Log verification method and related device

Abstract

The invention provides a log verification method and a related device, and relates to the field of CDN (Content Delivery Network). In the application, after the verification instruction is received, the actual verification value corresponding to the to-be-verified log packet is calculated, if the actual verification value is the same as the reference verification value of the to-be-verified log packet, the request time and the encryption parameter of the to-be-verified log packet are verified, and if the verification of the request time and the encryption parameter is passed, the to-be-verified log packet is verified. According to the method and the device, the request data corresponding to the preset identifier in the to-be-verified log packet is determined, the number of request entries and the request bandwidth of the request data are verified, and the log verification result of the to-be-verified log packet is obtained based on the verification result of the number of request entries and the request bandwidth, so that the purpose of verifying the log packet uploaded by a CDN manufacturer is achieved. According to the method and the device, the to-be-verified log packet is verified from the aspects of the verification value, the request time, the encryption parameter, the number of request entries and the request bandwidth, and the verification aspect is comprehensive, so that the verification accuracy is improved.

Description

Technical Field

[0001] The present application relates to the field of CDN (Content Delivery Network), and more specifically, to a log verification method and related devices. Background Art

[0002] The application scenarios of CDN acceleration are very wide, including but not limited to video streaming, game acceleration, static resource acceleration, etc.

[0003] CDN vendors will generate service logs during the acceleration service process. The vendors will periodically cut, aggregate, and package the logs and upload the log packages to Party A.

[0004] The log package uploaded by the CDN manufacturer may contain erroneous data. Therefore, how to verify it to determine whether the log package uploaded by the CDN manufacturer is correct is a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0005] In view of this, the present application provides a log verification method and related devices to solve the problem of verifying the log packages uploaded by CDN manufacturers.

[0006] In order to solve the above technical problems, this application adopts the following technical solutions:

[0007] A log verification method, comprising:

[0008] When it is determined that a verification instruction has been received, an actual verification value corresponding to the log packet to be verified is calculated;

[0009] If the actual verification value is the same as the reference verification value of the log package to be verified, verify the request time and encryption parameters of the log package to be verified;

[0010] If the request time and the encryption parameter verification pass, determine the request data corresponding to the preset identifier in the log package to be verified;

[0011] Verifying the number of requested items and the requested bandwidth of the requested data;

[0012] Based on the verification results of the number of requested entries and the requested bandwidth, a log verification result of the log package to be verified is obtained.

[0013] Optionally, determining that a verification instruction is received includes:

[0014] Receive a reference check value and a log packet to be checked corresponding to the reference check value;

[0015] After successfully receiving the log package to be verified, determining whether an empty file with the same name corresponding to the log package to be verified is received;

[0016] If so, it is determined that a verification instruction has been received.

[0017] Optionally, the process of determining whether the actual check value is the same as the reference check value of the log package to be checked includes:

[0018] Filtering out the reference verification value of the log package to be verified from the log package information library; the log package information library includes: the reference verification value of the log package uploaded through the specified interface and through the HTTP POST method;

[0019] Determine whether the actual check value is the same as the reference check value of the log package to be checked.

[0020] Optionally, verifying the request time and encryption parameters of the log package to be verified includes:

[0021] Verify whether each request time in the log package to be verified is within the collection time of the log package to be verified;

[0022] If it is within the collection time of the log package to be verified, a decryption operation is performed on the designated link in the log package to be verified. During the decryption operation, it is determined whether there is an encryption parameter in the designated link and whether the encryption parameter is correct;

[0023] If the encryption parameters exist in the specified link and are correct, determine whether each request time in the log package to be verified is within the effective time of the specified link;

[0024] If it is within the effective time of the designated link, it is determined that the request time of the log package to be verified and the encryption parameter verification have passed.

[0025] Optionally, determining the request data corresponding to the preset identifier in the log package to be verified includes:

[0026] Extracting a preset identifier from the specified link;

[0027] Performing a deduplication operation on the preset identifier to obtain a deduplication result;

[0028] Request data corresponding to each preset identifier in the deduplication data acquisition result is extracted from the log package to be verified.

[0029] Optionally, verifying the number of requested items and the requested bandwidth of the requested data includes:

[0030] Performing hash calculation on the request time and the preset identifier in the request data to obtain the number of request items;

[0031] Determine whether the requested number of entries is greater than an upper limit of the number of entries;

[0032] If it is less than the upper limit of the number of entries, determining the requested bandwidth corresponding to the preset identifier;

[0033] Determining whether the requested bandwidth is greater than a reference bandwidth value;

[0034] If it is greater than the reference bandwidth value, it is determined that the requested bandwidth has not passed the verification.

[0035] Optionally, obtaining a log verification result of the log packet to be verified based on the verification result of the number of request entries and the requested bandwidth includes:

[0036] If both the number of requested items and the requested bandwidth are verified, a log extraction operation is performed on the log package to be verified to obtain a target log;

[0037] Comparing the traffic data of the target log with the traffic reporting data corresponding to the target log;

[0038] Based on the comparison result, the log verification result of the log package to be verified is determined.

[0039] A log verification device, comprising:

[0040] A check value calculation module is used to calculate the actual check value corresponding to the log packet to be checked when it is determined that a check instruction has been received;

[0041] A first verification module, configured to verify the request time and encryption parameters of the log package to be verified if the actual verification value is the same as the reference verification value of the log package to be verified;

[0042] A data determination module, configured to determine the request data corresponding to the preset identifier in the log packet to be verified if the request time and the encryption parameter verification pass;

[0043] A second verification module, used to verify the number of request items and the request bandwidth of the request data;

[0044] The result determination module is used to obtain the log verification result of the log package to be verified based on the verification result of the number of request entries and the requested bandwidth.

[0045] An electronic device comprises at least one processor and a memory connected to the processor, wherein:

[0046] The memory is used to store computer programs;

[0047] The processor is used to execute the computer program so that the electronic device can implement the above-mentioned log verification method.

[0048] A computer storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement the above-mentioned log verification method.

[0049] The present application provides a log verification method and related devices. In the present application, after receiving the verification instruction, the actual verification value corresponding to the log package to be verified is calculated. If the actual verification value is the same as the reference verification value of the log package to be verified, the request time and encryption parameters of the log package to be verified are verified. If the request time and the encryption parameter verification pass, the request data corresponding to the preset identifier in the log package to be verified is determined, and the number of request entries and the request bandwidth of the request data are verified. Based on the verification results of the number of request entries and the request bandwidth, the log verification result of the log package to be verified is obtained, and the purpose of verifying the log package uploaded by the CDN manufacturer is achieved. In the present application, for the log package to be verified, verification is performed from the perspectives of verification value, request time, encryption parameter, number of request entries and request bandwidth. The verification angle is comprehensive, thereby improving the accuracy of the verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0051] Figure 1 A flow chart of a log verification method provided by an embodiment of the present invention;

[0052] Figure 2 A log upload schematic diagram provided by an embodiment of the present invention;

[0053] Figure 3 A schematic diagram of a scenario of a log verification method provided by an embodiment of the present invention;

[0054] Figure 4 A schematic diagram of a log verification process provided by an embodiment of the present invention;

[0055] Figure 5 A schematic diagram of the structure of a log verification device provided by an embodiment of the present invention;

[0056] Figure 6A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0058] The application scenarios of CDN acceleration are very wide, including but not limited to video streaming, game acceleration, static resource acceleration, etc.

[0059] CDN vendors will generate service logs during the acceleration service process. The vendors will periodically cut, aggregate and package the logs, upload the log package information to Party A within a limited time, and then upload the log package.

[0060] Since CDN vendors generally clean and settle logs unilaterally for accelerated billing, the log packages uploaded by CDN vendors may contain erroneous data. Currently, related parties, such as Party A, cannot verify the authenticity of the logs in the log packages and the accuracy of the data. In this context, it is necessary to verify the authenticity of the service log packages and determine the authenticity of the data.

[0061] In the embodiment of the present invention, stakeholders can enable log information verification and log auditing procedures to verify the authenticity of log packages and judge the authenticity of logs, thereby protecting the rights and interests of stakeholders and preventing financial risks.

[0062] Specifically, the present invention provides a log verification method and related devices. In this application, after receiving the verification instruction, the actual verification value corresponding to the log package to be verified is calculated. If the actual verification value is the same as the reference verification value of the log package to be verified, the request time and encryption parameters of the log package to be verified are verified. If the request time and the encryption parameter verification pass, the request data corresponding to the preset identifier in the log package to be verified is determined, and the number of request items and the request bandwidth of the request data are verified. Based on the verification results of the number of request items and the request bandwidth, the log verification result of the log package to be verified is obtained, thereby achieving the purpose of verifying the log package uploaded by the CDN manufacturer. In this application, for the log package to be verified, verification is performed from the perspectives of verification value, request time, encryption parameter, number of request items and request bandwidth. The verification angle is comprehensive, thereby improving the accuracy of the verification.

[0063] Based on the above content, an embodiment of the present invention provides a log verification method, and the execution subject can be a device such as a controller and a processor.

[0064] Reference Figure 1 , a log verification method may include:

[0065] S11. When it is determined that a verification instruction has been received, an actual verification value corresponding to the log packet to be verified is calculated.

[0066] In actual scenarios, CDN vendors generate logs in a specified format at a time granularity of 5 minutes or 1 hour, and then package and compress them to obtain log packages.

[0067] In an embodiment of the present invention, MD5 (Message Digest Algorithm MD5) is used to verify the authenticity of the actual log package. Specifically, before pushing the log package to Party A's storage device (such as an FTP (File Transfer Protocol) server), the CDN manufacturer calculates the MD5 value of the log package to be pushed, and the CDN manufacturer submits the MD5 to Party A's device, such as Party A's controller, through a designated interface and through HTTP POST within a specified time (within 1 hour) after the log package is generated. After the MD5 is successfully uploaded, it cannot be changed. The HTTP POST data content uses the JSON (JavaScript Object Notation) format, and the JSON data includes the MD5 value of the log package. A POST data only contains one file information, and Party A returns the receiving result.

[0068] It should be noted that if the time between the log package generation time and the MD5 value upload time exceeds one hour, it is considered that the log package may be at risk of tampering, and the log file will be discarded during settlement, but it will not affect the subsequent upload of the log package.

[0069] After the MD5 value of the log package is uploaded, the manufacturer uploads the actual log package. Figure 2 As shown, when a CDN manufacturer generates a log of a specified format every 5 minutes, the manufacturer will put the calculated MD5 into its own MD5 pool, and upload the MD5 value corresponding to each log package in the MD5 pool to Party A's log package information library. Taking two log packages as an example, it is necessary to upload log collection 1, that is, the MD5 value corresponding to log package 1, that is, MD5 collection 1, to the log package information library, and then upload log collection 2, that is, the MD5 value corresponding to log package 2, that is, MD5 collection 2, to the log package information library. After the MD5 value is uploaded, upload MD5 collection 1 and MD5 collection 2 in the log package pool to Party A's device, and use the MD5 value in the log package information library and the log package to perform verification and audit operations.

[0070] After the log package is uploaded, the manufacturer uploads an empty file named .finish with the same name as the log package. The empty file triggers the verification program to calculate the size of the actual uploaded log package, perform MD5 value comparison, and record it.

[0071] The MD5 value in the above embodiment is the reference verification value in the embodiment of the present invention, that is, the reference verification value and the log package to be verified corresponding to the reference verification value are first received. After successfully receiving the log package to be verified, it is determined whether an empty file with the same name corresponding to the log package to be verified is received, that is, the above-mentioned .finish empty file. If the .finish empty file is received, it is considered that the verification instruction has been received, and the verification operation is started at this time.

[0072] When the verification begins, the log auditing process begins. The log auditing function is a key information security and network management tool that helps organizations monitor the security status of their information systems, detect abnormal behaviors, and comply with various compliance requirements by collecting, analyzing, and storing log information generated by computer systems, networks, and applications. Log auditing can promptly detect potential security threats and abnormal behaviors by collecting, monitoring, and analyzing log information from various network devices and systems in real time, so that appropriate measures can be taken to avoid potential security risks or losses. When a network security incident occurs, the log auditing system can provide valuable evidence support, and help the security team quickly respond to and handle security incidents by tracing and analyzing event-related logs. At the same time, through the analysis and mining of log data, the system's performance bottlenecks, optimization space, and potential improvement directions can be discovered.

[0073] Specifically, when starting the verification, refer to Figure 3 First, check whether the actual check value (i.e., the actual MD5 value) corresponding to the uploaded log package to be checked is the same as the reference check value (i.e., the MD5 value uploaded by the manufacturer). Before the check, calculate the actual check value corresponding to the log package to be checked. When implementing it, you can use the MD5 calculation method to calculate the MD5 value of the log package to be checked, and then perform the MD5 check operation. If the check passes, perform the log package audit operation. If both pass, update the database to determine that the log is correct. If one fails, update the database to determine that the log is wrong.

[0074] It should be noted that the MD5 value verification and log package audit can also be performed at the same time. As long as one of them fails, the verification can be stopped and a prompt message indicating that the database has determined the log error can be output.

[0075] S12: If the actual verification value is the same as the reference verification value of the log package to be verified, verify the request time and encryption parameters of the log package to be verified.

[0076] Specifically, the log package information library includes: reference check values ​​of log packages uploaded through a specified interface and through HTTP POST. Therefore, the reference check value of the log package to be checked can be screened out from the log package information library to determine whether the actual check value is the same as the reference check value of the log package to be checked.

[0077] The reference check value and the actual check value may both be MD5 values.

[0078] If the actual MD5 value is the same as the MD5 value uploaded by the manufacturer, it means that the content of the log package uploaded by the manufacturer has not been modified. Then, the request time and encryption parameters of the log package to be verified are verified.

[0079] If the actual MD5 value is different from the MD5 value uploaded by the manufacturer, it means that the content of the log package uploaded by the manufacturer has been modified. In this case, the uploaded log package is judged as abnormal data.

[0080] S13: If the request time and the encryption parameter verification pass, determine the request data corresponding to the preset identifier in the log package to be verified.

[0081] If the request time and the encryption parameter verification pass, it means that the request time of the log in the log package and the encryption parameters of the entire log package are fine. At this time, the number of request entries and the request bandwidth are verified.

[0082] In actual scenarios, the log package uploaded by the manufacturer may contain log contents of other packages. In this case, when the service type is HLS (HTTP Live Streaming, dynamic bitrate adaptive technology) video playback, multiple requests for the same URL (uniform resource locator, uniform resource locator system) may be generated. Therefore, the number of requested entries can be verified to determine whether the log package uploaded by the manufacturer contains log contents of other packages.

[0083] In actual scenarios, the log packages uploaded by the manufacturer may contain duplicate log content, but only the request time has changed. In this case, the request bandwidth of the same user will be larger. Therefore, the request bandwidth can be verified to determine whether there is duplicate log content with different request times in the log packages uploaded by the manufacturer.

[0084] In order to implement the above-mentioned verification of the number of request items and the request bandwidth, it is necessary to determine the corresponding request data in the log package. A single request in a URL generally uses a preset identifier, such as "Subscribe-ID", UUID or a custom identifier. In the embodiment of the present invention, the preset identifier in the URL is extracted to determine the request data corresponding to the preset identifier.

[0085] S14: Verify the number of requested items and the requested bandwidth of the requested data.

[0086] After the request data is determined, the number of request items and the request bandwidth are counted based on the preset identifier, and are verified respectively.

[0087] S15. Obtain a log verification result of the log package to be verified based on the verification result of the number of requested entries and the requested bandwidth.

[0088] Specifically, if both the number of request entries and the request bandwidth are verified to be passed, it means that the current log verification is basically passed.

[0089] At this time, it is also possible that the log package log copy is completely tampered with. In this case, a single MAC (Media Access Control Address) can be randomly selected to generate a log with a large flow rate. In addition, the verification result is reported by the client flow and compared. If the difference is large, it is abnormal data.

[0090] Specifically, the content of the log package that needs to be checked is determined by the degree of random inspection, and specifically, the log extraction operation is performed on the log package to be checked using the degree of random inspection to obtain the target log. The extracted log is generally a log with a large flow rate generated by a single MAC, such as a program that sorts the logs in the log package according to the flow rate, and then extracts one or more target logs from the log with large flow rate.

[0091] Since the client also reports traffic data when using traffic, the reported traffic data corresponding to the target log is selected from the reported traffic data. Since the traffic data is directly reported by the client, it has a higher accuracy and is used as reference data for target log traffic comparison.

[0092] Subsequently, the traffic data of the target log is compared with the traffic reporting data corresponding to the target log, and based on the comparison result, the log verification result of the log package to be verified is determined.

[0093] Specifically, if the traffic data of the target log is the same as or slightly different from the traffic reporting data corresponding to the target log, it means that the log data of the log package is correct, and the log verification result of the log package to be verified is passed. If the traffic data of the target log is significantly different from the traffic reporting data corresponding to the target log, it means that the log data of the log package is abnormal, and the log verification result of the log package to be verified is failed.

[0094] It should be noted that, in this embodiment, large-flow logs are extracted for comparison because large-flow access may be tampered with by the manufacturer, resulting in large flow, and therefore large-flow data is extracted.

[0095] In addition, the log extraction and comparison method in the present invention and the verification method of the above-mentioned steps S11-S14 are two parallel methods. For an uploaded log package, the verification operation of steps S11-S14 is required, but the log extraction may not be extracted, that is, when the log is extracted, the logs in each log package may not be extracted. In addition, it can also be set to perform log extraction and comparison operations on each log package, which can be specifically configured according to the actual situation.

[0096] In this embodiment, after receiving the verification instruction, the actual verification value corresponding to the log package to be verified is calculated. If the actual verification value is the same as the reference verification value of the log package to be verified, the request time and encryption parameters of the log package to be verified are verified. If the request time and the encryption parameters are verified, the request data corresponding to the preset identifier in the log package to be verified is determined, and the number of request items and the request bandwidth of the request data are verified. Based on the verification results of the number of request items and the request bandwidth, the log verification result of the log package to be verified is obtained, and the purpose of verifying the log package uploaded by the CDN manufacturer is achieved. In this application, for the log package to be verified, verification is performed from the perspectives of verification value, request time, encryption parameters, number of request items and request bandwidth, and the verification angle is comprehensive, thereby improving the accuracy of the verification.

[0097] In another implementation of the present invention, a process for verifying the request time and encryption parameters of the log package to be verified is provided, referring to Figure 4 , which may include:

[0098] S21. Check whether each request time in the log package to be verified is within the collection time of the log package to be verified; if so, execute step S22.

[0099] In this embodiment, taking the example of a CDN manufacturer generating a specified format log with a granularity of 5 minutes, the log package uploaded by the user is the sum of the logs generated within a certain five minutes. Generally, in order to identify the specific five minutes of log data, the time period can be marked in the log package name, such as 10.05-10.10, which is the collection time.

[0100] In this embodiment, the request time of the log content in the log package is checked first. If the request time is not within the time range of the log package name, it means that the logs in the log package do not belong to the log collection time period, and they are removed, and a verification failure message is output.

[0101] If it is within the collection time of the log package to be verified, it means that the logs collected in the log package are all collected within the standard collection time, and then step S22 is executed.

[0102] S22. Decrypt the specified link in the log package to be verified.

[0103] Specifically, the log package uploaded by the manufacturer includes a specified link, such as a URL link, and the content of the link includes parameter values ​​of (MAC or IP) + URL generation timestamp + valid time + Verifykey.

[0104] Among them, IP (Internet Protocol Address) is the user address that accesses the specified link. URL generation timestamp refers to the time when the URL is generated. Validity time refers to the validity period of the URL, such as one hour, which means that the URL link will become invalid one hour after the URL is generated. Verifykey is a custom key, which is used as an encryption parameter. The key will replace the parameter name to ensure the validity of the parameter.

[0105] When the manufacturer generates a log package, it will obtain the above parameters, namely (MAC or IP) + URL generation timestamp + valid time + Verifykey, sign these parameters with the HmacSHA256 algorithm, and then encode them in the URL with base64 to obtain the specified link.

[0106] In this embodiment, after obtaining the log package, Party A extracts the specified link from the log package. Since the specified link is encrypted, it is necessary to decrypt the specified link in a manner opposite to that of encryption. After decryption, the values ​​of various parameters are obtained as a basis for determining abnormal logs.

[0107] S23. During the decryption operation, determine whether there are decryption parameters in the designated link and whether the decryption parameters are correct; if there are decryption parameters in the designated link and the decryption parameters are correct, execute step S24.

[0108] During the decryption operation, it is determined whether the encryption parameter Verifykey exists in the specified link and whether the encryption parameter Verifykey is correct. If the encryption parameter Verifykey exists and the encryption parameter Verifykey is correct, it indicates that the encryption process is normal, and step S23 is executed. If the encryption parameter Verifykey does not exist or the encryption parameter Verifykey exists and the encryption parameter Verifykey is incorrect, it indicates that the encryption process is abnormal, and the log packet may be tampered with, and a message that the verification fails is output.

[0109] In this embodiment, the encrypted parameters in the URL are decrypted. If there is no encrypted parameter Verifykey or the decryption fails and the log of the generated traffic is determined to be abnormal data, an abnormal prompt message is output.

[0110] S24, determining whether each request time in the log package to be verified is within the effective time of the specified link; if so, executing step S25.

[0111] S25, determining whether the request time of the log package to be verified and the encryption parameter verification have passed.

[0112] Specifically, after successfully decrypting the URL, the data in the URL is obtained, and the URL generation timestamp and validity time need to be obtained. The specified link, that is, the effective time of the URL link is (URL generation timestamp to URL generation timestamp + the end time corresponding to the effective time). If each request time in the log package to be verified is within the effective time of the specified link, it means that the log data is correct, and it is determined that the request time and encryption parameter verification of the log package to be verified have passed, and the subsequent verification continues.

[0113] If the request time is less than the URL generation timestamp, traffic is generated because the URL has not been generated at this time. At this time, the log is abnormal data and the output is a verification failure message. In addition, if the access time is greater than the URL generation timestamp + the end time corresponding to the validity time, the URL is invalid at this time. If traffic is still generated, it means that the log is abnormal data and the output is a verification failure message.

[0114] In this embodiment, after the MD5 value is successfully verified, the service log audit program will be enabled for secondary verification. There is a custom Verifykey parameter in the service log, and the (MAC or IP) + URL generation timestamp + valid time + Verifykey is signed with the HmacSHA256 algorithm, and then recorded in base64 encoding. The audit system will make judgments based on each field in the log and the decrypted parameter value to verify whether it complies with the business logic. Illegal logs will be found through logical checks, and then marked as abnormal data, and prompt information will be output.

[0115] In another implementation of the present invention, determining the request data corresponding to the preset identifier in the log package to be verified may include:

[0116] 1) Extracting a preset identifier from the specified link.

[0117] Among them, the preset identifier is the "Subscribe-ID", UUID or custom identifier in the above embodiment. In this embodiment, taking the preset identifier as Subscribe-ID as an example, in this embodiment, Subscribe-ID is extracted.

[0118] 2) Performing a deduplication operation on the preset identifier to obtain a deduplication result.

[0119] In actual applications, if the uploaded log package contains log contents of other packages, a single request in the URL is used to verify the log. Taking the preset identifier as Subscribe-ID as an example, deduplication and data retrieval operations are performed based on Subscribe-ID.

[0120] In this embodiment, all Subscribe-IDs involved in the log package can be obtained through the deduplication and number extraction operation. For example, if ten Subscribe-IDs are extracted from the log package, the ten Subscribe-IDs are the deduplication and number extraction results.

[0121] 3) Extracting request data corresponding to each preset identifier in the deduplication data acquisition result from the log packet to be verified.

[0122] For each preset identifier in the deduplication result, the logs related to the identifier are obtained from the log package, and all logs related to the same Subscribe-ID are combined into request data.

[0123] For example, for a certain access user, corresponding to the same Subscribe-ID, all logs of this user constitute the request data.

[0124] After obtaining the request data, you can verify the number of request items and the request bandwidth of the request data, as follows:

[0125] 1) Performing hash calculation on the request time and the preset identifier in the request data to obtain the number of request items.

[0126] Specifically, a hash calculation is performed on the request time + Subscribe-ID to obtain the number of request items.

[0127] 2) Determine whether the requested number of entries is greater than an upper limit of the number of entries; if less than the upper limit of the number of entries, determine the requested bandwidth corresponding to the preset identifier.

[0128] If the number of requested entries is greater than the upper limit of the number of entries, it is judged as abnormal data and a prompt message is output.

[0129] For example, a video requested by a user consists of ten items in total. In this embodiment, the video requests twelve items in total, which means that the number of requested items exceeds the limit, which is abnormal data.

[0130] If the number of requested entries is less than the upper limit of the number of entries, it means that the number of entries requested by the user is within a reasonable range. At this time, the requested bandwidth is further verified.

[0131] In this embodiment, the requested bandwidth can be calculated by the total requested traffic.

[0132] 3) Determine whether the requested bandwidth is greater than a reference bandwidth value. If so, determine that the requested bandwidth has not passed the verification.

[0133] Specifically, if there is a copy log with only the request time changed in the log package, perform deduplication operation based on Subscribe-ID. Calculate the bandwidth value generated by the log package with the Subscribe-ID, and compare it horizontally with the data of the same dimension from other CDN vendors or self-built CDNs. If the bandwidth of a single request is much larger than the reference bandwidth value (specifically the bandwidth of the data of the same dimension from other CDN vendors or self-built CDNs), it means that the user bandwidth is too large. At this time, there may be a copy log with only the request time changed in the log package, and the log package is defined as abnormal data.

[0134] In this embodiment, the verification operation is performed in a top-down order. If an abnormality is found, the operation is interrupted and a log packet is thrown out, which is determined to be abnormal data.

[0135] As can be seen from the above, the present invention realizes comprehensive verification of log packages through time-limited uploading of MD5 values ​​of log packages and verification of actual log packages, combined with secondary analysis of log packages by audit procedures, thereby improving the authenticity of data information, protecting the rights and interests of stakeholders, and preventing financial risks.

[0136] Based on the above-mentioned log verification method embodiment, another embodiment of the present invention provides a log verification device, referring to Figure 5 , which may include:

[0137] The check value calculation module 11 is used to calculate the actual check value corresponding to the log packet to be checked when it is determined that a check instruction has been received;

[0138] A first verification module 12 is used to verify the request time and encryption parameters of the log package to be verified if the actual verification value is the same as the reference verification value of the log package to be verified;

[0139] A data determination module 13 is used to determine the request data corresponding to the preset identifier in the log package to be verified if the request time and the encryption parameter verification pass;

[0140] A second verification module 14 is used to verify the number of request items and the request bandwidth of the request data;

[0141] The result determination module 15 is used to obtain the log verification result of the log package to be verified based on the verification result of the number of request entries and the requested bandwidth.

[0142] In one implementation, the check value calculation module 11 includes:

[0143] A data receiving submodule, used for receiving a reference check value and a log packet to be checked corresponding to the reference check value;

[0144] The file receiving judgment module is used to judge whether an empty file with the same name corresponding to the log package to be verified is received after successfully receiving the log package to be verified, and if so, judge that a verification instruction is received.

[0145] In one implementation, the first verification module 12 includes:

[0146] The verification value acquisition submodule is used to filter out the reference verification value of the log package to be verified from the log package information library; the log package information library includes: the reference verification value of the log package uploaded through the specified interface and through the HTTP POST method;

[0147] The check value comparison submodule is used to determine whether the actual check value is the same as the reference check value of the log packet to be checked.

[0148] In one implementation, the first verification module 12 includes:

[0149] A first time verification submodule, used to verify whether each request time in the log package to be verified is within the collection time of the log package to be verified;

[0150] A decryption submodule, for performing a decryption operation on a designated link in the log package to be verified if the decryption operation is within the collection time of the log package to be verified, and during the decryption operation, determining whether an encryption parameter exists in the designated link and whether the encryption parameter is correct;

[0151] The second time verification submodule is used to determine whether each request time in the log package to be verified is within the effective time of the specified link if the encryption parameters exist in the specified link and the encryption parameters are correct. If they are within the effective time of the specified link, it is determined that the request time of the log package to be verified and the encryption parameter verification have passed.

[0152] In one implementation, the data determination module 13 includes:

[0153] An identifier extraction submodule, used to extract a preset identifier from the specified link;

[0154] A deduplication submodule, used for performing a deduplication operation on the preset identifier to obtain a deduplication result;

[0155] The data extraction submodule is used to extract the request data corresponding to each preset identifier in the deduplication result from the log package to be verified.

[0156] In one implementation, the second verification module 14 includes:

[0157] A hash calculation submodule, used to perform a hash calculation on the request time and a preset identifier in the request data to obtain the number of request items;

[0158] An entry determination submodule, used to determine whether the requested number of entries is greater than an upper limit of the number of entries;

[0159] A bandwidth determination submodule, used for determining the requested bandwidth corresponding to the preset identifier if the bandwidth is less than the upper limit of the number of entries;

[0160] The bandwidth determination submodule is used to determine whether the requested bandwidth is greater than a reference bandwidth value. If so, it is determined that the requested bandwidth has not passed the verification.

[0161] In one implementation, the result determination module 15 includes:

[0162] An extraction submodule, configured to perform a log extraction operation on the log package to be verified to obtain a target log if both the number of requested items and the requested bandwidth are verified;

[0163] A comparison submodule, used to compare the flow data of the target log with the flow reporting data corresponding to the target log;

[0164] The result determination submodule is used to determine the log verification result of the log package to be verified based on the comparison result.

[0165] In this embodiment, after receiving the verification instruction, the actual verification value corresponding to the log package to be verified is calculated. If the actual verification value is the same as the reference verification value of the log package to be verified, the request time and encryption parameters of the log package to be verified are verified. If the request time and the encryption parameters are verified, the request data corresponding to the preset identifier in the log package to be verified is determined, and the number of request items and the request bandwidth of the request data are verified. Based on the verification results of the number of request items and the request bandwidth, the log verification result of the log package to be verified is obtained, and the purpose of verifying the log package uploaded by the CDN manufacturer is achieved. In this application, for the log package to be verified, verification is performed from the perspectives of verification value, request time, encryption parameters, number of request items and request bandwidth, and the verification angle is comprehensive, thereby improving the accuracy of the verification.

[0166] It should be noted that, for the working process of each module and sub-module in the embodiment of the present invention, please refer to the corresponding description of the above embodiment, which will not be repeated here.

[0167] An embodiment of the present application also provides an electronic device, including at least one processor and a memory connected to the processor, wherein:

[0168] The memory is used to store computer programs;

[0169] The processor is used to execute the computer program so that the electronic device can implement the above-mentioned log verification method.

[0170] refer to Figure 6 As shown, it shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiment of the present application. The electronic device in the embodiment of the present application may include but is not limited to fixed terminals such as mobile phones, laptops, PDAs (personal digital assistants), PADs (tablet computers), desktop computers, etc. Figure 6 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0171] like Figure 6 As shown, the electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 to a random access memory (RAM) 603. When the electronic device is powered on, various programs and data required for the operation of the electronic device are also stored in the RAM 603. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0172] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a memory card, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 An electronic device having various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0173] An embodiment of the present application also provides a computer program product including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements any log verification method provided in the embodiment of the present application.

[0174] A computer-readable storage medium is also provided in an embodiment of the present application. The storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any log verification method provided in an embodiment of the present application.

[0175] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A log verification method, characterized in that: include: When it is determined that a verification instruction has been received, an actual verification value corresponding to the log packet to be verified is calculated; If the actual verification value is the same as the reference verification value of the log package to be verified, verify the request time and encryption parameters of the log package to be verified; If the request time and the encryption parameter verification pass, determine the request data corresponding to the preset identifier in the log package to be verified; Verifying the number of requested items and the requested bandwidth of the requested data; Based on the verification results of the number of requested entries and the requested bandwidth, a log verification result of the log package to be verified is obtained.

2. The log verification method according to claim 1, characterized in that: Determining that a verification instruction is received includes: Receive a reference check value and a log packet to be checked corresponding to the reference check value; After successfully receiving the log package to be verified, determining whether an empty file with the same name corresponding to the log package to be verified is received; If so, it is determined that a verification instruction has been received.

3. The log verification method according to claim 1, characterized in that: The process of determining whether the actual check value is the same as the reference check value of the log package to be checked includes: Filtering out the reference verification value of the log package to be verified from the log package information library; the log package information library includes: the reference verification value of the log package uploaded through the specified interface and through the HTTP POST method; Determine whether the actual check value is the same as the reference check value of the log package to be checked.

4. The log verification method according to claim 1, characterized in that: Verify the request time and encryption parameters of the log package to be verified, including: Verify whether each request time in the log package to be verified is within the collection time of the log package to be verified; If it is within the collection time of the log package to be verified, a decryption operation is performed on the designated link in the log package to be verified. During the decryption operation, it is determined whether there is an encryption parameter in the designated link and whether the encryption parameter is correct; If the encryption parameters exist in the specified link and are correct, determine whether each request time in the log package to be verified is within the effective time of the specified link; If it is within the effective time of the designated link, it is determined that the request time of the log package to be verified and the encryption parameter verification have passed.

5. The log verification method according to claim 4, characterized in that: Determining the request data corresponding to the preset identifier in the log package to be verified includes: Extracting a preset identifier from the specified link; Performing a deduplication operation on the preset identifier to obtain a deduplication result; Request data corresponding to each preset identifier in the deduplication data acquisition result is extracted from the log package to be verified.

6. The log verification method according to claim 5, characterized in that: Verifying the number of requested items and the requested bandwidth of the requested data includes: Performing hash calculation on the request time and the preset identifier in the request data to obtain the number of request items; Determine whether the requested number of entries is greater than an upper limit of the number of entries; If it is less than the upper limit of the number of entries, determining the requested bandwidth corresponding to the preset identifier; Determining whether the requested bandwidth is greater than a reference bandwidth value; If it is greater than the reference bandwidth value, it is determined that the requested bandwidth has not passed the verification.

7. The log verification method according to claim 1, characterized in that: Based on the verification results of the number of requested entries and the requested bandwidth, a log verification result of the log packet to be verified is obtained, including: If both the number of requested items and the requested bandwidth are verified, a log extraction operation is performed on the log package to be verified to obtain a target log; Comparing the traffic data of the target log with the traffic reporting data corresponding to the target log; Based on the comparison result, the log verification result of the log package to be verified is determined.

8. A log verification device, characterized in that: include: A check value calculation module is used to calculate the actual check value corresponding to the log packet to be checked when it is determined that a check instruction has been received; A first verification module, configured to verify the request time and encryption parameters of the log package to be verified if the actual verification value is the same as the reference verification value of the log package to be verified; A data determination module, configured to determine the request data corresponding to the preset identifier in the log packet to be verified if the request time and the encryption parameter verification pass; A second verification module, used to verify the number of request items and the request bandwidth of the request data; The result determination module is used to obtain the log verification result of the log package to be verified based on the verification result of the number of request entries and the requested bandwidth.

9. An electronic device, characterized in that: The method comprises at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program so that the electronic device can implement the log verification method as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that: The storage medium carries one or more computer programs, and when the one or more computer programs are executed by an electronic device, the electronic device can implement the log verification method as described in any one of claims 1 to 7.

Images