Information interception method, device, storage medium and electronic device based on address resolution

Abstract

The present application proposes an information interception method, device, storage medium and electronic device based on address resolution, the method includes: obtaining multiple request information received by the management platform within a preset time length; determining multiple first target address information based on multiple request address information; determining the first flow state of multiple target address codes based on multiple data volume information, the first flow state includes an unsafe flow state; if the first flow state is an unsafe flow state, determining the information source information of the second target address information based on the pre-constructed first address database and the second target address information; intercepting the request information based on the information source information. In this way, the system can quickly identify the address that will cause security problems and quickly parse it to obtain the source information of the resolved information, and conduct targeted interception on the information of the information source information, so that the efficiency of the system blockage problem is improved and the system burden is reduced.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to an information interception method, device, storage medium and electronic device based on address resolution. Background Art

[0002] As the Internet becomes more and more prosperous, the number of addresses is growing explosively. The amount of information received by the system platform in a short period of time is huge. However, since the data processing capacity of the system platform is limited, if the amount of data obtained in a short period of time exceeds the load capacity, it will affect the system platform's processing of the obtained information and cause system congestion. At this time, it is necessary to de-congest the cause of the congestion. The current method is to intercept information based on the address that causes the problem.

[0003] However, the current system's methods for solving congestion problems are not smart, fast, or accurate enough, and still have problems such as low decongestion efficiency and excessive system burden. Summary of the invention

[0004] The embodiments of the present application provide an information interception method, device, storage medium and electronic device based on address resolution, which can improve the efficiency of solving system congestion problems and reduce system burden.

[0005] In a first aspect, an embodiment of the present application provides an information interception method based on address resolution, which is applied to a server of a management system, wherein the management system further includes a management platform and a first memory, wherein the first memory is provided with a pre-built first address database, and the method includes:

[0006] Acquire multiple request information received by the management platform within a preset time length, wherein a single request information includes request address information;

[0007] Determine a plurality of first target address information based on the plurality of request address information, wherein the first target address information is address information that is not identified as unsafe, and a single first target address information includes a target address code and data volume information, wherein the data volume information is used to characterize the amount of data sent by the outside world to the management system within the preset time length;

[0008] Determine a first flow state of a plurality of the target address codes based on the plurality of the data volume information, wherein the first flow state includes an unsafe flow state;

[0009] If the first traffic state is the traffic insecurity state, determining information source information of the second target address information based on the pre-constructed first address database and the second target address information, the second target address information is the first target address information of the traffic insecurity state, the pre-constructed first address database is used to store multiple addresses and perform address resolution, and the pre-constructed first address database is a database including a multi-level index structure;

[0010] An interception operation is performed on the request information based on the information source information, and the interception operation is used to reduce the amount of request information received from the target address in the traffic insecure state sent to the management platform.

[0011] In a possible embodiment, the first memory is further provided with a pre-built second address database, the pre-built second address database is used to store historical unsafe addresses and perform address resolution queries, and the pre-built second address database is a database including a multi-level index structure; the determining of the plurality of first target address information based on the plurality of request address information comprises:

[0012] The existence of a first resolution result obtained by performing address resolution based on the plurality of request address information and the pre-built second address database, wherein the first resolution result is address information obtained by parsing the second address database, and the existence includes existence and non-existence;

[0013] Determine multiple address security states corresponding to the multiple request address information based on the existence situation, the address security state includes a secure state and an unsecure state, if the existence situation is the existence, the address security state is the secure state, if the existence situation is the non-existence, the address security state is the unsecure state;

[0014] If the address security state is the security state, the request address information of the security state is determined as the first target address information, and a plurality of first target address information are obtained.

[0015] In a possible embodiment, determining the first flow status of the plurality of target address codes based on the plurality of data volume information includes:

[0016] A first data flow parameter is determined based on the data volume information corresponding to the target address code in the security state; and the first flow state is determined based on the first data flow parameter and a first preset flow threshold.

[0017] In a possible embodiment, the multi-level index structure of the pre-constructed first address database includes a first primary index area and a first secondary index area, and the pre-constructed first address database includes a first header area, a first record area, the first secondary index area, and the first primary index area; the addresses of the first header area, the first record area, the first secondary index area, and the first primary index area have a sequentially extended relationship;

[0018] The first header area is constructed with a first header structure, the first recording area is constructed with a first recording area structure, the first level index area is constructed with a first level index area structure, and the first level index area is constructed with a first level index area structure;

[0019] The first header structure includes multiple header data lengths, the first record area structure includes record value length, the first secondary index area structure includes secondary index address data length, and the first primary index area structure includes start address length, end address length and record address length.

[0020] In a possible embodiment, determining the information source information of the second target address information based on the pre-built first address database and the second target address information includes:

[0021] Performing a data conversion operation on the second target address information to obtain standard second target address information;

[0022] Determining first address location information based on the standard second target address information and the first secondary index area;

[0023] Performing a first-level index based on the first address location information, a binary indexing method, and the first first-level index area to determine a second address location information;

[0024] The information source information of the second target address information is determined based on the second address location information.

[0025] In a possible embodiment, the method further includes:

[0026] If the address security state is the unsafe state, a pre-interception operation is performed based on the target address code of the unsafe state, wherein the pre-interception operation is used to prevent the management platform from obtaining request information from the target address code of the unsafe state;

[0027] The pre-interception operation based on the target address code in the unsafe state includes:

[0028] Determine a second data flow parameter based on the data volume information corresponding to the target address code in the unsafe state;

[0029] Determine a second traffic state based on the second data traffic parameter and the second preset traffic threshold, wherein the second traffic state includes the traffic unsafe state;

[0030] If the second traffic state is the traffic unsafe state, obtaining the first resolution result obtained by performing address resolution on the pre-built second address database, and determining information source information of the target address code;

[0031] An interception operation is performed based on the information source information of the target address code and the request information of the target address code in the traffic insecurity state.

[0032] In a possible embodiment, after the step of intercepting the request information based on the information source information, the method further includes:

[0033] The requested address information corresponding to the request information is stored in the pre-constructed first address database.

[0034] In a second aspect, an embodiment of the present application provides an information interception device based on address resolution, which is applied to a server of a management system, wherein the management system further includes a management platform and a first memory, wherein the first memory is provided with a pre-built first address database, and the device includes:

[0035] An acquisition module, used to acquire multiple request information received by the management platform within a preset time length, wherein a single request information includes request address information;

[0036] A first determination module is used to determine a plurality of first target address information based on the plurality of request address information, wherein the first target address information is address information that is not identified as unsafe, and a single first target address information includes a target address code and data volume information, wherein the data volume information is used to characterize the amount of data sent by the outside world to the management system within the preset time length;

[0037] A second determination module is used to determine a first flow state of a plurality of the target address codes based on the plurality of the data volume information, wherein the first flow state includes an unsafe flow state;

[0038] A third determination module is used to determine, if the first traffic state is the traffic insecure state, information source information of the second target address information based on the pre-constructed first address database and the second target address information, the second target address information is the first target address information of the traffic insecure state, the pre-constructed first address database is used to store multiple addresses and perform address resolution, and the pre-constructed first address database is a database including a multi-level index structure;

[0039] An interception module is used to intercept the request information based on the information source information, and the interception operation is used to reduce the amount of request information received from the target address of the management platform that is in the unsafe traffic state.

[0040] In a third aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes some or all of the steps described in the first aspect.

[0041] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising a processor, a second memory, a communication interface, and one or more programs, wherein the one or more programs are stored in the second memory and are configured to be executed by the processor, and the program includes instructions for executing some or all of the steps described in the first aspect of the embodiment of the present application.

[0042] In a fifth aspect, an embodiment of the present application provides a computer program product, wherein the computer program product includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute some or all of the steps described in the first aspect of the embodiment of the present application. The computer program product may be a software installation package.

[0043] By implementing the embodiments of the present application, multiple request information received by the management platform within a preset time length is obtained, and each of the request information includes request address information; multiple first target address information is determined based on the multiple request address information, and the first target address information is address information that is not identified as unsafe. The single first target address information includes a target address code and data volume information, and the data volume information is used to characterize the amount of data sent by the outside world to the management system within the preset time length; based on the multiple data volume information, a first flow state of multiple target address codes is determined, and the first flow state includes an unsafe flow state; if the first flow state is the unsafe flow state, the information source information of the second target address information is determined based on the pre-constructed first address database and the second target address information, and the second target address information is the first target address information in the unsafe flow state, and the pre-constructed first address database is used to store multiple addresses and perform address resolution, and the pre-constructed first address database is a database containing a multi-level index structure; based on the information source information, an interception operation is performed on the request information, and the interception operation is used to reduce the amount of request information received by the target address in the unsafe flow state sent to the management platform. In this way, the system can quickly identify addresses that may cause security problems and quickly parse them to obtain the source information of the resolution information, and conduct targeted interception of the information from the source information, thereby improving the efficiency of system blocking problems and reducing the system burden. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the background technology, the drawings required for use in the embodiments of the present invention or the background technology will be described below.

[0045] Figure 1 It is a schematic diagram of the architecture of a management system provided in an embodiment of the present application;

[0046] Figure 2 It is a method flow chart of an information interception method for address resolution provided by an embodiment of the present application;

[0047] Figure 3 It is a method flow chart of another method for intercepting information of address resolution provided by an embodiment of the present application;

[0048] Figure 4 It is a block diagram of the functional units of an information interception device based on address resolution provided by an embodiment of the present application;

[0049] Figure 5 It is a block diagram of the functional units of another information interception device based on address resolution proposed in an embodiment of the present application;

[0050] Figure 6 It is a block diagram of the functional units of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0052] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or electronic device that includes a series of steps or units is not limited to the listed steps or units, but in an optional example also includes steps or units that are not listed, or in an optional example also includes other steps or units inherent to these processes, methods, products, or electronic devices.

[0053] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0054] The information interception method, device, storage medium and electronic device based on address resolution provided in the embodiments of the present application can be applied to Figure 1 In the management system shown, see Figure 1 , Figure 1 It is a schematic diagram of the architecture of a management system provided in an embodiment of the present application. The management system 100 includes a management platform 110, a server 120 and a first storage 130. The management platform 110 can communicate with the server 120.

[0055] In this solution, the management platform 110 can be accessed by users, and the management platform 110 can interact with the server 120 to obtain data information generated by other terminal devices for access, which can specifically be request information. The server 120 refers to a remote computer used to handle a large number of computing tasks and perform analysis and processing. The first memory 130 is used to store data. In this solution, the first memory 130 is provided with a pre-built first address database, and in some cases, a pre-built first address database is also provided. In this solution, the server 120 is used to perform specific control and situation analysis of information interception.

[0056] Based on this, the present application provides an address resolution information interception method, device, storage medium and electronic device, and the present application is described in detail below in conjunction with the accompanying drawings.

[0057] See also Figure 2 , Figure 2 1 is a method flow chart of an information interception method for address resolution provided by an embodiment of the present application, the method is applied to a server of a management system, the management system further includes a management platform and a first memory, the first memory is provided with a pre-built first address database. Figure 2 As shown, the method comprises the following steps:

[0058] S210, obtaining multiple request information received by the management platform within a preset time length, wherein a single request information includes request address information.

[0059] The preset time length may be a unit time length, such as per second, per millisecond, or a fixed time length, such as two seconds, five seconds, or 2 milliseconds. The specific time length is not limited here. The multiple request information obtained is information generated by the access behavior of the external device to the management platform. A single request information includes request address information, and the request address information is the address information corresponding to the single request information. It can be understood that multiple request information pairs include multiple request address information.

[0060] Specifically, the request address information includes IP addresses corresponding to multiple request information. Specifically, the request address information can be an IPv4 address, an IPv6 address, or other types of IP addresses, which are not limited here. This solution takes the IPv4 address as an example for detailed description.

[0061] S220, determining multiple first target address information based on multiple request address information, wherein the first target address information is address information that has not been identified as unsafe, and a single first target address information includes a target address code and data volume information, and the data volume information is used to characterize the amount of data sent by the outside world to the management system within the preset time length.

[0062] Among them, the first target address information is an IP address, which is an address information that is determined to be unsafe. The method for determining whether the address is safe may be to determine whether the request address information has ever been involved in malicious behavior. Malicious behavior includes traffic insecurity behavior. Traffic insecurity behavior may specifically be that the amount of data sent within a preset time length exceeds the limit. Specifically, it may be determined by a preset traffic threshold. The specific value of the preset traffic threshold is not limited here, and the preset traffic threshold may include multiple. The first target address information may include a target address code and data volume information. The target address code may be a specific IP address corresponding to the first target address information, and the data volume information is the amount of data generated by the IP address within a preset time length. The outside world is the client or terminal device that accesses the management platform, which is not limited here.

[0063] In a possible embodiment, the first memory is further provided with a pre-built second address database, the pre-built second address database is used to store historical unsafe addresses and perform address resolution queries, and the pre-built second address database is a database including a multi-level index structure; the determining of the plurality of first target address information based on the plurality of request address information comprises:

[0064] 21. performing address resolution based on the plurality of requested address information and the pre-built second address database to obtain a first resolution result, wherein the first resolution result is address information obtained by parsing the second address database, and the existence condition includes existence and non-existence;

[0065] 22. Determine multiple address security states corresponding to the multiple request address information based on the existence condition, the address security state includes a secure state and an unsecure state, if the existence condition is the existence condition, the address security state is the secure state, if the existence condition is the non-existence condition, the address security state is the unsecure state;

[0066] 23. If the address security state is the security state, determine the request address information of the security state as the first target address information to obtain multiple first target address information.

[0067] Among them, the second address database is used to store historical unsafe addresses and perform address resolution queries. The second address database can be updated in real time. When a new unsafe address is generated, the new unsafe address is stored in the second address database. The second address database can be used for address resolution. The specific process includes: performing a data conversion operation on the request address information to obtain standard request address information; performing secondary indexing and / or primary indexing based on the standard request address information to determine the first resolution result. Among them, if the first resolution result exists, it means that the relevant information of the specific IP address of the request address information has been stored in the second address database, indicating that the IP address has performed malicious behavior, and the security status of the address is unsafe. If the first resolution result does not exist, it means that the IP address has not performed malicious behavior, and the security status of the address is safe.

[0068] Among them, if the address security status of the request address information is a safe state, the request address information is determined as the first target address information, and if there are multiple request address information with safe states, multiple first target address information are obtained. If the address security status of the request address information is an unsafe state, a pre-interception operation can be performed. The purpose of the pre-interception operation is to increase vigilance against the address if it is known that the address has performed malicious behavior before, and the probability that the address may generate malicious behavior is high. Specifically, it can be to lower the threshold for determining malicious behavior.

[0069] Optionally, the multi-level index structure of the second address database may include a second first-level index area and a second second-level index area, and the pre-built second address database includes a second header area, a second record area, a second second-level index area and a second first-level index area; the addresses of the second header area, the second record area, the second second-level index area and the second first-level index area have a sequential extension relationship; the second header area is constructed with a second header structure, the second record area is constructed with a second record area structure, the second first-level index area is constructed with a second first-level index area structure, and the second second-level index area is constructed with a second second-level index area structure; the second header structure includes multiple header data lengths, the second record area structure includes a record value length, the second second-level index area structure includes a second-level index address data length, and the second first-level index area structure includes a start address length, an end address length and a record address length. Specifically, the second address database can be used for address resolution, and the specific process may include: performing a data conversion operation on the request address information to obtain standard request address information; determining third address location information based on the standard request address information and the second secondary index area; performing a primary index based on the third address location information, a binary indexing method, and the second primary index area to determine fourth address location information; and determining the information source information of the request address information based on the fourth address location information.

[0070] It can be seen that in this embodiment, by screening the second address database, the security situation of at least one requested address information can be determined, and the next operation can be performed based on the security situation. The setting of the second address database can speed up the parsing process, and while increasing the system's response speed to unsafe addresses, it also increases the response accuracy, which is beneficial to reducing the occurrence of system congestion.

[0071] In a possible embodiment, the method further includes:

[0072] 24. If the address security state is the unsafe state, a pre-interception operation is performed based on the target address code of the unsafe state, and the pre-interception operation is used to prevent the management platform from obtaining request information from the target address code of the unsafe state; the pre-interception operation based on the target address code of the unsafe state includes:

[0073] 241. Determine a second data flow parameter based on the data volume information corresponding to the target address code in the unsafe state;

[0074] 242. Determine a second traffic state based on the second data traffic parameter and a second preset traffic threshold, where the second traffic state includes the traffic unsafe state;

[0075] 243. If the second traffic state is the traffic unsafe state, obtain the first resolution result obtained by performing address resolution on the pre-built second address database to determine information source information of the target address code;

[0076] 244. Perform an interception operation based on the information source information of the target address code and the request information of the target address code in the traffic insecure state.

[0077] Among them, if the address security status is unsafe, it means that malicious behavior has occurred at the address, and a pre-interception operation is performed based on the target address code of the unsafe state. The pre-interception operation can be achieved by lowering the screening threshold to increase vigilance against the address.

[0078] Specifically, the pre-interception operation based on the target address code of the unsafe state may include: determining the second data flow parameter based on the data volume information corresponding to the target address code of the unsafe state. Since the data volume information is generated within a period of time, it may be a total amount or multiple discrete amounts. If it is a total amount, the data volume information can be directly used as the second data flow parameter. If it is multiple discrete amounts, the second data flow parameter is obtained based on a mathematical method, which may be a summation. The specific details are not limited here. Then, the second flow state is determined based on the second data flow parameter and the second preset flow threshold. The flow represented by the second preset flow threshold is less than the flow represented by the first preset flow threshold. If the second data flow parameter is greater than the second preset flow threshold, it means that the second flow state of the second data flow parameter is a flow unsafe state. If it is a flow unsafe state, the information source information of the second target address information is determined based on the pre-constructed first address database and the second target address information. The above-mentioned pre-constructed first address database is a database with the same structure as the pre-constructed second address database. The difference is that the specific addresses stored are different, and the specific meanings represented are different. A plurality of addresses are pre-stored in a pre-constructed first address database, and the plurality may be millions, tens of millions, hundreds of millions, or other orders of magnitude. For example, it may be 4.2 billion, which is not limited here. Then, a first resolution result is obtained by performing address resolution on a pre-constructed second address database, and the first resolution result is used as the information source information of the target address code. Then, based on the information source information of the target address code, an interception operation is performed on the request information of the target address code in the unsafe flow state. Specifically, the interception operation may be to intercept all or part of the information, and the specific interception situation is not limited here. If the flow is safe, the information of the address is released normally without interception.

[0079] It can be seen that in this embodiment, by performing a security judgment to obtain an unsafe state, unsafe addresses are screened, unsafe addresses are determined and the standard for unsafe traffic is lowered, so that addresses where malicious behavior has occurred are easier to identify, while increasing the system's response speed to unsafe addresses. At the same time, the response accuracy is increased, which is beneficial to reducing the occurrence of system congestion, and a pre-built second address database that is the same as the pre-built first address database is used. The structure of this database can improve the response speed and reduce the system burden.

[0080] It should be noted that the specific structure of the pre-constructed second address database is the same as that of the pre-constructed first address database. For the specific structure, please refer to the specific structure of the pre-constructed first address database in S240.

[0081] S230, determining a first flow state of the plurality of target address codes based on the plurality of data volume information, wherein the first flow state includes an unsafe flow state.

[0082] The first traffic state may include an unsafe traffic state and a safe traffic state. The unsafe traffic state may indicate that the data volume information exceeds a set threshold, and the safe traffic state may indicate that the data volume information does not exceed the set threshold.

[0083] In a possible embodiment, determining the first flow state of the multiple target address codes based on the multiple data volume information includes: determining a first data flow parameter based on the data volume information corresponding to the target address code in a safe state; and determining the first flow state based on the first data flow parameter and a first preset flow threshold.

[0084] Specifically, if the first data flow parameter is greater than the first preset flow threshold, the first flow state is an unsafe state; if the first data flow parameter is not greater than the first preset flow threshold, the first flow state is a safe state. Since the data volume information is generated within a period of time, it may be a total amount or multiple discrete amounts. If it is a total amount, the data volume information can be directly used as the first data flow parameter. If it is multiple discrete amounts, the first data flow parameter is obtained based on a mathematical method, which may be a summation, and is not specifically limited here.

[0085] It can be seen that in this embodiment, by setting the traffic threshold to determine whether the current amount of information is safe, the system can quickly identify addresses that may cause security problems and quickly parse them to obtain the source information of the parsed information, and conduct targeted interception of the information source information, thereby improving the efficiency of system blocking problems and reducing the system burden.

[0086] S240, if the first traffic state is the unsafe traffic state, determine the information source information of the second target address information based on the pre-constructed first address database and the second target address information, the second target address information is the first target address information in the unsafe traffic state, the pre-constructed first address database is used to store multiple addresses and perform address resolution, and the pre-constructed first address database is a database containing a multi-level index structure.

[0087] When the first traffic state is an unsafe traffic state, the information source information of the second target address information is determined based on the pre-built first address database and the second target address information. If the first traffic state is a safe traffic state, the information of the address is released normally without interception.

[0088] Specifically, the multi-level index structure of the pre-constructed first address database includes a first primary index area and a first secondary index area, and the pre-constructed first address database includes a first header area, a first record area, the first secondary index area and the first primary index area; the addresses of the first header area, the first record area, the first secondary index area and the first primary index area have a sequential extension relationship; the first header area is constructed with a first header structure, the first record area is constructed with a first record area structure, the first primary index area is constructed with a first primary index area structure, and the first secondary index area is constructed with a first secondary index area structure; the first header structure includes multiple header data lengths, the first record area structure includes a record value length, the first secondary index area structure includes a secondary index address data length, and the first primary index area structure includes a start address length, an end address length and a record address length.

[0089] Among them, the above-mentioned sequential continuation relationship means that the storage addresses of the above-mentioned first header area, first recording area, first secondary index area and first primary index area are arranged in order from small to large, and can be adjacent or there can be empty addresses between every two, which is not limited here.

[0090] It should be noted that, since IPv4 addresses are divided into groups, that is, multiple consecutive IPv4 addresses can be resolved into one area, for example, 123.132.0.0-123.132.127.255 can be resolved as "Country C | Province S | City J | China Unicom". Country C, Province S, City J is only used for example. In actual use, it is the actual area name. Most of them are fixed values ​​in the first two segments and arbitrary values ​​in the last two segments, which are grouped together. Therefore, the 8-byte IPv4 address can be split into the fixed values ​​of the first two segments of 4 bytes and the range values ​​of the last two segments of 4 bytes. If it exceeds the range of the fixed value, it will be split. For example, 27.198.0.0-27.199.255.255 needs to be split into 27.198.0.0-27.198.255.255 and 27.199.0.0-27.199.255.255.

[0091] For example, the storage address of the first header area is 00000000-00000013 (20 bytes in total), the storage address of the first record area is 00000014-00069B5F (432972 bytes in total), the storage address of the first secondary index area is 00069B60-000A9B63 (262148 bytes in total), and the storage address of the first primary index area is 000A9B64-005E8E1B (5501624 bytes in total).

[0092] Specifically, a pre-built first address database storing IPv4 addresses is used as an example for description. Since the pre-built first address database and the pre-built second address database have the same structure, the following description of the database does not include the first or second prefix restriction. For example, the header area can be the first header area or the second header area. The structure of the first pre-built first address database can refer to the following Table 1.

[0093] Table 1

[0094]

[0095] Among them, the header area can be extended arbitrarily. The checksum refers to the CRC32 check of all the remaining data after removing the checksum. Specifically, the structure of the header area can refer to the following Table 2. The checksum is a value calculated by a specific algorithm on the data, which is used to verify whether an error occurs during the transmission or storage of the data. The version number is used to identify the specific version followed by the data structure or the data it contains. This 4-byte version number allows the system to clearly understand the format, functional characteristics and compatibility with other versions of the data. As the system or application is upgraded, the data structure may change. Through the version number, the program that processes the data can adopt the corresponding parsing and processing methods. For example, when the data format is upgraded from version 1 to version 2, the program can judge and use the parsing logic corresponding to the new version based on the version number. The extension part provides flexibility and scalability for the data structure. Since its length is not limited, additional information can be added according to actual needs, such as metadata of specific applications, functional identifiers that may be needed in the future, etc. For example, as the business develops, it may be necessary to add information such as data encryption identifiers and data source identifiers, which can be placed in the extension part without modifying the fixed-length data part, ensuring the compatibility and maintainability of the data structure.

[0096] Table 2

[0097]

[0098] The record area includes multiple records, and the structure of each record can be referred to in Table 3. The length of the record value does not include the 1 byte it occupies, and the maximum length of the record value is 255 bytes. The data type of the record value is encoded in UTF8.

[0099] Table 3

[0100]

[0101] Among them, since the IPv4 address range is fixed, the number of secondary indexes is also fixed. The number of secondary indexes is 256×256=65536 (each segment occupies 256 entries, a total of 2 segments), and the end address of the last primary index also needs to be recorded. The final number of entries is 65537, of which 65537=256×256+1. The secondary index area includes multiple second indexes, and the format structure of each second index can be referred to in the following Table 4. The secondary index is essentially a 256×256 array, with a total of 65537 secondary indexes.

[0102] Table 4

[0103]

[0104] For example, the first and second secondary indexes record the primary index addresses of IPv4 addresses 0.0.0.0-0.0.255.255 and 0.0.0.0-0.1.255.255. Since 0.0.0.0-0.255.255.255 is the first record, 0.0.0.0-0.0.255.255 and 0.0.0.0-0.1.255.255 are both within this range, so the primary index address of the second record is the same as that of the first record. The storage results are shown in Table 5 below.

[0105] Table 5

[0106]

[0107] Among them, the first-level index area includes multiple first indexes, and the format structure of each first index can be referred to as shown in the following Table 6.

[0108] Table 6

[0109]

[0110] For example, in the order of IPv4 addresses, each group of IPv4 addresses records a primary index, where the first 2 bytes are the starting IPv4 address, the middle 2 bytes are the ending IPv4 address, and the last 4 bytes are the record address. For example, the IPv4 address 123.132.0.0-123.132.127.255, the storage result is:

[0111] Table 7

[0112]

[0113] In the process of pre-building an address database, specifically, the first address database needs to store data, that is, enter several pieces of information including address information and resolution information for subsequent use, that is, the process of determining the source information of the information.

[0114] Specifically, when entering data, the original data is obtained to form an original record. The format of the original record of each original data is: "starting IPv4 address, ending IPv4 address, country, province, city, Internet service provider" and separated by "|", for example, "123.132.0.0|123.132.127.255|C country|S province|J city|China Unicom", and each original record occupies one line. First, read all the original data, and split each original record into the format of "starting IPv4 address", "ending IPv4 address" and "country|province|city|Internet service provider" (record), put the record into a deduplicated and sorted array, and put the starting IPv4 address, ending IPv4 address and record value feature code (hash value) into the array. Then specify the record area address, traverse the record array, and put the feature code (hash value), address and record value of each record into the sequential mapping. Then calculate the storage capacity occupied by the record area and the primary index area to determine the file size. Then create a file, and put the data in the order of record area, primary index area, secondary index area, and header area, where the header area puts the data in the order of checksum, version number, record area address, secondary index area address, and primary index area address to form an uncompressed file. Optionally, the file is then compressed, which can be in zip format or other formats that are not limited here.

[0115] For example, the original data is shown in Table 8, with a total of 683,844 entries.

[0116] Table 8

[0117]

[0118] For example, the generated uncompressed files can refer to the following Tables 9, 10, 11 and 12. Specifically, the header area address is 00000000-00000013 (a total of 20 bytes), refer to Table 9; the record area address is 00000014-00069B5F (a total of 432972 bytes), refer to Table 10, a total of 13828 entries, where the record value length in brackets is the decimal length, and the record value in brackets is the UTF8 encoding value; the secondary index area address is 00069B60-000A9B63 (a total of 262148 bytes), a total of 65537 entries, please refer to Table 11; the primary index area address is 000A9B64-005E8E1B, a total of 5501624 bytes, a total of 687703 entries, please refer to Table 12.

[0119] Table 9

[0120]

[0121] Table 10

[0122]

[0123] Table 11

[0124]

[0125] Table 12

[0126]

[0127] It should be noted that based on this storage structure, that is, the pre-constructed first address database or the pre-constructed second address database, more addresses can be stored in a smaller space, reducing the burden on the system, and parsing with this structure can increase the speed of address parsing.

[0128] It should be noted that the description method of (letter) country (letter) province (letter) city, such as country C, province N, city X, is only used for example. In actual use, the letter part is the specific actual region name.

[0129] It can be seen that in this embodiment, an optimized database file storage structure is provided, which can store 4.2 billion IPv4 address locations in less than 3Mb; the algorithm is improved, and it takes an average of 0.13 microseconds to parse an IPv4 location; on this basis, the source data analysis of the system platform is carried out, so as to quickly intercept the IPv4 with malicious behavior. The speed of IPv4 address resolution is improved, and the response time of network attacks is improved. In this way, the system can quickly identify the address that will cause security problems and quickly parse it to obtain the source information of the resolution information, and carry out targeted interception of the information of the source information, so that the efficiency of system blocking problems is improved and the system burden is reduced.

[0130] In a possible embodiment, the information source information of the second target address information is determined based on the pre-constructed first address database and the second target address information, including: performing a data conversion operation on the second target address information to obtain standard second target address information; determining the first address location information based on the standard second target address information and the first secondary index area; performing a primary index based on the first address location information, a binary indexing method and the first primary index area to determine the second address location information; and determining the information source information of the second target address information based on the second address location information.

[0131] Among them, the data conversion process can be to convert the address format into a digital form through mathematical operations for retrieval use, and the standard second target address information is the address for the retrieval operation; specifically, the first address positioning information can start the address position of the first-level index, and the first address positioning information determined based on the standard second target address information and the first secondary index area can be based on the address of the first and second index areas in the storage structure, and the standard second target address information is combined with the address of the first and second index areas in the storage structure to obtain the first address positioning information; then, the binary indexing method is used in the first-level index area to perform the first-level indexing to determine the second address positioning information, and the second address positioning information is the retrieved matching information, and then the information is extracted based on the address of the information in the storage structure to obtain the information source information.

[0132] For example, first enter the IPv4 address. Convert to digital type: For the IPv4 address abcd, the formula for converting it to a number is a×256×256×256+b×256×256+c×256+d. This converts the IPv4 address from its dotted decimal representation to a 32-bit unsigned integer representation. Then divide by 65536 and take the integer part: 65536 is equal to 256×256, which is equivalent to dividing the 32-bit IPv4 digital representation into the first two segments and the last two segments. Taking the integer part can get a classification index based on the first two segments. Then multiply by 4 (the length of the first-level index is 4 bytes), where it is assumed that the length of the data block storing the first-level index is 4 bytes, and multiply by 4 in order to map the above result to the offset of the first-level index storage area for subsequent search. Then add the address of the second-level index area, where in order to find the actual address in the entire storage structure, it is necessary to add the starting address of the second-level index area, so that the starting position of the first-level index can be located. The data file address is located at this address, wherein, in the file storing the data, the corresponding position is found according to the calculated address, so as to read the primary index data later. Then 4 bytes of data are taken out as the left boundary of the primary index, wherein 4 bytes of data are read from the located position as the left boundary of the primary index, which is the starting position of the search range, and then 4 bytes of data are taken out as the right boundary of the primary index: 4 bytes of data are continued to be read as the right boundary of the primary index, which is the end position of the search range. If the left and right boundary numbers are equal, or the left boundary is equal to the right boundary - 8, then the left boundary + 4 position is located, wherein this is a special case processing. When the left and right boundaries meet the above conditions, the left boundary + 4 position is directly located to continue searching, which may be due to the special design of the data structure or the purpose of optimizing the search. Otherwise, the right boundary - 8 and the binary search method are used to find the primary index address. If the above special case is not met, the search range is narrowed (right boundary - 8), and the binary search method is used to find the index position corresponding to the target IPv4 address in the primary index. Binary search is an efficient search algorithm that reduces the search range by half each time. Then read 4 bytes of data as the record area address: After finding the first-level index address, read 4 bytes of data as the address of the record area, which points to the location where the specific information of the IPv4 address (such as the area) is stored. Then locate the data file address to this address, where the file address is located to the record area address to prepare for reading the record. Read 1 byte as the record length: read 1 byte from the record area, which indicates the length of the subsequent storage area. Then extract the record length byte as the record value, where, according to the record length, read the data of the corresponding length as the record value, which stores the area information of the IPv4 address. Finally, the parsing is completed, and the record value finally obtained is the area to which the IPv4 address belongs.

[0133] It should be noted that the construction process and parsing process of the pre-built second address database are the same as those of the pre-built first address database, except that the storage content is different. By changing the corresponding names, such as changing the first to the second, the relevant description content corresponding to the pre-built second address database can be obtained, which will not be repeated here.

[0134] It can be seen that in this embodiment, an address resolution method is provided, which can enable the system to quickly perform address resolution on addresses that may cause security issues to obtain information about the source of the resolution information, which is conducive to subsequent targeted interception of information from the source of the information, thereby improving the efficiency of system blocking problems and reducing system burden.

[0135] S250, performing an interception operation on the request information based on the information source information, wherein the interception operation is used to reduce the amount of request information received from the target address in the traffic insecure state sent to the management platform.

[0136] The specific interception operation may include: limiting the request frequency based on the IP address represented by the information source information, etc. For example, if it is determined that a certain IP address frequently sends abnormal requests, an interception strategy based on the IP address may be selected to block some or all requests sent by the IP address.

[0137] Among them, in some cases, the number of requests received by the target address of the management platform can be continuously monitored to observe whether the interception operation has achieved the expected mitigation effect. Relevant data can be obtained through the platform's own monitoring tools, network traffic analysis tools, etc. For example, through the platform's background monitoring system, check whether the number of requests received by the target address within the preset time length after the interception operation is implemented has dropped from the previous abnormal high level to a reasonable range. The reasonable range can be a preset threshold, and specifically, the first preset traffic threshold or the second preset traffic threshold can be adopted, or other traffic thresholds can be added, such as the third preset traffic threshold, etc., which are not limited here. In some cases, according to the monitoring results, if it is found that the interception operation has not achieved the expected effect, or has a negative impact on normal business (such as erroneously intercepting normal requests), the interception strategy needs to be adjusted. For example, if it is found that the interception strategy based on IP address has erroneously intercepted some normal business requests, the strategy can be further refined and changed to joint filtering based on request frequency and request content to ensure that both unsafe traffic can be effectively intercepted and normal business is not affected.

[0138] It can be seen that by implementing the embodiments of the present application, multiple request information received by the management platform within a preset time length is obtained, and a single request information includes request address information; multiple first target address information is determined based on the multiple request address information, and the first target address information is address information that has not been identified as unsafe. A single first target address information includes a target address code and data volume information, and the data volume information is used to characterize the amount of data sent by the outside world to the management system within the preset time length; based on the multiple data volume information, a first traffic state of multiple target address codes is determined, and the first traffic state includes an unsafe traffic state; if the first traffic state is the unsafe traffic state, the information source information of the second target address information is determined based on the pre-constructed first address database and the second target address information, and the second target address information is the first target address information in the unsafe traffic state, and the pre-constructed first address database is used to store multiple addresses and perform address resolution, and the pre-constructed first address database is a database containing a multi-level index structure; based on the information source information, an interception operation is performed on the request information, and the interception operation is used to slow down the amount of request information received by the target address in the unsafe traffic state sent to the management platform. In this way, the system can quickly identify addresses that may cause security problems and quickly parse them to obtain the source information of the resolution information, and conduct targeted interception of the information from the source information, thereby improving the efficiency of system blocking problems and reducing the system burden.

[0139] See also Figure 3 , Figure 3 is a method flow chart of another method for intercepting information of address resolution provided by an embodiment of the present application, such as Figure 3 As shown, the method comprises the following steps:

[0140] S310, obtaining multiple request information received by the management platform within a preset time length, wherein a single request information includes request address information;

[0141] S320, performing address resolution based on the plurality of request address information and the pre-built second address database to obtain existence status of the first resolution result, wherein the existence status includes existence and non-existence;

[0142] S331, if the existence condition is the existence, the address security state is the security state, and the request address information of the security state is determined as the first target address information to obtain multiple first target address information;

[0143] S3321, if the existence condition is the non-existence condition, the address security state is the unsafe state, and a second data flow parameter is determined based on the data volume information corresponding to the target address code in the unsafe state;

[0144] S3322: Determine a second traffic state based on the second data traffic parameter and the second preset traffic threshold, where the second traffic state includes the traffic insecurity state and the traffic security state;

[0145] S332211: If the second traffic state is the traffic unsafe state, obtain the first resolution result obtained by performing address resolution on the pre-built second address database to determine the information source information of the target address code;

[0146] S33212, performing an interception operation based on the information source information of the target address code and the request information of the target address code in the traffic insecure state;

[0147] S332221: If the second traffic state is the traffic safety state, the information of the address is released normally without interception;

[0148] S3311, determining a first flow state of a plurality of the target address codes based on the plurality of the data volume information, the first flow state comprising a flow insecurity state and a flow security state;

[0149] S33111: If the first traffic state is the traffic insecurity state, performing a parsing operation based on the pre-built first address database and the second target address information to determine the information source information of the second target address information;

[0150] S331111, intercepting the request information based on the information source information;

[0151] S33112: If the first traffic state is the traffic security state, the information of the address is released normally without interception.

[0152] It can be seen that through the steps in this embodiment and the pre-built first address database and second address database included therein, the system can quickly identify addresses that may cause security issues and quickly parse them to obtain source information of the resolution information, and conduct targeted interception of the information source information, thereby improving the efficiency of system blocking problems and reducing the system burden.

[0153] See also Figure 4 , Figure 4This is a functional unit composition block diagram of an information interception device based on address resolution proposed in an embodiment of the present application. The device is applied to a server of a management system. The management system also includes a management platform and a first memory, and the first memory is provided with a pre-built first address database. The information interception device 400 based on address resolution includes: an acquisition module 410, which is used to acquire multiple request information received by the management platform within a preset time length, and a single request information includes request address information; a first determination module 420, which is used to determine multiple first target address information based on multiple request address information, and the first target address information is address information that has not been identified as unsafe, and a single first target address information includes a target address code and data volume information, and the data volume information is used to characterize the amount of data sent by the outside world to the management system within the preset time length; a second determination module 430, which is used to determine a first traffic state of multiple target address codes based on multiple data volume information, and the first traffic state includes The invention relates to a flow-insecure state; a third determination module 440 is used to determine, if the first flow state is the flow-insecure state, the information source information of the second target address information based on the pre-constructed first address database and the second target address information, the second target address information is the first target address information of the flow-insecure state, the pre-constructed first address database is used to store multiple addresses and perform address resolution, the pre-constructed first address database is a database containing a multi-level index structure; an interception module 450 is used to intercept the request information based on the information source information, the interception operation is used to reduce the amount of request information received from the target address in the flow-insecure state sent to the management platform.

[0154] In a possible embodiment, the first memory is also provided with a pre-constructed second address database, and the pre-constructed second address database is used to store historical unsafe addresses and perform address resolution queries, and the pre-constructed second address database is a database containing a multi-level index structure; the first determination module 420 is specifically used to determine multiple first target address information based on multiple request address information: based on the multiple request address information and the pre-constructed second address database, obtain the existence of a first resolution result, the first resolution result is the address information obtained by parsing the second address database, and the existence includes existence and non-existence; based on the existence, determine multiple address security states corresponding to the multiple request address information, the address security state includes a secure state and an unsecure state, if the existence is the existence, then the address security state is the secure state, if the existence is the non-existence, then the address security state is the unsecure state; if the address security state is the secure state, determine the request address information of the secure state as the first target address information, and obtain multiple first target address information.

[0155] In a possible embodiment, the first determination module 420 is specifically configured to:

[0156] A first data flow parameter is determined based on the data volume information corresponding to the target address code in the security state; and the first flow state is determined based on the first data flow parameter and a first preset flow threshold.

[0157] In a possible embodiment, the first determination module 420 is also specifically used for: if the address security state is the unsafe state, performing a pre-interception operation based on the target address code of the unsafe state, the pre-interception operation is used to prevent the management platform from obtaining request information from the target address code of the unsafe state; the pre-interception operation based on the target address code of the unsafe state includes: determining a second data traffic parameter based on the data volume information corresponding to the target address code of the unsafe state; determining a second traffic state based on the second data traffic parameter and a second preset traffic threshold, the second traffic state including the unsafe traffic state; if the second traffic state is the unsafe traffic state, obtaining the first resolution result obtained by performing address resolution on the pre-constructed second address database, and determining the information source information of the target address code; performing an interception operation based on the information source information of the target address code and the request information of the target address code of the unsafe traffic state.

[0158] In a possible embodiment, the third determination module 440, in determining the information source information of the second target address information based on the pre-constructed first address database and the second target address information, is specifically used to: perform a data conversion operation on the second target address information to obtain standard second target address information; determine the first address location information based on the standard second target address information and the first secondary index area; perform a primary index based on the first address location information, the binary indexing method and the first primary index area to determine the second address location information; and determine the information source information of the second target address information based on the second address location information.

[0159] In a possible embodiment, the multi-level index structure of the pre-constructed first address database includes a first primary index area and a first secondary index area, and the pre-constructed first address database includes a first header area, a first record area, the first secondary index area and the first primary index area; the addresses of the first header area, the first record area, the first secondary index area and the first primary index area have a sequential extension relationship; the first header area is constructed with a first header structure, the first record area is constructed with a first record area structure, the first primary index area is constructed with a first primary index area structure, and the first secondary index area is constructed with a first secondary index area structure; the first header structure includes multiple header data lengths, the first record area structure includes a record value length, the first secondary index area structure includes a secondary index address data length, and the first primary index area structure includes a start address length, an end address length and a record address length.

[0160] In a possible embodiment, the interception module 450 is further specifically configured to: store the request address information corresponding to the request information in the pre-constructed first address database.

[0161] It is worth noting that the specific functional implementation of the information interception device 400 based on address resolution can be found in the above Figure 2 The description of the information interception method based on address resolution is shown, for example, the acquisition module 410 is used to implement the relevant content of executing S210. The various units or modules in the address-resolved information interception device 400 can be separately or completely combined into one or several other units or modules to constitute, or one (some) of the units or modules can be further divided into multiple functionally smaller units or modules to constitute, which can achieve the same operation without affecting the realization of the technical effects of the embodiments of the present invention. The above-mentioned units or modules are divided based on logical functions. In actual applications, the functions of one unit (or module) are implemented by multiple units (or modules), or the functions of multiple units (or modules) are implemented by one unit (or module).

[0162] In the case of integrated units, see Figure 5 , Figure 5 is a block diagram of the functional units of another information interception device based on address resolution proposed in an embodiment of the present application, such as Figure 5 As shown, the information interception device 400 based on address resolution includes: a communication module 401 and a processing module 402. The processing module 402 is used to control and manage the actions of the information interception device 400 based on address resolution, for example, executing the steps of the acquisition module 410, the first determination module 420, the second determination module 430, the third determination module 440 and the interception module 450 and / or other processes for executing the technology described herein. The communication module 401 is used for the interaction between the information interception device 400 based on address resolution and other devices, such as a platform or a terminal device. Figure 5 As shown, the information interception device 400 based on address resolution may further include a storage module 403, and the storage module 403 is used for program codes and data of the information interception device 400 based on address resolution.

[0163] Among them, the processing module 402 can be a processor or a controller, for example, a central processing unit (CPU), a general processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It can implement or execute various exemplary logic boxes, modules and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements a computing function, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like. The communication module 401 can be a transceiver, an RF circuit or a communication interface, and the like.

[0164] Among them, all relevant contents of each scenario involved in the above method embodiment can be referred to the functional description of the corresponding functional module, which will not be repeated here.

[0165] See also Figure 6 , Figure 6 is a block diagram of the functional units of an electronic device proposed in an embodiment of the present application, such as Figure 6 As shown, the electronic device 600 includes a processor 610 , a second memory 620 , a communication interface 630 , and one or more programs 621 . The one or more programs 621 are stored in the second memory 620 and are configured to be executed by the processor 610 .

[0166] The processor 610, the second memory 620, and the communication interface 630 are connected to each other and complete the communication work between them;

[0167] The second memory 620 may be a volatile memory such as a dynamic random access memory DRAM, or a non-volatile memory such as a mechanical hard disk. The second memory 620 is used to store a set of executable program codes, and the processor 610 is used to call one or more programs 621 stored in the second memory 620, and may execute some or all steps of any information interception method based on address resolution as described in the above-mentioned information interception method embodiment based on address resolution.

[0168] Among them, the electronic device 600 may include smart phones (such as Android phones, iOS phones, Windows Phone phones, etc.), tablet computers, PDAs, driving recorders, vehicle-mounted electronic devices, servers, laptops, mobile Internet electronic devices (MID, Mobile Internet Devices) or wearable electronic devices (such as smart watches, Bluetooth headsets), etc. The above are only examples and not exhaustive, including but not limited to the above electronic devices.

[0169] It should be noted that the first memory and the second memory may be the same memory or different memories.

[0170] It can be seen that, through the electronic device 600 described in the embodiment of the present application, multiple request information received by the management platform within a preset time length is obtained, and a single request information includes request address information; multiple first target address information is determined based on the multiple request address information, and the first target address information is address information that has not been identified as unsafe. A single first target address information includes a target address code and data volume information, and the data volume information is used to characterize the amount of data sent by the outside world to the management system within the preset time length; based on the multiple data volume information, a first flow state of multiple target address codes is determined, and the first flow state includes an unsafe flow state; if the first flow state is the unsafe flow state, the information source information of the second target address information is determined based on the pre-constructed first address database and the second target address information, and the second target address information is the first target address information in the unsafe flow state, and the pre-constructed first address database is used to store multiple addresses and perform address resolution, and the pre-constructed first address database is a database containing a multi-level index structure; based on the information source information, an interception operation is performed on the request information, and the interception operation is used to slow down the amount of request information received by the target address in the unsafe flow state sent to the management platform. In this way, the system can quickly identify addresses that may cause security problems and quickly parse them to obtain the source information of the resolution information, and conduct targeted interception of the information from the source information, thereby improving the efficiency of system blocking problems and reducing the system burden.

[0171] An embodiment of the present application also provides a computer storage medium, wherein the computer storage medium stores a computer program for electronic data exchange, wherein the computer program enables a computer to execute part or all of the steps of any method described in the above method embodiments, and the above computer includes an electronic device.

[0172] The embodiment of the present application also provides a computer program product, the computer program product includes a non-transitory computer-readable storage medium storing a computer program, the computer program is operable to cause a computer to execute some or all of the steps of any method described in the method embodiment. The computer program product may be a software installation package, and the computer includes an electronic device.

[0173] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0174] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0175] In the several embodiments provided in the present application, it should be understood that the disclosed device can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of the above-mentioned units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0176] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0177] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0178] If the above-mentioned integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a memory, including a number of instructions to enable a computer electronic device (which can be a personal computer, electronic device or network electronic device, etc.) to perform all or part of the steps of the above-mentioned methods in each embodiment of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0179] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable memory, which may include a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0180] The embodiments of the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An information interception method based on address resolution, characterized in that: A server applied to a management system, the management system further comprising a management platform and a first memory, the first memory being provided with a pre-built first address database, the method comprising: Acquire multiple request information received by the management platform within a preset time length, wherein a single request information includes request address information; Determine a plurality of first target address information based on the plurality of request address information, wherein the first target address information is address information that is not identified as unsafe, and a single first target address information includes a target address code and data volume information, wherein the data volume information is used to characterize the amount of data sent by the outside world to the management system within the preset time length; Determine a first flow state of a plurality of the target address codes based on the plurality of the data volume information, wherein the first flow state includes an unsafe flow state; If the first traffic state is the traffic insecurity state, performing a parsing operation based on the pre-constructed first address database and the second target address information to determine the information source information of the second target address information, the second target address information is the first target address information of the traffic insecurity state, the pre-constructed first address database is used to store multiple addresses and perform address parsing, and the pre-constructed first address database is a database including a multi-level index structure; An interception operation is performed on the request information based on the information source information, and the interception operation is used to reduce the amount of request information received from the target address in the traffic insecure state sent to the management platform.

2. The method according to claim 1, characterized in that The first memory is also provided with a pre-built second address database, the pre-built second address database is used to store historical unsafe addresses and perform address resolution queries, and the pre-built second address database is a database including a multi-level index structure; The determining a plurality of first target address information based on the plurality of request address information comprises: The existence of a first resolution result obtained by performing address resolution based on the plurality of request address information and the pre-built second address database, wherein the first resolution result is address information obtained by parsing the second address database, and the existence includes existence and non-existence; Determine multiple address security states corresponding to the multiple request address information based on the existence situation, the address security state includes a secure state and an unsecure state, if the existence situation is the existence, the address security state is the secure state, if the existence situation is the non-existence, the address security state is the unsecure state; If the address security state is the security state, the request address information of the security state is determined as the first target address information, and a plurality of first target address information are obtained.

3. The method according to claim 2, characterized in that The determining of the first flow status of the plurality of target address codes based on the plurality of data volume information comprises: A first data flow parameter is determined based on the data volume information corresponding to the target address code in the security state; and the first flow state is determined based on the first data flow parameter and a first preset flow threshold.

4. The method according to claim 1, characterized in that: The multi-level index structure of the pre-constructed first address database includes a first primary index area and a first secondary index area, and the pre-constructed first address database includes a first header area, a first record area, the first secondary index area and the first primary index area; the addresses of the first header area, the first record area, the first secondary index area and the first primary index area have a sequential extension relationship; The first header area is constructed with a first header structure, the first recording area is constructed with a first recording area structure, the first level index area is constructed with a first level index area structure, and the first level index area is constructed with a first level index area structure; The first header structure includes multiple header data lengths, the first record area structure includes record value length, the first secondary index area structure includes secondary index address data length, and the first primary index area structure includes start address length, end address length and record address length.

5. The method according to claim 4, characterized in that The determining the information source information of the second target address information based on the pre-built first address database and the second target address information includes: Performing a data conversion operation on the second target address information to obtain standard second target address information; Determining first address location information based on the standard second target address information and the first secondary index area; Performing a first-level index based on the first address location information, a binary indexing method, and the first first-level index area to determine a second address location information; The information source information of the second target address information is determined based on the second address location information.

6. The method according to claim 2, characterized in that The method further comprises: If the address security state is the unsafe state, a pre-interception operation is performed based on the target address code of the unsafe state, wherein the pre-interception operation is used to prevent the management platform from obtaining request information from the target address code of the unsafe state; The pre-interception operation based on the target address code in the unsafe state includes: Determine a second data flow parameter based on the data volume information corresponding to the target address code in the unsafe state; Determine a second traffic state based on the second data traffic parameter and the second preset traffic threshold, wherein the second traffic state includes the traffic unsafe state; If the second traffic state is the traffic unsafe state, obtaining the first resolution result obtained by performing address resolution on the pre-built second address database, and determining information source information of the target address code; An interception operation is performed based on the information source information of the target address code and the request information of the target address code in the traffic insecurity state.

7. The method according to claim 3, characterized in that After the step of intercepting the request information based on the information source information, the method further includes: The requested address information corresponding to the request information is stored in the pre-constructed first address database.

8. An information interception device based on address resolution, characterized in that: A server applied to a management system, the management system further comprising a management platform and a first memory, the first memory being provided with a pre-built first address database, the device comprising: An acquisition module, used to acquire multiple request information received by the management platform within a preset time length, wherein a single request information includes request address information; A first determination module is used to determine a plurality of first target address information based on the plurality of request address information, wherein the first target address information is address information that is not identified as unsafe, and a single first target address information includes a target address code and data volume information, wherein the data volume information is used to characterize the amount of data sent by the outside world to the management system within the preset time length; A second determination module is used to determine a first flow state of a plurality of the target address codes based on the plurality of the data volume information, wherein the first flow state includes an unsafe flow state; A third determination module is used to determine, if the first traffic state is the traffic insecure state, information source information of the second target address information based on the pre-constructed first address database and the second target address information, the second target address information is the first target address information of the traffic insecure state, the pre-constructed first address database is used to store multiple addresses and perform address resolution, and the pre-constructed first address database is a database including a multi-level index structure; An interception module is used to intercept the request information based on the information source information, and the interception operation is used to reduce the amount of request information received from the target address of the management platform that is in the unsafe traffic state.

9. A computer-readable storage medium, characterized in that: An information interception program based on address resolution is stored, including execution instructions. When a processor of an electronic device executes the execution instructions, the processor executes the method as described in any one of claims 1 to 7.

10. An electronic device, characterized in that: It comprises a processor and a second memory storing execution instructions, wherein the second memory stores one or more programs; when the processor executes the execution instructions stored in the second memory, the processor executes the method as claimed in any one of claims 1 to 7.

Images