Distributed network user access frequency control method and device

Abstract

The invention discloses a distributed network user access frequency control method and device, and relates to the technical field of network security. The method comprises the following steps: receiving threat information reported by each proxy server node in a network; issuing the forbidden user list to all proxy server nodes, and generating a hash table which takes the user ID as a keyword and the user traffic sampling information as a value; traversing the hash table, and judging whether the user should be maintained in the observation user list, added to the observation user list, moved out of the observation user list or forbidden; and issuing the newest observation user list and the newest forbidden user list to all proxy server nodes. According to the method, on the premise of low memory occupation and high real-time performance, multi-dimensional and deep analysis can be carried out on the access traffic, a more friendly and more flexible deployment mode is provided, and the availability of the system is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method and device for controlling the access frequency of distributed network users. Background Art

[0002] System access frequency control in network security technology is to observe or restrict users who access the system too many times or with malicious intent. Access frequency control can be simply divided into two types: stand-alone and distributed. The implementation of stand-alone access frequency control is relatively simple, and there is no need to synchronize the consistency of user data. When the stand-alone traffic is not high, access frequency control can be completely achieved through a simple statistical algorithm. The access frequency control of distributed systems is relatively more complex. At present, it is mainly achieved through simple reporting of access times, such as unifying the rolling time windows of all proxy server nodes, regularly reporting the number of user accesses to a core system, and issuing alarms or handling.

[0003] The demand for access frequency control is more common in high-concurrency, high-traffic distributed systems. For distributed systems, all nodes report rolling time windows, which lacks real-time performance and is often difficult to resist short-term burst traffic. Further use of sliding windows will bring about data synchronization difficulties, because the reported sliding time windows are difficult to be consistent in time intervals. In addition, the existing distributed system access frequency control technology lacks in-depth analysis of attacking users, such as time dimension, space dimension, attack feature dimension, and the features generated by the combination of these dimensions. This lack of in-depth analysis is not conducive to the multi-layer control of the system. Summary of the invention

[0004] In view of the above-mentioned defects or deficiencies in the prior art, the present invention provides a method and device for controlling the access frequency of distributed network users, which can perform multi-dimensional and in-depth analysis of access traffic under the premise of low memory usage and high real-time performance, and provide a more friendly and flexible deployment method to improve the availability of the system.

[0005] In one aspect of the present invention, a method for controlling the access frequency of users in a distributed network is provided, which is used for a controller node, and includes: receiving threat information reported by each proxy server node in the network, wherein the threat information includes user traffic sampling information of a non-observed user list, user traffic sampling information of an observed user list, and a banned user list; sending the banned user list to all proxy server nodes, and merging the user traffic sampling information of the observed user list reported by each proxy server node to obtain a hash table with user ID as a keyword and user traffic sampling information as a value; traversing the hash table to identify whether a user is in the current observed user list, and judging whether the user should be maintained in the observed user list, added to the observed user list, removed from the observed user list, or banned according to the identification result, so as to obtain the latest observed user list and the latest banned user list; sending the latest observed user list and the latest banned user list to all proxy server nodes, so that each proxy server node will take effect the banning action according to the latest banned user list, and storing the latest observed user list in a local storage device to wait for reporting again.

[0006] Another aspect of the present invention provides a device for controlling access frequency of distributed network users, which is used in a controller node and includes: A receiving module, used for receiving threat information reported by each proxy server node in the network, wherein the threat information includes user traffic sampling information of a non-observed user list, user traffic sampling information of an observed user list, and a banned user list; A hash table generation module is used to send the banned user list to all proxy server nodes, and merge the user flow sampling information of the observed user list reported by each proxy server node to obtain a hash table with user ID as the keyword and user flow sampling information as the value; A user list generation module, used to traverse the hash table, identify whether the user is in the current observed user list, and determine whether the user should be maintained in the observed user list, added to the observed user list, removed from the observed user list, or banned according to the identification result, so as to obtain the latest observed user list and the latest banned user list; The data sending module is used to send the latest observed user list and the latest banned user list to all proxy server nodes, so that each proxy server node will take effect the ban action according to the latest banned user list, and store the latest observed user list in the local storage to wait for re-reporting.

[0007] The present invention provides a method and device for controlling the access frequency of distributed network users, which has the following beneficial effects: (1) Low memory overhead. Since there is no need to fully synchronize the sliding time window and the corresponding data structure (such as hash table) on each node, there is almost no data consistency conflict between nodes. At the same time, each node only maintains the user access information of the traffic it forwards, and does not need to maintain copies, which greatly reduces memory overhead;

[0008] (2) High response speed. For proxy server nodes that are not handled by iptables, log n-level queries can be implemented. Nodes handled by iptables do not need to be processed at the application layer, and the speed is faster.

[0009] (3) High accuracy. Whether it is global or local processing, there will be no false alarms. It is only possible to lose information when the node reports, or miss a small amount of traffic when estimating the user access frequency. That is, the traffic in a critical state needs to wait for the next round of reporting, but this traffic itself does not put much pressure on the system.

[0010] (4) Easy to expand and good fault tolerance. Each proxy server node can be deployed at will and communicate with each other. If the reported information is lost, it will not cause false alarms and will not affect normal business.

[0011] (5) Achieve multi-dimensional and in-depth analysis of access traffic, which helps the system to carry out multi-layer management and control. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings: Figure 1 It is a flowchart of a method for controlling the access frequency of distributed network users provided by an embodiment of the present application; Figure 2 It is a structural diagram of a device for controlling access frequency of distributed network users provided by an embodiment of the present application; Figure 3 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0013] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0014] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0015] It should be understood that although the terms first, second, third, etc. may be used to describe the acquisition modules in the embodiments of the present invention, the acquisition modules should not be limited to these terms. These terms are only used to distinguish the acquisition modules from each other.

[0016] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0017] It should be noted that the directional words such as "upper", "lower", "left", and "right" described in the embodiments of the present invention are described at the angles shown in the drawings and should not be understood as limiting the embodiments of the present invention. In addition, in the context, it should also be understood that when it is mentioned that an element is formed "on" or "under" another element, it can not only be formed directly "on" or "under" another element, but also be formed "on" or "under" another element indirectly through an intermediate element.

[0018] The nodes of the distributed business system can be divided into proxy server nodes and controller nodes. At the same time, the distributed business system also relies on some cache clusters such as redis. Proxy server nodes and controller nodes do not conflict, so they can be deployed on the same device. Proxy server nodes are used to forward or count business traffic, and controller nodes are used to synchronize information and issue rules.

[0019] The traffic handling strategies of distributed business systems are divided into local handling and global handling. Global access frequency control is applicable to scenarios where the access frequency of all interfaces needs to be strictly controlled, such as preventing DDoS attacks and protecting system resources. Local access frequency control is applicable to scenarios where only frequency control of specific interfaces is required, such as certain sensitive operations or high-traffic interfaces. By properly configuring global and local access frequency control, system security can be effectively protected, malicious attacks can be prevented, and user experience and system performance can be optimized.

[0020] When the client uses a consistent algorithm for load balancing, only local processing is used. When the client uses an inconsistent algorithm, local processing and global processing are effective at the same time, and a user may be blocked due to local processing or global processing. The method and device for controlling the access frequency of distributed network users of the present invention are applicable to the case of inconsistent algorithms.

[0021] See also Figure 1 An embodiment of the present application provides a method for controlling the access frequency of distributed network users. The method is a process in which a controller node receives the reporting information of all proxy server nodes, performs centralized processing, and issues new blocking rules, including the following steps: Step S101, receiving threat information reported by each proxy server node in the network, wherein the threat information includes user traffic sampling information of a non-observed user list, user traffic sampling information of an observed user list, and a banned user list.

[0022] Specifically, each proxy server node in the distributed business system reports threat information to the controller node. The threat information includes user traffic sampling information of the non-observation user list, user traffic sampling information of the observation user list, and the banned user list. Non-observation users refer to users who have not been found to be threatening and have not been included in the observation user list; observation users refer to users who are included in the observation user list because they have threats but are not enough to be banned; banned users refer to users who have triggered the threat threshold (for example, the access frequency reaches the threshold) and have been banned. Some proxy server nodes have previously handled some users locally or globally, so some users have been included in the observation user list and / or the banned user list, and these lists will be transmitted to the controller node at the next report. Furthermore, the user sampling information of the observation user list / non-observation user list includes but is not limited to the access information such as the observation list / non-observation list IP, timestamp, request body, request header, etc. The reported banned user list includes the banned list of local handling, which is used to synchronize the ban status of the entire network to avoid occasional failure of the ban.

[0023] For example, assuming that it is the nth second of the system time and a proxy server node is required to report threat information, then take the information in the interval [nk, n], build a big root heap (a big root heap is a binary tree, which can be functionally understood as an ordered queue sorted from large to small according to the value of the key), take out the first p bits of the big root heap, and report them together with the size of the k value. This reported information is called sampling information.

[0024] Among them, the k value is the reporting time interval of the proxy server node. The reporting time interval k of each proxy server node is determined based on the time point of the last report, the preset maximum reporting cycle, the preset minimum reporting cycle, the node load and the node CPU processing speed. The loop will not be executed if the conditions are not met. When the CPU processing of the entire node is fast enough, nk is the time of the last report. If the load is particularly high, the CPU will not be able to handle it. At this time, the proxy server node will choose to report only part of it. For example, the last time was the 10th second, and the current time is the 20th second. If the load is too high, it may only report threat information in the interval [15, 20].

[0025] The p value is the effectiveness of the information reported by each node, which is issued by the controller node and depends on the generation The validity of the information previously reported by the proxy server node. The higher the validity of the p value, the more likely it is that this node is frequently visited by attackers, or that this node has more traffic than other nodes. The higher the validity of the p value, the more traffic this node should randomly sample. If more than the first predetermined proportion of users in the threat information reported by each proxy server node are banned, the validity p of the information reported by the proxy server node is increased; if less than the second predetermined proportion of users in the threat information reported by each proxy server node are banned, the validity of the information reported by the proxy server node is lowered; the validity of the information reported by the proxy server node is used to determine the proportion of the threat information reported by the proxy server node each time to all threat information in the reporting period. Exemplarily, if more than 10% (not limited to this example) of users in a batch of sampled information reported by a node are banned, then the p value of this node should increase; if less than 1% (not limited to this example) of users in the reported sampled information are banned, then the p value of this node should decrease; if the banned users are between 1% and 9% (not limited to this example), the p value does not change. The specific range of p-value changes can be calculated by the following formula:

[0026] p = p + (percentage of banned users - 10%) k p, when the percentage of banned users > 10%; p = p - (1% - percentage of banned users) k p, when the percentage of banned users is < 1%; Among them, the k value can be 0.1.

[0027] Step S102: Send the banned user list to all proxy server nodes, and merge the user traffic sampling information of the observed user list reported by each proxy server node to obtain a hash table with user ID as the keyword and user traffic sampling information as the value.

[0028] Specifically, the controller node synchronizes the banned list to the redis cluster, generates ban rules for users in the banned list, and sends the banned list and ban rules to all proxy server nodes. The controller node needs to integrate the reporting information of all proxy server nodes, merge the sampling information and observed user lists of all proxy server nodes, and generate a general table of the observation list. The general table of the observation list is a hash table with user ID as the keyword and user traffic sampling information as the value, and the general table of the observation list is sent to each proxy server node. Among them, the user ID can be a field value in the HTTP header or Cookies, or it can be the user's socket IP, or the first value of the X-Forwarded-For field, which can be set according to needs and customer environment.

[0029] Step S103, traverse the hash table to identify whether the user is in the current observed user list, and determine whether the user should be maintained in the observed user list, added to the observed user list, removed from the observed user list or banned based on the identification result, so as to obtain the latest observed user list and the latest banned user list.

[0030] Specifically, for each user, the generated hash table is traversed to determine whether the user is an observed user, and then the user's access frequency and threat level are calculated. The specific judgment process is as follows: Step S1031, traverse the hash table to confirm that the user is not in the current list of observed users, and then calculate the user's access frequency according to the following formula: : = sum(c) / avg(k) Where c is the number of visits by the user, k is the reporting time interval of the proxy server node, sum() means sum, and avg() means average; Then calculate the access frequency threshold according to the following formula: _threshold: _threshold = P / Q Wherein, P represents the maximum value of the number of user accesses within the specified time in the set blocking policy; Q represents the specified time in the set blocking policy; If the user's access frequency Greater than or equal to the access frequency threshold _threshold, and k is greater than or equal to Q, the user is directly included in the banned user list; if the user's access frequency Greater than or equal to the access frequency threshold The product of _threshold and coefficient a, and coefficient a is less than 1, then the user is added to the rule of the observed user list, and the total number of previous visits of the user sum(c) and the average value avg(k) of the proxy server node reporting period are cached.

[0031] Step S1032: traverse the hash table to confirm that the user is in the current list of observed users, and then calculate the user's access frequency according to the following formula: : = (sum(c)+c_cache) / avg(k) + k_cache Where c is the number of visits by the user, k is the reporting time interval of the proxy server node, sum() represents summing, avg() represents averaging, c_cache represents the total number of visits by the user in the current cache, and k_cache represents the average of the reporting time intervals of the proxy server nodes in the current cache; Then calculate the access frequency threshold according to the following formula: _threshold: _threshold = P / Q Wherein, P represents the maximum value of the number of user accesses within the specified time in the set blocking policy; Q represents the specified time in the set blocking policy; like >= _threshold, and k is greater than or equal to Q, the user is directly included in the banned user list; if the user's access frequency Greater than or equal to the access frequency threshold The product of _threshold and coefficient a, coefficient a is less than 1, and k is less than Q, then the user is maintained in the list of observed users; if Less than _threshold, and k is greater than or equal to Q, the user is removed from the list of observed users.

[0032] Step S1033: if the user is included in the observed user list in two consecutive rounds of threat information reporting and has not been banned, the threat level of the user is determined. If the threat level of the user is greater than the threat level threshold, the user is directly included in the banned user list, specifically including: The geographical location information and timestamp information of the user's multiple visits are obtained, the path distance of multiple geographical location coordinate points is calculated, and the average moving speed v_temp of the user is calculated according to the path distance and timestamp information. If the average moving speed v_temp of the user is greater than the speed threshold v_threshold, the product of the average moving speed v_temp of the user and the preset first weight coefficient w1 is used as the first threat level T1 of the user. The empirical value of the speed threshold v_threshold is usually 36 km / h, and the empirical value of the first weight coefficient w1 is usually 0.4.

[0033] The Euclidean distance between any two geographic coordinate points visited by a user is calculated according to the following formula: in, Represents the geographic location coordinate point The actual geographical distance Represents the geographic location coordinate point The actual geographical distance Represents the geographic location coordinate point The access time, Represents the geographic location coordinate point The time of visit; According to the Euclidean distance between the geographic location coordinate points visited by any two users, cluster the geographic location coordinate points with a closer distance, divide the geographic location coordinate points visited by the users into multiple clusters, and set a maximum number of members for each cluster (depending on the total number of users, 400 is recommended for 100,000 users). Whenever a new geographic location coordinate point is added, recalculate the cluster division; calculate the threat level of all users in the cluster according to the calculation method of the first threat level, divide the calculated threat level of all users in the cluster by the number of users in the cluster to obtain the average threat level of the cluster, and use the average threat level of the cluster as the second threat level T2 of the user; When visiting a site, attackers often use dynamic user agents (UA) to forge requests, so the user agent and time information themselves also contain attack features. Considering daily scenarios, a user usually only uses a fixed browser on a mobile phone to access services, or a mobile phone and a PC to access services alternately. It is rare to use multiple mobile phones to access the same set of services at the same time. Based on this, common user agents (UA) can be counted to estimate the distance between two user agents (UA). For example, the distance between an iPhone browser and an Ipad tablet browser should be far, which is a reasonable usage scenario. The distance between browsers of different Android versions of Android phones should be close, and the closer the distance, the more repellent the user agent (UA) should be. Based on the above principles, the user's third threat level is calculated according to the following formula :

[0034] in, is the preset second weight coefficient, The time difference for the user agent (UA) change, () indicates the distance between two user agents. Indicates two adjacent user agents. Represents the sum of all distances between user agents.

[0035] The sum of the first threat level T1, the second threat level T2 and the third threat level T3 is taken as the final threat level T. If the final threat level is greater than the threat level threshold T_threshold, the user is directly included in the banned user list.

[0036] Step S104, the latest observed user list and the latest banned user list are sent to all proxy server nodes, so that each proxy server node will take effect the ban action according to the latest banned user list, and store the latest observed user list in the local storage to wait for reporting again.

[0037] See also Figure 2 Another embodiment of the present invention further provides a distributed network user access frequency control device 200, including a receiving module 201, a hash table generation module 202, a user list generation module 203 and a data sending module 204. The distributed network user access frequency control device 200 can execute the distributed network user access frequency control method in the method embodiment.

[0038] Specifically, the control device 200 for the access frequency of distributed network users is configured to include: A receiving module 201, configured to receive threat information reported by each proxy server node in the network, wherein the threat information includes user traffic sampling information of a non-observed user list, user traffic sampling information of an observed user list, and a banned user list; The hash table generation module 202 is used to send the banned user list to all proxy server nodes, and merge the user flow sampling information of the observed user list reported by each proxy server node to obtain a hash table with the user ID as the keyword and the user flow sampling information as the value; A user list generation module 203 is used to traverse the hash table, identify whether the user is in the current observed user list, and determine whether the user should be maintained in the observed user list, added to the observed user list, removed from the observed user list, or banned according to the identification result, so as to obtain the latest observed user list and the latest banned user list; The data sending module 204 is used to send the latest observed user list and the latest banned user list to all proxy server nodes, so that each proxy server node will take effect the ban action according to the latest banned user list, and store the latest observed user list in the local storage to wait for reporting again.

[0039] It should be noted that the distributed network user access frequency control device 200 provided in this embodiment corresponds to a technical solution that can be used to execute each method embodiment, and its implementation principle and technical effect are similar to the method, which will not be repeated here.

[0040] See also Figure 3 Another embodiment of the present invention provides a schematic diagram of the structure of an electronic device 300, which is used to implement the method for controlling the access frequency of distributed network users in the method embodiment. The electronic device 300 in the embodiment of the present invention may include but is not limited to a PC and a server. Figure 3 The electronic device 300 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0041] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 to a random access memory (RAM) 303 to implement the method of the embodiment of the present invention. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0042] Typically, the following devices may be connected to the I / O interface 305: an input device 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 308 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 309. The communication device 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0043] The above description is only a preferred embodiment of the present invention. Those skilled in the art should understand that the scope of disclosure involved in the present invention is not limited to the technical solution formed by a specific combination of the above technical features, but also should cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present invention (but not limited to) to form a technical solution.

Claims

1. A method for controlling the access frequency of distributed network users, used in a controller node, characterized in that include: Receiving threat information reported by each proxy server node in the network, the threat information including user traffic sampling information of a non-observed user list, user traffic sampling information of an observed user list, and a banned user list; Send the banned user list to all proxy server nodes, and merge the user traffic sampling information of the observed user list reported by each proxy server node to obtain a hash table with user ID as the keyword and user traffic sampling information as the value; Traversing the hash table to identify whether the user is in the current observed user list, and determining whether the user should be maintained in the observed user list, added to the observed user list, removed from the observed user list, or banned according to the identification result, so as to obtain the latest observed user list and the latest banned user list; The latest observed user list and the latest banned user list are sent to all proxy server nodes, so that each proxy server node will take effect the ban action according to the latest banned user list, and store the latest observed user list in the local storage to wait for reporting again.

2. A method for controlling the access frequency of distributed network users according to claim 1, characterized in that: The step of traversing the hash table, identifying whether the user is in the current observed user list, and determining whether the user should be maintained in the observed user list, added to the observed user list, removed from the observed user list, or banned according to the identification result includes: If the user is not in the current list of observed users, the user's access frequency is calculated according to the following formula: : = sum(c) / avg(k) Where c is the number of visits by the user, k is the reporting time interval of the proxy server node, sum() means sum, and avg() means average; Then calculate the access frequency threshold according to the following formula: _threshold: _threshold = P / Q Wherein, P represents the maximum value of the number of user accesses within the specified time in the set blocking policy; Q represents the specified time in the set blocking policy; If the user's access frequency Greater than or equal to the access frequency threshold _threshold, and k is greater than or equal to Q, the user is directly included in the banned user list; if the user's access frequency Greater than or equal to the access frequency threshold The product of _threshold and coefficient a, and coefficient a is less than 1, then the user is added to the rule of the observed user list, and the total number of previous visits of the user sum(c) and the average value avg(k) of the proxy server node reporting period are cached.

3. A method for controlling the access frequency of distributed network users according to claim 2, characterized in that: The step of traversing the hash table to identify whether the user is in the current observed user list, and judging whether the user should be maintained in the observed user list, added to the observed user list, removed from the observed user list, or banned according to the identification result also includes: If the user is in the current list of observed users, the user's access frequency is calculated according to the following formula: : = (sum(c)+c_cache) / avg(k) + k_cache Where c is the number of visits by the user, k is the reporting time interval of the proxy server node, sum() represents summing, avg() represents averaging, c_cache represents the total number of visits by the user in the current cache, and k_cache represents the average of the reporting time intervals of the proxy server nodes in the current cache; Then calculate the access frequency threshold according to the following formula: _threshold: _threshold = P / Q Wherein, P represents the maximum value of the number of user accesses within the specified time in the set blocking policy; Q represents the specified time in the set blocking policy; like >= _threshold, and k is greater than or equal to Q, the user is directly included in the banned user list; if the user's access frequency Greater than or equal to the access frequency threshold The product of _threshold and coefficient a, coefficient a is less than 1, and k is less than Q, then the user is maintained in the list of observed users; if Less than _threshold, and k is greater than or equal to Q, the user is removed from the list of observed users.

4. A method for controlling the access frequency of distributed network users according to claim 3, characterized in that: Also includes: If a user is included in the observed user list in two consecutive rounds of threat information reporting and has not been banned, the threat level of the user is determined. If the threat level of the user is greater than the threat level threshold, the user is directly included in the banned user list.

5. A method for controlling the access frequency of distributed network users according to claim 4, characterized in that: If the user is included in the list of observed users in two consecutive rounds of threat information reporting and is not banned, the step of determining the threat level of the user includes: Obtaining geographic location information and timestamp information of multiple visits by the user, calculating the path distance of multiple geographic location coordinate points, and calculating the average moving speed of the user according to the path distance and timestamp information. If the average moving speed of the user is greater than a speed threshold, the product of the average moving speed of the user and a preset first weight coefficient is used as the first threat level of the user; The Euclidean distance between any two geographic coordinate points visited by a user is calculated according to the following formula: in, Represents the geographic coordinate point The actual geographical distance Represents the geographic location coordinate point The actual geographical distance Represents the geographic location coordinate point The access time, Represents the geographic coordinate point The time of visit; According to the Euclidean distance between the geographic location coordinate points visited by any two users, cluster the geographic location coordinate points that are closer to each other, divide the geographic location coordinate points visited by the users into multiple clusters, and set a maximum number of members for each cluster. Whenever a new geographic location coordinate point is added, recalculate the cluster division; calculate the threat level of all users in the cluster according to the calculation method of the first threat level, divide the calculated threat level of all users in the cluster by the number of users in the cluster to obtain the average threat level of the cluster, and use the average threat level of the cluster as the second threat level of the user; Calculate the user's third threat level according to the following formula : in, is the preset second weight coefficient, The time difference for the user agent to change. () indicates the distance between two user agents. Indicates two adjacent user agents. represents the sum of all distances between user agents; The sum of the first threat level, the second threat level and the third threat level is taken as the final threat level. If the final threat level is greater than the threat level threshold, the user is directly included in the banned user list.

6. A method for controlling the access frequency of distributed network users according to claim 1, characterized in that: The reporting time interval k of each proxy server node is determined according to a preset maximum reporting period, a preset minimum reporting period, the node load, and the node CPU processing speed.

7. A method for controlling the access frequency of distributed network users according to claim 1, characterized in that: Also includes: If more than a first predetermined proportion of users in the threat information reported by each proxy server node are banned, the validity of the information reported by the proxy server node is increased; If less than a second predetermined proportion of users in the threat information reported by each proxy server node are banned, the validity of the information reported by the proxy server node is lowered; The validity of the information reported by the proxy server node is used to determine the proportion of the threat information reported by the proxy server node each time to the total threat information in the reporting period.

8. A distributed network user access frequency control device, used for a controller node, characterized in that include: A receiving module, configured to receive threat information reported by each proxy server node in the network, wherein the threat information includes user traffic sampling information of a non-observed user list, user traffic sampling information of an observed user list, and a banned user list; A hash table generation module is used to send the banned user list to all proxy server nodes, and merge the user flow sampling information of the observed user list reported by each proxy server node to obtain a hash table with user ID as the keyword and user flow sampling information as the value; A user list generation module, used to traverse the hash table, identify whether the user is in the current observed user list, and determine whether the user should be maintained in the observed user list, added to the observed user list, removed from the observed user list, or banned according to the identification result, so as to obtain the latest observed user list and the latest banned user list; The data sending module is used to send the latest observed user list and the latest banned user list to all proxy server nodes, so that each proxy server node will take effect the ban action according to the latest banned user list, and store the latest observed user list in the local storage to wait for re-reporting.

9. A device for controlling the access frequency of distributed network users according to claim 8, characterized in that: The user list generation module is also used for: If the user is not in the current list of observed users, the user's access frequency is calculated according to the following formula: : = sum(c) / avg(k) Where c is the number of visits by the user, k is the reporting time interval of the proxy server node, sum() means sum, and avg() means average; Then calculate the access frequency threshold according to the following formula: _threshold: _threshold = P / Q Wherein, P represents the maximum value of the number of user accesses within the specified time in the set blocking policy; Q represents the specified time in the set blocking policy; If the user's access frequency Greater than or equal to the access frequency threshold _threshold, and k is greater than or equal to Q, the user is directly included in the banned user list; if the user's access frequency Greater than or equal to the access frequency threshold The product of _threshold and coefficient a, and coefficient a is less than 1, then the user is added to the rule of the observed user list, and the total number of previous visits of the user sum(c) and the average value avg(k) of the proxy server node reporting period are cached.

10. A device for controlling the access frequency of distributed network users according to claim 9, characterized in that: The user list generation module is also used for: If the user is in the current list of observed users, the user's access frequency is calculated according to the following formula: : = (sum(c)+c_cache) / avg(k) + k_cache Where c is the number of visits by the user, k is the reporting time interval of the proxy server node, sum() represents summing, avg() represents averaging, c_cache represents the total number of visits by the user in the current cache, and k_cache represents the average of the reporting time intervals of the proxy server nodes in the current cache; Then calculate the access frequency threshold according to the following formula: _threshold: _threshold = P / Q Wherein, P represents the maximum value of the number of user accesses within the specified time in the set blocking policy; Q represents the specified time in the set blocking policy; like >= _threshold, and k is greater than or equal to Q, the user is directly included in the banned user list; if the user's access frequency Greater than or equal to the access frequency threshold The product of _threshold and coefficient a, coefficient a is less than 1, and k is less than Q, then the user is maintained in the list of observed users; if Less than _threshold, and k is greater than or equal to Q, the user is removed from the list of observed users.

Images