Anti-hotlinking processing method and device based on routing link

Abstract

The invention discloses an anti-theft link processing method and device based on a routing link, and the method comprises the steps: extracting a source IP and a user ID from an HTTP request when the HTTP request of a user is received, carrying out the routing detection of the source IP through a routing detection algorithm, obtaining a node path, and determining the node path as the routing link; wherein the node path is a node path from the server to the source IP, if the user ID is not accessed for the first time and the user IP corresponding to the user ID is monitored to be changed, judging whether the routing change range of the routing link is reasonable or not through a preset hotlinking identification rule to obtain an identification result, and if the identification result shows that the routing change range of the routing link is unreasonable, judging whether the routing change range of the routing link is not reasonable or not. And link theft prevention processing is carried out on the routing link, and the identification result of the unreasonable routing change range of the routing link is determined according to the identification result of the preset hard identification condition, the identification result of the confidence coefficient verification and the identification result of the model identification in sequence.

Description

Technical Field

[0001] The present application relates to the technical field of anti-hotlink processing, and more specifically, to an anti-hotlink processing method and device based on routing links. Background Art

[0002] Hotlinking is a problem that video manufacturers have encountered for a long time. The main form of hotlinking is to use a legitimate user account to pass the video manufacturer's authentication, cache the authentication result (such as the video scheduling string), and illegally distribute the cached authentication result. Other people who obtain the illegally distributed authentication result can request data from the video manufacturer's server. As a result, a large amount of bandwidth of the video manufacturer is used to serve illegal requests, resulting in cost increases and profit losses.

[0003] Existing anti-hotlink technologies usually include IP authentication to achieve anti-hotlink, and anti-hotlink by collecting user ID information. IP authentication to achieve anti-hotlink is to bind the IP one-to-one with the corresponding authentication string. If you change the IP, it will not be usable. Due to the changeable IP environment of the user, the change of IP when the mobile terminal switches the network will cause the authentication to be unavailable. This type of anti-hotlink technology has low flexibility. Anti-hotlink by collecting user ID information means that the user is allowed to use it first, and the information of the same user ID is collected during use. After the problem is found through statistics, the server is notified to terminate the service. The disadvantage is that the bandwidth loss in the early stage of hotlinking is large, and hotlinking can also be carried out by changing accounts. The reliability of this type of anti-hotlink technology is low.

[0004] Therefore, how to improve the flexibility and reliability of the anti-hotlinking process is a problem that needs to be solved urgently in this application. Summary of the invention

[0005] In view of this, the present application discloses a method and device for anti-hotlink processing based on routing links. Even when the user switches to a daily network environment that changes, this solution can perform anti-hotlink processing on routing links corresponding to an unreasonable routing link change range, thereby improving the flexibility and reliability of the anti-hotlink process.

[0006] In order to achieve the above purpose, the disclosed technical solution is as follows:

[0007] The first aspect of the present application discloses a method for anti-hotlink processing based on a routing link, the method comprising:

[0008] When receiving a user's HTTP request, extracting a source IP and a user ID from the HTTP request;

[0009] Performing route detection on the source IP through a route detection algorithm to obtain a node path, and determining the node path as a routing link; wherein the node path is a node path from the server to the source IP;

[0010] If the user ID is not the first visit, and the user IP corresponding to the user ID is monitored to have a change, the preset hotlink identification rule is used to determine whether the route change range of the routing link is reasonable, and obtain an identification result;

[0011] If the identification result indicates that the route change range of the routing link is unreasonable, anti-hotlink processing is performed on the routing link; wherein the identification result of the unreasonable route change range of the routing link is determined in turn according to the identification result of the preset hard identification condition, the identification result of the confidence check and the identification result of the model identification.

[0012] Preferably, performing route detection on the source IP by using a route detection algorithm to obtain a route link includes:

[0013] Setting different distribution lifetimes through the Internet Control Message Protocol and reporting mechanism;

[0014] Determine the source IP as a detection target;

[0015] Performing route detection on the detection target according to the different distribution survival times to obtain the target survival time and its IP datagram; wherein the target survival time is a target survival time greater than a preset threshold;

[0016] A node path is obtained according to the target lifetime and its IP datagram, and the node path is determined as a routing link.

[0017] Preferably, if the user ID is not the first visit and a change in the user IP corresponding to the user ID is detected, a preset hotlink identification rule is used to determine whether the route change range of the routing link is reasonable, and an identification result is obtained, including:

[0018] If the user ID is not the first visit and a change in the user IP corresponding to the user ID is detected, a preset hard identification indicator is obtained; wherein the prefabricated hard identification indicator at least includes the number of user IP addresses corresponding to the routing link, the user IP address corresponding to the routing link, the IP change range of the routing link, and the operator range;

[0019] If the number of user IP addresses corresponding to the routing link is greater than the preset number, or the user IP address corresponding to the routing link belongs to the link adjustment blacklist, an identification result that the routing change range of the routing link is unreasonable is obtained;

[0020] If the number of user IP addresses corresponding to the routing link is less than or equal to the preset number, and the user IP address corresponding to the routing link does not belong to the link adjustment blacklist, then obtain the range of the routing link; wherein the range of the routing link at least includes the IP change range and the operator range of the routing link;

[0021] If the IP change range of the routing link does not fall within the preset IP change range, or the operator range does not fall within the preset operator range, an identification result that the routing change range of the routing link is unreasonable is obtained;

[0022] If the IP change range of the routing link falls within the preset IP change range, and the operator range falls within the preset operator range, obtaining a confidence verification index of the routing link; wherein the confidence verification index includes at least an IP frequency modulation frequency and a request volume frequency;

[0023] If the IP frequency modulation frequency or the request amount frequency does not conform to the normal distribution, an identification result that the route change range of the routing link is unreasonable is obtained;

[0024] If the IP frequency modulation frequency and the request volume frequency both conform to normal distribution, the routing links are identified by using a classification model through a pre-trained routing chain table to obtain a difference value corresponding to the routing link; the difference value at least includes a regional jump difference and an IP segment logic difference value between the links;

[0025] If the regional jump difference value between the links is greater than the preset regional jump difference comparison value, or the IP segment logic difference value is greater than the preset IP segment logic difference comparison value, an identification result that the route change range of the routing link is unreasonable is obtained;

[0026] If the regional jump difference value between the links is less than or equal to the preset regional jump difference comparison value, and the IP segment logic difference value is less than or equal to the preset IP segment logic difference comparison value, a reasonable identification result of the routing change range of the routing link is obtained.

[0027] Preferably, the process of training the routing chain table using the classification model includes:

[0028] For multiple routing links, obtain IP addresses of the routing links;

[0029] Converting different address segments of the IP address of the routing link into a four-dimensional space;

[0030] In the four-dimensional space, all IP nodes are determined as points in each four-dimensional space;

[0031] Connect the points in each four-dimensional space to obtain a curve;

[0032] Processing the curve through a linear regression model to obtain a straight line, and returning to execute the step of converting different address segments of the IP address of the routing link into a four-dimensional space until straight lines corresponding to multiple routing links are obtained;

[0033] Compare the cosines of the straight lines corresponding to the multiple routing links to obtain a first cosine similarity;

[0034] The shapes of routing links of different lengths are compared by dynamic time warping to obtain the second cosine similarity;

[0035] Obtaining each geographical location corresponding to the IP addresses of the multiple routing links;

[0036] Converting each geographical location corresponding to the IP address of the routing link into each geographical coordinate;

[0037] Calculating the straight line cosines of the plurality of routing links at their geographical locations according to the respective geographical coordinates;

[0038] Compare the cosines of each line to obtain the third cosine similarity;

[0039] Inputting the first cosine similarity, the second cosine similarity and the third cosine similarity into a random forest as training features;

[0040] The routing link table is trained using a classification model through the training features and hotlink training identifiers; wherein the hotlink training identifier is a training identifier indicating that the routing change range of the routing link is unreasonable.

[0041] Preferably, it also includes:

[0042] If the identification result indicates that the route change range of the routing link is reasonable, the routing link corresponding to the identification result is stored in the database for service.

[0043] Preferably, it also includes:

[0044] If the user ID is accessing for the first time or is accessing for the first time within a preset time period, the user corresponding to the user ID is provided with services.

[0045] The second aspect of the present application discloses an anti-hotlink processing device based on a routing link, and the method includes:

[0046] An extraction unit, configured to extract a source IP and a user ID from a user's HTTP request when receiving the HTTP request;

[0047] A routing detection unit, used to perform routing detection on the source IP through a routing detection algorithm to obtain a node path, and determine the node path as a routing link; wherein the node path is a node path from the server to the source IP;

[0048] A judgment unit, configured to, if the user ID is not accessing for the first time and a change in the user IP corresponding to the user ID is detected, judge whether the route change range of the routing link is reasonable by using a preset hotlink identification rule to obtain an identification result;

[0049] The anti-hotlink processing unit is used to perform anti-hotlink processing on the routing link if the recognition result indicates that the route change range of the routing link is unreasonable; wherein the recognition result of the unreasonable route change range of the routing link is determined in turn according to the recognition result of the preset hard recognition condition, the recognition result of the confidence check and the recognition result of the model recognition.

[0050] Preferably, the routing detection unit includes:

[0051] A setting module, used for setting different distribution survival times through an Internet control message protocol and a reporting mechanism;

[0052] A first determination module, used to determine the source IP as a detection target;

[0053] A routing detection module, used for performing routing detection on the detection target according to the different distribution survival times, and obtaining the target survival time and its IP datagram; wherein the target survival time is a target survival time greater than a preset threshold;

[0054] The second determination module is used to obtain a node path according to the target lifetime and its IP datagram, and determine the node path as a routing link.

[0055] Preferably, the judging unit comprises:

[0056] A first acquisition module is used to acquire a preset hard identification indicator if the user ID is not accessed for the first time and a change in the user IP corresponding to the user ID is detected; wherein the prefabricated hard identification indicator at least includes the number of user IP addresses corresponding to the routing link, the user IP address corresponding to the routing link, the IP change range of the routing link, and the operator range;

[0057] A second acquisition module is used to obtain an identification result that the route change range of the routing link is unreasonable if the number of user IP addresses corresponding to the routing link is greater than a preset number, or the user IP address corresponding to the routing link belongs to the link adjustment blacklist;

[0058] A third acquisition module is used to acquire a range of the routing link if the number of user IP addresses corresponding to the routing link is less than or equal to a preset number and the user IP address corresponding to the routing link does not belong to the link adjustment blacklist; wherein the range of the routing link at least includes an IP change range and an operator range of the routing link;

[0059] A fourth acquisition module, configured to obtain an identification result that the route change range of the routing link is unreasonable if the IP change range of the routing link does not fall within the preset IP change range, or the operator range does not fall within the preset operator range;

[0060] A fifth acquisition module, used for acquiring a confidence verification index of the routing link if the IP change range of the routing link belongs to the preset IP change range and the operator range belongs to the preset operator range; wherein the confidence verification index at least includes the IP frequency modulation frequency and the request volume frequency;

[0061] A sixth acquisition module, configured to obtain an identification result that a route change range of a routing link is unreasonable if the IP frequency modulation frequency or the request amount frequency does not conform to a normal distribution;

[0062] A seventh acquisition module is used to identify the difference of the routing links by using a classification model through a pre-trained routing chain table if the IP frequency modulation frequency and the request frequency both conform to the normal distribution, and obtain the difference value corresponding to the routing link; the difference value at least includes the regional jump difference between the links and the IP segment logic difference value;

[0063] An eighth acquisition module, configured to obtain an identification result that the route change range of the routing link is unreasonable if the regional jump difference value between the links is greater than a preset regional jump difference comparison value, or the IP segment logic difference value is greater than a preset IP segment logic difference comparison value;

[0064] The ninth acquisition module is used to obtain a reasonable identification result of the routing change range of the routing link if the regional jump difference value between the links is less than or equal to the preset regional jump difference comparison value, and the IP segment logic difference value is less than or equal to the preset IP segment logic difference comparison value.

[0065] Preferably, the seventh acquisition module of the classification model is used to train the routing chain table, including:

[0066] A first acquisition submodule, used for acquiring IP addresses of multiple routing links;

[0067] A first conversion submodule, used for converting different address segments of the IP address of the routing link into a four-dimensional space;

[0068] A determination submodule is used to determine all IP nodes as points in the four-dimensional space in the four-dimensional space;

[0069] A connection submodule is used to connect the points in each four-dimensional space to obtain a curve;

[0070] A processing submodule, used for processing the curve by a linear regression model to obtain a straight line, and returning to execute the step of converting different address segments of the IP address of the routing link into a four-dimensional space until straight lines corresponding to a plurality of routing links are obtained;

[0071] A first comparison submodule, used to compare the cosines between the straight lines corresponding to the plurality of routing links to obtain a first cosine similarity;

[0072] A second comparison submodule is used to compare the shapes of routing links of different lengths through dynamic time warping to obtain a second cosine similarity;

[0073] A second acquisition submodule is used to obtain each geographical location corresponding to the IP addresses of the multiple routing links;

[0074] A second conversion submodule, used to convert each geographical location corresponding to the IP address of the routing link into each geographical coordinate;

[0075] A calculation submodule, used for calculating the straight line cosines of the plurality of routing links at their geographical locations according to the respective geographical coordinates;

[0076] A third comparison submodule is used to compare the cosines of each line to obtain a third cosine similarity;

[0077] An input submodule, used for inputting the first cosine similarity, the second cosine similarity and the third cosine similarity into a random forest as training features;

[0078] The training submodule is used to train the routing link table using a classification model through the training features and hotlink training identifier; wherein the hotlink training identifier is a training identifier that the routing change range of the routing link is unreasonable.

[0079] It can be known from the above technical scheme that the present application discloses a method and device for anti-hotlink processing based on routing link. When a user's HTTP request is received, the source IP and user ID are extracted from the HTTP request, and the routing detection algorithm is used to perform routing detection on the source IP to obtain a node path, and the node path is determined as a routing link; wherein, the node path is a node path from a server to a source IP. If the user ID is not a first visit, and it is detected that the user IP corresponding to the user ID has changed, the preset hotlink identification rule is used to determine whether the routing change range of the routing link is reasonable, and an identification result is obtained. If the identification result indicates that the routing change range of the routing link is unreasonable, the routing link is subjected to anti-hotlink processing, wherein the identification result that the routing change range of the routing link is unreasonable is determined in turn according to the identification result of the preset hard identification condition, the identification result of the confidence check, and the identification result of the model identification.

[0080] Through the above scheme, the source IP extracted from the HTTP request is routed for detection to obtain the routing link, and the preset hotlink identification rules are used to determine whether the routing change range of the routing link is reasonable, and the routing link corresponding to the unreasonable routing link change range is processed for anti-hotlinking. That is, starting from the routing layer, it does not rely on the high-level protocol to determine the hotlink, and it will not bind the user's IP for anti-hotlinking processing. Therefore, even under the condition that the user switches to the daily network environment, this scheme can still perform anti-hotlinking processing on the routing link corresponding to the unreasonable routing link change range, thereby improving the flexibility and reliability of the anti-hotlinking process. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0082] Figure 1 A schematic diagram of a flow chart of an anti-hotlink processing method based on a routing link disclosed in an embodiment of the present application;

[0083] Figure 2 This is an example diagram of the routing link detection disclosed in the embodiments of the present application;

[0084] Figure 3 A schematic diagram of hijacking authentication hotlinking disclosed in an embodiment of the present application;

[0085] Figure 4 A flowchart of another anti-hotlink processing method based on routing links disclosed in an embodiment of the present application;

[0086] Figure 5 A schematic diagram of the structure of an anti-hotlink processing device based on a routing link disclosed in an embodiment of the present application;

[0087] Figure 6 This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0088] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0089] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0090] As can be seen from the background technology, the existing anti-hotlink technology usually includes IP authentication to achieve anti-hotlink, and anti-hotlink by collecting user ID information. Authentication of IP to achieve anti-hotlink is to bind IP one-to-one with the corresponding authentication string, and it cannot be used if another IP is changed. Due to the changeable IP environment of the user, the change of IP when the mobile terminal switches the network will cause the authentication to be unavailable, and the flexibility of this type of anti-hotlink technology is low. Anti-hotlink by collecting user ID information is to allow the user to use it first, collect the information of the same user ID during use, and notify the server to terminate the service after statistically discovering problems. The disadvantage is that the bandwidth loss in the early stage of hotlinking is large, and hotlinking can also be carried out by changing accounts. The reliability of this type of anti-hotlink technology is low. Therefore, how to improve the flexibility and reliability in the anti-hotlink process is a problem that the present application urgently needs to solve.

[0091] In order to solve the above problems, the present application discloses a method and device for anti-hotlink processing based on routing links, which performs routing detection on the source IP extracted from the HTTP request to obtain the routing link, determines whether the routing change range of the routing link is reasonable through the preset hotlink identification rules, and performs anti-hotlink processing on the routing link corresponding to the unreasonable routing link change range. This solution starts from the routing layer, does not rely on the high-level protocol to judge hotlinks, and does not bind the user's IP to perform anti-hotlink processing. Therefore, even under the condition that the user switches to the daily network environment, this solution can perform anti-hotlink processing on the routing link corresponding to the unreasonable routing link change range, thereby improving the flexibility and reliability of the anti-hotlink process. The specific implementation method is specifically described through the following embodiments.

[0092] refer to Figure 1 As shown, an anti-hotlink processing method based on a routing link disclosed in an embodiment of the present application is applied to a server, and the anti-hotlink processing method based on a routing link mainly includes the following steps:

[0093] S101: When a Hypertext Transfer Protocol (HTTP) request from a user is received, a source IP and a user ID are extracted from the HTTP request.

[0094] Among them, the source IP, that is, the source IP address, refers to the source address of the data packet, that is, the IP address of the device that sends the data packet.

[0095] S102: Perform route detection on the source IP through a route detection algorithm to obtain a node path, and determine the node path as a route link; wherein the node path is a node path from the server to the source IP.

[0096] It should be noted that the routing link may change, and multiple detections are required. If there are different results, that is, multiple routing links, all of the multiple links are processed through S103.

[0097] Specifically, the process of performing route detection on the source IP through the route detection algorithm and obtaining the route link is shown in A1-A4.

[0098] A1: Set different distribution time to live (TTL) through the Internet Control Message Protocol (ICMP) and the reporting mechanism.

[0099] A2: Identify the source IP address as the detection target.

[0100] A3: Perform route detection on the detection target according to different TTLs to obtain the target lifetime and its IP datagram; wherein the target lifetime is a target lifetime greater than a preset threshold.

[0101] Among them, the preset threshold is set according to the actual situation and this application does not make any specific limitation.

[0102] In the process of performing route detection on the detection target according to different TTLs, only by sending an IP datagram with a TTL value large enough (that is, the target lifetime greater than the preset threshold) can the IP datagram reach the destination host and obtain an ICMP port unreachable error message, finally forming a routing link to the target address.

[0103] It should be noted that IP datagram is the basic unit of network transmission. Each IP datagram has a TTL field, which is an 8-bit integer indicating the maximum number of hops that the IP datagram can go through in the network.

[0104] A4: According to the target lifetime and its IP datagram, the node path is obtained and the node path is determined as the routing link.

[0105] Specifically get the routing link combination Figure 2 Provide explanation. Figure 2 A schematic diagram of routing link detection is shown.

[0106] like Figure 2 According to different TTL1, TTL2, TTL3, and TTL4, the detection target is routed and the target survival time and its IP datagram are obtained.

[0107] Figure 2 In the example, the source IP obtained in S101 is used as the detection target to construct Internet Control Message Protocol (ICMP) routing detection. The ICMP routing detection mechanism is based on the error detection and reporting mechanism of ICMP, and different step-by-step survival time TTLs are set, such as Figure 2 The TTL1, TTL2, TTL3, and TTL4 in the protocol are used to detect the route, and finally a node path is formed from the server itself to the detection target (ie, the source IP).

[0108] Specifically, every time an IP datagram passes through a router, the TTL field is reduced by one until it reaches zero. At this point, the router will discard the IP datagram and send an ICMP timeout error message to the source host. First, it sends an IP datagram with a TTL of 1 (i.e., TTL1). The IP datagram will be discarded by the first router and an ICMP timeout error message will be returned. Then, it sends an IP datagram with a TTL of 2 (i.e., TTL 2). The IP datagram will be discarded by the second router and an ICMP timeout error message will be returned. And so on, until an IP datagram with a TTL value large enough (i.e., greater than the target lifetime of the preset threshold) is sent, the IP datagram can reach the destination host and receive an ICMP port unreachable error message. Finally, a routing link to the target address is formed.

[0109] S103: If the user ID is not the first visit and the user IP corresponding to the user ID is monitored to have a change, a preset hotlink identification rule is used to determine whether the route change range of the routing link is reasonable, and an identification result is obtained.

[0110] In S103, if the user ID is not the first request, it is determined whether the IP corresponding to the user ID has changed, and if not, it is directly served. If the IP corresponding to the user ID has changed, the changed new IP and the detection routing link are transmitted to the hotlink identification module, and the preset hotlink identification rules in the hotlink identification module are used to determine whether the route change range of the routing link is reasonable.

[0111] The preset hotlink identification rules include three levels: the first level is preset rule identification, the second level is statistical identification, and the third level is model identification.

[0112] The first layer of preset rule judgment can set some hard identification conditions, such as each user can only have 10 IP addresses, link jump blacklist, and other hard identification indicators. If it meets the hotlink rule (such as each user has 11 IP addresses, the user is in the blacklist of link jump, the IP change range does not belong to the preset IP change range, etc., it means that it meets the hotlink rule), it will be identified as hotlink. If it is not identified as hotlink, it will enter the second layer of statistical judgment. The statistical judgment will make basic judgments based on the region to which the IP address belongs, the operator, and the stability of the link. For example, the user's IP was in Beijing in the last second, but it became Shanghai in the next second, and Chongqing in the next second. This may be hotlink. If it passes the second layer of statistical judgment, that is, it is not identified as hotlink by the second layer of statistical judgment, it can enter the third layer of model recognition. Model recognition uses historical routing links to train and generate a random forest classification model (that is, the routing chain table uses the classification model), and uses the routing chain table to use the classification model to identify the newly input routing links.

[0113] In order to facilitate the understanding of hotlinking, combined Figure 3 Provide explanation. Figure 3 A schematic diagram of hijacking authentication and hotlinking is shown.

[0114] Figure 3 The left side of the figure is the normal request process, and the right side is the hotlink request process.

[0115] In the normal request process, a legitimate account sends an authentication request to the authentication server to obtain the play string, and accesses the content server through the play string and the player. In the hotlink request process, a legitimate account sends an authentication request to the authentication server to obtain the play string, and the illegal requester illegally obtains the play string from the legitimate account, and initiates an illegal request to the content server through the illegally obtained play string.

[0116] The process of training the routing list using the classification model is as follows:

[0117] The routing link set is selected based on the user ID, and the routing link set is simplified according to the node IP sequence, IP region / operator, and IP segment. For example, a routing link is from Beijing-Guangzhou-Guangzhou-Hong Kong-Singapore, which can be simplified to Beijing-Guangzhou-Hong Kong-Singapore. Similarly, the IP segment can also be simplified for the same subnet segment. The link set of the same user is calculated for pairwise differences (regional jump differences between links, IP segment logical differences, differences in various straight line cosines, etc.), and the difference value with the largest difference, source IP, destination IP, various straight line cosines of multiple routing links in their geographical locations, hotlink training identifiers, etc. are selected as the features of the training data. The model is trained based on the features of the training data, and the resulting model is the third-layer routing link table classification model.

[0118] If the user ID is visiting for the first time or is visiting for the first time within a preset time period, the user corresponding to the user ID will be provided with services.

[0119] It should be noted that if the user ID is the first request within a time period (which can be set according to needs, such as 24 hours), the IP corresponding to the user ID and the routing links (there may be multiple) detected by the IP will be directly entered into the local file or database in the order of the links.

[0120] The link sequence is the sequence in which the IPs obtained by detection are formed.

[0121] The specific process of obtaining the recognition result is shown in B1-B9.

[0122] B1: If the user ID is not the first visit and a change is detected in the user IP corresponding to the user ID, a preset hard identification indicator is obtained; wherein the preset hard identification indicator includes at least the number of user IP addresses corresponding to the routing link, the user IP address corresponding to the routing link, the IP change range of the routing link and the operator range.

[0123] B2: If the number of user IP addresses corresponding to the routing link is greater than the preset number, or the user IP address corresponding to the routing link belongs to the link adjustment blacklist, an identification result that the routing change range of the routing link is unreasonable is obtained.

[0124] Among them, the preset number can be 9, 10, etc. The preset number is set according to actual conditions and this application does not make any specific limitations.

[0125] The link adjustment blacklist stores illegal user IPs that have been determined to be hotlinking. If the user IP address corresponding to the routing link is consistent with the IP address in the link adjustment blacklist, the user IP address corresponding to the routing link is determined to be an illegal user IP of hotlinking.

[0126] B3: If the number of user IP addresses corresponding to the routing link is less than or equal to the preset number, and the user IP address corresponding to the routing link does not belong to the link adjustment blacklist, then obtain the range of the routing link; wherein the range of the routing link at least includes the IP change range and operator range of the routing link.

[0127] B4: If the IP change range of the routing link does not fall within the preset IP change range, or the operator range does not fall within the preset operator range, an identification result that the routing change range of the routing link is unreasonable is obtained.

[0128] The preset IP change range and the preset operator range are used to distinguish whether the route change range of the routing link is reasonable. The preset IP change range and the preset operator range are set according to the actual situation, and this application does not make specific restrictions.

[0129] B5: If the IP change range of the routing link is within the preset IP change range, and the operator range is within the preset operator range, obtain the confidence verification index of the routing link; wherein the confidence verification index at least includes the IP frequency modulation frequency and the request volume frequency.

[0130] In B5, confidence verification is performed through the confidence verification index of the routing link. Confidence verification is to count the normal specified indicators such as the IP jump frequency within the time period and the request frequency within the time period. Because normal indicators conform to the normal distribution, the distribution parameters of the indicator can be known from the statistical results, and then the T test or other test methods are used to check whether it is in the confidence interval. If it is not in the confidence interval, further filtering is required.

[0131] B6: If the IP frequency modulation frequency or the request volume frequency does not conform to the normal distribution, the identification result that the routing change range of the routing link is unreasonable is obtained.

[0132] B7: If the IP frequency modulation frequency and the request volume frequency both conform to the normal distribution, the classification model is used through the pre-trained routing link list to identify the differences in the routing links and obtain the difference values ​​corresponding to the routing links; the difference values ​​at least include the regional jump differences between the links and the IP segment logic difference values.

[0133] The specific process of training the routing list using the classification model is shown in C1-C13.

[0134] C1: For multiple routing links, obtain the IP addresses of the routing links.

[0135] C2: Convert different address segments of the IP address of the routing link into four-dimensional space.

[0136] C3: In the four-dimensional space, all IP nodes are determined as points in each four-dimensional space.

[0137] C4: Connect the points in each four-dimensional space to obtain a curve.

[0138] C5: The curve is processed by a linear regression model to obtain a straight line, and the process returns to execute the step of converting different address segments of the IP address of the routing link into a four-dimensional space until straight lines corresponding to multiple routing links are obtained.

[0139] It should be noted that the IP cosine similarity judgment of routing links mainly includes three aspects: the first aspect is based on link angle judgment; the second aspect is shape comparison; and the third aspect is the cosine similarity judgment of geographical location.

[0140] C6: Compare the cosines of the straight lines corresponding to multiple routing links to obtain the first cosine similarity.

[0141] Among them, C6 is based on link angle judgment. It converts different address segments of IP addresses into four-dimensional space, regards each IP node as a point in four-dimensional space, and connects multiple nodes into a curve. A straight line can be obtained using a linear regression model. By comparing the cosines between different straight lines, there will be multiple cosines for multiple routing links.

[0142] C7: Use Dynamic Time Warping (DTW) to compare the shapes of routing links of different lengths and obtain the second cosine similarity.

[0143] Among them, C7 is shape comparison, which uses DTW dynamic time warping to compare the shapes of routing links of different lengths and give cosine similarity.

[0144] C8: Obtain the geographical locations corresponding to the IP addresses of multiple routing links.

[0145] C9: Convert each geographical location corresponding to the IP address of the routing link into each geographical coordinate.

[0146] C10: Based on the geographic coordinates, calculate the straight line cosines of multiple routing links at their geographic locations.

[0147] C11: Compare the cosines of each line to obtain the third cosine similarity.

[0148] C8-C11 is based on the cosine similarity judgment of geographic location. The geographic location corresponding to each IP is converted into geographic coordinates. The straight cosine of the routing link in the geographic location can be calculated based on the link coordinates. The cosine similarity is obtained by comparing the cosines of multiple links.

[0149] The above cosine similarity is input into the random forest as a feature, and whether it is hotlinked is used as a label to train the model.

[0150] C12: Input the first cosine similarity, the second cosine similarity, and the third cosine similarity into the random forest as training features.

[0151] C13: The classification model is used to train the routing link table through the training features and the hotlink training flag; wherein the hotlink training flag is a training flag indicating that the routing change range of the routing link is unreasonable.

[0152] B8: If the regional jump difference value between the links is greater than the preset regional jump difference comparison value, or the IP segment logic difference value is greater than the preset IP segment logic difference comparison value, an identification result is obtained that the routing change range of the routing link is unreasonable.

[0153] The preset IP segment logic difference comparison value is a comparison reference value used to determine whether the IP segment logic difference value is reasonable. The preset IP segment logic difference comparison value is set according to actual conditions, and this application does not make specific restrictions.

[0154] B9: If the regional jump difference value between the links is less than or equal to the preset regional jump difference comparison value, and the IP segment logic difference value is less than or equal to the preset IP segment logic difference comparison value, a reasonable identification result of the routing change range of the routing link is obtained.

[0155] S104: If the recognition result indicates that the route change range of the routing link is unreasonable, anti-hotlink processing is performed on the routing link; wherein the recognition result of the unreasonable route change range of the routing link is determined in turn according to the recognition result of the preset hard recognition condition, the recognition result of the confidence check and the recognition result of the model recognition.

[0156] If the identification result indicates that the route change range of the routing link is reasonable, the routing link and the corresponding IP corresponding to the identification result are stored in the database for service.

[0157] In order to facilitate the understanding of the anti-hotlink processing process based on routing links, combined with Figure 4 Give an example. Figure 4 A flow chart of another anti-hotlink processing method based on routing links is shown.

[0158] S401: receiving a user HTTP request;

[0159] S402: constructing a routing detection (such as reverse detection) according to the HTTP request, and obtaining a routing link; specifically, performing routing detection on the source IP extracted from the HTTP request through a routing detection algorithm, obtaining a node path, and determining the node path as a routing link;

[0160] S403: Determine whether the user ID extracted by the HTTP request is the first entry, that is, the first visit, if not, execute S404, if yes, execute S406;

[0161] S404: Identify the route change range of the routing link by using a preset hotlink identification rule to obtain an identification result;

[0162] S405: Determine whether the route change range of the route link of the identification result is reasonable; if reasonable, execute S406; if unreasonable, execute S408;

[0163] S406: storing the routing link corresponding to the reasonable identification result of the routing change range of the routing link in the database;

[0164] S407: Provide service to the user IP corresponding to the routing link in the database;

[0165] S408: Perform anti-hotlink processing on the routing link corresponding to the identification result that the routing change range of the routing link is unreasonable.

[0166] This solution uses the client's request routing link as the basis for client identity identification to determine the possibility that the request is an illegal request. Using routing links to prevent hotlinking has the following benefits:

[0167] (1) It does not rely on advanced protocols and is compatible with applications (APP) and browsers;

[0168] (2) The network jump of the same device is essentially a jump at the IP routing layer. This jump follows a certain pattern and can be inferred to be legal if it conforms to the pattern. This is unlike the situation where one authentication is used and a large number of hotlinks are used;

[0169] (3) When the same account is used on multiple devices, or changes in screen projection conditions can also be fed back through the routing table, because screen projection generally requires the use of the same wireless network communication technology (WIFI) environment. At this time, changes in the routing table for external access will be within a controllable range.

[0170] The beneficial effects of the embodiments of the present application are as follows: routing detection is performed on the source IP extracted from the HTTP request to obtain a routing link, and whether the routing change range of the routing link is reasonable is judged by a preset hotlink identification rule, and anti-hotlink processing is performed on the routing link corresponding to the unreasonable routing link change range. This solution starts from the routing layer and does not rely on the high-level protocol to judge hotlinks. At the same time, it will not bind the user's IP to perform anti-hotlink processing. Therefore, even under the condition that the user switches to a daily network environment change, this solution can perform anti-hotlink processing on the routing link corresponding to the unreasonable routing link change range, thereby improving the flexibility and reliability of the anti-hotlink process.

[0171] Based on the above embodiments Figure 1 A method for processing anti-hotlink based on a routing link is disclosed. The embodiment of the present application also discloses an anti-hotlink processing device based on a routing link. Figure 5 As shown, the anti-hotlink processing device based on the routing link includes:

[0172] The extraction unit 501 is used to extract the source IP and user ID from the HTTP request when receiving the HTTP request from the user;

[0173] The routing detection unit 502 is used to perform routing detection on the source IP through a routing detection algorithm to obtain a node path, and determine the node path as a routing link; wherein the node path is a node path from the server to the source IP;

[0174] The judgment unit 503 is used to judge whether the route change range of the routing link is reasonable by using a preset hotlink identification rule if the user ID is not accessing for the first time and a change in the user IP corresponding to the user ID is detected, and obtain an identification result;

[0175] The anti-hotlink processing unit 504 is used to perform anti-hotlink processing on the routing link if the recognition result indicates that the route change range of the routing link is unreasonable; wherein the recognition result of the unreasonable route change range of the routing link is determined in turn according to the recognition result of the preset hard recognition condition, the recognition result of the confidence check and the recognition result of the model recognition.

[0176] Furthermore, the route detection unit 502 includes:

[0177] A setting module, used for setting different distribution survival times through an Internet control message protocol and a reporting mechanism;

[0178] A first determination module, used to determine the source IP as a detection target;

[0179] A routing detection module is used to perform routing detection on a detection target according to different distribution survival times, and obtain a target survival time and an IP datagram thereof; wherein the target survival time is a target survival time greater than a preset threshold;

[0180] The second determination module is used to obtain a node path according to the target lifetime and its IP datagram, and determine the node path as a routing link.

[0181] Further, the judging unit 503 includes:

[0182] The first acquisition module is used to acquire a preset hard identification indicator if the user ID is not accessed for the first time and a change in the user IP corresponding to the user ID is detected; wherein the preset hard identification indicator at least includes the number of user IP addresses corresponding to the routing link, the user IP address corresponding to the routing link, the IP change range of the routing link, and the operator range;

[0183] A second acquisition module is used to obtain an identification result that the route change range of the routing link is unreasonable if the number of user IP addresses corresponding to the routing link is greater than a preset number, or the user IP address corresponding to the routing link belongs to the link adjustment blacklist;

[0184] A third acquisition module is used to acquire a range of the routing link if the number of user IP addresses corresponding to the routing link is less than or equal to a preset number and the user IP address corresponding to the routing link does not belong to the link adjustment blacklist; wherein the range of the routing link at least includes an IP change range and an operator range of the routing link;

[0185] A fourth acquisition module is used to obtain an identification result that the route change range of the routing link is unreasonable if the IP change range of the routing link does not fall within the preset IP change range, or the operator range does not fall within the preset operator range;

[0186] A fifth acquisition module is used to acquire a confidence verification index of the routing link if the IP change range of the routing link belongs to the preset IP change range and the operator range belongs to the preset operator range; wherein the confidence verification index includes at least the IP frequency modulation frequency and the request volume frequency;

[0187] A sixth acquisition module, used for obtaining an identification result that the route change range of the routing link is unreasonable if the IP frequency modulation frequency or the request amount frequency does not conform to the normal distribution;

[0188] The seventh acquisition module is used to identify the difference of the routing links by using the classification model through the pre-trained routing chain table if the IP frequency modulation frequency and the request frequency both conform to the normal distribution, and obtain the difference value corresponding to the routing link; the difference value at least includes the regional jump difference between the links and the IP segment logic difference value;

[0189] An eighth acquisition module, configured to obtain an identification result that the route change range of the routing link is unreasonable if the regional jump difference value between the links is greater than a preset regional jump difference comparison value, or the IP segment logic difference value is greater than a preset IP segment logic difference comparison value;

[0190] The ninth acquisition module is used to obtain a reasonable identification result of the routing change range of the routing link if the regional jump difference value between the links is less than or equal to the preset regional jump difference comparison value, and the IP segment logic difference value is less than or equal to the preset IP segment logic difference comparison value.

[0191] Further, the training routing list uses the seventh acquisition module of the classification model, including:

[0192] A first acquisition submodule is used to acquire IP addresses of routing links for multiple routing links;

[0193] A first conversion submodule, used to convert different address segments of the IP address of the routing link into a four-dimensional space;

[0194] A determination submodule is used to determine all IP nodes as points in the four-dimensional space in the four-dimensional space;

[0195] A connection submodule is used to connect the points in each four-dimensional space to obtain a curve;

[0196] A processing submodule, used for processing the curve by a linear regression model to obtain a straight line, and returning to execute the step of converting different address segments of the IP address of the routing link into a four-dimensional space until straight lines corresponding to multiple routing links are obtained;

[0197] A first comparison submodule, used to compare the cosines between the straight lines corresponding to the plurality of routing links to obtain a first cosine similarity;

[0198] A second comparison submodule is used to compare the shapes of routing links of different lengths through dynamic time warping to obtain a second cosine similarity;

[0199] The second acquisition submodule is used to obtain the geographical locations corresponding to the IP addresses of the multiple routing links;

[0200] A second conversion submodule, used to convert each geographical location corresponding to the IP address of the routing link into each geographical coordinate;

[0201] A calculation submodule, used to calculate the straight line cosines of multiple routing links at their geographical locations according to the geographical coordinates;

[0202] A third comparison submodule is used to compare the cosines of each line to obtain a third cosine similarity;

[0203] An input submodule, used for inputting the first cosine similarity, the second cosine similarity and the third cosine similarity into the random forest as training features;

[0204] The training submodule is used to train the routing link table using a classification model through training features and hotlink training identifiers; wherein the hotlink training identifier is a training identifier that the routing change range of the routing link is unreasonable.

[0205] Furthermore, the anti-hotlink processing device based on the routing link also includes:

[0206] The storage unit is used to store the routing link corresponding to the identification result into the database for service if the identification result indicates that the routing change range of the routing link is reasonable.

[0207] Furthermore, the anti-hotlink processing device based on the routing link also includes:

[0208] The service unit is used to provide service to the user corresponding to the user ID if the user ID is visiting for the first time or is visiting for the first time within a preset time period.

[0209] The beneficial effects of the embodiments of the present application are as follows: the source IP extracted from the HTTP request is routed for detection to obtain a routing link, whether the routing change range of the routing link is reasonable is determined by a preset hotlink identification rule, and anti-hotlink processing is performed on the routing link corresponding to the unreasonable routing link change range. The present solution starts from the routing layer and does not rely on the high-level protocol to determine hotlinking. At the same time, it does not bind the user's IP for anti-hotlink processing. Therefore, even under the condition that the user switches to a daily network environment change, the present solution can perform anti-hotlink processing on the routing link corresponding to the unreasonable routing link change range, thereby improving the flexibility and reliability of the anti-hotlink process.

[0210] An embodiment of the present application further provides a storage medium, which includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the above-mentioned anti-hotlink processing method based on routing links.

[0211] The present application also provides an electronic device, whose structural diagram is as follows: Figure 6As shown, it specifically includes a memory 601 and one or more instructions 602, wherein the one or more instructions 602 are stored in the memory 601 and are configured to be executed by one or more processors 603 to execute the one or more instructions 602 to execute the above-mentioned anti-hotlink processing method based on routing links.

[0212] For the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0213] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0214] The steps in the methods of the embodiments of the present application can be adjusted in order, combined, and deleted according to actual needs.

[0215] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.

[0216] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

[0217] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for preventing hotlinks based on routing links, characterized in that: The method comprises: When receiving a user's HTTP request, extracting a source IP and a user ID from the HTTP request; Performing route detection on the source IP through a route detection algorithm to obtain a node path, and determining the node path as a routing link; wherein the node path is a node path from the server to the source IP; If the user ID is not the first visit, and the user IP corresponding to the user ID is monitored to have a change, the preset hotlink identification rule is used to determine whether the route change range of the routing link is reasonable, and obtain an identification result; If the identification result indicates that the route change range of the routing link is unreasonable, anti-hotlink processing is performed on the routing link; wherein the identification result of the unreasonable route change range of the routing link is determined in turn according to the identification result of the preset hard identification condition, the identification result of the confidence check and the identification result of the model identification.

2. The method according to claim 1, characterized in that: The method of performing route detection on the source IP by using a route detection algorithm to obtain a route link includes: Setting different distribution lifetimes through the Internet Control Message Protocol and reporting mechanism; Determine the source IP as a detection target; Performing route detection on the detection target according to the different distribution survival times to obtain the target survival time and its IP datagram; wherein the target survival time is a target survival time greater than a preset threshold; A node path is obtained according to the target lifetime and its IP datagram, and the node path is determined as a routing link.

3. The method according to claim 1, characterized in that: If the user ID is not the first visit, and the user IP corresponding to the user ID is monitored to have a change, the preset hotlink identification rule is used to determine whether the route change range of the routing link is reasonable, and the identification result is obtained, including: If the user ID is not the first visit and a change in the user IP corresponding to the user ID is detected, a preset hard identification indicator is obtained; wherein the prefabricated hard identification indicator at least includes the number of user IP addresses corresponding to the routing link, the user IP address corresponding to the routing link, the IP change range of the routing link, and the operator range; If the number of user IP addresses corresponding to the routing link is greater than the preset number, or the user IP address corresponding to the routing link belongs to the link adjustment blacklist, an identification result that the routing change range of the routing link is unreasonable is obtained; If the number of user IP addresses corresponding to the routing link is less than or equal to the preset number, and the user IP address corresponding to the routing link does not belong to the link adjustment blacklist, then obtain the range of the routing link; wherein the range of the routing link at least includes the IP change range and the operator range of the routing link; If the IP change range of the routing link does not fall within the preset IP change range, or the operator range does not fall within the preset operator range, an identification result that the routing change range of the routing link is unreasonable is obtained; If the IP change range of the routing link falls within the preset IP change range, and the operator range falls within the preset operator range, obtaining a confidence verification index of the routing link; wherein the confidence verification index includes at least an IP frequency modulation frequency and a request volume frequency; If the IP frequency modulation frequency or the request amount frequency does not conform to the normal distribution, an identification result that the route change range of the routing link is unreasonable is obtained; If the IP frequency modulation frequency and the request volume frequency both conform to normal distribution, the routing links are identified by using a classification model through a pre-trained routing chain table to obtain a difference value corresponding to the routing link; the difference value at least includes a regional jump difference and an IP segment logic difference value between the links; If the regional jump difference value between the links is greater than the preset regional jump difference comparison value, or the IP segment logic difference value is greater than the preset IP segment logic difference comparison value, an identification result that the route change range of the routing link is unreasonable is obtained; If the regional jump difference value between the links is less than or equal to the preset regional jump difference comparison value, and the IP segment logic difference value is less than or equal to the preset IP segment logic difference comparison value, a reasonable identification result of the routing change range of the routing link is obtained.

4. The method according to claim 3, characterized in that The process of training the routing list using the classification model includes: For multiple routing links, obtain IP addresses of the routing links; Converting different address segments of the IP address of the routing link into a four-dimensional space; In the four-dimensional space, all IP nodes are determined as points in each four-dimensional space; Connect the points in each four-dimensional space to obtain a curve; Processing the curve through a linear regression model to obtain a straight line, and returning to execute the step of converting different address segments of the IP address of the routing link into a four-dimensional space until straight lines corresponding to multiple routing links are obtained; Compare the cosines of the straight lines corresponding to the multiple routing links to obtain a first cosine similarity; The shapes of routing links of different lengths are compared by dynamic time warping to obtain the second cosine similarity; Obtaining the geographical locations corresponding to the IP addresses of the multiple routing links; Converting each geographical location corresponding to the IP address of the routing link into each geographical coordinate; Calculating the straight line cosines of the plurality of routing links at their geographical locations according to the respective geographical coordinates; Compare the cosines of each line to obtain the third cosine similarity; Inputting the first cosine similarity, the second cosine similarity and the third cosine similarity into a random forest as training features; The classification model is used to train the routing link table through the training features and hotlink training identifier; wherein the hotlink training identifier is a training identifier that the routing change range of the routing link is unreasonable.

5. The method according to claim 1, characterized in that Also includes: If the identification result indicates that the route change range of the routing link is reasonable, the routing link corresponding to the identification result is stored in the database for service.

6. The method according to claim 1, characterized in that Also includes: If the user ID is accessing for the first time or is accessing for the first time within a preset time period, the user corresponding to the user ID is provided with services.

7. An anti-hotlink processing device based on routing link, characterized in that: The method comprises: An extraction unit, configured to extract a source IP and a user ID from a user's HTTP request when receiving the HTTP request; A routing detection unit, used to perform routing detection on the source IP through a routing detection algorithm to obtain a node path, and determine the node path as a routing link; wherein the node path is a node path from the server to the source IP; A judgment unit, configured to, if the user ID is not accessing for the first time and a change in the user IP corresponding to the user ID is detected, judge whether the route change range of the routing link is reasonable by using a preset hotlink identification rule to obtain an identification result; The anti-hotlink processing unit is used to perform anti-hotlink processing on the routing link if the recognition result indicates that the route change range of the routing link is unreasonable; wherein the recognition result of the unreasonable route change range of the routing link is determined in turn according to the recognition result of the preset hard recognition condition, the recognition result of the confidence check and the recognition result of the model recognition.

8. The device according to claim 7, characterized in that The routing detection unit comprises: A setting module, used for setting different distribution survival times through an Internet control message protocol and a reporting mechanism; A first determination module, used to determine the source IP as a detection target; A routing detection module, used for performing routing detection on the detection target according to the different distribution survival times, and obtaining the target survival time and its IP datagram; wherein the target survival time is a target survival time greater than a preset threshold; The second determination module is used to obtain a node path according to the target lifetime and its IP datagram, and determine the node path as a routing link.

9. The device according to claim 7, characterized in that The judging unit comprises: A first acquisition module is used to acquire a preset hard identification indicator if the user ID is not accessed for the first time and a change in the user IP corresponding to the user ID is detected; wherein the prefabricated hard identification indicator at least includes the number of user IP addresses corresponding to the routing link, the user IP address corresponding to the routing link, the IP change range of the routing link, and the operator range; A second acquisition module is used to obtain an identification result that the route change range of the routing link is unreasonable if the number of user IP addresses corresponding to the routing link is greater than a preset number, or the user IP address corresponding to the routing link belongs to the link adjustment blacklist; A third acquisition module is used to acquire a range of the routing link if the number of user IP addresses corresponding to the routing link is less than or equal to a preset number and the user IP address corresponding to the routing link does not belong to the link adjustment blacklist; wherein the range of the routing link at least includes an IP change range and an operator range of the routing link; A fourth acquisition module, configured to obtain an identification result that the route change range of the routing link is unreasonable if the IP change range of the routing link does not fall within the preset IP change range, or the operator range does not fall within the preset operator range; A fifth acquisition module, used for acquiring a confidence verification index of the routing link if the IP change range of the routing link belongs to the preset IP change range and the operator range belongs to the preset operator range; wherein the confidence verification index at least includes the IP frequency modulation frequency and the request volume frequency; A sixth acquisition module, configured to obtain an identification result that a route change range of a routing link is unreasonable if the IP frequency modulation frequency or the request amount frequency does not conform to a normal distribution; A seventh acquisition module is used to identify the difference of the routing links by using a classification model through a pre-trained routing chain table if the IP frequency modulation frequency and the request frequency both conform to the normal distribution, and obtain the difference value corresponding to the routing link; the difference value at least includes the regional jump difference between the links and the IP segment logic difference value; An eighth acquisition module, configured to obtain an identification result that the route change range of the routing link is unreasonable if the regional jump difference value between the links is greater than a preset regional jump difference comparison value, or the IP segment logic difference value is greater than a preset IP segment logic difference comparison value; The ninth acquisition module is used to obtain a reasonable identification result of the routing change range of the routing link if the regional jump difference value between the links is less than or equal to the preset regional jump difference comparison value, and the IP segment logic difference value is less than or equal to the preset IP segment logic difference comparison value.

10. The device according to claim 9, characterized in that Training the routing list uses the seventh acquisition module of the classification model, including: A first acquisition submodule, used for acquiring IP addresses of multiple routing links; A first conversion submodule, used for converting different address segments of the IP address of the routing link into a four-dimensional space; A determination submodule is used to determine all IP nodes as points in the four-dimensional space in the four-dimensional space; A connection submodule is used to connect the points in each four-dimensional space to obtain a curve; A processing submodule, used for processing the curve by a linear regression model to obtain a straight line, and returning to execute the step of converting different address segments of the IP address of the routing link into a four-dimensional space until straight lines corresponding to a plurality of routing links are obtained; A first comparison submodule, used to compare the cosines between the straight lines corresponding to the plurality of routing links to obtain a first cosine similarity; A second comparison submodule is used to compare the shapes of routing links of different lengths through dynamic time warping to obtain a second cosine similarity; A second acquisition submodule is used to obtain each geographical location corresponding to the IP addresses of the multiple routing links; A second conversion submodule, used to convert each geographical location corresponding to the IP address of the routing link into each geographical coordinate; A calculation submodule, used for calculating the straight line cosines of the plurality of routing links at their geographical locations according to the respective geographical coordinates; A third comparison submodule is used to compare the cosines of each line to obtain a third cosine similarity; An input submodule, used for inputting the first cosine similarity, the second cosine similarity and the third cosine similarity into a random forest as training features; The training submodule is used to train the routing link table using a classification model through the training features and hotlink training identifier; wherein the hotlink training identifier is a training identifier that the routing change range of the routing link is unreasonable.

Images