Short message link DDoS protection method and system

Abstract

The invention relates to a short message link DDoS protection method and system, and belongs to the field of safety protection, and the method comprises the steps: when a 5G message user sends a 5G message containing a file or map coordinate to a non-5G message user, converting the 5G message into a normal link pointing to an internal server through a 5G message-to-short message server; adding an expiration timestamp and a UUID in the normal link, and sending the normal link to a short link server; converting the short message into a short link through a short link server, and sending the short link to a short message server; sending the short link to a non-5G message user in a short message form through a short message server; when a user clicks a short message, initiating a link access request for a short link to the firewall; checking whether a non-5G message user IP and a short link address are in a blacklist or not through a firewall, if yes, intercepting the request, and if not, releasing the request; and performing DDoS protection according to the short link of the access failure, the reason and the non-5G message user IP.

Description

Technical Field

[0001] The present invention belongs to the field of security protection, and in particular relates to a short message link DDoS protection method and system. Background Art

[0002] With the rapid development of 5G technology, 5G messaging services have gradually become an important means of communication. Users can send 5G messages to non-5G messaging users to transfer files and geographic location coordinates, which greatly improves the convenience and real-time nature of information exchange. Especially in scenarios such as file sharing and location sharing, the high bandwidth and low latency characteristics of 5G messaging significantly improve the user experience.

[0003] In the existing technology, when a 5G messaging user sends a message to a non-5G messaging user, the system automatically generates a standard link pointing to an internal file server or map server, and converts it into a short link and sends it to the recipient. This process simplifies user operations and makes information transmission more efficient.

[0004] However, short links lack an effective security authentication mechanism after being sent, which allows hackers to easily collect a large number of such short links and use them to launch DDoS attacks. Such attacks will have a serious impact on the internal servers of the 5G messaging system, thereby affecting the user experience of normal users.

[0005] In the above technical solution, the short link lacks an effective security authentication mechanism after being sent, which allows hackers to easily collect a large number of such short links and use them to launch DDoS attacks. This attack will have a serious impact on the internal servers of the 5G messaging system, thereby affecting the user experience of normal users. Summary of the invention

[0006] In view of the above deficiencies in the prior art, the purpose of the invention is to provide a method and system for SMS link DDoS protection. The short link can be sent to non-5G message users in the form of a short link SMS through a SMS server. When the non-5G message user clicks on the short link SMS, a link access request for the short link is sent to the firewall. The firewall checks the link access request to determine whether the IP address of the non-5G message user and the address of the short link are in the blacklist; if so, the link access request is intercepted; otherwise, the link access request is released, and SMS link DDoS protection is performed based on the short link that failed to be accessed, the reason for the failure, and the IP address of the non-5G message user. An effective security authentication mechanism can be implemented after the short link is sent, making it difficult for hackers to easily collect a large number of short links and launch DDoS attacks, thereby avoiding the serious impact of DDoS attacks on the internal servers of the 5G message system and significantly improving the user experience of normal users.

[0007] The first aspect of the present invention provides a method for protecting against SMS link DDoS, comprising:

[0008] S1, when a 5G message user sends a 5G message to a non-5G message user and the message content is a file or map coordinates, the 5G message is converted into a normal link pointing to the internal server through the 5G message to SMS server;

[0009] S2, adding an expiration timestamp and UUID to the normal link, and sending it to the short link server;

[0010] S3, converting the normal link with the expiration timestamp and the UUID added thereto into a short link through the short link server, and sending the short link to the SMS server;

[0011] S4, sending the short link to the non-5G message user in the form of a short link SMS through the SMS server;

[0012] S5, when the non-5G message user clicks on the short link SMS, a link access request for the short link is sent to the firewall;

[0013] S6, checking the link access request through the firewall to determine whether the IP address of the non-5G message user and the address of the short link are in the blacklist; if so, intercepting the link access request; otherwise, allowing the link access request;

[0014] S7, based on the failed short link, the reason for the failure, and the IP address of the non-5G message user, provides protection against SMS link DDoS.

[0015] Furthermore, after S3 and before S4, the method further includes:

[0016] S31, creating a sub-token bucket of the UUID in the token bucket, and filling multiple tokens into the sub-token bucket through the 5G message to SMS server;

[0017] S32, setting an expiration time for the sub-token bucket, and when the expiration time is reached, the token bucket destroys the sub-token bucket.

[0018] Further, after S6 and before S7, the method further includes:

[0019] S61, converting the short link contained in the link access request into the normal link through the short link server, and checking the normal link to determine whether the expiration timestamp in the normal link is greater than the current time; if so, the access fails, entering S63, and returning an error message to the non-5G message user; otherwise, obtaining a token from the token bucket according to the UUID in the normal link;

[0020] S62, determining whether a token is successfully obtained in the token bucket; if so, the short link server removes the expired timestamp and UUID in the normal link, and directs the link access request to the internal server through a reverse proxy; otherwise, the access fails, entering S63, and returning an error message to the non-5G message user;

[0021] S63, sending the short link that failed to be accessed, the reason for the failure, and the IP address of the non-5G message user to the intrusion detection module and the situation awareness module through the short link server.

[0022] Further, the failure reasons include: a first failure reason, a second failure reason and a third failure reason;

[0023] The first failure reason is specifically: the IP of the non-5G message user and the address of the short link are in the blacklist;

[0024] The second failure reason is specifically: the expiration timestamp in the normal link is greater than the current time;

[0025] The third failure reason is specifically: a token cannot be obtained in the token bucket.

[0026] Furthermore, the S7 specifically includes:

[0027] S701, performing real-time statistics on the short links that failed to be accessed, the reasons for the failure, and the IP addresses of non-5G message users through the intrusion detection module, and when the number of accesses to the short links that failed to be accessed and the IP addresses of non-5G message users is greater than or equal to the access threshold within a first preset time period, adding the short links that failed to be accessed and the IP addresses of non-5G message users to a blacklist, and intercepting them through the firewall;

[0028] S702, according to the second preset time period, obtaining interception statistics information of each short link and IP address of a non-5G message user in the blacklist in the firewall;

[0029] S703, based on the interception statistical information, determine whether the number of interceptions of each short link and non-5G message user's IP in the blacklist is less than the interception threshold; if so, delete the short link and non-5G message user's IP whose interception number is less than the interception threshold from the blacklist through the intrusion detection module, and update the blacklist; otherwise, determine that the current DDoS attack is serious through the situation awareness module, dynamically reduce the access threshold and the interception threshold, and trigger an alarm signal to introduce manual intervention to protect against SMS link DDoS.

[0030] The second aspect of the present invention provides a SMS link DDoS protection system, comprising:

[0031] The first conversion module is used to convert the 5G message to a normal link pointing to the internal server through the 5G message to SMS server when the 5G message user sends a 5G message to a non-5G message user and the message content is a file or map coordinates;

[0032] A first sending module, used for adding an expiration timestamp and a UUID to the normal link, and sending the same to a short link server;

[0033] A second conversion module, configured to convert the normal link added with the expiration timestamp and the UUID into a short link through the short link server, and send the short link to a short message server;

[0034] A second sending module is used to send the short link to the non-5G message user in the form of a short link SMS through the SMS server;

[0035] A third sending module is used to send a link access request for the short link to the firewall when the non-5G message user clicks on the short link SMS;

[0036] A first checking module is used to check the link access request through the firewall to determine whether the IP address of the non-5G message user and the address of the short link are in the blacklist; if so, intercept the link access request; otherwise, release the link access request;

[0037] The protection module is used to protect SMS link DDoS based on the failed short link, the reason for the failure, and the IP address of the non-5G message user.

[0038] Furthermore, the SMS link DDoS protection system also includes:

[0039] A filling module, used to create a sub-token bucket of the UUID in the token bucket, and fill multiple tokens into the sub-token bucket through the 5G message to SMS server;

[0040] The destruction module is used to set an expiration time for the sub-token bucket. When the expiration time is reached, the token bucket destroys the sub-token bucket.

[0041] Furthermore, the SMS link DDoS protection system also includes:

[0042] A second checking module is used to convert the short link contained in the link access request into the normal link through the short link server, and check the normal link to determine whether the expiration timestamp in the normal link is greater than the current time; if so, the access fails, enter the fourth sending module, and return an error message to the non-5G message user; otherwise, obtain a token from the token bucket according to the UUID in the normal link;

[0043] A judgment module, used to judge whether a token is successfully obtained in the token bucket; if so, the short link server removes the expiration timestamp and UUID in the normal link, and directs the link access request to the internal server through a reverse proxy; otherwise, the access fails, enters the fourth sending module, and returns an error message to the non-5G message user;

[0044] The fourth sending module is used to send the short link that failed to be accessed, the reason for the failure, and the IP of the non-5G message user to the intrusion detection module and the situation awareness module through the short link server.

[0045] Further, the failure reasons include: a first failure reason, a second failure reason and a third failure reason;

[0046] The first failure reason is specifically: the IP of the non-5G message user and the address of the short link are in the blacklist;

[0047] The second failure reason is specifically: the expiration timestamp in the normal link is greater than the current time;

[0048] The third failure reason is specifically: a token cannot be obtained in the token bucket.

[0049] Furthermore, the protection module is specifically used for:

[0050] The intrusion detection module performs real-time statistics on the short links that failed to be accessed, the reasons for the failure, and the IP addresses of non-5G message users. When the number of accesses to the short links that failed to be accessed and the IP addresses of non-5G message users is greater than or equal to the access threshold within a first preset time period, the short links that failed to be accessed and the IP addresses of non-5G message users are added to a blacklist and intercepted by the firewall.

[0051] Obtaining interception statistics of each short link and IP address of a non-5G message user in the blacklist in the firewall according to a second preset time period;

[0052] According to the interception statistical information, it is determined whether the number of interceptions of each short link and non-5G message user's IP in the blacklist is less than the interception threshold; if so, the short link and non-5G message user's IP whose interception number is less than the interception threshold are deleted from the blacklist through the intrusion detection module, and the blacklist is updated; otherwise, it is determined through the situation awareness module that it is currently in a serious DDoS attack, the access threshold and the interception threshold are dynamically lowered, and an alarm signal is triggered to introduce manual intervention to protect against SMS link DDoS.

[0053] The beneficial effects of the present invention are as follows:

[0054] The method and system of the present invention send the short link to the non-5G message user in the form of a short link SMS through the SMS server. When the non-5G message user clicks the short link SMS, a link access request for the short link is sent to the firewall. The firewall checks the link access request to determine whether the IP of the non-5G message user and the address of the short link are in the blacklist; if so, the link access request is intercepted; otherwise, the link access request is released, and SMS link DDoS protection is performed based on the short link that failed to be accessed, the reason for the failure, and the IP of the non-5G message user. An effective security authentication mechanism can be implemented after the short link is sent, making it difficult for hackers to easily collect a large number of short links and launch DDoS attacks, thereby avoiding the serious impact of DDoS attacks on the internal servers of the 5G message system and significantly improving the user experience of normal users. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The accompanying drawings are only used to illustrate specific embodiments and are not considered to limit the present invention. In the entire drawings, the same reference symbols represent the same components. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings.

[0056] Figure 1 A flowchart of a method for protecting against DDoS via SMS links provided by an embodiment of the present invention;

[0057] Figure 2 A schematic diagram of the structure of a SMS link DDoS protection system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0058] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without making creative work should fall within the scope of protection of the present invention.

[0059] Furthermore, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessarily obscuring the concepts disclosed in the present invention.

[0060] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the orientation or position relationship indicated by the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inside", "outside", etc. is based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation of the present invention. In addition, the terms "first", "second", and "third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. The terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be a connection between the two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0061] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of methods and systems consistent with some aspects of the present invention as detailed in the appended claims.

[0062] The present invention proposes a SMS link DDoS protection method and system, which solves the problem in the prior art that short links lack an effective security authentication mechanism after being sent, which allows hackers to easily collect a large number of such short links and use them to launch DDoS attacks. Such attacks will have a serious impact on the internal servers of the 5G messaging system, thereby affecting the user experience of normal users.

[0063] Method Embodiment

[0064] Reference Manual Attached Figure 1 , shows a flow chart of a SMS link DDoS protection method provided by an embodiment of the present invention.

[0065] An SMS link DDoS protection method provided by an embodiment of the present invention includes:

[0066] Specifically, the method includes steps S1 to S7.

[0067] S1, when a 5G message user sends a 5G message to a non-5G message user and the message content is a file or map coordinates, the 5G message is converted into a normal link pointing to the internal server through the 5G message to SMS server.

[0068] It should be noted that the internal server is a server used to store and process 5G message content, including file servers and geolocation servers. When a 5G message user sends a file or geolocation information, the file server is responsible for storing the file, the geolocation server is responsible for storing the location information, and generates a normal link to these contents through the 5G message to SMS server for non-5G message users to access.

[0069] In the present invention, storing files and geographic location information on dedicated internal servers (such as file servers and geographic location servers) helps to centrally manage 5G message content and ensure that these resources are securely stored and efficiently processed. This can avoid the direct transmission of large files or complex information between user devices and reduce the storage burden of mobile devices. By converting large files or complex geographic location information into concise links, non-5G message users can more conveniently access these contents through regular text messages. This simplifies the information transmission process and improves the user experience, especially when facing non-5G users, without being restricted by device or platform differences.

[0070] S2, add the expiration timestamp and UUID to the normal link and send it to the short link server.

[0071] The expiration timestamp is the current time point plus the preset link expiration time, which is used to determine the effective deadline of the link or resource. For example, the current time point is the time point when the normal link is generated, and the expiration time is the effective duration of the link or resource. The expiration timestamp obtained by adding the two indicates that the normal link will be invalid after this time point.

[0072] It should be noted that those skilled in the art can set the link expiration time according to actual needs, and the present invention does not limit this.

[0073] Among them, UUID (Universally Unique Identifier) ​​is a standardized identifier used to generate a globally unique number. UUID usually consists of a string of 32 characters of numbers and letters, which is randomly generated by a specific algorithm. Its main purpose is to ensure that in a distributed system or network, each element (such as a link, object, record, etc.) can have a unique identifier and will not conflict with other elements. Therefore, UUID is widely used in scenarios such as databases, network services, and application development.

[0074] In the present invention, the expiration timestamp ensures that the link is only valid within a specific time period, limiting the possibility of malicious users abusing the link for a long time. Even if the link is collected by a malicious user, the link will automatically become invalid after exceeding the preset validity period, preventing long-term attacks or improper access. UUID provides a globally unique identifier to ensure the uniqueness of each link. This uniqueness not only prevents conflicts between different links, but also effectively prevents attackers from launching attacks by guessing or reusing certain common links. The design of using expiration timestamps and UUIDs avoids exposing real file or location information during transmission, and implements resource access control through short links, which also strengthens user privacy protection to a certain extent and reduces the risk of sensitive data leakage.

[0075] S3, converts the normal link with the expiration timestamp and UUID into a short link through the short link server, and sends the short link to the SMS server.

[0076] In the present invention, normal links with expired timestamps and UUIDs are converted into short links, which helps to hide the specific addresses and structural information of internal servers. This can avoid direct exposure of server information and reduce the risk of attacks by malicious users. Short links are managed and verified by security modules to ensure the legitimacy and security of user access. Short links can generate independent access paths for each user. Even if the same resource is sent to multiple users, the short link obtained by each user is unique (due to the existence of UUID). This allows flexible management of each user's access rights, and even when a link is abused, only a specific short link needs to be disabled without affecting the normal use of other users.

[0077] In a possible implementation manner, after S3 and before S4, the process further includes:

[0078] S31, create a UUID sub-token bucket in the token bucket, and fill multiple tokens into the sub-token bucket through the 5G message to SMS server.

[0079] Among them, the Token Bucket is a network traffic control algorithm used to limit the transmission rate of data streams. It uses a "bucket" to store a certain number of tokens, which represent the operations or data transmissions allowed by the system. Whenever there is a new data stream or operation request, the system needs to take one or more tokens from the bucket to perform the corresponding operation. If there are not enough tokens, the request will be blocked or delayed. Tokens are added to the bucket at a fixed rate, and the bucket capacity is also limited. Tokens that exceed the capacity will be discarded. Through this mechanism, the token bucket can effectively control and manage data traffic to avoid overload.

[0080] In the present invention, the token bucket mechanism is used to limit the number of accesses corresponding to each UUID, ensuring that non-5G message users cannot access the corresponding link resources without restriction. If the token is used up, the user's subsequent access request will be blocked or delayed. This can effectively prevent attackers from frequently requesting the same link and avoid malicious abuse of resources. The token bucket can make requests more smoothly processed and prevent system overload caused by instantaneous peaks. Even during the peak period of network requests, through the limitation of the token bucket, the system can still smoothly process requests according to the token filling rate, avoiding response delays or crashes caused by overload.

[0081] S32, setting an expiration time for the sub-token bucket. When the expiration time is reached, the token bucket destroys the sub-token bucket.

[0082] It should be noted that those skilled in the art can set the expiration time according to actual needs, and the present invention is not limited thereto.

[0083] In the present invention, after the sub-token bucket is set with an expiration time, once the specified validity period is exceeded, the bucket will be automatically destroyed. This can prevent users from retaining access rights for a long time or maliciously making repeated requests, thereby avoiding long-term occupation of system resources. This ensures that limited system resources (such as storage, processing power, etc.) are not continuously consumed by expired and invalid requests. Each sub-token bucket corresponds to a specific UUID and access rights. By automatically destroying expired sub-token buckets, the invalid token buckets that exist in the system for a long time can be effectively reduced, avoiding the system from maintaining a large amount of useless access rights and data, thereby reducing the system's memory and processing burden and optimizing performance.

[0084] S4, sends the short link to non-5G message users in the form of a short link SMS through the SMS server.

[0085] In the present invention, the method of sending short links via SMS simplifies the operating experience of non-5G users. Non-5G users can access resources by simply clicking on the short link in the SMS, without the need to install or configure specific applications. This convenience helps to improve the overall user experience. Compared with directly sending large files or complex information, the method of sending short links via SMS greatly reduces the amount of data transmission. The SMS transmission itself consumes less bandwidth, and the actual access to resources is achieved through links, thereby reducing the network load of the system and improving communication efficiency.

[0086] S5, when a non-5G message user clicks on the short link SMS, a link access request for the short link is sent to the firewall.

[0087] In the present invention, all access requests are first directed to the firewall, which means that the system can finely control and review each access. According to the rules of the firewall, it is possible to flexibly manage which IP addresses and short links can be accessed, and set various access restrictions (such as frequency restrictions, regional restrictions, etc.), thereby ensuring that system resources are only open to legitimate users. The firewall can record detailed information on each short link access, including the user's IP address, access time, link, etc. This data can be used for subsequent security analysis, behavior tracking and statistics, thereby helping system administrators quickly detect and respond to abnormal activities.

[0088] S6, check the link access request through the firewall to determine whether the IP address of the non-5G message user and the address of the short link are in the blacklist. If so, intercept the link access request. Otherwise, release the link access request.

[0089] In the present invention, the firewall can effectively prevent known malicious users and attack sources from accessing the system by checking whether the IP and short link addresses are in the blacklist. Doing so can prevent malicious users from repeatedly using the same link or IP address to attack, improve the overall security of the system, and prevent malicious traffic from entering the system. The firewall can automatically update the blacklist based on the user's IP and short link access behavior to prevent large-scale DDoS attacks. When the system detects that a certain IP or short link frequently initiates abnormal requests, it can immediately add it to the blacklist and automatically intercept subsequent requests to prevent the continuous influx of attack traffic and reduce server pressure.

[0090] In a possible implementation manner, after S6 and before S7, the method further includes:

[0091] S61, convert the short link contained in the link access request into a normal link through the short link server, and check the normal link to determine whether the expiration timestamp in the normal link is greater than the current time. If so, the access fails, enter S63, and return an error message to the non-5G message user. Otherwise, obtain a token from the token bucket according to the UUID in the normal link.

[0092] In the present invention, by checking the expiration timestamp in the normal link, it can be ensured that the link is only accessed within the set validity period. If the link has expired, the system will block the access request and return an error message to the user. This timeliness protection can prevent malicious users from using or abusing expired links for a long time, thereby improving the security of the system. By checking the expiration timestamp on the short link server, a large number of invalid requests can be filtered out in advance, effectively reducing the pressure on the server when facing large-scale malicious requests. This mechanism cooperates with the token bucket to further limit malicious access traffic and improve the protection against DDoS attacks.

[0093] S62, determine whether the token is successfully obtained in the token bucket. If so, the short link server removes the expired timestamp and UUID in the normal link, and directs the link access request to the internal server through the reverse proxy. Otherwise, the access fails, enters S63, and returns an error message to the non-5G message user.

[0094] In the present invention, the token bucket mechanism limits the access frequency of short links. By judging whether the token is successfully obtained, it can ensure that the access request of each user will not exceed the preset limit of the system. If there is no token in the token bucket, it means that the user's access frequency is too high, and the system will reject subsequent requests. This helps to prevent malicious users or attackers from frequently accessing resources and avoid abusing system resources. The token bucket mechanism can resist DDoS attacks and ensure that the system will not be overwhelmed by too many access requests by setting the maximum number of accesses for each link or each user. When the tokens in the token bucket are exhausted, the system rejects new access requests, reducing the excessive consumption of system resources and preventing the server from being overwhelmed by a large number of malicious requests.

[0095] S63, sending the short link that failed to be accessed, the reason for the failure, and the IP address of the non-5G message user to the intrusion detection module and the situation awareness module through the short link server.

[0096] It should be noted that the failure reasons include: the first failure reason, the second failure reason and the third failure reason.

[0097] The first reason for failure is: the IP address of the non-5G message user and the address of the short link are on the blacklist.

[0098] The second failure reason is specifically: the expiration timestamp in the normal link is greater than the current time.

[0099] The third failure reason is specifically: a token cannot be obtained in the token bucket.

[0100] In the present invention, by recording and reporting the short links of failed accesses, the reasons for failure, and the user IP, the system can monitor all failed access requests in real time. This provides important data support for the intrusion detection module, helping the system to identify potential security threats, such as abnormal or malicious access behaviors, so as to respond in time. The situation awareness module can dynamically adjust the security policy based on the failed access data received. For example, when the system detects a large number of failed requests with expired links, it may temporarily tighten access restrictions. In the case where the token bucket is frequently exhausted, the system can more strictly control the access frequency, or trigger the alarm mechanism in advance to prevent further attacks.

[0101] S7, based on the failed short link, the reason for the failure, and the IP address of the non-5G message user, provides protection against SMS link DDoS.

[0102] It should be noted that DDoS (Distributed Denial of Service) is a type of network attack in which the attacker controls a large number of devices distributed in different locations and sends a large number of requests to the target server or network, causing the target resources to be overloaded and unable to respond to legitimate users' requests normally. The purpose of a DDoS attack is to consume the target's bandwidth, computing resources or memory, etc., disrupting its normal services, thereby paralyzing the website, application or service and making it impossible for normal users to access or operate it.

[0103] In the present invention, by continuously monitoring the short links that failed to access, the reasons for the failure, and the user IP, the system can quickly identify early signs of DDoS attack behavior. For example, if a certain IP address frequently sends requests that failed to access, or the token bucket is frequently exhausted, the system can determine the potential DDoS attack and take immediate measures to protect it. By monitoring and limiting the access to short links, the system can effectively avoid resource exhaustion due to large-scale malicious requests. The purpose of a DDoS attack is to overload the system's bandwidth, memory, or computing resources, and the present invention can reduce the consumption of system resources by malicious traffic by strictly controlling the frequency and number of short link accesses, ensuring that requests from legitimate users can be responded to normally.

[0104] In a possible implementation, S7 specifically includes sub-steps S701 to S703:

[0105] S701, real-time statistics are collected on the short links that failed to be accessed, the reasons for the failures, and the IP addresses of non-5G message users through the intrusion detection module. When the number of accesses to the short links that failed to be accessed and the IP addresses of non-5G message users is greater than or equal to the access threshold within a first preset time period, the short links that failed to be accessed and the IP addresses of non-5G message users are added to the blacklist and intercepted through the firewall.

[0106] In the present invention, the intrusion detection module can accurately identify potential DDoS attacks by real-time statistics of short links, failure reasons and user IPs that failed to access. Especially when a certain IP address frequently attempts to access and fails in a short period of time, the system can make a judgment in time, and put these malicious behaviors into the blacklist in time, effectively preventing the attack from spreading further. By setting a preset time period and access threshold, the system can monitor malicious behaviors in real time and respond in the early stage of the attack. The intrusion detection module can quickly add the attack source (such as malicious IP or short link) to the blacklist, and intercept it by the firewall, thereby preventing it from further attacking the system. This rapid response mechanism can greatly reduce the impact of DDoS attacks on the system.

[0107] S702. According to the second preset time period, the interception statistics of each short link and IP of non-5G message users in the blacklist are obtained in the firewall.

[0108] In the present invention, regularly obtaining interception statistics in the blacklist from the firewall can help the system understand the intensity and mode of the current attack. Through these data, the system can dynamically adjust the protection strategy, such as raising or lowering the entry threshold of the blacklist, strengthening or relaxing the protection measures for certain specific IPs or short links, so as to more flexibly respond to attacks of different intensities. By obtaining the interception statistics of each IP and short link, the system can identify which IPs or short links have continuous attack behaviors and which are temporary or occasional problems. Based on these data, the system can intercept malicious traffic more accurately, rather than blocking all potential threats in a one-size-fits-all manner, avoiding misjudgments and improving the accuracy of protection.

[0109] S703, based on the interception statistics, determine whether the number of interceptions of each short link and non-5G message user's IP in the blacklist is less than the interception threshold. If so, the short link and non-5G message user's IP whose interception times are less than the interception threshold are deleted from the blacklist through the intrusion detection module, and the blacklist is updated. Otherwise, the situation awareness module determines that the current DDoS attack is serious, dynamically lowers the access threshold and interception threshold, and triggers an alarm signal to introduce manual intervention to protect against SMS link DDoS.

[0110] It should be noted that those skilled in the art can set the first preset time period, the access threshold, the second preset time period and the interception threshold according to actual needs, and the present invention is not limited thereto.

[0111] In the present invention, continuous malicious behavior and short-term abnormal behavior are distinguished by analyzing the number of interceptions. If the number of interceptions of a certain IP or short link is lower than the set threshold, it may indicate that the attack has stopped or the problem has been solved. By removing these IPs or links from the blacklist in a timely manner, excessive blocking of normal users can be avoided, ensuring that the protective measures are more accurate and effective. By updating the blacklist in real time, long-term bans on IPs and links that are no longer active or have stopped attacking can be avoided, thereby reducing the burden of system management blacklists. This resource optimization helps to improve system performance and ensure that server resources are used to deal with more urgent threats rather than continuously processing outdated attack sources. By updating the blacklist in real time, long-term bans on IPs and links that are no longer active or have stopped attacking can be avoided, thereby reducing the burden of system management blacklists. This resource optimization helps to improve system performance and ensure that server resources are used to deal with more urgent threats rather than continuously processing outdated attack sources.

[0112] System Example

[0113] Reference Manual Attached Figure 2 , showing a structural diagram of a SMS link DDoS protection system provided by an embodiment of the present invention.

[0114] The present invention proposes a SMS link DDoS protection system 20, comprising:

[0115] The first conversion module 201 is used to convert the 5G message into a normal link pointing to the internal server through the 5G message to SMS server when a 5G message user sends a 5G message to a non-5G message user and the message content is a file or map coordinates.

[0116] The first sending module 202 is used to add an expiration timestamp and a UUID to a normal link, and send the same to a short link server.

[0117] The second conversion module 203 is used to convert the normal link with the expiration timestamp and UUID added thereto into a short link through the short link server, and send the short link to the SMS server.

[0118] The second sending module 204 is used to send the short link to the non-5G message user in the form of a short link SMS through the SMS server.

[0119] The third sending module 205 is used to send a link access request for the short link to the firewall when a non-5G message user clicks on the short link SMS.

[0120] The first checking module 206 is used to check the link access request through the firewall to determine whether the IP address of the non-5G message user and the address of the short link are in the blacklist. If so, the link access request is intercepted. Otherwise, the link access request is released.

[0121] The protection module 207 is used to protect SMS link DDoS based on the short link that failed to be accessed, the reason for the failure, and the IP address of the non-5G message user.

[0122] Furthermore, the SMS link DDoS protection system also includes:

[0123] Filling module 208 is used to create a sub-token bucket of UUID in the token bucket, and fill multiple tokens into the sub-token bucket through the 5G message to SMS server.

[0124] The destruction module 209 is used to set an expiration time for the sub-token bucket. When the expiration time is reached, the token bucket destroys the sub-token bucket.

[0125] Furthermore, the SMS link DDoS protection system also includes:

[0126] The second checking module 210 is used to convert the short link contained in the link access request into a normal link through the short link server, and check the normal link to determine whether the expiration timestamp in the normal link is greater than the current time. If so, the access fails, enter the fourth sending module 212, and return an error message to the non-5G message user. Otherwise, obtain a token from the token bucket according to the UUID in the normal link.

[0127] The judgment module 211 is used to judge whether the token is successfully obtained in the token bucket. If so, the short link server removes the expired timestamp and UUID in the normal link, and directs the link access request to the internal server through the reverse proxy. Otherwise, the access fails, enters the fourth sending module 212, and returns an error message to the non-5G message user.

[0128] The fourth sending module 212 is used to send the short link that failed to be accessed, the reason for the failure, and the IP of the non-5G message user to the intrusion detection module and the situation awareness module through the short link server.

[0129] Furthermore, the failure reasons include: a first failure reason, a second failure reason and a third failure reason.

[0130] The first reason for failure is: the IP address of the non-5G message user and the address of the short link are on the blacklist.

[0131] The second failure reason is specifically: the expiration timestamp in the normal link is greater than the current time.

[0132] The third failure reason is specifically: a token cannot be obtained in the token bucket.

[0133] Furthermore, the protection module 207 is specifically used for:

[0134] The intrusion detection module collects real-time statistics on the short links that failed to be accessed, the reasons for the failure, and the IP addresses of non-5G message users. When the number of accesses to the short links that failed to be accessed and the IP addresses of non-5G message users is greater than or equal to the access threshold within a first preset time period, the short links that failed to be accessed and the IP addresses of non-5G message users are added to the blacklist and intercepted by the firewall.

[0135] According to the second preset time period, the interception statistics of each short link and IP of non-5G message users in the blacklist are obtained in the firewall.

[0136] According to the interception statistics, it is determined whether the number of interceptions of each short link and non-5G message user's IP in the blacklist is less than the interception threshold. If so, the short link and non-5G message user's IP whose interception number is less than the interception threshold are deleted from the blacklist through the intrusion detection module, and the blacklist is updated. Otherwise, it is determined that the current DDoS attack is serious through the situation awareness module, and the access threshold and interception threshold are dynamically lowered, and an alarm signal is triggered to introduce manual intervention to protect against SMS link DDoS.

[0137] The SMS link DDoS protection system 20 provided by the present invention can implement the various steps and technical effects of the above-mentioned SMS link DDoS protection method. To avoid repetition, the present invention will not go into details.

[0138] The beneficial effects of the present invention are as follows:

[0139] The method and system of the present invention send the short link to the non-5G message user in the form of a short link SMS through the SMS server. When the non-5G message user clicks the short link SMS, a link access request for the short link is sent to the firewall. The firewall checks the link access request to determine whether the IP of the non-5G message user and the address of the short link are in the blacklist; if so, the link access request is intercepted; otherwise, the link access request is released, and SMS link DDoS protection is performed based on the short link that failed to be accessed, the reason for the failure, and the IP of the non-5G message user. An effective security authentication mechanism can be implemented after the short link is sent, making it difficult for hackers to easily collect a large number of short links and launch DDoS attacks, thereby avoiding the serious impact of DDoS attacks on the internal servers of the 5G message system and significantly improving the user experience of normal users.

[0140] The applicant of the present invention has made a detailed explanation and description of the implementation examples of the present invention in conjunction with the drawings in the specification. However, those skilled in the art should understand that the above implementation examples are only preferred implementation schemes of the present invention, and the detailed description is only to help readers better understand the spirit of the present invention, but not to limit the scope of protection of the present invention. On the contrary, any improvements or modifications based on the inventive spirit of the present invention should fall within the scope of protection of the present invention.

[0141] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, rather than to limit them. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the above embodiments, or replace some of the technical features therein by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or replacements that can be easily thought of by those skilled in the art within the technical scope disclosed in the present invention should be covered within the protection scope of the present invention.

Claims

1. A SMS link DDoS protection method, characterized in that: include: S1, when a 5G message user sends a 5G message to a non-5G message user and the message content is a file or map coordinates, the 5G message is converted into a normal link pointing to the internal server through the 5G message to SMS server; S2, adding an expiration timestamp and UUID to the normal link, and sending it to the short link server; S3, converting the normal link with the expiration timestamp and the UUID added thereto into a short link through the short link server, and sending the short link to the SMS server; S4, sending the short link to the non-5G message user in the form of a short link SMS through the SMS server; S5, when the non-5G message user clicks on the short link SMS, a link access request for the short link is sent to the firewall; S6, checking the link access request through the firewall to determine whether the IP address of the non-5G message user and the address of the short link are in the blacklist; if so, intercepting the link access request; otherwise, allowing the link access request; S7, based on the failed short link, the reason for the failure, and the IP address of the non-5G message user, provides protection against SMS link DDoS.

2. The SMS link DDoS protection method according to claim 1, characterized in that: After S3 and before S4, the method further includes: S31, creating a sub-token bucket of the UUID in the token bucket, and filling multiple tokens into the sub-token bucket through the 5G message to SMS server; S32, setting an expiration time for the sub-token bucket, and when the expiration time is reached, the token bucket destroys the sub-token bucket.

3. The SMS link DDoS protection method according to claim 1, characterized in that: After S6 and before S7, the method further includes: S61, converting the short link contained in the link access request into the normal link through the short link server, and checking the normal link to determine whether the expiration timestamp in the normal link is greater than the current time; if so, the access fails, entering S63, and returning an error message to the non-5G message user; otherwise, obtaining a token from the token bucket according to the UUID in the normal link; S62, determining whether a token is successfully obtained in the token bucket; if so, the short link server removes the expired timestamp and UUID in the normal link, and directs the link access request to the internal server through a reverse proxy; otherwise, the access fails, entering S63, and returning an error message to the non-5G message user; S63, sending the short link that failed to be accessed, the reason for the failure, and the IP address of the non-5G message user to the intrusion detection module and the situation awareness module through the short link server.

4. The SMS link DDoS protection method according to claim 3, characterized in that: The failure reasons include: a first failure reason, a second failure reason and a third failure reason; The first failure reason is specifically: the IP of the non-5G message user and the address of the short link are in the blacklist; The second failure reason is specifically: the expiration timestamp in the normal link is greater than the current time; The third failure reason is specifically: a token cannot be obtained in the token bucket.

5. The SMS link DDoS protection method according to claim 3 is characterized in that: The S7 specifically includes: S701, performing real-time statistics on the short links that failed to be accessed, the reasons for the failure, and the IP addresses of non-5G message users through the intrusion detection module, and when the number of accesses to the short links that failed to be accessed and the IP addresses of non-5G message users is greater than or equal to the access threshold within a first preset time period, adding the short links that failed to be accessed and the IP addresses of non-5G message users to a blacklist, and intercepting them through the firewall; S702, according to the second preset time period, obtaining interception statistics information of each short link and IP address of a non-5G message user in the blacklist in the firewall; S703, based on the interception statistical information, determine whether the number of interceptions of each short link and non-5G message user's IP in the blacklist is less than the interception threshold; if so, delete the short link and non-5G message user's IP whose interception number is less than the interception threshold from the blacklist through the intrusion detection module, and update the blacklist; otherwise, determine that the current DDoS attack is serious through the situation awareness module, dynamically reduce the access threshold and the interception threshold, and trigger an alarm signal to introduce manual intervention to protect against SMS link DDoS.

6. A SMS link DDoS protection system, characterized in that: The SMS link DDoS protection system is used to implement the SMS link DDoS protection method according to any one of claims 1 to 5, wherein the SMS link DDoS protection system specifically includes: The first conversion module is used to convert the 5G message to a normal link pointing to the internal server through the 5G message to SMS server when the 5G message user sends a 5G message to a non-5G message user and the message content is a file or map coordinates; A first sending module, used for adding an expiration timestamp and a UUID to the normal link, and sending the same to a short link server; A second conversion module, configured to convert the normal link added with the expiration timestamp and the UUID into a short link through the short link server, and send the short link to a short message server; A second sending module is used to send the short link to the non-5G message user in the form of a short link SMS through the SMS server; A third sending module is used to send a link access request for the short link to the firewall when the non-5G message user clicks on the short link SMS; A first checking module is used to check the link access request through the firewall to determine whether the IP address of the non-5G message user and the address of the short link are in the blacklist; if so, intercept the link access request; otherwise, release the link access request; The protection module is used to protect SMS link DDoS based on the failed short link, the reason for the failure, and the IP address of the non-5G message user.

7. The SMS link DDoS protection system according to claim 6, characterized in that: The SMS link DDoS protection system also includes: A filling module, used to create a sub-token bucket of the UUID in the token bucket, and fill multiple tokens into the sub-token bucket through the 5G message to SMS server; The destruction module is used to set an expiration time for the sub-token bucket. When the expiration time is reached, the token bucket destroys the sub-token bucket.

8. The SMS link DDoS protection system according to claim 6, characterized in that: The SMS link DDoS protection system also includes: A second checking module is used to convert the short link contained in the link access request into the normal link through the short link server, and check the normal link to determine whether the expiration timestamp in the normal link is greater than the current time; if so, the access fails, enter the fourth sending module, and return an error message to the non-5G message user; otherwise, obtain a token from the token bucket according to the UUID in the normal link; A judgment module, used to judge whether a token is successfully obtained in the token bucket; if so, the short link server removes the expiration timestamp and UUID in the normal link, and directs the link access request to the internal server through a reverse proxy; otherwise, the access fails, enters the fourth sending module, and returns an error message to the non-5G message user; The fourth sending module is used to send the short link that failed to be accessed, the reason for the failure, and the IP of the non-5G message user to the intrusion detection module and the situation awareness module through the short link server.

9. The SMS link DDoS protection system according to claim 8, characterized in that: The failure reasons include: a first failure reason, a second failure reason and a third failure reason; The first failure reason is specifically: the IP of the non-5G message user and the address of the short link are in the blacklist; The second failure reason is specifically: the expiration timestamp in the normal link is greater than the current time; The third failure reason is specifically: a token cannot be obtained in the token bucket.

10. The SMS link DDoS protection system according to claim 8, characterized in that: The protection module is specifically used for: The intrusion detection module performs real-time statistics on the short links that failed to be accessed, the reasons for the failure, and the IP addresses of non-5G message users. When the number of accesses to the short links that failed to be accessed and the IP addresses of non-5G message users is greater than or equal to the access threshold within a first preset time period, the short links that failed to be accessed and the IP addresses of non-5G message users are added to a blacklist and intercepted by the firewall. Obtaining interception statistics of each short link and IP address of a non-5G message user in the blacklist in the firewall according to a second preset time period; According to the interception statistical information, determine whether the number of interception times of each short link and non-5G message user's IP in the blacklist is less than the interception threshold; if so, delete the short link and non-5G message user's IP whose number of interception times is less than the interception threshold from the blacklist through the intrusion detection module, and update the blacklist; Otherwise, the situation awareness module determines that the current DDoS attack is serious, dynamically lowers the access threshold and the interception threshold, triggers an alarm signal, and introduces manual intervention to protect against SMS link DDoS.

Images