0221] S2 and UPF network elements receive network access requests from port N3 through the upstream node.

[0222] S3 and UPF network elements redirect network access requests to the cache server through the upstream node.

[0223] S4. The cache server processes the domain name of the network access request through the network address processing service to obtain the IP address.

[0224] Among them, the details of step S4 can refer to the aforementioned steps S304 to S308, which will not be repeated here.

[0225] S5. The cache server sends the IP address to the UPF network element.

[0226] S6 and UPF network elements receive IP addresses from port N6 through the downstream node.

[0227] S7. The UPF network element sends the IP address to the client through the downstream node.

[0228] Among them, the downstream node can check the IP address, and after checking that it is correct, send the IP address to the client.

[0229] S8. The client receives the IP address and accesses website A based on the IP address.

[0230] Based on the above, the time taken to obtain the target network address, i.e., the IP address, in each of the two test environments can be calculated by capturing packet data. The test results in the two test environments are shown in Table 1. From Table 1, it can be seen that the time taken to obtain the target network address by the existing related technology is about 15ms, while the time taken to obtain the target network address by the present application is about 1ms. It can be seen that the performance of the present application is improved by 15 times. After testing, the effectiveness of the present application is verified.

[0231] website domain name Destination network address Time consumed (ms) This application A website A1 A2 1 Existing related technologies A website A1 A2 15

[0232] Table 1

[0233] This application has many advantages, as follows:

[0234] For example, this application designs a network address processing service through the UPF network element, which can enhance the functions of the 5G core network, improve the performance of domain name resolution and the quality of client access to the network.

[0235] For another example, the present application designs a bypass DNS cache architecture in the 5G core network. By designing a network address processing service on the cache server on the UPF network element, the network address caching task is completed and the efficiency of obtaining the target network address is improved. This architecture can effectively reduce the load and overhead of the UPF network element, reduce the time consumption of domain name resolution on the client, reduce the pressure on the DNS server on the public network, and improve the Internet experience of 5G users.

[0236] For another example, the present application has designed and built a comparative test environment, that is, whether the 5G network introduces the present application, to compare and test the effectiveness of the present application. After experimental testing and verification, the present application can reduce the original domain name resolution time by about 15 times.

[0237] The present application can obtain a network access request of at least one client in an internal network, the network access request includes an initial network address of an external access object in an external network; filter out at least one network address corresponding to the network access request in a preset reference address set to obtain a target reference address set; perform risk detection on the initial network address based on the target reference address set to obtain a risk detection result of the initial network address; determine the target network address of the external access object based on the risk detection result and the target reference address set; send the target network address to the corresponding client so that the client can access the external access object based on the target network address. Since the present application can filter out a target reference address set corresponding to the network access request of a client in an internal network in a preset reference address set, the initial network address can be risk detected based on the target reference address set to obtain a risk detection result of the initial network address, and thus the target network address of the external access object with higher security can be quickly determined based on the risk detection result and the target reference address set, so that the client of the internal network can quickly and securely access the external access object based on the target network address, thereby improving the security and access efficiency of the client's network access.

[0238] In order to better implement the above method, an embodiment of the present application also provides an object access device, which can be integrated into a computer device, such as a server or a terminal. The terminal may include a tablet computer, a laptop computer and / or a personal computer.

[0239] For example, Fig.14 As shown, the object access device may include an acquisition unit 301, a screening unit 302, a detection unit 303, a determination unit 304 and an access unit 305, as follows:

[0240] (1) Acquisition unit 301;

[0241] The acquisition unit 301 may be used to acquire a network access request of at least one client in an internal network, where the network access request includes an initial network address of an external access object in an external network.

[0242] In some embodiments, the object access device can be integrated into a cache server of an internal network; the acquisition unit 301 can be used to determine a target network element corresponding to the cache server in the internal network; and receive a network access request from at least one client in the internal network through the target network element.

[0243] In some embodiments, the acquisition unit 301 can be used to obtain the communication distance of at least one client in the internal network; based on the communication distance, determine the network interface corresponding to the client in the target network element of the internal network, and obtain the receiving network interface; obtain the network access request sent by at least one client from the receiving network interface of the target network element.

[0244] (2) screening unit 302;

[0245] The screening unit 302 may be configured to screen out at least one network address corresponding to the network access request from a preset reference address set to obtain a target reference address set.

[0246] (3) detection unit 303;

[0247] The detection unit 303 may be configured to perform risk detection on the initial network address based on the target reference address set to obtain a risk detection result of the initial network address.

[0248] In some embodiments, the detection unit 303 may be used to match the initial network address with the network addresses in the target reference address set to obtain a matching result; and determine the risk detection result of the initial network address based on the matching result.

[0249] In some embodiments, the detection unit 303 can be used to determine the risk detection result of the initial network address based on the target reference address matched by the initial network address in the target reference address set when the matching result is a successful match; when the matching result is a failed match, generate a prompt message and return the prompt message to the client so that the client can access the external access object based on the network access request.

[0250] In some embodiments, the target reference address set includes an abnormal reference address subset and a normal reference address subset. The detection unit 303 can be used to filter out a network address that matches the initial network address in the target reference address set to obtain the target reference address; when the target reference address is a network address in the normal reference address subset, it is determined that there is no network risk for the initial network address; when the target reference address is a network address in the abnormal reference address subset, the initial network address is verified to obtain a risk detection result for the initial network address.

[0251] In some embodiments, the detection unit 303 may be used to verify the initial network address to obtain a verification result of the initial network address; and determine a risk detection result of the initial network address based on the verification result.

[0252] In some embodiments, the detection unit 303 can be used to obtain risk verification information for the initial network address, and calculate the correlation between the risk verification information and the initial network address; when the correlation is greater than or equal to a preset threshold, the verification result of the initial network address is determined to be a verification failure; when the correlation is less than the preset threshold, the verification result of the initial network address is determined to be a verification pass.

[0253] In some embodiments, the detection unit 303 can be used to determine that the risk detection result of the initial network address is that the initial network address has a risk when the verification result is that the verification failed; when the verification result is that the verification passed, determine that the risk detection result of the initial network address is that the initial network address does not have a risk.

[0254] (4) determining unit 304;

[0255] The determination unit 304 may be configured to determine a target network address of an external access object according to the risk detection result and the target reference address set.

[0256] In some embodiments, the determination unit 304 can be used to extract the target network address corresponding to the initial network address from the target reference address set to obtain the target network address of the external access object when the risk detection result is that the initial network address does not have a risk; when the risk detection result is that the initial network address does have a risk, extract the candidate network address that matches the initial network address from the preset reference address set to obtain the target network address of the external access object.

[0257] In some embodiments, the determination unit 304 can be used to determine the network address category of the initial network address; based on the network address category, select candidate network addresses matching the initial network address from a preset reference address set to obtain a target network address of an external access object.

[0258] (5) access unit 305;

[0259] The access unit may be used to send a target network address to a corresponding client, so that the client can access an external access object based on the target network address.

[0260] In some embodiments, the access unit 305 can be used to obtain the physical address of each network interface in the target network element; based on the physical address, filter out the network interface corresponding to the client in the network interface to obtain the sending network interface; send the target network address to the corresponding client through the sending network interface, so that the client can access the external access object based on the target network address.

[0261] In some application embodiments, such as Fig.15 As shown, the object access device may further include a clustering unit 306 .

[0262] (6) clustering unit 306;

[0263] The clustering unit 306 may be used to obtain a plurality of candidate network addresses; cluster the candidate network addresses to obtain a plurality of categories of candidate network address sets; and construct a preset reference address set based on the candidate network address sets.

[0264] As can be seen from the above, the acquisition unit 301 of the present application can be used to obtain a network access request of at least one client in an internal network, and the network access request includes an initial network address of an external access object in an external network; the screening unit 302 can be used to screen out at least one network address corresponding to the network access request in a preset reference address set to obtain a target reference address set; the detection unit 303 can be used to perform risk detection on the initial network address based on the target reference address set to obtain a risk detection result of the initial network address; the determination unit 304 can be used to determine the target network address of the external access object based on the risk detection result and the target reference address set; the access unit 305 can be used to send the target network address to the corresponding client, so that the client accesses the external access object based on the target network address. Since the present application can filter out a target reference address set corresponding to a network access request of a client in an internal network from a preset reference address set, a risk detection can be performed on the initial network address based on the target reference address set to obtain a risk detection result of the initial network address, and then a target network address with higher security for an external access object can be quickly determined based on the risk detection result and the target reference address set, so that the client in the internal network can quickly and securely access the external access object based on the target network address, thereby improving the security and access efficiency of the client's network access.

[0265] The present application also provides a computer device, such as Fig.16 As shown, it shows a schematic diagram of the structure of the computer device involved in the embodiment of the present application, specifically:

[0266] The computer device may include components such as a processor 401 with one or more processing cores, a memory 402 with one or more computer-readable storage media, a power supply 403, and an input unit 404. Those skilled in the art will appreciate that Fig.16 The computer device structure shown in the figure does not constitute a limitation on the computer device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. Among them:

[0267] The processor 401 is the control center of the computer device, and uses various interfaces and lines to connect various parts of the entire computer device. By running or executing software programs and / or modules stored in the memory 402, and calling data stored in the memory 402, the processor 401 performs various functions of the computer device and processes data. Optionally, the processor 401 may include one or more processing cores; preferably, the processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and computer programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 401.

[0268] The memory 402 can be used to store software programs and modules. The processor 401 executes various functional applications and data processing by running the software programs and modules stored in the memory 402. The memory 402 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, a computer program required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 402 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory 402 may also include a memory controller to provide the processor 401 with access to the memory 402.

[0269] The computer device also includes a power supply 403 for supplying power to various components. Preferably, the power supply 403 can be logically connected to the processor 401 through a power management system, so as to manage charging, discharging, and power consumption through the power management system. The power supply 403 can also include any components such as one or more DC or AC power supplies, recharging systems, power failure detection circuits, power converters or inverters, and power status indicators.

[0270] The computer device may further include an input unit 404, which may be used to receive input digital or character information communications and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function controls.

[0271] Although not shown, the computer device may further include a display unit, etc., which will not be described in detail herein. Specifically in this embodiment, the processor 401 in the computer device will load the executable files corresponding to the processes of one or more computer programs into the memory 402 according to the following instructions, and the processor 401 will run the computer programs stored in the memory 402, thereby realizing various functions, as follows:

[0272] Obtain a network access request from at least one client in an internal network, the network access request including an initial network address of an external access object in an external network; filter out at least one network address corresponding to the network access request from a preset reference address set to obtain a target reference address set; perform risk detection on the initial network address based on the target reference address set to obtain a risk detection result of the initial network address; determine a target network address of the external access object based on the risk detection result and the target reference address set; and send the target network address to a corresponding client so that the client can access the external access object based on the target network address.

[0273] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0274] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by a computer program, or by controlling related hardware through a computer program. The computer program may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0275] To this end, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. The computer program can be loaded by a processor to execute any object access method provided by the embodiment of the present application.

[0276] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0277] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0278] Since the instructions stored in the computer-readable storage medium can execute the steps in any object access method provided in the embodiments of the present application, the beneficial effects that can be achieved by any object access method provided in the embodiments of the present application can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0279] According to one aspect of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the methods provided in the various optional implementations provided in the above embodiments.

[0280] The above is a detailed introduction to an object access method, device, computer equipment, computer-readable storage medium and computer program product provided in an embodiment of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An object access method, characterized in that: include: Obtaining a network access request of at least one client in the internal network, wherein the network access request includes an initial network address of an external access object in the external network; Filtering at least one network address corresponding to the network access request from a preset reference address set to obtain a target reference address set; Based on the target reference address set, performing risk detection on the initial network address to obtain a risk detection result of the initial network address; Determining the target network address of the external access object according to the risk detection result and the target reference address set; The target network address is sent to a corresponding client, so that the client accesses the external access object based on the target network address.

2. The object access method according to claim 1, characterized in that: The performing risk detection on the initial network address based on the target reference address set to obtain a risk detection result of the initial network address includes: Matching the initial network address with the network addresses in the target reference address set to obtain a matching result; According to the matching result, a risk detection result of the initial network address is determined.

3. The object access method according to claim 2, characterized in that: Determining the risk detection result of the initial network address according to the matching result includes: When the matching result is a successful match, determining a risk detection result of the initial network address based on a target reference address matched by the initial network address in the target reference address set; When the matching result is a matching failure, a prompt message is generated and the prompt message is returned to the client so that the client can access the external access object based on the network access request.

4. The object access method according to claim 3, characterized in that: The target reference address set includes an abnormal reference address subset and a normal reference address subset, and determining the risk detection result of the initial network address based on the target reference address matched by the initial network address in the target reference address set includes: Filtering out a network address matching the initial network address from the target reference address set to obtain a target reference address; When the target reference address is a network address in the normal reference address subset, determining that there is no network risk for the initial network address; When the target reference address is a network address in the abnormal reference address subset, the initial network address is verified to obtain a risk detection result of the initial network address.

5. The object access method according to claim 4, characterized in that: The verifying the initial network address to obtain a risk detection result of the initial network address includes: Verifying the initial network address to obtain a verification result of the initial network address; Based on the verification result, a risk detection result of the initial network address is determined.

6. The object access method according to claim 5, characterized in that: The verifying the initial network address to obtain the verification result of the initial network address includes: Acquiring risk verification information for the initial network address, and calculating a correlation between the risk verification information and the initial network address; When the correlation degree is greater than or equal to a preset threshold, determining that the verification result of the initial network address is verification failure; When the correlation degree is less than the preset threshold, it is determined that the verification result of the initial network address is verification passed.

7. The object access method according to claim 5, characterized in that: The step of determining the risk detection result of the initial network address based on the verification result includes: When the verification result is that the verification fails, determining that the risk detection result of the initial network address is that the initial network address has a risk; When the verification result is that the verification is passed, it is determined that the risk detection result of the initial network address is that there is no risk in the initial network address.

8. The object access method according to claim 1, characterized in that: The determining, according to the risk detection result and the target reference address set, the target network address of the external access object comprises: When the risk detection result is that the initial network address does not have a risk, extracting the target network address corresponding to the initial network address from the target reference address set to obtain the target network address of the external access object; When the risk detection result is that the initial network address has a risk, a candidate network address that matches the initial network address is extracted from the preset reference address set to obtain the target network address of the external access object.

9. The object access method according to claim 8, characterized in that: The step of extracting a candidate network address matched by the initial network address from the preset reference address set to obtain a target network address of the external access object includes: Determine a network address category of the initial network address; Based on the network address category, candidate network addresses that match the initial network address are screened out from the preset reference address set to obtain the target network address of the external access object.

10. The object access method according to claim 1, characterized in that: Before filtering out at least one network address corresponding to the network access request from the preset reference address set to obtain the target reference address set, the method further includes: Get multiple candidate network addresses; Clustering the candidate network addresses to obtain candidate network address sets of multiple categories; Based on the candidate network address set, the preset reference address set is constructed.

11. The object access method according to any one of claims 1 to 10, characterized in that: The cache server in the internal network is applied; the obtaining of a network access request of at least one client in the internal network comprises: Determine a target network element corresponding to the cache server in the internal network; A network access request of at least one client in the internal network is received through the target network element.

12. The object access method according to claim 11, characterized in that: The receiving, through the target network element, a network access request of at least one client in the internal network includes: Obtaining a communication distance of at least one client in the internal network; Based on the communication distance, determining a network interface corresponding to the client in a target network element of the internal network, and obtaining a receiving network interface; A network access request sent by at least one client is obtained from a receiving network interface of the target network element.

13. The object access method according to claim 11, characterized in that: The sending the target network address to the corresponding client so that the client accesses the external access object based on the target network address includes: Obtaining the physical address of each network interface in the target network element; Based on the physical address, filter out the network interface corresponding to the client from the network interfaces to obtain a sending network interface; The target network address is sent to a corresponding client through the sending network interface, so that the client accesses the external access object based on the target network address.

14. An object access device, characterized in that: include: An acquisition unit, configured to acquire a network access request of at least one client in the internal network, wherein the network access request includes an initial network address of an external access object in the external network; A screening unit, configured to screen out at least one network address corresponding to the network access request from a preset reference address set to obtain a target reference address set; A detection unit, configured to perform risk detection on the initial network address based on the target reference address set, and obtain a risk detection result of the initial network address; a determination unit, configured to determine a target network address of the external access object according to the risk detection result and the target reference address set; The access unit is used to send the target network address to the corresponding client, so that the client can access the external access object based on the target network address.

15. A computer device, characterized in that: It comprises a memory and a processor; the memory stores a computer program, and the processor is used to run the computer program in the memory to execute the object access method according to any one of claims 1 to 13.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is suitable for being loaded by a processor to execute the object access method according to any one of claims 1 to 13.

17. A computer program product, characterized in that The computer program product stores a computer program, and the computer program is suitable for being loaded by a processor to execute the object access method according to any one of claims 1 to 13.

Images