Abnormal traffic processing method and device, computer equipment and readable storage medium

Abstract

The invention relates to the technical field of network traffic, in particular to an abnormal traffic processing method and device, computer equipment and a readable storage medium. The method comprises the following steps: determining whether the current access traffic has a traffic fraud risk or not according to the current access traffic in a current time period and historical access traffic received in a historical time period, if so, analyzing access behavior characteristics corresponding to the current access traffic to obtain abnormal fraud traffic in the current access traffic; and according to the behavior characteristics corresponding to the abnormal unauthorized flow, processing the abnormal unauthorized flow. According to the technical scheme provided by the invention, the fraud behavior is identified by analyzing the traffic behavior characteristics without depending on a specific domain name or configuration, so that cross-domain attacks can be more effectively resisted, and the service security of CDN customers is protected.

Description

Technical Field

[0001] The present application relates to the field of network traffic technology, and in particular to an abnormal traffic processing method, device, computer equipment and readable storage medium. Background Art

[0002] Content Delivery Network (CDN) is a distributed network service that aims to improve the delivery speed and reliability of Internet content and improve the resource access efficiency of end users. When a user requests content from a website, CDN distributes the content to multiple CDN edge nodes distributed around the world, allowing users to obtain data from the nearest node, thereby reducing latency and increasing access speed.

[0003] At present, traffic theft based on CDN refers to the behavior of illegal users obtaining the available URL addresses of CDN customers (i.e. content providers) through improper means, and then using these addresses to make a large number of illegal accesses or requests, thereby stealing or abusing CDN service resources. This behavior will cause the service costs of CDN customers to rise sharply, because CDN services are usually charged based on traffic or number of requests. At the same time, a large amount of illegal traffic will also bring huge service pressure to CDN edge nodes, causing node resource exhaustion, increased response delays, and even service paralysis, which will seriously affect the access efficiency and experience of normal users.

[0004] In order to solve the problem of traffic theft, traditional technology mainly relies on the configuration instruction language of Nginx proxy service. When the client request reaches the Nginx proxy service, the legitimacy of the request is determined in real time. The method of determining the legitimacy of the request can include a variety of conventional CDN service configurations, such as IP blacklist and whitelist configuration, single IP access frequency limit, UA blacklist and whitelist configuration, Referer blacklist and whitelist configuration, and traffic control.

[0005] However, the conventional CDN service configuration mentioned above uses domain names as the configuration unit, and the protection mechanism of each domain name needs to be connected and configured separately. This method not only increases the operation and maintenance costs, but also cannot effectively deal with cross-domain attacks. Therefore, it is urgently needed to be improved. Summary of the invention

[0006] Based on this, it is necessary to provide an abnormal traffic processing method, device, computer equipment and readable storage medium that can effectively process abnormal traffic in response to the above technical problems.

[0007] In a first aspect, the present application provides a method for processing abnormal traffic, which is applied to a CDN edge node. The method includes:

[0008] Determine whether the current access traffic has a risk of traffic fraud based on the current access traffic in the current period and the historical access traffic received in the historical period;

[0009] If it exists, the access behavior characteristics corresponding to the current access traffic are analyzed to obtain the abnormal fraud traffic in the current access traffic;

[0010] Abnormal fraudulent traffic is processed according to the behavioral characteristics corresponding to the abnormal fraudulent traffic.

[0011] In one embodiment, determining whether the current access traffic has a risk of traffic fraud based on the current access traffic in the current period and the historical access traffic received in the historical period includes:

[0012] Determine the total current traffic corresponding to the current access traffic and the total historical traffic corresponding to the historical access traffic;

[0013] Determine the current traffic burst rate in the current period based on the traffic increment of the current traffic total compared to the historical traffic total;

[0014] Determine whether there is a risk of traffic fraud in the current access traffic based on the traffic increment, the current traffic burst rate, and whether the change trend between the current traffic burst rate and the reference traffic burst rate in the reference period is consistent;

[0015] The reference time period and the current time period are the same time period in different time periods.

[0016] In one embodiment, the access behavior characteristics include IP address, source page Referer, user agent UA and request uniform resource locator URI; the access behavior characteristics corresponding to the current access traffic are analyzed to obtain abnormal fraud traffic in the current access traffic, including:

[0017] Determine whether the IP address is abnormal based on the geographical location and access frequency corresponding to the IP address, as well as the match between the IP address and the preset address list;

[0018] Verify the legitimacy of the source page Referer and check whether there is a potential jump chain in the source page Referer. According to the legitimacy verification result and the check result, determine whether there is an abnormality in the source page Referer.

[0019] Determine whether there is any abnormality in the user agent UA based on the device type, device version, and browser features corresponding to the user agent UA;

[0020] Analyze the URL path corresponding to the request URI and verify whether there is any abnormality in the parameter value of the request URI. Determine whether there is any abnormality in the request URI based on the path analysis result and the verification result.

[0021] For each access flow in the current access flow, if any of the IP address, source page Referer, user agent UA and request URI corresponding to the access flow is abnormal, the access flow is determined to be abnormal fraudulent flow.

[0022] In one embodiment, the abnormal fraudulent traffic is processed according to the behavior characteristics corresponding to the abnormal fraudulent traffic, including:

[0023] Determine the initiator and request URL corresponding to the abnormal fraudulent traffic;

[0024] Return and update the URL to the initiator; the updated URL is used to access the security verification page;

[0025] If the initiator's access to the security verification page is not detected, the initiator is determined to be a fraudulent operator, and the abnormal fraudulent traffic is processed according to the behavioral characteristics corresponding to the abnormal fraudulent traffic.

[0026] In one embodiment, the method further comprises:

[0027] If the initiator's access behavior to the security verification page is detected, the initiator is determined to be a manual operator, and the manual operator is verified.

[0028] In one embodiment, the abnormal fraudulent traffic is processed according to the behavior characteristics corresponding to the abnormal fraudulent traffic, including:

[0029] If it is determined that there is an intelligent scheduling configuration in the CDN edge node, then according to the behavioral characteristics corresponding to the abnormal fraudulent traffic, an abnormal processing node is selected in the distribution corresponding to the CDN edge node; the risk value of the CDN edge node processing abnormal fraudulent traffic is less than the risk value of the abnormal processing node processing abnormal fraudulent traffic;

[0030] Send abnormal fraudulent traffic to the exception processing node.

[0031] In one embodiment, the abnormal fraudulent traffic is processed according to the behavior characteristics corresponding to the abnormal fraudulent traffic, including:

[0032] When it is determined that there is no intelligent scheduling configuration in the CDN edge node or it is determined that the intelligent scheduling configuration fails to execute, an exception handling strategy for the abnormal fraudulent traffic is generated according to the behavior characteristics corresponding to the abnormal fraudulent traffic;

[0033] According to the exception handling strategy, the exception handling strategy is added to the Location layer of the Nginx component in the CDN edge node to obtain the updated Nginx component to handle abnormal fraudulent traffic.

[0034] In one embodiment, the distribution selection exception handling node corresponding to the CDN edge node includes:

[0035] In the distribution corresponding to the CDN edge node, select the candidate processing node that matches the behavior characteristics corresponding to the abnormal fraudulent traffic;

[0036] An abnormal processing node is selected from the candidate processing nodes based on their geographical location, load conditions, and processing capabilities for abnormal fraudulent traffic.

[0037] In one embodiment, an abnormal handling strategy for abnormal fraudulent traffic is generated according to the behavioral characteristics corresponding to the abnormal fraudulent traffic, including:

[0038] According to the abnormal traffic analysis model, the behavioral characteristics corresponding to the abnormal fraudulent traffic are analyzed to generate an abnormal handling strategy for the abnormal fraudulent traffic;

[0039] Among them, the abnormal traffic analysis model is constructed based on the behavioral characteristics and historical processing strategies corresponding to historical fraudulent traffic.

[0040] In a second aspect, the present application also provides an abnormal traffic processing device, including:

[0041] The traffic risk verification module is used to determine whether the current access traffic has a risk of traffic fraud based on the current access traffic in the current period and the historical access traffic received in the historical period;

[0042] The abnormal traffic identification module is used to analyze the access behavior characteristics corresponding to the current access traffic if any, and obtain the abnormal fraudulent traffic in the current access traffic;

[0043] The abnormal traffic processing module is used to process abnormal fraudulent traffic according to the behavioral characteristics corresponding to the abnormal fraudulent traffic.

[0044] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0045] Determine whether the current access traffic has a risk of traffic fraud based on the current access traffic in the current period and the historical access traffic received in the historical period;

[0046] If it exists, the access behavior characteristics corresponding to the current access traffic are analyzed to obtain the abnormal fraud traffic in the current access traffic;

[0047] Abnormal fraudulent traffic is processed according to the behavioral characteristics corresponding to the abnormal fraudulent traffic.

[0048] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0049] Determine whether the current access traffic has a risk of traffic fraud based on the current access traffic in the current period and the historical access traffic received in the historical period;

[0050] If it exists, the access behavior characteristics corresponding to the current access traffic are analyzed to obtain the abnormal fraud traffic in the current access traffic;

[0051] Abnormal fraudulent traffic is processed according to the behavioral characteristics corresponding to the abnormal fraudulent traffic.

[0052] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0053] Determine whether the current access traffic has a risk of traffic fraud based on the current access traffic in the current period and the historical access traffic received in the historical period;

[0054] If it exists, the access behavior characteristics corresponding to the current access traffic are analyzed to obtain the abnormal fraud traffic in the current access traffic;

[0055] Abnormal fraudulent traffic is processed according to the behavioral characteristics corresponding to the abnormal fraudulent traffic.

[0056] The above-mentioned abnormal traffic processing method, device, computer equipment and readable storage medium, the present application compares the access traffic in the current period with the access traffic in the historical period, and the technical solution can dynamically identify abnormal changes in the traffic pattern. This analysis method based on historical data can more accurately identify traffic theft behavior and reduce false positives and false negatives compared to traditional static configurations (such as IP black and white lists, single IP access frequency limits, etc.). The present application does not rely on fixed configuration rules, but analyzes and judges according to actual traffic data, and can automatically adapt to traffic changes in different time periods, as well as specific attack modes faced by different content providers, thereby improving the flexibility and adaptability of the protection mechanism. Traditional CDN service configuration requires docking and configuration for each domain name separately, which is not only time-consuming and labor-intensive, but also difficult to maintain. The technical solution of the present application processes the traffic of all domain names through a unified traffic analysis model, simplifies the configuration and management process, and reduces operation and maintenance costs. When facing cross-domain attacks, traditional domain name-based configurations are often difficult to respond effectively. The technical solution of the present application identifies fraudulent transactions by analyzing traffic behavior characteristics and does not rely on specific domain names or configurations. Therefore, it can more effectively resist cross-domain attacks and protect the service security of CDN customers. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 A schematic diagram of a flow chart of a method for handling abnormal traffic in one embodiment;

[0059] Figure 2 A flowchart of a step of determining whether current access traffic has a risk of traffic fraud in one embodiment;

[0060] Figure 3 A flowchart of steps for obtaining abnormal fraudulent traffic in current access traffic in one embodiment;

[0061] Figure 4 A flowchart of the steps of processing abnormal fraudulent traffic according to the behavioral characteristics corresponding to the abnormal fraudulent traffic in an embodiment;

[0062] Figure 5 The present invention is a flowchart of the steps for processing abnormal fraudulent traffic according to the behavioral characteristics corresponding to the abnormal fraudulent traffic in an embodiment. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0064] In an exemplary embodiment, Figure 1 As shown, a method for processing abnormal traffic is provided, and the method is applied to a CDN edge node, including:

[0065] S101, determining whether there is a risk of traffic fraud in the current access traffic based on the current access traffic in the current period and the historical access traffic received in the historical period.

[0066] Obtain current access traffic data in the current period from the user. Retrieve historical access traffic data in the same or similar time periods in the past from the historical database. Perform time series analysis on the traffic data of the current period and historical periods to extract traffic change trends, periodic characteristics, etc. Calculate the traffic mean, variance, kurtosis, skewness and other statistical characteristics of the current period and historical periods. Identify significant features such as abnormal peaks and troughs in traffic data.

[0067] Compare the traffic trends of the current period with those of the historical period to analyze whether there are significant deviations. Use time series analysis techniques (such as ARIMA model, Holt-Winters model, etc.) to predict the normal traffic range of the current period and compare it with the actual traffic. Compare the traffic statistical characteristics of the current period with those of the historical period, such as whether there are significant differences in mean, variance, etc. Use statistical test methods (such as t-test, F-test, etc.) to determine whether the traffic data of the current period is significantly different from the historical data.

[0068] A reasonable traffic anomaly threshold is set based on the fluctuation range and change trend of historical traffic data. If the traffic data in the current period exceeds the set anomaly threshold, or the traffic trend and statistical characteristics are significantly different from historical data, the current access traffic is judged to be at risk of traffic fraud.

[0069] S102: If it exists, the access behavior characteristics corresponding to the current access traffic are analyzed to obtain the abnormal fraud traffic in the current access traffic.

[0070] Specifically, extract the IP addresses of all requests in the current access traffic. Analyze the distribution of IP addresses to identify whether there are abnormally high-frequency requests from the same IP address or the same IP segment. Use IP address blacklists or graylists for comparison to check whether there are known malicious IP addresses.

[0071] Analyze the request characteristics such as URL pattern, request frequency, request time, etc. Identify whether there are abnormal request patterns, such as a large number of repeated requests, requests to non-existent URLs, etc.

[0072] Extract the User-Agent field in the request and analyze information such as client type, operation, browser version, etc. Identify whether there are abnormal or forged User-Agents, which are often related to automated scripts or malware.

[0073] Extract the Referer field in the request and analyze the legitimacy of the request source. Identify whether there are requests from illegal or untrusted sources.

[0074] Comprehensively analyze information from multiple dimensions such as IP address, request mode, User-Agent, Referer, etc. to identify whether there are abnormal behavior patterns, such as multiple visits to different pages in a short period of time, and access patterns that are significantly different from normal users.

[0075] According to the behavioral characteristics of normal access traffic, set reasonable abnormal thresholds. These thresholds include request frequency, request mode, User-Agent distribution, etc. Use the set abnormal thresholds to filter the current access traffic and identify requests that meet the abnormal behavior characteristics.

[0076] S103, processing the abnormal fraudulent transaction flow according to the behavior characteristics corresponding to the abnormal fraudulent transaction flow.

[0077] Specifically, analyze the access patterns of abnormal fraudulent traffic, including access frequency, access time, access path, etc., to identify whether it has typical attack characteristics. Trace the source IP address of abnormal fraudulent traffic to determine whether it belongs to the known malicious IP address range or whether it comes from a high-risk area. Check the request content carried by abnormal fraudulent traffic to analyze whether it contains malicious code, illegal requests or abnormal parameters.

[0078] For example, for ongoing abnormal fraudulent traffic, immediately start a real-time interception mechanism to prevent it from further consuming CDN resources or affecting the access experience of normal users. Add the IP address of the source of the identified abnormal fraudulent traffic to the blacklist to prevent it from launching attacks again. For IP addresses that frequently have abnormal traffic, consider implementing stricter access control policies, such as IP address blocking. Limit the speed of abnormal fraudulent traffic, limit its access speed or number of visits, to reduce the pressure on CDN resources. For IP addresses from high-risk areas or those that frequently launch attacks, consider implementing a global flow limiting strategy.

[0079] The above abnormal traffic processing method, this application compares the access traffic in the current period with the access traffic in the historical period, and the technical solution can dynamically identify abnormal changes in the traffic pattern. This analysis method based on historical data can more accurately identify traffic theft and reduce false positives and false negatives compared to traditional static configurations (such as IP black and white lists, single IP access frequency limits, etc.). This application does not rely on fixed configuration rules, but analyzes and judges based on actual traffic data, and can automatically adapt to traffic changes in different time periods, as well as specific attack modes faced by different content providers, thereby improving the flexibility and adaptability of the protection mechanism. Traditional CDN service configuration requires docking and configuration for each domain name separately, which is not only time-consuming and labor-intensive, but also difficult to maintain. The technical solution of this application processes the traffic of all domain names through a unified traffic analysis model, simplifies the configuration and management process, and reduces the operation and maintenance costs. In the face of cross-domain attacks, traditional domain-based configurations are often difficult to respond effectively. The technical solution of this application identifies theft by analyzing traffic behavior characteristics, and does not rely on specific domain names or configurations, so it can more effectively resist cross-domain attacks and protect the service security of CDN customers.

[0080] In an exemplary embodiment, Figure 2 As shown, according to the current access traffic in the current period and the historical access traffic received in the historical period, it is determined whether the current access traffic has the risk of traffic fraud, including:

[0081] S201, determining the total current traffic volume corresponding to the current access traffic volume and the total historical traffic volume corresponding to the historical access traffic volume.

[0082] Optionally, obtain the access traffic data of the current period in real time from the CDN (Content Distribution Network) log. This data usually includes information such as request time, request type, request source IP, requested URL, response status code, number of bytes transmitted, etc. Count the total number of all valid requests in the current period, that is, the current total traffic. This can be achieved by counting request records.

[0083] Get access traffic data for a period of time (such as one day, one week, one month, etc.) from the CDN's historical log storage. This data also includes information such as request time, request type, request source IP, requested URL, response status code, number of bytes transferred, etc. According to the analysis requirements, select a specific time period related to the calculation of the total historical traffic. This can be a fixed time period in the past, such as the same period last week, or a combination of several identical time periods in the past. Count all valid requests within the selected time period to obtain the total historical traffic. This can be achieved by accumulating the request records within the selected time period.

[0084] S202: Determine the current traffic surge rate in the current period according to the traffic increment between the current traffic total and the historical traffic total.

[0085] Specifically, the current total flow rate of the current period (recorded as C_current) and the historical total flow rate of the same period or reference period (recorded as C_historical) are obtained. The difference between the current total flow rate and the historical total flow rate is calculated, that is, the flow increment (recorded as ΔC). The calculation formula of the flow increment is: ΔC = C_current-C_historical.

[0086] The traffic increase rate refers to the growth ratio of the current traffic relative to the traffic in the same period or reference period in history, and is used to quantify the abnormal growth of traffic. Calculate the traffic increase rate (denoted as R_increase). The calculation formula of the traffic increase rate is: R_increase = (ΔC / C_historical) × 100%.

[0087] S203, determining whether there is a risk of traffic fraud in the current access traffic based on the traffic increment, the current traffic burst rate, and whether the change trend between the current traffic burst rate and the reference traffic burst rate in the reference time period is consistent.

[0088] The reference period and the current period are the same period in different time periods. The reference period specifically means that when performing traffic analysis, a period with the same time characteristics (such as hour, date, week, etc.) as the current period but belonging to a different time period (such as last week, last month, same period last year, etc.) is selected as a reference.

[0089] Specifically, the difference between the current total traffic volume calculated in step S202 and the total historical traffic volume is the traffic increment (ΔC). The current traffic increase rate (R_increase_current) calculated in step S202 indicates the growth ratio of the current traffic volume relative to the historical traffic volume. Select one or more reference time periods (such as the same time period in the past week, the same time period in the past month, etc.), and calculate the traffic increase rate in these time periods as the reference traffic increase rate (R_increase_reference): Set a traffic increment threshold.

[0090] If the current traffic increment ΔC exceeds the threshold, it indicates that the current traffic has abnormal growth and needs further analysis. Calculate the difference between the current traffic burst rate and the reference traffic burst rate (ΔR_increase). Analyze whether the change trend of ΔR_increase is consistent. If the current traffic burst rate is significantly higher than the reference traffic burst rate, and this growth trend is inconsistent with historical data, it is an indication of traffic fraud.

[0091] In an exemplary embodiment, the access behavior characteristics include IP address, source page Referer, user agent UA and request uniform resource locator URI.

[0092] like Figure 3 As shown, the access behavior characteristics corresponding to the current access traffic are analyzed to obtain abnormal fraud traffic in the current access traffic, including:

[0093] S301, determining whether there is an abnormality in the IP address based on the geographical location and access frequency corresponding to the IP address, and the matching result between the IP address and a preset address list.

[0094] Optionally, use an IP address geographic location database or online tools (such as IP Data Cloud, etc.) to query the geographic location information of the IP address, including country, region, city, etc. Collect and record the access frequency of each IP address in a specific time period, including the number of visits, access time interval, etc.

[0095] Obtain a preset address list, including known suspicious IP addresses, blacklist IP addresses, whitelist IP addresses, etc. Compare the queried IP address location information with the expected normal location range. If the location of the IP address does not match the expected location (for example, the access source does not match the actual business operation location), it is marked as a geographic location anomaly.

[0096] Access frequency anomaly detection: Analyze the access frequency data of IP addresses and identify IP addresses with abnormally high access frequencies. Set a reasonable access frequency threshold and treat access frequencies exceeding the threshold as abnormal.

[0097] Blacklist matching: Match the IP address with the blacklist. If the match is successful, it is marked as a blacklist IP address, which is high risk. Whitelist matching: Match the IP address with the whitelist. If the match is successful, it is marked as a trusted IP address to reduce the risk of abnormal judgment. Other preset list matching: According to business needs, there are other preset address lists (such as partner IP address lists, specific service access IP address lists, etc.), which are matched and marked accordingly.

[0098] S302, verify the legitimacy of the source page Referer, and check whether there is a potential jump chain in the source page Referer, and determine whether there is an abnormality in the source page Referer based on the legitimacy verification result and the check result.

[0099] The Referer field is obtained in the HTTP request header, and the field usually contains the URL of the page that the user was on before accessing the current page.

[0100] Optionally, check whether the format of the Referer field conforms to the standard format of the URL, including the protocol (such as http, https), domain name, path, etc. If the format is incorrect, mark it as an abnormal Referer. Verify whether the domain name in the Referer field belongs to the expected list of legal domain names. If the domain name is not in the list of legal domain names, or the domain name is marked as suspicious or malicious, mark it as an abnormal Referer. For specific business scenarios, you can further verify whether the path in the Referer field meets expectations. If the path is incorrect or does not conform to business logic, mark it as an abnormal Referer.

[0101] Parse the Referer field and extract the URL components, including the protocol, domain name, path, query parameters, etc. Check whether the Referer field contains multiple jump links, that is, whether there are multiple redirects or jumps to the current page. Jump chains can be detected by analyzing the path and query parameters in the Referer field, or by parsing special tags (such as redirect parameters) in the Referer field. For the detected jump chains, evaluate their legitimacy. Check whether each link in the jump chain belongs to a legal and trusted domain name, and whether the length and complexity of the jump chain are reasonable. If the jump chain contains malicious or suspicious links, or the length and complexity of the jump chain are abnormal, it is marked as an abnormal Referer. Comprehensively consider the legitimacy verification results of the Referer field and the jump chain inspection results, and conduct a comprehensive evaluation of the abnormality of the Referer. If the Referer field has an abnormality in any of the format, domain name, path, or jump chain, or multiple anomalies occur at the same time, it is determined that the Referer has an abnormality.

[0102] S303: Determine whether there is any abnormality in the user agent UA based on the device type, device version, and browser features corresponding to the user agent UA.

[0103] Specifically, check whether the parsed device type matches the expected device type list. Common device types include mobile phones, tablets, desktop computers, etc. If the device type is not in the expected list or does not match the business scenario, it is marked as an abnormal device type.

[0104] For specific device types, further check whether the device version is reasonable. For example, check whether the version of the mobile phone operation is too old or too new, and whether it is consistent with the version range supported by the current business. If the device version is abnormal, such as too old or not in the known version list, it is marked as an abnormal device version.

[0105] Check whether the parsed browser identifiers (such as Chrome, Firefox, Safari, etc.) are legal and common. If the browser identifier is not in the expected list, or does not match the business scenario (such as the business only supports specific browsers), mark it as an abnormal browser. For a specific browser, further check whether its version is reasonable. For example, check whether the browser version is too old or whether there are known security vulnerabilities. If the browser version is abnormal, such as being too old or having known security issues, mark it as an abnormal browser version. Based on business needs, you can further check specific features of the browser, such as whether it supports specific JavaScript functions, whether certain browser plug-ins are enabled, etc. If the browser features are not as expected or there are security risks, mark it as an abnormal browser feature.

[0106] S304: Analyze the URL path corresponding to the request URI and verify whether there is an abnormality in the parameter value in the request URI. Determine whether there is an abnormality in the request URI based on the path analysis result and the verification result.

[0107] Specifically, check the path part in the request URI against the preset legal path list one by one to see if it matches. If the path is not in the legal list, or its format and hierarchy do not match the business logic, it is marked as an abnormal path. In-depth analysis of the depth and structure of the path to check whether there are abnormally long paths, illegal characters, or potential path traversal risks (such as .. / ). If the path structure is abnormal, such as attempting to access a non-public directory or there are signs of a path traversal attack, it is also marked as abnormal.

[0108] Furthermore, verify whether each parameter in the request URI is in the expected parameter list. If an unknown parameter appears or a required parameter is missing, it is considered an abnormal parameter. Perform strict format and range checks on the value of each parameter. For example, check whether numeric parameters are within a reasonable range and whether string parameters conform to a specific format (such as email address, phone number, etc.). If the parameter value format is incorrect or exceeds the expected range, it is marked as an abnormal parameter value. Check whether the parameter value contains special characters or potential injection attack codes (such as SQL injection, XSS attack, etc.). If special characters or injection risks are found, immediately mark it as an exception and take corresponding security measures.

[0109] If there is an abnormality in any link of the request URI in the path, parameters or parameter value, or multiple abnormalities occur at the same time, it is decisively determined that there is an abnormality in the request URI.

[0110] S305: For each access flow in the current access flow, if any of the IP address, source page Referer, user agent UA and request URI corresponding to the access flow is abnormal, the access flow is determined to be abnormal fraudulent flow.

[0111] Optionally, for each access flow, review the anomaly detection results of its IP address, source page Referer, user agent UA and request URI in the previous steps S301 to S304. Ensure that the anomaly detection of each dimension has been completed and a clear abnormal or normal judgment has been obtained.

[0112] Set a comprehensive judgment rule, that is, if any item in the access traffic (IP address, source page Referer, user agent UA, request URI) is abnormal, the entire access traffic is considered abnormal. For each access traffic, execute the comprehensive judgment rule based on the abnormal detection results of each dimension. If any item in the access traffic is marked as abnormal, the access traffic is immediately determined as abnormal fraudulent traffic.

[0113] For access that is determined to be abnormal traffic fraud, the relevant information is recorded in detail, including the abnormal type, abnormal time, access source, target resource, etc. According to business needs and security policies, the corresponding response mechanism is triggered to reject or intercept abnormal access traffic, and an alarm notification is sent to the administrator. The abnormal IP address is added to the blacklist or the flow is limited, and further security analysis and investigation of the abnormal access is carried out.

[0114] In an exemplary embodiment, Figure 4 As shown, according to the behavioral characteristics corresponding to the abnormal fraudulent traffic, the abnormal fraudulent traffic is processed, including:

[0115] S401, determine the initiator and request URL corresponding to the abnormal fraudulent traffic.

[0116] Optionally, extract the source IP address of each flow in the abnormal flow record. Perform geolocation, location query, and check whether these IP addresses belong to the known malicious IP list. Combined with the flow characteristics (such as access time, access frequency, access mode, etc.), comprehensively judge the legitimacy of the IP address and its correlation with the abnormal flow, so as to lock the initiator. If user login or identity authentication is supported, it can be further combined with user ID, session information or login log to identify the specific user identity of the abnormal flow.

[0117] Furthermore, the request URL is directly extracted from the abnormal traffic record, which usually contains the specific resource path accessed and the query parameters. If the request URL does not contain complete URL information (such as protocol, domain name, etc.), it needs to be supplemented according to the configuration or traffic context to construct a complete request URL. Verify whether the extracted request URL is legal by comparing it with the legal URL list or routing table. If the URL is not in the legal list, or there are security risks such as path traversal and parameter injection, it is further confirmed to be an abnormal request URL.

[0118] S402, returning and updating the URL to the initiator.

[0119] The update URL is used to access the security verification page.

[0120] Specifically, create a web page dedicated to security verification. The page can include multiple security verification methods such as verification code input, secondary authentication, and user information confirmation. Ensure that the design of the security verification page meets the user experience principles and can effectively resist automated attacks and fraudulent behavior. Assign a unique URL to the security verification page, namely the update URL, and configure the update URL into the response logic so that it can be returned to the initiator when needed.

[0121] Extract the initiator's IP address, user agent (UA) and other key information from the abnormal fraud traffic records. Construct an HTTP redirect response based on the extracted initiator information. The response contains the status code 302 (or other appropriate redirection status code) and the Location header, and the value of the Location header is set to the update URL. Establish a TCP connection with the initiator to ensure that the response message can be reliably transmitted to the initiator. Send the constructed redirect response message to the initiator via the TCP connection. Ensure that the format and content of the response message comply with the HTTP protocol specification. After sending the response message, record relevant log information, including the initiator's IP, redirection time, response status, etc., for subsequent analysis and auditing.

[0122] When the initiator receives the redirect response and accesses the update URL, the security verification page will receive the HTTP request from the initiator. According to the design of the security verification page, the initiator is subject to necessary security verification. This includes verification code verification, secondary authentication, user information confirmation and other steps. If the initiator passes the security verification, it is allowed to continue access or perform subsequent operations. If the initiator fails the security verification, its access request is denied and further security measures are taken, such as blocking the IP address, reporting abnormal behavior, etc.

[0123] S403: If the initiator's access behavior to the security verification page is not detected, the initiator is determined to be a fraudulent user, and the abnormal fraudulent traffic is processed according to the behavior characteristics corresponding to the abnormal fraudulent traffic.

[0124] Specifically, if the initiator's access behavior to the security verification page is not detected, it is determined that the initiator has not passed the security verification, that is, the initiator determines that the initiator is a fraudulent operator (robot).

[0125] For example, for traffic identified as fraudulent operations, appropriate processing measures are taken based on their behavioral characteristics, such as immediately blocking subsequent access requests from the initiator. Adding the initiator's IP address, UA and other information to the blacklist for rapid interception. Sending alerts to the security team to notify potential fraudulent behavior. Logging fraudulent traffic for subsequent analysis and tracing.

[0126] Furthermore, if the initiator's access behavior to the security verification page is detected, the initiator is determined to be a manual operator, and the manual operator is verified. Please give the specific implementation process of the above technical solution.

[0127] Specifically, if the initiator's access behavior to the security verification page is detected, the initiator is determined to be a manual operator, and the traffic determined to be the manual operator is further verified, including: verifying the input information on the security verification page (such as verification code, secondary authentication, etc.). A comprehensive judgment is made based on user historical behavior, device fingerprint and other information. If the verification passes, the user is allowed to continue access or perform subsequent operations. If the verification fails, take appropriate measures based on the cause of the failure, such as requiring re-verification, restricting access, etc.

[0128] In an exemplary embodiment, abnormal fraudulent traffic is processed according to the behavioral characteristics corresponding to the abnormal fraudulent traffic, including: if it is determined that there is an intelligent scheduling configuration in the CDN edge node, an abnormal processing node is selected in the distribution corresponding to the CDN edge node according to the behavioral characteristics corresponding to the abnormal fraudulent traffic; and the abnormal fraudulent traffic is sent to the abnormal processing node.

[0129] Among them, the risk value of CDN edge nodes processing abnormal fraudulent traffic is smaller than the risk value of abnormal processing nodes processing abnormal fraudulent traffic.

[0130] It is understandable that if there is an intelligent scheduling configuration in the CDN edge node, a suitable exception handling node will be selected in the distribution corresponding to the CDN edge node according to the behavioral characteristics of abnormal fraudulent traffic. The exception handling node is a node dedicated to handling abnormal traffic, with stronger processing capabilities, richer processing strategies or a safer processing environment.

[0131] When selecting an exception handling node, consider a variety of factors, such as the node's processing capacity, historical processing results, current load conditions, etc. The goal is to select a node that can efficiently and securely handle abnormal fraudulent traffic and forward the abnormal fraudulent traffic from the CDN edge node to the selected exception handling node. The forwarding process involves technical means such as network routing and protocol conversion to ensure that the traffic can reach the exception handling node accurately and quickly.

[0132] Specifically, selecting an exception processing node in the distribution corresponding to the CDN edge node includes: selecting a candidate processing node that matches the behavioral characteristics corresponding to the abnormal fraudulent traffic in the distribution corresponding to the CDN edge node; selecting an exception processing node from the candidate processing nodes based on the candidate processing nodes' geographical location, load conditions, and processing capabilities for abnormal fraudulent traffic.

[0133] It is understandable that there are one or more candidate processing nodes in the distribution corresponding to the CDN edge node. It is necessary to screen out matching nodes from the candidate nodes based on the behavioral characteristics of abnormal fraudulent traffic. The matching process is based on preset rules or algorithms, such as screening based on historical processing effects of traffic characteristics, node expertise, and other factors.

[0134] Geographic location is an important consideration when selecting anomaly processing nodes. Giving priority to nodes that are geographically close to the source of abnormal fraudulent traffic can reduce network latency and improve processing efficiency. The load of candidate processing nodes needs to be evaluated in real time. Selecting nodes with relatively low load and sufficient processing capacity to handle new traffic can ensure the stability and efficiency of the processing process. In addition to load conditions, the specific processing capabilities of candidate processing nodes for abnormal fraudulent traffic also need to be evaluated. This includes factors such as the processing speed of the node, the effectiveness of the processing strategy, and the historical processing success rate.

[0135] Based on the above analysis, an optimal exception processing node is selected from the candidate processing nodes by comprehensively considering multiple factors such as geographical location, load conditions, and processing capacity. The selection process involves complex algorithms or decision models to ensure that the selected node can maximize the processing requirements.

[0136] In an exemplary embodiment, Figure 5 As shown, according to the behavioral characteristics corresponding to the abnormal fraudulent traffic, the abnormal fraudulent traffic is processed, including:

[0137] S501, when it is determined that there is no intelligent scheduling configuration in the CDN edge node or it is determined that the intelligent scheduling configuration fails to execute, an abnormal handling strategy for abnormal fraudulent traffic is generated according to the behavioral characteristics corresponding to the abnormal fraudulent traffic.

[0138] Specifically, the detected abnormal fraudulent traffic is analyzed in depth. This includes identifying key features such as the source of the traffic, request frequency, access mode, user agent information, request parameters, etc. Through these features, the nature of the abnormal fraudulent traffic and the attack method can be preliminarily determined.

[0139] Furthermore, check whether there are preset processing strategies for such abnormal traffic in the CDN edge node, and evaluate whether these strategies are applicable or whether they fail to execute. If they exist and the strategy is valid, apply the strategy directly; if they do not exist or the strategy fails to execute, proceed to the next step to generate a new abnormal handling strategy.

[0140] Based on the analysis of abnormal fraudulent traffic, targeted exception handling strategies are generated. The handling strategies include: blocking access, limiting access frequency, requiring secondary verification, recording logs for subsequent analysis, sending alerts to notify the security team, etc. The specific content of the strategy will be customized according to the behavioral characteristics of abnormal fraudulent traffic and security requirements. Once the exception handling strategy is generated and optimized and tested, it will be applied to the CDN edge node to handle subsequent abnormal fraudulent traffic in real time.

[0141] S502, according to the exception handling strategy, add the exception handling strategy to the Location layer of the Nginx component in the CDN edge node, obtain the updated Nginx component, and process the abnormal fraudulent traffic.

[0142] Optionally, find and access the configuration files of the Nginx component on the CDN edge node. Usually, these configuration files are located in a specific directory, such as / etc / nginx / nginx.conf or a *.conf file in a subdirectory. In the Nginx configuration file, find the Location block related to abnormal fraudulent traffic. The Location block is used to define how Nginx handles requests for a specific URL or path. In the selected Location block, add the corresponding Nginx instructions or configurations according to the specific content of the exception handling strategy.

[0143] For example, if the exception handling strategy is to block access, you can add the deny all; directive; if it is to limit the access frequency, you can use the limit_req_zone and limit_req directives; if it is to require secondary verification, you need to combine Lua scripts or other modules to implement it. Save the changes to the Nginx configuration file and make sure there are no syntax errors. Before formally applying it, you can verify the validity of the configuration in a test environment to ensure that the exception handling strategy works as expected. Use the nginx-sreload command or an equivalent instruction to reload the Nginx configuration for the changes to take effect. This will not cause Nginx service interruption, but will smoothly apply the new configuration.

[0144] Specifically, based on the behavioral characteristics corresponding to the abnormal fraudulent traffic, an exception handling strategy for the abnormal fraudulent traffic is generated, including: based on the abnormal traffic analysis model, the behavioral characteristics corresponding to the abnormal fraudulent traffic are analyzed, and an exception handling strategy for the abnormal fraudulent traffic is generated.

[0145] Among them, the abnormal traffic analysis model is constructed based on the behavioral characteristics and historical processing strategies corresponding to historical fraudulent traffic.

[0146] First, collect a large amount of historical fraudulent traffic data, including key behavioral features such as the source of the traffic, request frequency, access mode, user agent information, and request parameters. At the same time, collect the processing strategies corresponding to these historical fraudulent traffic, including the measures taken, processing effects, duration, etc. Use machine learning algorithms (such as decision trees, random forests, neural networks, etc.) or statistical methods (such as cluster analysis, anomaly detection, etc.) to build an abnormal traffic analysis model. The input of the model is the behavioral characteristics of abnormal fraudulent traffic, and the output is the predicted processing strategy or processing suggestion. During the model training process, use the historical fraudulent traffic data and the corresponding processing strategies as training samples, and iteratively optimize the model parameters to improve the prediction accuracy of the model.

[0147] Use a portion of historical data as a validation set to verify and evaluate the constructed abnormal traffic analysis model. By calculating the model's accuracy, recall rate, F1 score and other indicators, evaluate the model's ability to identify abnormal fraudulent traffic and generate processing strategies.

[0148] Deploy the built and verified abnormal traffic analysis model to the monitoring of CDN edge nodes. When new abnormal fraudulent traffic is detected, extract the behavioral characteristics of the traffic in real time and input them into the abnormal traffic analysis model. Based on the input behavioral characteristics, the model outputs a processing strategy or processing suggestion for the abnormal fraudulent traffic. The processing strategy includes blocking access, limiting access frequency, requiring secondary verification, recording logs, sending alarms, etc. Apply the generated abnormal processing strategy to the Nginx component or other processing mechanism of the CDN edge node to process the abnormal fraudulent traffic in real time. Monitor the execution effect of the processing strategy, and provide feedback and optimization to the model based on the actual effect to improve the adaptability and accuracy of the model.

[0149] As the network environment and security threats change, we continuously collect new fraud traffic data and processing strategies to update and train abnormal traffic analysis models. This ensures that the model can continuously adapt to new abnormal fraud behavior characteristics and provide effective processing strategies.

[0150] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0151] Based on the same inventive concept, the embodiment of the present application also provides an abnormal traffic processing device for implementing the abnormal traffic processing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more abnormal traffic processing device embodiments provided below can refer to the limitations of the abnormal traffic processing method above, and will not be repeated here.

[0152] In an exemplary embodiment, an abnormal traffic processing device is provided, which is configured in a CDN node and includes:

[0153] The traffic risk verification module is used to determine whether the current access traffic has a risk of traffic fraud based on the current access traffic in the current period and the historical access traffic received in the historical period;

[0154] The abnormal traffic identification module is used to analyze the access behavior characteristics corresponding to the current access traffic if any, and obtain the abnormal fraudulent traffic in the current access traffic;

[0155] The abnormal traffic processing module is used to process abnormal fraudulent traffic according to the behavioral characteristics corresponding to the abnormal fraudulent traffic.

[0156] Each module in the above abnormal traffic processing device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0157] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0158] Determine whether the current access traffic has a risk of traffic fraud based on the current access traffic in the current period and the historical access traffic received in the historical period;

[0159] If it exists, the access behavior characteristics corresponding to the current access traffic are analyzed to obtain the abnormal fraud traffic in the current access traffic;

[0160] Abnormal fraudulent traffic is processed according to the behavioral characteristics corresponding to the abnormal fraudulent traffic.

[0161] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0162] Determine whether the current access traffic has a risk of traffic fraud based on the current access traffic in the current period and the historical access traffic received in the historical period;

[0163] If it exists, the access behavior characteristics corresponding to the current access traffic are analyzed to obtain the abnormal fraud traffic in the current access traffic;

[0164] Abnormal fraudulent traffic is processed according to the behavioral characteristics corresponding to the abnormal fraudulent traffic.

[0165] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0166] Determine whether the current access traffic has a risk of traffic fraud based on the current access traffic in the current period and the historical access traffic received in the historical period;

[0167] If it exists, the access behavior characteristics corresponding to the current access traffic are analyzed to obtain the abnormal fraud traffic in the current access traffic;

[0168] Abnormal fraudulent traffic is processed according to the behavioral characteristics corresponding to the abnormal fraudulent traffic.

[0169] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0170] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for processing abnormal traffic, characterized in that: Applied to CDN edge nodes, the method includes: Determine whether there is a risk of traffic fraud in the current access traffic based on the current access traffic in the current period and the historical access traffic received in the historical period; If so, the access behavior characteristics corresponding to the current access traffic are analyzed to obtain abnormal fraud traffic in the current access traffic; The abnormal fraudulent transaction traffic is processed according to the behavioral characteristics corresponding to the abnormal fraudulent transaction traffic.

2. The method according to claim 1, characterized in that The determining, based on the current access traffic in the current period and the historical access traffic received in the historical period, whether the current access traffic has a risk of traffic fraud includes: Determine the total current traffic corresponding to the current access traffic and the total historical traffic corresponding to the historical access traffic; Determine the current traffic burst rate of the current period according to the traffic increment of the current traffic total compared to the historical traffic total; Determine whether there is a risk of traffic fraud in the current access traffic based on the traffic increment, the current traffic burst rate, and whether the change trend between the current traffic burst rate and the reference traffic burst rate in the reference time period is consistent; The reference time period and the current time period are the same time period in different time periods.

3. The method according to claim 1, characterized in that The access behavior characteristics include IP address, source page Referer, user agent UA and request uniform resource locator URI; the access behavior characteristics corresponding to the current access traffic are analyzed to obtain abnormal fraudulent traffic in the current access traffic, including: Determine whether the IP address is abnormal based on the geographical location and access frequency corresponding to the IP address, and the matching result between the IP address and a preset address list; Verify the legitimacy of the source page Referer, and check whether there is a potential jump chain in the source page Referer, and determine whether there is an abnormality in the source page Referer based on the legitimacy verification result and the check result; Determine whether there is an abnormality in the user agent UA based on the device type, device version, and browser features corresponding to the user agent UA; Analyze the URL path corresponding to the request URI, and verify whether the parameter value in the request URI is abnormal, and determine whether the request URI is abnormal according to the path analysis result and the verification result; For each access flow in the current access flow, if any one of the IP address, source page Referer, user agent UA and request URI corresponding to the access flow is abnormal, the access flow is determined to be abnormal fraudulent flow.

4. The method according to claim 3, characterized in that The processing of the abnormal fraudulent transaction flow according to the behavior characteristics corresponding to the abnormal fraudulent transaction flow includes: Determine the initiator and request URL corresponding to the abnormal fraudulent traffic; Return and update the URL to the initiator; the updated URL is used to access the security verification page; If the initiator's access behavior to the security verification page is not detected, the initiator is determined to be a fraudulent user, and the abnormal fraudulent traffic is processed according to the behavioral characteristics corresponding to the abnormal fraudulent traffic.

5. The method according to claim 4, characterized in that The method further comprises: If the initiator's access behavior to the security verification page is detected, the initiator is determined to be a manual operator, and a verification process is performed on the manual operator.

6. The method according to claim 4, characterized in that The processing of the abnormal fraudulent transaction flow according to the behavior characteristics corresponding to the abnormal fraudulent transaction flow includes: If it is determined that there is an intelligent scheduling configuration in the CDN edge node, then according to the behavior characteristics corresponding to the abnormal fraudulent flow, an abnormal processing node is selected in the distribution system corresponding to the CDN edge node; the risk value of the CDN edge node processing the abnormal fraudulent flow is less than the risk value of the abnormal processing node processing the abnormal fraudulent flow; The abnormal fraudulent flow is sent to the abnormal processing node.

7. The method according to claim 4, characterized in that The processing of the abnormal fraudulent transaction flow according to the behavior characteristics corresponding to the abnormal fraudulent transaction flow includes: When it is determined that there is no intelligent scheduling configuration in the CDN edge node or it is determined that the intelligent scheduling configuration fails to execute, an exception handling strategy for the abnormal fraudulent traffic is generated according to the behavior characteristics corresponding to the abnormal fraudulent traffic; According to the exception handling strategy, the exception handling strategy is added to the Location layer of the Nginx component in the CDN edge node to obtain an updated Nginx component to process the abnormal fraudulent traffic.

8. The method according to claim 6, characterized in that The distribution system corresponding to the CDN edge node selects an exception processing node, including: In the distribution system corresponding to the CDN edge node, selecting a candidate processing node that matches the behavior characteristics corresponding to the abnormal fraudulent traffic; An abnormal processing node is selected from the candidate processing nodes based on the geographical location, load conditions, and processing capabilities of the abnormal fraudulent traffic of the candidate processing nodes.

9. The method according to claim 7, characterized in that: The generating, according to the behavior characteristics corresponding to the abnormal fraudulent traffic, an abnormal handling strategy for the abnormal fraudulent traffic, comprises: According to the abnormal traffic analysis model, the behavior characteristics corresponding to the abnormal fraudulent traffic are analyzed to generate an abnormal handling strategy for the abnormal fraudulent traffic; The abnormal traffic analysis model is constructed based on the behavioral characteristics and historical processing strategies corresponding to historical fraudulent traffic.

10. An abnormal flow processing device, characterized in that: Configured at a CDN node, the device includes: A traffic risk verification module is used to determine whether there is a risk of traffic fraud based on the current access traffic in the current period and the historical access traffic received in the historical period; An abnormal traffic identification module is used to analyze the access behavior characteristics corresponding to the current access traffic, if any, to obtain abnormal fraudulent traffic in the current access traffic; The abnormal traffic processing module is used to process the abnormal fraudulent traffic according to the behavioral characteristics corresponding to the abnormal fraudulent traffic.

Images