Data processing method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a data processing method and device, electronic equipment and a storage medium, and relates to the technical field of distributed network detection.The method comprises the steps that a content access request sent by a client side is obtained, and client side parameters corresponding to the client side are obtained; detecting the content access request according to whether the content access request carries an authentication parameter and / or a client parameter, and generating a detection result for the content access request, the authentication parameter being a parameter for authenticating a content access link of the content distribution network; if the request detection result represents that the content access request is the normal access request, the target data corresponding to the content access request is returned to the client, so that the abnormal access request can be accurately identified, and the bandwidth cost caused by the abnormal access request is reduced.

Description

Technical Field

[0001] The present invention relates to the field of distributed network detection technology, and in particular to a data processing method, a data processing device, an electronic device and a computer-readable storage medium. Background Art

[0002] CDN (Content Delivery Network) refers to a network based on a distributed server system, which is used to accelerate the delivery and distribution of content on the Internet. Among them, the application of CDN in games can include the access and download of game content such as game installation packages, game patch packages, game expansion packages, and game page resources. Since the game content is theoretically open to all users for download after being released through CDN, and since CDN is open to the public network and cannot be controlled by real-time, specific whitelist rules, it is easy for CDN to maliciously download on various download channels, causing CDN to generate a large bandwidth, causing great losses to CDN operators, and bringing serious unnecessary bandwidth costs. Summary of the invention

[0003] The embodiments of the present invention provide a data processing method, device, electronic device and computer-readable storage medium to solve or partially solve the problem of difficulty in accurately identifying abnormal access requests and high processing costs during CDN monitoring.

[0004] The embodiment of the present invention discloses a data processing method, which is applied to a content distribution network. The method includes:

[0005] Obtaining a content access request sent by a client, and obtaining client parameters corresponding to the client;

[0006] Detecting the content access request according to whether the content access request carries an authentication parameter and / or the client parameter, and generating a detection result for the content access request, wherein the authentication parameter is a parameter used to authenticate the content access link of the content distribution network;

[0007] If the request detection result indicates that the content access request is a normal access request, target data corresponding to the content access request is returned to the client.

[0008] The embodiment of the present invention further discloses a data processing device, which is applied to a content distribution network. The device includes:

[0009] A request acquisition module, used to acquire a content access request sent by a client and acquire client parameters corresponding to the client;

[0010] a detection module, configured to detect the content access request according to whether the content access request carries an authentication parameter and / or the client parameter, and generate a detection result for the content access request, wherein the authentication parameter is a parameter used to authenticate the content access link of the content distribution network;

[0011] The data returning module is configured to return target data corresponding to the content access request to the client if the request detection result indicates that the content access request is a normal access request.

[0012] The embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0013] The memory is used to store computer programs;

[0014] The processor is used to implement the method described in the embodiment of the present invention when executing the program stored in the memory.

[0015] The embodiment of the present invention further discloses a computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, enables the processors to execute the method described in the embodiment of the present invention.

[0016] The embodiments of the present invention include the following advantages:

[0017] In an embodiment of the present invention, applied to a content distribution network, a client may send a corresponding request to the content distribution network to obtain corresponding data from the content distribution network. For the content access request sent by the client, the server corresponding to the content distribution network may obtain the client parameters corresponding to the client, and then detect the content access request according to whether the content access request carries authentication parameters and / or client parameters, and generate a detection result for the content access request. The authentication parameters are parameters used to authenticate the content access link of the content distribution network. If the request detection result indicates that the content access request is a normal access request, the target data corresponding to the content access request is returned to the client. By judging whether the content access request carries the authentication parameters, the problem that the third-party access channel cannot support authentication access is solved, and the monitoring surface of the content distribution network is expanded. At the same time, the access request is detected based on the authentication parameters and the client parameters, so that abnormal access requests can be accurately identified, and the bandwidth cost caused by abnormal access requests can be reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 is a flowchart of a method for processing data provided in an embodiment of the present invention;

[0019] Figure 2 It is a schematic diagram of the processing flow of URL authentication provided in an embodiment of the present invention;

[0020] Figure 3 is a flow chart of log processing provided in an embodiment of the present invention;

[0021] Figure 4 is a schematic diagram of the inspection process provided in an embodiment of the present invention;

[0022] Figure 5 is a structural block diagram of a data processing device provided in an embodiment of the present invention;

[0023] Figure 6 It is a block diagram of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0025] As an example, the application of CDN in games may include the access and download of game content such as game installation packages, game patch packages, game expansion packages, and game page resources. For CDN download monitoring and log services, relying on traditional monitoring and obtaining massive CDN download logs for manual analysis, it is difficult to distinguish whether it is a malicious request on the one hand, and the analysis is difficult and inefficient on the other hand; for the access control function provided by CDN manufacturers, conventional CDN anti-theft solutions are easy to be cracked, such as the data such as UA (User-Agent, user agent) / referer (reference page) / IP address / URL (Uniform Resource Locator, Uniform Resource Locator) in user download behavior can make corresponding anti-hotlinks, so that relevant users can evade corresponding monitoring by changing information at low cost, and the access control function cannot be used blindly, and the UA, referer, IP black and white lists are configured arbitrarily, which is easy to affect the risk of game download business, and it is necessary to repeatedly perform manual analysis, explanation, confirmation processing, tracking effect, etc., which increases the labor cost. Therefore, the monitoring method for CDN at least has the problems of difficulty in accurately identifying abnormal access requests and high processing costs.

[0026] In this regard, in the present invention, for a content access request sent by a client, a server corresponding to a content distribution network can obtain client parameters corresponding to the client, and then detect the content access request according to whether the content access request carries authentication parameters and / or client parameters, and generate a detection result for the content access request, wherein the authentication parameters are parameters used to authenticate content access links of the content distribution network. If the request detection result indicates that the content access request is a normal access request, target data corresponding to the content access request is returned to the client. By determining whether the content access request carries authentication parameters, the problem that a third-party access channel cannot support authentication access is solved, and the monitoring surface of the content distribution network is expanded. At the same time, by detecting the access request based on the authentication parameters and the client parameters, abnormal access requests can be accurately identified, thereby reducing the bandwidth cost caused by abnormal access requests.

[0027] Reference Figure 1 , shows a flowchart of a data processing method provided in an embodiment of the present invention, which is applied to a content distribution network (hereinafter referred to as CDN), and specifically may include the following steps:

[0028] Step 101, obtaining a content access request sent by a client, and obtaining client parameters corresponding to the client;

[0029] In the embodiment of the present invention, CDN is a network based on a distributed server system, which can be used to accelerate the delivery and distribution of content on the Internet. For example, in a game scenario, a user can obtain corresponding game installation packages, game patch packages, game expansion packages, game page resources and other game content by accessing CDN. For example, a user can access the access page corresponding to the CDN network through a browsing page running on a user terminal, and trigger access to the game resource link on the CDN through a download control provided in the access page, and then download the corresponding game resource through the game resource link, etc. The present invention does not limit this.

[0030] Among them, the monitoring of CDN can include real-time monitoring and periodic monitoring. Real-time monitoring means that when a user initiates an access request to the CDN, the access request is detected to determine whether the access request is a normal access request; periodic monitoring means batch processing of historical access requests, screening out abnormal access requests, and locating the IP addresses, user terminals, etc. corresponding to these abnormal access requests, so as to add such abnormal IP addresses, user terminals, etc. to the blacklist and restrict their continued access to the CDN, so as to reduce the bandwidth cost of the CDN caused by abnormal access requests.

[0031] In a specific implementation, for a content access request sent by a client, a server corresponding to the CDN can obtain client parameters corresponding to the client, so as to detect the content access request based on the client parameters and determine whether the request is a normal access request. The client parameters may be parameters related to the client, such as IP address, traffic information, resource information, device information, regional information, etc., which are not limited in the present invention.

[0032] Step 102, detecting the content access request according to whether the content access request carries an authentication parameter and / or the client parameter, and generating a detection result for the content access request, wherein the authentication parameter is a parameter used to authenticate the content access link of the content distribution network;

[0033] In an embodiment of the present invention, an authentication mechanism is introduced. For a content access request sent by a client, the server can detect the content access request based on whether the content access request carries authentication parameters and / or client parameters, and then generate a corresponding detection result based on the detection result, so as to determine whether the client is allowed to obtain corresponding data from the CDN based on the detection result. In the access page corresponding to the CDN, a corresponding resource access entry can be configured, and each resource access entry can correspond to a content access link, through which corresponding resources can be obtained, such as game installation packages, game patch packages, game expansion packages, and game page resources. For a content access link, the server can perform authentication processing on the content access request by determining whether the content access request carries the authentication parameters corresponding to the content access link, thereby determining whether the content access request is a normal access request.

[0034] In addition, in the process of authenticating content access requests through authentication parameters, further detection can be performed in combination with client parameters, or content access requests can be detected based on client parameters alone, so as to monitor access requests from multiple dimensions, expand the monitoring surface of the content distribution network, and detect access requests based on authentication parameters and client parameters. This can accurately identify abnormal access requests and reduce the bandwidth costs caused by abnormal access requests.

[0035] In some feasible implementations, the content access request at least includes a content access link corresponding to the content distribution network. The server may first detect whether the content access request carries an authentication parameter for the content access link. If the content access request carries an authentication parameter for encrypting the content access link, the content access request is detected according to the authentication parameter, and a request detection result for the content access request is output; if the content access request does not carry the authentication parameter for encrypting the content access link, the content access request is treated as an abnormal access request, or the content access request is detected according to the client parameter to generate a request detection result for the content access request. By determining whether the content access request carries the authentication parameter, the problem that the third-party access channel cannot support authentication access is solved, and the monitoring surface of the content distribution network is expanded. At the same time, by detecting the access request based on the authentication parameter and the client parameter, abnormal access requests can be accurately identified, thereby reducing the bandwidth cost caused by abnormal access requests.

[0036] It should be noted that the content distributed by CDN is public resource by default. Users can access the corresponding resources after obtaining the corresponding content access link. In order to prevent site resources from being maliciously downloaded, stolen or inflated, CDN needs to authenticate the client's access to ensure normal client access.

[0037] Among them, the authentication parameters may at least include target key information, the target key information is information generated by the client based on the symmetric key and time information, the symmetric key is a key agreed in advance between the client and the server corresponding to the content distribution network, and the time information is the time point when the user triggers access to the content access link. In the process of determining whether the content access request is a normal access request through the authentication parameters, the server can obtain the symmetric key corresponding to the client, and then authenticate the content access request based on the symmetric key, the target key information and the content access link, and output the authentication result for the content access request.

[0038] Optionally, in the process of authenticating the content access request, the server may require the client to construct corresponding authentication parameters, and the authentication parameters may be content constructed based on an encryption algorithm. Before constructing the authentication parameters, the client and the server may agree on a symmetric key so as to implement authentication of the content access request based on the symmetric key. The generation method of the symmetric key may include certificate-based generation, password-based key derivation, random number-based key generation, etc., which is not limited in the present invention.

[0039] In the process of the client initiating a request to the CDN to obtain the corresponding content, for a client with normal access, it has a symmetric key agreed in advance with the server. When generating a content access request, the client can obtain the corresponding content access link, the time point when the user triggers access to the content access link, etc., and then build the corresponding target key information based on the content access link, time point, symmetric key and other information, and carry the target key information in the content access request and send it to the corresponding CDN server, so that the server can authenticate the content access request based on the target key information.

[0040] In a specific implementation, the target key information includes at least a first subkey and a second subkey. The first subkey may be key information generated by the client based on time information, and the second subkey may be key information generated by the client based on the first subkey, a content access link, and a symmetric key. The server may use the symmetric key, the first subkey, the second subkey, and the content access link to authenticate the content access request, and output the authentication result for the content access request.

[0041] Specifically, the server can first obtain the request time corresponding to the content access request and the validity period of the first subkey, and then use the request time to calculate to obtain the corresponding third subkey, and then use the symmetric key, the content access link and the first subkey to calculate to obtain the corresponding fourth subkey. If the sum of the first subkey and the validity period is greater than or equal to the third subkey, and the second subkey is the same as the fourth subkey, the content access request is treated as a normal access request; if the sum of the first subkey and the validity period is less than the third subkey, and / or the second subkey is different from the fourth subkey, the content access request is treated as an abnormal access request.

[0042] In one example, the client and the server can authenticate the content access request based on a pre-agreed symmetric key and a corresponding authentication algorithm. Specifically, the client can first construct the corresponding authentication parameters, obtain the time point when the user triggers the access to the content access link, and superimpose the corresponding preset validity period (such as 12 hours, etc.) on the basis of the time point, and then convert the superimposed time point into hexadecimal to obtain the corresponding first sub-key key1, and then use the symmetric key, content access link and key1 to perform operations to obtain the corresponding MD5 value, and use the MD5 value as the second sub-key key2, and then the client can carry key1 and key2 in the content access request and send it to the server; the server can first calculate the corresponding hash value based on the symmetric key, content access link and key1, and use the hash value as the third sub-key key3, and at the same time obtain the receiving time of the content access request, convert The fourth subkey key4 is obtained by corresponding hexadecimal, and then key1 is compared with key3, key2 is combined with the validity period T configured by CDN, and the combined result is compared with key4. If key1=key3 and key2+T≥key4, the authentication is passed, otherwise the authentication fails and a 403 page is returned. Therefore, by judging whether the content access request carries the authentication parameter and authenticating the content access request based on the authentication parameter, the problem that the third-party access channel cannot support authentication access is solved, the monitoring surface of the content distribution network is expanded, and because the authenticated content access link itself has a corresponding validity period, the content distribution network can be reduced from being used by the client for brushing for a long time, further reducing the unnecessary bandwidth of the content distribution network.

[0043] It should be noted that, for symmetric keys, they can be used to define authentication keys, support uppercase and lowercase letters, numbers, etc., and can be provided by CDN operators; key1 can be the corresponding timestamp, identified in hexadecimal form, and can be the corresponding time point + preset duration (such as 12 hours, etc.); key2 can be the corresponding hash value, etc., and the present invention is not limited to this.

[0044] In addition, the URL authentication function for the client can be enabled according to the domain name, URL regular expression and other dimensions. After enabling, the request sent by the client to the CDN needs to carry the authentication parameters for the content access link, otherwise the CDN can directly determine that the authentication failed and return the corresponding 403 page. At the same time, the CDN can perform authentication when receiving the request sent by the client, without being affected by the download timeout validity period; and each content access link can construct the corresponding authentication parameters separately, otherwise the timestamp is easy to expire, and the timestamp can be selected from the current time or the future time. When the future time is selected, the download validity period of the content access link will be increased, etc. The present invention does not limit this.

[0045] In one example, referring to Figure 2 , shows a schematic diagram of the processing flow of URL authentication provided in an embodiment of the present invention. In the process of authenticating the content access request sent by the client, the self-built CDN control system provides domain-level URL authentication configuration and change services, and controls the seven-layer component nginx of the CDN node in the entire network to render the URL authentication configuration (authentication key, authentication mode, timestamp, authentication algorithm, etc.). After the request reaches the CDN edge node, the authentication parameters and URL are extracted to call nginxlua for URL authentication. For real user requests, the authentication is passed, and the requested resources are obtained and responded normally; for malicious requests, the correct authentication parameters are lacking, the authentication fails, and a 403 response is given directly.

[0046] In some other feasible implementations, when the content access request does not carry the authentication parameters for the content access link, the server can detect the content access request based on the client parameters; or, in a regular inspection process, the server can periodically detect the historical access requests sent by the client based on the client parameters, and generate a corresponding inspection report based on the detection results, so as to implement batch detection according to the client parameters and improve detection efficiency.

[0047] It should be noted that the server can obtain the corresponding client parameters according to the CDN download log and detect the content access request based on the client parameters. Figure 2 , shows a schematic diagram of a resource download scenario provided in an embodiment of the present invention. In a normal game resource download process, a user can download game resources from a game official website, an application store, and other channels. After downloading the corresponding game resources, the corresponding game application can be installed on the user terminal, and the corresponding game client can be opened when playing; when the game client needs to be updated, the corresponding game update resource can be obtained from the CDN, and the corresponding game update resource can be downloaded from the CDN by obtaining a list of resources that need to be updated for the game application, and then the user can play based on the updated game application. In the above process, when the user opens the client, the client can generate a corresponding activation log; when the client obtains the corresponding game update resource from the CDN, the client can generate a corresponding resource download log; and when the user terminal obtains the corresponding game installation package from the CDN, the CDN can record the corresponding download log, so that by collecting download logs, activation logs, resource download logs, etc., the client parameters corresponding to the client can be effectively collected, so as to detect the content access request (installation package acquisition request, update resource acquisition request, etc.) initiated by the client based on the client parameters, and determine whether the request initiated by the client is a normal content access request.

[0048] For the collected logs, the server can detect whether the request is abnormal from multiple dimensions, such as data usage, resource dimension, IP / region dimension, device proxy dimension, computer room bandwidth dimension, etc. Among them, for data usage, it can represent the bandwidth usage of a game project on the CDN. When the data usage represents that the bandwidth / traffic of the target project increases unnecessarily and is not caused by version updates or promotions, it can represent that the project may have traffic theft. For the resource dimension, there may be old packages in the resource link, and downloading such old packages may generate large traffic. For the IP / regional dimension, there may be a large number of downloads from individual IP addresses, or devices with large bandwidth usage may have clear regionality. For the device agent dimension, when downloading game resources on the game official website, the UA can usually be a browser, and the appearance of unconventional browser UAs such as curl / Go can be judged as abnormal. For mobile game installation packages or resource packages, the UA can usually be a computer terminal. Accordingly, when the download traffic of the UA is greater than or equal to the preset traffic threshold, it can be judged as abnormal. For the computer room bandwidth dimension, the computer room bandwidth continuously reaches the upper limit value. This may be due to the fact that when traffic is theft, abnormal IPs are concentrated in one area and obtain corresponding resources from computer room nodes near the area.

[0049] It should be noted that, for the above different analysis dimensions, the involved fraudulent features can be converted into query SQL, and packaged in the inspection service of the server, and the data that needs to be inspected can be regularly inspected, and then the corresponding inspection results can be output. For example, in the case where the download bandwidth or traffic increase does not meet expectations (non-version update), the corresponding prompt information can be output to prompt the corresponding items to be checked; for the case where the client IP is concentrated in the target area and the UA consistency is very high, the distribution of the domain name UA can be checked first to determine whether the download volume of the UA of individual non-game clients is greater than or equal to the preset threshold, and then it can be checked whether the resource link downloaded by the UA is normal, and whether the UA corresponding to the downloaded resource link belongs to a normal UA, and the domain name downloaded by the UA can be checked to determine the corresponding impact range, and abnormal domain names can be screened out and continuously monitored, etc.; for the case where the download volume of individual client IP is greater than or equal to the preset threshold, the resource link downloaded by the abnormal IP can be checked to determine whether the old package body is continuously downloaded based on the resource link. If so, the abnormal IP can be added to the blacklist, or the old package body can be deleted, etc.; for the old package body downloaded, the old package body can be deleted, etc., and the present invention does not limit this.

[0050] Furthermore, the inspection data to be inspected related to the CDN can be inspected by constructing a corresponding inspection model to detect the corresponding abnormal behavior, and the corresponding inspection tasks can be formulated for the game project, and the data to be inspected can be processed based on the inspection tasks. Specifically, the inspection model can at least include an inspection management module, an exception handling module, and an interaction module, etc. The inspection management module can be used to manage inspection cases, inspection data, and inspection alarms. In the inspection case management, different scripts can be configured, such as a detection script for brushing abnormal IPs, an abnormal detection script for downloading data packets, and a script for detecting downloaded data. In the inspection data management, the inspection result data, inspection report, etc. can be managed, and the corresponding dashboard data query function can be provided; the exception handling module can support the configuration of black and white lists such as UA / referer / IP, and support the removal of repeatedly downloaded files and support the unblocking of UA / referer / IP, etc.; the interaction module can be used to provide users with one-click subscription, viewing processing, configuration management, and permission management functions.

[0051] In actual applications, due to the large number of CDN logs, in order to improve the query efficiency of download inspection indicators, the data can be partitioned by hour, and the offline download logs can be collected according to the partitions and the indicators can be summed to maintain the relationship (n minutes -> indicator). Through pre-aggregation, the amount of data to be queried can be reduced from 100 million to 10 million, thereby improving the query efficiency of inspection indicators. At the same time, the inspection service uses the day as the granularity, and performs the final aggregation of the pre-aggregated data of the previous day according to n minutes, and finally writes it into a large wide table for subsequent inspection indicator query judgment. Through this process, the amount of data to be queried is reduced from 10 million to 1 million, further improving the query efficiency of inspection indicators.

[0052] It should be noted that CDN logs can be uploaded to the server, and the server can analyze the uploaded logs. For example, refer to Figure 3, shows a flow chart of log processing provided in an embodiment of the present invention. Through loghub, scribe agent3 can be provided in all CDN nodes of the entire network, with a customized log aggregation upload strategy, and real-time return of nginx logs to the GDC (Global Data Center) in the specified area, providing two log stream aggregation queries. The data flow direction is scribe agent3 (data collection) -> kafka (message queue) -> fink (real-time processing) -> kafka (message queue) -> GDC (data center) -> ES (distributed search and analysis engine) for quasi-real-time log stream, providing a small range of quasi-real-time log queries; scribe agent3 -> kafka -> fink -> kafka -> GDC -> HIVE (database) is an offline log stream, providing a large range of log queries.

[0053] For quasi-real-time log streams, the corresponding processing process can be:

[0054] 1. Agent 3 collects data and sends it to Kafka.

[0055] 2. Kafka stores raw data for Flink to consume.

[0056] 3. Flink processes the data in real time and sends the processed data to Kafka.

[0057] 4. Kafka stores processed data for consumption by GDC.

[0058] 5. GDC further processes the data and sends it to Elasticsearch.

[0059] 6. Elasticsearch stores data and provides search and analysis capabilities.

[0060] For offline data streams, the corresponding processing process can be:

[0061] 1. Agent 3 collects data and sends it to Kafka.

[0062] 2. Kafka stores raw data for Flink to consume.

[0063] 3. Flink processes the data in real time and sends the processed data to Kafka.

[0064] 4. Kafka stores processed data for consumption by GDC.

[0065] 5. GDC further processes the data and sends it to Hive.

[0066] 6. Hive stores data and provides SQL query capabilities.

[0067] Through the above process, after uploading the data to be inspected to the server, the inspection can be performed based on the inspection model. Specifically, the server can extract the client data corresponding to the client from the corresponding log, and then input the client data into the inspection model for analysis to determine whether the content access request initiated by the client is a normal access request. Among them, the client parameters at least include the IP address corresponding to the client and the time series traffic data of the IP address in the first preset time period. The server can detect the IP address according to the time series traffic data and generate an address detection result. If the address detection result indicates that the IP address is a normal IP address, the content access request is determined to be a normal access request; if the address detection result indicates that the IP address is an abnormal IP address, the content access request is determined to be an abnormal access request, thereby accurately identifying whether the IP address to which the client belongs is an abnormal IP by analyzing the traffic changes of the domain name corresponding to the client in the corresponding time period. Among them, the time series traffic data can be the time series traffic of the corresponding IP address within the preset time length, such as the time series traffic corresponding to IP① within 7 days before the detection.

[0068] Optionally, for the detection process of the IP address, the server can first use the time series traffic data to calculate the traffic change value of the IP address in a preset time period. If the traffic change value is greater than the preset threshold range, the IP address is regarded as an abnormal IP address; if the traffic change value is within the preset threshold range, the IP address is regarded as a normal IP address. Among them, the traffic change value can be used to characterize the change of the IP address within a certain period of time, such as the change of the traffic value within 7 days, etc., and the present invention does not limit this.

[0069] Furthermore, after determining that the content access request is an abnormal access request, the server can further analyze the root cause of the abnormality. Optionally, the server can pull the traffic detail data of the IP address within a second preset time period, and the second preset time period is a time period determined according to the current time and a preset duration. Then, the root cause analysis of the abnormal IP address is performed based on the traffic detail data to obtain the abnormal root cause corresponding to the abnormal IP address. After identifying that the content access request is an abnormal request, the server can further analyze the cause of the abnormality in order to execute targeted processing strategies.

[0070] Among them, the traffic detail data includes at least several detection elements corresponding to each detection dimension. The server can first calculate the difference value corresponding to each detection element under the detection dimension, and the difference value is used to characterize the possibility that the detection element causes the detection dimension to be the abnormal root cause dimension, and calculate the abnormal contribution value corresponding to each detection element under the same detection dimension, and use the detection element with an abnormal contribution value greater than or equal to the preset threshold as the abnormal element information corresponding to the detection dimension, and use the abnormal element information as the abnormal root cause of the abnormality in the detection dimension, and then sort the detection elements in the same detection dimension according to the size of the difference value, and generate a root cause set corresponding to the abnormal IP information based on the sorted detection elements and abnormal root causes.

[0071] It should be noted that, for the detection dimension, it may include city, IP address, resource link and user agent, etc., and each detection dimension may correspond to multiple detection elements. The detection element may be the specific value or instance corresponding to each detection dimension, for example, in the city dimension, the detection element may be Shanghai, Guangzhou, Shenzhen, Hangzhou, etc.; in the IP address dimension, the detection element may be 192.168.1.1, 192.167.1.1, 192.166.1.1, etc.; in the resource link dimension, the detection element may be / home, / products, / about, / contact, etc.; in the user agent dimension, the detection element may be a browser, a computer, a mobile phone, etc., and the present invention does not limit this.

[0072] In a specific implementation, the difference value corresponding to each detection element under each detection dimension can be calculated through a corresponding algorithm, and the difference value can characterize the possibility that the detection element causes the detection dimension to be the root cause dimension of the abnormality; at the same time, the abnormal contribution value corresponding to each detection element under the same detection dimension can be calculated through a corresponding algorithm, and the abnormal contribution value can be used to characterize the possibility that the detection element causes the detection dimension to be abnormal, thereby calculating the difference value and the abnormal contribution value, identifying the element most likely to cause the abnormality, and then quickly locating the root cause of the abnormality, so as to effectively troubleshoot and solve the problem.

[0073] In an example, whether it is a content access request for a single client or a batch of content access requests, inspection can be performed through a corresponding inspection process, and batch processing of multiple content access requests is used as an example for exemplary description. Figure 4, showing a flow chart of the inspection process provided in an embodiment of the present invention, the server can obtain the domain name corresponding to the client from the domain name list to be detected through the PrometheusAPI interface, as well as the time series traffic data corresponding to the domain name in the past 7 days. Then, the server can use the mean shift detection algorithm to identify whether there is an abnormal phenomenon of continuous increase in traffic. Specifically, the time training will be decomposed using STL (Seasonal-Trend decomposition using Loess) first, and the ESD (Extreme Studentized Deviate) test algorithm will be used to remove outliers in the window, and then the mean shift will be calculated for the residual part, thereby filtering out scenarios with periodic traffic increases (that is, regular active traffic can be identified to avoid false alarms).

[0074] After detecting that the domain name corresponding to the client belongs to the domain name with abnormal traffic, the server can further analyze the root cause of the abnormality. Specifically, the server can use the SDK to pull and aggregate all traffic data details one hour before the abnormal moment from the source SRC table of the corresponding CDN in real time. Since pulling Hive table data is a long-running task, Scheduler will be used for task scheduling, and a multi-process plus cache strategy will be used to speed up the overall data acquisition efficiency. Then, for the obtained domain name traffic details, the Adtributor-like algorithm is used here to locate the root cause. Specifically, the Surprise (S) values ​​of all elements in each dimension (city, IP, URL or UA, etc.) are first calculated and sorted to indicate the difference between the predicted value and the actual value, that is, the greater the difference, the more likely it is to be the abnormal root cause dimension; then for each dimension, the Explanatory Power (EP) value of each element for the abnormality of the dimension is calculated. When it is greater than the threshold, it indicates that the element is more able to explain the occurrence of the abnormality of the dimension, so it can be added to the final abnormal root cause set. Finally, all root causes of traffic anomalies are compiled and returned to the system for final judgment, so that the difference value and anomaly contribution value can be calculated, the elements most likely to cause the anomaly can be identified, and the root cause of the anomaly can be quickly located for effective problem troubleshooting and resolution.

[0075] Through the above process, on the one hand, by judging whether the content access request carries authentication parameters, the problem that the third-party access channel cannot support authentication access is solved, and the monitoring surface of the content distribution network is expanded; on the other hand, the access request can be detected based on the authentication parameters and the client parameters, and abnormal access requests can be accurately identified, thereby reducing the bandwidth cost caused by abnormal access requests.

[0076] Step 103: If the request detection result indicates that the content access request is a normal access request, target data corresponding to the content access request is returned to the client.

[0077] In an embodiment of the present invention, after completing the detection of the content access request based on the aforementioned process, if the content access request is a normal access request, the server can return the target data corresponding to the content access request to the client, so that after completing the content access request according to the authentication parameters and / or client parameters, the server can perform corresponding processing operations according to the detection results to ensure that the user can obtain the corresponding data through the client.

[0078] In addition, in the above authentication process, for CDN, there are many download channels, which leads to the problem that third-party download channels cannot support authentication download. In this regard, in an embodiment of the present invention, a content access link corresponding to the CDN can be constructed. When the client authentication is passed, the client can jump to the resource link through the content access link to obtain the corresponding data through the resource link, thereby solving the problem that the third-party access channel cannot support authentication access and expanding the monitoring surface of the content distribution network.

[0079] In a specific implementation, if the authentication is successful, the server can return a resource link corresponding to the content access request to the client, and the client can send a resource download request for the resource link. The server receives the resource download request for the resource link sent by the client, and returns the target data corresponding to the resource download request to the client; if the authentication fails, the client accesses the corresponding HTML page through the content access link, but cannot obtain a resource link that can download the resource. Therefore, by constructing a content access link, the client is authenticated, and the resource link can be obtained only when the client authentication is successful. This effectively solves the problem that third-party access channels cannot support authenticated access, expands the monitoring surface of the content distribution network, and based on the authentication process, can effectively ensure the security of data access and reduce unnecessary bandwidth of the content distribution network.

[0080] In one example, the content access link can be a link built based on a download management system. The download management system can help game products quickly generate official websites and fixed and unique download addresses for various channels. CDN URL authentication is implemented through content access links based on an agreed key. After the CDN link with the key is generated, it is rendered into HTML, and users are redirected through JS to obtain the corresponding resource link. If the authentication fails, the user can only access the corresponding HTML page but cannot obtain the corresponding resource link.

[0081] It should be noted that the embodiments of the present invention include but are not limited to the above examples. It is understandable that those skilled in the art can also make settings according to actual needs under the guidance of the ideas of the embodiments of the present invention, and the present invention is not limited to this.

[0082] In an embodiment of the present invention, applied to a content distribution network, a client may send a corresponding request to the content distribution network to obtain corresponding data from the content distribution network. For the content access request sent by the client, the server corresponding to the content distribution network may obtain the client parameters corresponding to the client, and then detect the content access request according to whether the content access request carries authentication parameters and / or client parameters, and generate a detection result for the content access request. The authentication parameters are parameters used to authenticate the content access link of the content distribution network. If the request detection result indicates that the content access request is a normal access request, the target data corresponding to the content access request is returned to the client. By judging whether the content access request carries the authentication parameters, the problem that the third-party access channel cannot support authentication access is solved, and the monitoring surface of the content distribution network is expanded. At the same time, the access request is detected based on the authentication parameters and the client parameters, so that abnormal access requests can be accurately identified, and the bandwidth cost caused by abnormal access requests can be reduced.

[0083] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0084] Reference Figure 5 , shows a structural block diagram of a data processing device provided in an embodiment of the present invention, which is applied to a content distribution network and may specifically include the following modules:

[0085] The request acquisition module 501 is used to acquire a content access request sent by a client and acquire client parameters corresponding to the client;

[0086] A detection module 502, configured to detect the content access request according to whether the content access request carries an authentication parameter and / or the client parameter, and generate a detection result for the content access request, wherein the authentication parameter is a parameter used to authenticate the content access link of the content distribution network;

[0087] The data returning module 503 is configured to return target data corresponding to the content access request to the client if the request detection result indicates that the content access request is a normal access request.

[0088] In some feasible implementations, the content access request at least includes a content access link corresponding to the content distribution network, and the detection module 502 is specifically configured to:

[0089] If the content access request carries an authentication parameter for encrypting the content access link, detecting the content access request according to the authentication parameter, and outputting a request detection result for the content access request;

[0090] If the content access request does not carry the authentication parameter for encrypting the content access link, the content access request is treated as an abnormal access request, or the content access request is detected according to the client parameter to generate a request detection result for the content access request.

[0091] In some feasible implementations, the authentication parameter at least includes target key information, the target key information is information generated by the client according to the symmetric key and time information, the symmetric key is a key agreed upon in advance between the client and the server corresponding to the content distribution network, and the time information is the time point when the user triggers access to the content access link. The detection module 502 is specifically used to:

[0092] Obtaining the symmetric key corresponding to the client;

[0093] The content access request is authenticated according to the symmetric key, the target key information and the content access link, and an authentication result for the content access request is output.

[0094] In some feasible implementations, the target key information includes at least a first subkey and a second subkey, the first subkey is key information generated by the client according to the time information, and the second subkey is key information generated by the client according to the first subkey, the content access link, and the symmetric key, and the detection module 502 is specifically used to:

[0095] The content access request is authenticated using the symmetric key, the first subkey, the second subkey, and the content access link, and an authentication result for the content access request is output.

[0096] In some feasible implementations, the detection module 502 is specifically used to:

[0097] Obtaining a request time corresponding to the content access request and a validity period for the first sub-key;

[0098] The request time is used for calculation to obtain a corresponding third sub-key;

[0099] Using the symmetric key, the content access link and the first subkey to perform calculation, to obtain a corresponding fourth subkey;

[0100] If the sum of the first subkey and the validity period is greater than or equal to the third subkey, and the second subkey is the same as the fourth subkey, treating the content access request as a normal access request;

[0101] If the sum of the first subkey and the validity period is smaller than the third subkey, and / or the second subkey is different from the fourth subkey, the content access request is regarded as an abnormal access request.

[0102] In some feasible implementations, the client parameters include at least an IP address corresponding to the client and time series traffic data of the IP address within a first preset time period, and the detection module 502 is specifically used to:

[0103] Detect the IP address according to the time series traffic data and generate an address detection result;

[0104] If the address detection result indicates that the IP address is a normal IP address, determining that the content access request is a normal access request;

[0105] If the address detection result indicates that the IP address is an abnormal IP address, the content access request is determined to be an abnormal access request.

[0106] In some feasible implementations, the detection module 502 is specifically used to:

[0107] Calculate the traffic change value of the IP address in a preset time period using the time series traffic data;

[0108] If the traffic change value is greater than a preset threshold range, the IP address is regarded as an abnormal IP address;

[0109] If the traffic change value is within a preset threshold range, the IP address is regarded as a normal IP address.

[0110] In some feasible implementations, the device further includes:

[0111] A detailed data acquisition module, used to pull the traffic detailed data of the IP address within a second preset time period, where the second preset time period is a time period determined according to the current time and a preset duration;

[0112] The root cause analysis module is used to perform root cause analysis on the abnormal IP address according to the traffic detail data to obtain the abnormal root cause corresponding to the abnormal IP address.

[0113] In some feasible implementations, the traffic detail data includes at least detection elements corresponding to several detection dimensions, and the root cause analysis module is specifically used to:

[0114] Calculate the difference values ​​corresponding to each of the detection elements under the detection dimension, where the difference values ​​are used to characterize the possibility that the detection element causes the detection dimension to be an abnormal root cause dimension;

[0115] Calculate the abnormal contribution value corresponding to each of the detection elements under the same detection dimension;

[0116] The detection element whose abnormal contribution value is greater than or equal to the preset threshold is used as the abnormal element information corresponding to the detection dimension, and the abnormal element information is used as the abnormal root cause of the abnormality in the detection dimension;

[0117] The detection elements in the same detection dimension are sorted according to the size of the difference value, and a root cause set corresponding to the abnormal IP information is generated based on the sorted detection elements and the abnormal root causes.

[0118] In some feasible implementations, the data returning module 503 is specifically used to:

[0119] Returning a resource link corresponding to the content access request to the client;

[0120] A resource download request for the resource link sent by the client is received, and target data corresponding to the resource download request is returned to the client.

[0121] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0122] In addition, an embodiment of the present invention further provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned data processing method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0123] The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned data processing method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0124] Figure 6 A schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention.

[0125] The electronic device 600 includes but is not limited to: a radio frequency unit 601, a network module 602, an audio output unit 603, an input unit 604, a sensor 605, a display unit 606, a user input unit 607, an interface unit 608, a memory 609, a processor 610, and a power supply 611. Those skilled in the art will appreciate that the electronic device structure involved in the embodiments of the present invention does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange components differently. In the embodiments of the present invention, the electronic device includes but is not limited to a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted terminal, a wearable device, and a pedometer.

[0126] It should be understood that in the embodiment of the present invention, the radio frequency unit 601 can be used for receiving and sending signals during information transmission or communication. Specifically, after receiving downlink data from the base station, it is sent to the processor 610 for processing; in addition, uplink data is sent to the base station. Generally, the radio frequency unit 601 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, etc. In addition, the radio frequency unit 601 can also communicate with the network and other devices through a wireless communication system.

[0127] The electronic device provides users with wireless broadband Internet access through the network module 602, such as helping users to send and receive emails, browse web pages, and access streaming media.

[0128] The audio output unit 603 can convert the audio data received by the RF unit 601 or the network module 602 or stored in the memory 609 into an audio signal and output it as sound. Moreover, the audio output unit 603 can also provide audio output related to a specific function performed by the electronic device 600 (for example, a call signal reception sound, a message reception sound, etc.). The audio output unit 603 includes a speaker, a buzzer, a receiver, etc.

[0129] The input unit 604 is used to receive audio or video signals. The input unit 604 may include a graphics processor (GPU) 6041 and a microphone 6042, and the graphics processor 6041 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The processed image frame can be displayed on the display unit 606. The image frame processed by the graphics processor 6041 can be stored in the memory 609 (or other storage medium) or sent via the radio frequency unit 601 or the network module 602. The microphone 6042 can receive sound and can process such sound into audio data. The processed audio data can be converted into a format output that can be sent to a mobile communication base station via the radio frequency unit 601 in the case of a telephone call mode.

[0130] The electronic device 600 also includes at least one sensor 605, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor, wherein the ambient light sensor can adjust the brightness of the display panel 6061 according to the brightness of the ambient light, and the proximity sensor can turn off the display panel 6061 and / or the backlight when the electronic device 600 is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity when stationary, which can be used to identify the posture of the electronic device (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; the sensor 605 can also include a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which will not be repeated here.

[0131] The display unit 606 is used to display information input by the user or information provided to the user. The display unit 606 may include a display panel 6061, which may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0132] The user input unit 607 can be used to receive input digital or character information, and to generate key signal input related to user settings and function control of the electronic device. Specifically, the user input unit 607 includes a touch panel 6071 and other input devices 6072. The touch panel 6071, also known as a touch screen, can collect the user's touch operation on or near it (such as the user's operation on the touch panel 6071 or near the touch panel 6071 using any suitable object or accessory such as a finger, stylus, etc.). The touch panel 6071 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact coordinates, and then sends it to the processor 610, receives the command sent by the processor 610 and executes it. In addition, the touch panel 6071 can be implemented in various types such as resistive, capacitive, infrared and surface acoustic waves. In addition to the touch panel 6071, the user input unit 607 may also include other input devices 6072. Specifically, other input devices 6072 may include but are not limited to a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be described in detail here.

[0133] Further, the touch panel 6071 may be covered on the display panel 6061. When the touch panel 6071 detects a touch operation on or near it, it is transmitted to the processor 610 to determine the type of the touch event, and then the processor 610 provides a corresponding visual output on the display panel 6061 according to the type of the touch event. It can be understood that in one embodiment, the touch panel 6071 and the display panel 6061 are used as two independent components to implement the input and output functions of the electronic device, but in some embodiments, the touch panel 6071 and the display panel 6061 can be integrated to implement the input and output functions of the electronic device, which is not limited here.

[0134] The interface unit 608 is an interface for connecting an external device to the electronic device 600. For example, the external device may include a wired or wireless headset port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, etc. The interface unit 608 may be used to receive input (e.g., data information, power, etc.) from an external device and transmit the received input to one or more elements within the electronic device 600 or may be used to transmit data between the electronic device 600 and an external device.

[0135] The memory 609 can be used to store software programs and various data. The memory 609 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 609 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0136] The processor 610 is the control center of the electronic device. It uses various interfaces and lines to connect various parts of the entire electronic device. By running or executing software programs and / or modules stored in the memory 609 and calling data stored in the memory 609, it performs various functions of the electronic device and processes data, thereby monitoring the electronic device as a whole. The processor 610 may include one or more processing units; preferably, the processor 610 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 610.

[0137] The electronic device 600 may also include a power supply 611 (such as a battery) for supplying power to each component. Preferably, the power supply 611 may be logically connected to the processor 610 through a power management system, thereby implementing functions such as charging, discharging, and power consumption management through the power management system.

[0138] In addition, the electronic device 600 includes some functional modules not shown, which will not be described in detail here.

[0139] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0140] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0141] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

[0142] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0143] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0144] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0145] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0146] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0147] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical disks.

[0148] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A data processing method, characterized in that: Applied to a content distribution network, the method comprises: Obtaining a content access request sent by a client, and obtaining client parameters corresponding to the client; Detecting the content access request according to whether the content access request carries an authentication parameter and / or the client parameter, and generating a detection result for the content access request, wherein the authentication parameter is a parameter used to authenticate the content access link of the content distribution network; If the request detection result indicates that the content access request is a normal access request, target data corresponding to the content access request is returned to the client.

2. The method according to claim 1, characterized in that The content access request at least includes a content access link corresponding to the content distribution network, and the detecting the content access request according to whether the content access request carries an authentication parameter and / or the client parameter, and generating a detection result for the content access request includes: If the content access request carries an authentication parameter for encrypting the content access link, detecting the content access request according to the authentication parameter, and outputting a request detection result for the content access request; If the content access request does not carry the authentication parameter for encrypting the content access link, the content access request is treated as an abnormal access request, or the content access request is detected according to the client parameter to generate a request detection result for the content access request.

3. The method according to claim 2, characterized in that The authentication parameters at least include target key information, the target key information is information generated by the client according to the symmetric key and time information, the symmetric key is a key agreed in advance between the client and the server corresponding to the content distribution network, and the time information is the time point when the user triggers access to the content access link, and the content access request is detected according to the authentication parameters, and the request detection result for the content access request is output, including: Obtaining the symmetric key corresponding to the client; The content access request is authenticated according to the symmetric key, the target key information and the content access link, and an authentication result for the content access request is output.

4. The method according to claim 3, characterized in that The target key information at least includes a first subkey and a second subkey, the first subkey is key information generated by the client according to the time information, and the second subkey is key information generated by the client according to the first subkey, the content access link, and the symmetric key, authenticating the content access request according to the symmetric key, the target key information, and the content access link, and outputting an authentication result for the content access request, including: The content access request is authenticated using the symmetric key, the first subkey, the second subkey, and the content access link, and an authentication result for the content access request is output.

5. The method according to claim 4, characterized in that The using the symmetric key, the first subkey, the second subkey and the content access link to authenticate the content access request and outputting an authentication result for the content access request includes: Obtaining a request time corresponding to the content access request and a validity period for the first sub-key; The request time is used for calculation to obtain a corresponding third sub-key; Using the symmetric key, the content access link and the first subkey to perform calculation, to obtain a corresponding fourth subkey; If the sum of the first subkey and the validity period is greater than or equal to the third subkey, and the second subkey is the same as the fourth subkey, treating the content access request as a normal access request; If the sum of the first subkey and the validity period is smaller than the third subkey, and / or the second subkey is different from the fourth subkey, the content access request is regarded as an abnormal access request.

6. The method according to claim 1 or 2, characterized in that: The client parameters at least include an IP address corresponding to the client and time series traffic data of the IP address within a first preset time period, and the detecting the content access request according to whether the content access request carries an authentication parameter and / or the client parameters, and generating a detection result for the content access request, includes: Detect the IP address according to the time series traffic data to generate an address detection result; If the address detection result indicates that the IP address is a normal IP address, determining that the content access request is a normal access request; If the address detection result indicates that the IP address is an abnormal IP address, the content access request is determined to be an abnormal access request.

7. The method according to claim 6, characterized in that The detecting the IP address according to the time series traffic data to generate an address detection result includes: Calculate the traffic change value of the IP address in a preset time period using the time series traffic data; If the traffic change value is greater than a preset threshold range, the IP address is regarded as an abnormal IP address; If the traffic change value is within a preset threshold range, the IP address is regarded as a normal IP address.

8. The method according to claim 6, characterized in that After determining that the content access request is an abnormal access request, the method further includes: Pulling detailed traffic data of the IP address within a second preset time period, where the second preset time period is a time period determined according to the current time and a preset duration; A root cause analysis is performed on the abnormal IP address according to the traffic detail data to obtain an abnormal root cause corresponding to the abnormal IP address.

9. The method according to claim 8, characterized in that The traffic detail data includes at least detection elements corresponding to a plurality of detection dimensions, and performing root cause analysis on the abnormal IP address according to the traffic detail data to obtain the abnormal root cause corresponding to the abnormal IP address includes: Calculate the difference values ​​corresponding to each of the detection elements under the detection dimension, where the difference values ​​are used to characterize the possibility that the detection element causes the detection dimension to be an abnormal root cause dimension; Calculate the abnormal contribution value corresponding to each of the detection elements under the same detection dimension; The detection element whose abnormal contribution value is greater than or equal to the preset threshold is used as the abnormal element information corresponding to the detection dimension, and the abnormal element information is used as the abnormal root cause of the abnormality in the detection dimension; The detection elements in the same detection dimension are sorted according to the size of the difference value, and a root cause set corresponding to the abnormal IP information is generated based on the sorted detection elements and the abnormal root causes.

10. The method according to claim 1, characterized in that The returning target data corresponding to the content access request to the client includes: Returning a resource link corresponding to the content access request to the client; A resource download request for the resource link sent by the client is received, and target data corresponding to the resource download request is returned to the client.

11. A data processing device, characterized in that: Applied to a content distribution network, the device comprises: A request acquisition module, used to acquire a content access request sent by a client and acquire client parameters corresponding to the client; a detection module, configured to detect the content access request according to whether the content access request carries an authentication parameter and / or the client parameter, and generate a detection result for the content access request, wherein the authentication parameter is a parameter used to authenticate the content access link of the content distribution network; The data returning module is configured to return target data corresponding to the content access request to the client if the request detection result indicates that the content access request is a normal access request.

12. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 10 when executing the program stored in the memory.

13. A computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the method according to any one of claims 1 to 10.

Images