Network protection method, computing device, machine readable storage medium and program product

Abstract

The embodiment of the invention provides a network protection method, computing equipment, a machine readable storage medium and a program product, and belongs to the field of network security. The network protection method is applied to gateway equipment, and comprises the following steps: in response to a target access request to a network server, obtaining a target ID in the target access request; determining a target terminal corresponding to the target ID; determining whether the target terminal has an access permission for accessing the network server; acquiring the network state of the target terminal under the condition that the target terminal has the access permission of accessing the network server; and determining a protection strategy for the network server according to the network state of the target terminal. The protection strategy of the server side is generated according to the unique ID corresponding to the terminal, that is, when a network attacker changes the IP, the network attack can still be blocked, the network bandwidth of the server side is prevented from being occupied, and then the server side can run reliably even if the server side is subjected to the network attack.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network protection method, computing equipment, machine-readable storage medium and program product. Background Art

[0002] A data center is a globally collaborative network of devices used to transmit, display, calculate, and store data information on internet devices. With the wave of digital technology, data centers have been widely used. With the continuous iteration of network attack technology, more and more data center servers have become targets of network attacks. DDoS (Distributed Denial of Service) attacks are a low-threshold network attack method. When a server encounters a DDoS attack, a large amount of invalid information will flow to the server in a short period of time. The server needs to spend a lot of resources to process invalid information, which in turn affects the reliable operation of the server.

[0003] When a terminal requests to access a server, the gateway device usually obtains the terminal's MAC (Media Access Control) address and authenticates the terminal based on the MAC address. If the terminal MAC address authentication fails, the gateway device will deny the terminal access to the server. However, a network attacker can bypass the gateway's protection and launch a network attack by spoofing the MAC address and using a changed IP (Internet Protocol) message. When a server is attacked by a network, the network bandwidth is occupied, the server cannot operate reliably, and other terminals cannot access the server normally. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a network protection method, a computing device, a machine-readable storage medium and a program product. The network protection method is used to solve the problem that the server cannot run reliably when it is attacked by a network.

[0005] In order to achieve the above objectives, in a first aspect, the present application provides a network protection method, which is applied to a gateway device. The network protection method includes:

[0006] Respond to the target access request to the network server and obtain the target ID in the target access request;

[0007] Determine the target terminal corresponding to the target ID;

[0008] Determine whether the target terminal has access rights to the network server;

[0009] When the target terminal has access rights to the network server, obtaining the network status of the target terminal, wherein the network status includes online and offline;

[0010] Determine the protection strategy for the network server based on the network status of the target terminal.

[0011] In an embodiment of the present application, determining a protection strategy for a network service end according to a network status of a target terminal includes:

[0012] When the network status of the target terminal is offline, obtaining a first request number corresponding to the target ID, wherein the first request number is the number of access requests including the target ID received within a first time period;

[0013] A protection strategy for the network server is determined based on the first request number.

[0014] In an embodiment of the present application, determining a protection strategy for the network server according to the first request number includes:

[0015] Extract the target IP in the target access request;

[0016] Obtain the second request count corresponding to the target IP, where the second request count is the number of access requests including the target IP received within the second time;

[0017] A protection strategy for the network server is determined according to the first request number and / or the second request number.

[0018] In an embodiment of the present application, determining a protection strategy for the network server according to the first request number and / or the second request number includes:

[0019] When the first request number is less than the first number threshold, and the second request number is less than the second number threshold, determining the protection strategy for the network server to release the target access request to the network server;

[0020] When the first request number is greater than or equal to the first number threshold, determining the protection strategy to block all access requests including the target ID within a third time;

[0021] When the second request number is greater than or equal to the second number threshold, the protection strategy is determined to block all access requests including the target IP within a fourth time.

[0022] In an embodiment of the present application, a protection strategy for a network server is determined according to the network status of a target terminal, including:

[0023] When the network status of the target terminal is online, the protection strategy for the network server is determined to block the target access request.

[0024] In an embodiment of the present application, the network protection method further includes:

[0025] If the target terminal does not have access permission to the network server, the target access request is blocked.

[0026] In an embodiment of the present application, determining whether the target terminal has access rights to access the network server includes:

[0027] Obtain a list of all blacklist IDs and determine whether the blacklist ID list includes the target ID;

[0028] In the case where the blacklist ID list does not include the target ID, determining that the target terminal has access rights to access the network server;

[0029] When the blacklist ID list includes the target ID, it is determined that the target terminal does not have access authority to access the network service end.

[0030] In a second aspect, the present application provides a network protection device, which is applied to a gateway device, and the network protection device includes:

[0031] An ID acquisition module is used to respond to a target access request to a network server and acquire a target ID in the target access request;

[0032] A terminal determination module is used to determine a target terminal corresponding to a target ID;

[0033] The permission determination module is used to determine whether the target terminal has access permission to access the network server;

[0034] A network status acquisition module, used to acquire the network status of the target terminal when the target terminal has access rights to the network server, wherein the network status includes online and offline;

[0035] The protection strategy determination module is used to determine the protection strategy for the network server according to the network status of the target terminal.

[0036] In a third aspect, the present application provides a computing device, including:

[0037] a memory configured to store instructions;

[0038] The processor is configured to call instructions from the memory and implement the above-mentioned network protection method when executing the instructions.

[0039] In a fourth aspect, the present application provides a machine-readable storage medium, on which instructions are stored, and when the instructions are executed by a processor, the processor is configured to execute the above-mentioned network protection method.

[0040] In a fifth aspect, the present application provides a computer program product, including a computer program, which implements the above-mentioned network protection method when executed by a processor.

[0041] The present application provides a network protection method, which is applied to a gateway device, including: responding to a target access request to a network server, obtaining a target ID in the target access request; determining a target terminal corresponding to the target ID; determining whether the target terminal has access rights to access the network server; if the target terminal has access rights to access the network server, obtaining the network status of the target terminal; and determining a protection strategy for the network server based on the network status of the target terminal. A protection strategy for the server is generated based on the unique ID corresponding to the terminal, that is, even if the network attacker changes the IP, the network attack can still be blocked, avoiding the network bandwidth of the server from being squeezed, thereby enabling the server to operate reliably even when it is attacked by a network. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0043] Figure 1 A flowchart of a network protection method provided by an embodiment of the present application is shown;

[0044] Figure 2 A schematic diagram of the structure of a network protection device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0045] The specific implementation of the embodiment of the present invention will be described in detail below in conjunction with the accompanying drawings in the embodiment of the present invention. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0046] The components of the embodiments of the present invention generally described and shown in the drawings herein may be arranged and designed in a variety of different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0047] Hereinafter, the terms "including", "having" and their cognates, which may be used in various embodiments of the present invention, are intended only to indicate specific features, numbers, steps, operations, elements, components or combinations of the foregoing items, and should not be understood as first excluding the existence of one or more other features, numbers, steps, operations, elements, components or combinations of the foregoing items or adding the possibility of one or more features, numbers, steps, operations, elements, components or combinations of the foregoing items.

[0048] Furthermore, the terms “first”, “second”, “third”, etc. are merely used for distinguishing descriptions and are not to be understood as indicating or implying relative importance.

[0049] Unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meanings as those generally understood by those skilled in the art to which the various embodiments of the present invention belong. The terms (such as those defined in generally used dictionaries) will be interpreted as having the same meanings as the contextual meanings in the relevant technical field and will not be interpreted as having idealized meanings or overly formal meanings unless clearly defined in the various embodiments of the present invention.

[0050] Example 1

[0051] See also Figure 1 , Figure 1 A flow chart of a network protection method provided in an embodiment of the present application is shown.

[0052] Figure 1 The network protection methods in the above are applied to gateway devices. The network protection methods include:

[0053] S110, responding to a target access request to a network server, and obtaining a target ID in the target access request.

[0054] The network protection method of this embodiment is applied to a gateway device, and the gateway device communicates with a network server, so as to block information sent to the network server through the gateway device, or release information sent to the network server. The type of the network server is set according to actual needs and is not limited here. For ease of understanding, the network server in the embodiment of this application is an Internet of Things video server.

[0055] The type of access request is also set according to actual needs and is not limited here. For ease of understanding, in the embodiments of the present application, the access request is the registration information sent by the terminal. When the network service is operating normally, the terminal can send the registration information to the network service. After the registration information is passed, the terminal can access the Internet of Things video service provided by the network service. In the case where the network service is attacked by a network, if the network attacker uses new registration information, a large amount of new registration information will consume the resources of the network service to process invalid information, affecting the normal registration of normal terminals. If the normal terminal has completed registration, the network attacker sends a large amount of registration information, which will cause the normal terminal connected to the network service to fail to operate normally.

[0056] In the embodiment of the present application, the gateway device monitors the network port traffic information and analyzes the traffic in the IoT control network to obtain the message containing the target access request. The gateway device responds to the target access request to the network service end and obtains the target ID (Identity document) in the target access request.

[0057] S120, determining the target terminal corresponding to the target ID.

[0058] The access request sent by the terminal to the network server includes the terminal's own target ID, and each terminal has a unique ID in the network. The gateway device can use the terminal's unique ID as identification information to determine the identity of the terminal sending the access request, that is, to determine the target terminal corresponding to the target ID.

[0059] S130, determining whether the target terminal has access authority to access the network server.

[0060] After the identity of the target terminal is determined, determine whether the target terminal has access rights to the network server. If the target terminal has access rights to the network server, then verify the identity of the target terminal and the target access request. Setting access rights for different IDs in advance can block a large number of malicious network attacks.

[0061] In an embodiment of the present application, determining whether the target terminal has access rights to access the network server includes:

[0062] Obtain a list of all blacklist IDs and determine whether the blacklist ID list includes the target ID;

[0063] In the case where the blacklist ID list does not include the target ID, determining that the target terminal has access rights to access the network server;

[0064] When the blacklist ID list includes the target ID, it is determined that the target terminal does not have access authority to access the network service end.

[0065] In this embodiment, it is determined whether the target terminal has the access right to access the network service end according to the blacklist ID list. Specifically, the gateway device responds to the access request, obtains all blacklist ID lists, and determines whether the blacklist ID list includes the target ID. In the case where the blacklist ID list does not include the target ID, it is determined that the target terminal corresponding to the target ID is not a terminal in the blacklist, and then it is determined that the target terminal has the access right to access the network service end. In the case where the blacklist ID list includes the target ID, it is determined that the target terminal corresponding to the target ID is a terminal in the blacklist, and then it is determined that the target terminal does not have the access right to access the network service end.

[0066] It should be understood that a whitelist ID list may also be set, and terminals corresponding to IDs outside the whitelist ID list may be determined as not having access rights to the network server, which will not be elaborated here.

[0067] S140, when the target terminal has access rights to the network server, obtain the network status of the target terminal, wherein the network status includes online and offline.

[0068] When the target terminal has access rights to the network service end, the gateway device obtains the network status of the target terminal, and then determines whether the terminal requesting access to the network service end is online. When the gateway device receives a message including an access request sent by the terminal, it determines whether the message sent by the terminal is an attack message based on the network status of the terminal.

[0069] S150, determining a protection strategy for the network server according to the network status of the target terminal.

[0070] Compared with using IP as a unique value to identify a terminal, using ID as a unique value to identify a terminal is easier to manage. Specifically, in this embodiment, the protection strategy for the network server is determined according to the network status of the target terminal. If there are terminals with the same ID but different IPs, the gateway device can determine the protection strategy for the network server according to the network status of the terminal, and then restrict the terminals with abnormal access to prevent DDoS attacks. The protection strategy for the server is generated according to the unique ID corresponding to the terminal, that is, the network attacker can change the IP and still block the network attack, avoiding the network bandwidth of the server from being squeezed, so that the server can operate reliably even when it is attacked by the network.

[0071] In an embodiment of the present application, determining a protection strategy for a network service end according to a network status of a target terminal includes:

[0072] When the network status of the target terminal is offline, obtaining a first request number corresponding to the target ID, wherein the first request number is the number of access requests including the target ID received within a first time period;

[0073] A protection strategy for the network server is determined based on the first request number.

[0074] In this embodiment, it is assumed that there are three terminals, namely terminal A, terminal B and terminal C, where terminal A is a normal terminal, and terminals B and C are attack terminals. Terminal A has the correct service user name and password, that is, the target access request sent by terminal A can pass the verification of the network service end, so that terminal A can register successfully and use the services of the network terminal normally.

[0075] Specifically, when the gateway device determines that the target terminal has access authority and the network status of the target terminal is offline, it obtains the first request number corresponding to the target ID. The first request number is the number of access requests including the target ID received within the first time. According to the first request number, it can be determined whether the target terminal frequently makes requests. According to the first request number, the protection strategy for the network service end is determined. When terminal A sends an access request including the correct user name and password, the value of the first request number is low.

[0076] In an embodiment of the present application, determining a protection strategy for the network server according to the first request number includes:

[0077] Extract the target IP in the target access request;

[0078] Obtain the second request count corresponding to the target IP, where the second request count is the number of access requests including the target IP received within the second time;

[0079] A protection strategy for the network server is determined according to the first request number and / or the second request number.

[0080] In the case where the access request is registration information, the registration information may also include the target IP corresponding to the target terminal, and obtain the second request number corresponding to the target IP. The second request number is the number of access requests including the target IP received within the second time. According to the first request number and / or the second request number, it is determined whether the target terminal frequently makes requests, and then the protection strategy for the network server is determined.

[0081] It should be understood that the values ​​of the first time and the second time are set according to actual needs, and the values ​​of the first time and the second time can be the same or different, which is not limited here. For ease of understanding, in the embodiment of the present application, the first time and the second time are the same unit time, that is, determining whether the target terminal frequently sends access requests in the unit time.

[0082] In an embodiment of the present application, determining a protection strategy for the network server according to the first request number and / or the second request number includes:

[0083] When the first request number is less than the first number threshold, and the second request number is less than the second number threshold, determining the protection strategy for the network server to release the target access request to the network server;

[0084] When the first request number is greater than or equal to the first number threshold, determining the protection strategy to block all access requests including the target ID within a third time;

[0085] When the second request number is greater than or equal to the second number threshold, the protection strategy is determined to block all access requests including the target IP within a fourth time.

[0086] When the first request number is less than the first number threshold, and the second request number is less than the second number threshold, the protection strategy for the network server is determined to release the target access request to the network server. The network server verifies the released target access request. When terminal A sends an access request including the correct user name and password, the target access request sent by terminal A will pass the verification of the network server, so that terminal A can access the network server to use the Internet of Things service.

[0087] Terminal B and Terminal C do not have the correct user name and password. In a network attack scenario, Terminal B and Terminal C can send a large number of messages including access requests to consume the resources of the network server, thereby interfering with the operation of Terminal A.

[0088] In this embodiment, when terminal B uses a target ID with access permission and the network status of the target terminal corresponding to the target ID is offline, when the first request number is less than the first request number threshold, and the second request number is less than the second request number threshold, the access request sent by terminal B will be released to the network server, that is, the message including the access request can reach the network server for registration.

[0089] Terminal B does not have the correct username and password, and the access request sent by Terminal B cannot pass the verification of the network server. Terminal B continuously sends access requests to carry out DDoS attacks. Since Terminal B sends attack messages at a high frequency, when the first request number is greater than or equal to the first number threshold, the protection strategy is determined to block all access requests including the target ID within the third time, that is, the gateway device prohibits access requests including the target ID within the third time. Even if the network attacker changes the IP and initiates an access request with the target ID, the network attack can still be blocked, avoiding the network bandwidth of the server from being squeezed, and thus enabling the server to operate reliably even when it is attacked by the network.

[0090] When the second number of requests is greater than or equal to the second number threshold, the protection strategy is determined to block all access requests including the target IP within the fourth time, that is, the gateway device prohibits access requests including the target IP within the fourth time, and the attack message based on the target IP cannot affect the network server.

[0091] It should be understood that the first number threshold and the second number threshold are both set according to actual needs, and the first number threshold and the second number threshold can be the same or different, which is not limited here. The values ​​of the third time and the fourth time are both set according to actual needs, and the values ​​of the third time and the fourth time can be the same or different, which is not limited here. For ease of understanding, in the embodiment of the present application, the first time and the second time are the same time period.

[0092] In an embodiment of the present application, a protection strategy for a network server is determined according to the network status of a target terminal, including:

[0093] When the network status of the target terminal is online, the protection strategy for the network server is determined to block the target access request.

[0094] When terminal A sends an access request including a correct user name and password, the target access request sent by terminal A will be verified by the network server, and the network status will switch to online when terminal A accesses the network server to use the IoT service.

[0095] In this embodiment, when terminal C uses the target ID of terminal A, after the gateway device determines that terminal C has access authority, it determines that the target terminal corresponding to the target ID is terminal A, and then determines that the network status of terminal A is online. When the network status of the target terminal is online, it is determined that the message including the access request sent by terminal C is an attack message, and then determines that the protection strategy for the network server is to block the target access request.

[0096] In an embodiment of the present application, the network protection method further includes:

[0097] If the target terminal does not have access permission to the network server, the target access request is blocked.

[0098] When the target terminal frequently sends invalid access requests to conduct network attacks, it is determined that the target terminal does not have access rights to the network server. In the case that the target terminal does not have access rights to the network server, the gateway device directly blocks the target access request. The gateway device sets access rights for different IDs in advance, which can block a large number of malicious network attacks, thereby preventing a large amount of invalid information from flooding into the network server.

[0099] The present application provides a network protection method, which is applied to a gateway device, including: responding to a target access request to a network server, obtaining a target ID in the target access request; determining a target terminal corresponding to the target ID; determining whether the target terminal has access rights to access the network server; if the target terminal has access rights to access the network server, obtaining the network status of the target terminal; and determining a protection strategy for the network server based on the network status of the target terminal. A protection strategy for the server is generated based on the unique ID corresponding to the terminal, that is, even if the network attacker changes the IP, the network attack can still be blocked, avoiding the network bandwidth of the server from being squeezed, thereby enabling the server to operate reliably even when it is attacked by a network.

[0100] Example 2

[0101] See also Figure 2 , Figure 2 A schematic diagram of the structure of a network protection device provided in an embodiment of the present application is shown. Figure 2 The network protection device 200 is applied to a gateway device, and the network protection device 200 includes:

[0102] ID acquisition module 210, used to respond to the target access request to the network server and obtain the target ID in the target access request;

[0103] A terminal determination module 220 is used to determine a target terminal corresponding to a target ID;

[0104] The authority determination module 230 is used to determine whether the target terminal has access authority to access the network server;

[0105] The network status acquisition module 240 is used to acquire the network status of the target terminal when the target terminal has access rights to the network server, wherein the network status includes online and offline;

[0106] The protection strategy determination module 250 is used to determine the protection strategy for the network server according to the network status of the target terminal.

[0107] In the embodiment of the present application, the protection strategy determination module 250 includes:

[0108] A first request number acquisition submodule, used to acquire a first request number corresponding to a target ID when the network status of the target terminal is offline, wherein the first request number is the number of access requests including the target ID received within a first time;

[0109] The strategy determination module is used to determine the protection strategy for the network server according to the first request number.

[0110] In an embodiment of the present application, the policy determination module includes:

[0111] IP extraction submodule, used to extract the target IP in the target access request;

[0112] A second request count acquisition submodule is used to acquire a second request count corresponding to the target IP, wherein the second request count is the number of access requests including the target IP received within a second time period;

[0113] The strategy submodule is used to determine a protection strategy for the network server according to the first request number and / or the second request number.

[0114] In an embodiment of the present application, the policy submodule is further used to determine the protection strategy for the network server to release the target access request to the network server when the first request number is less than the first number threshold and the second request number is less than the second number threshold;

[0115] When the first request number is greater than or equal to the first number threshold, determining the protection strategy to block all access requests including the target ID within a third time;

[0116] When the second request number is greater than or equal to the second number threshold, the protection strategy is determined to block all access requests including the target IP within a fourth time.

[0117] In the embodiment of the present application, the protection strategy determination module 250 is further used to determine that the protection strategy for the network service end is to block the target access request when the network status of the target terminal is online.

[0118] In an embodiment of the present application, the network protection device 200 further includes:

[0119] The permission blocking module is used to block the target access request when the target terminal does not have the access permission to access the network server.

[0120] In an embodiment of the present application, the authority determination module 230 includes:

[0121] A blacklist determination submodule is used to obtain all blacklist ID lists and determine whether the blacklist ID list includes the target ID;

[0122] The access submodule is used to determine whether the target terminal has access rights to access the network server when the blacklist ID list does not include the target ID;

[0123] The no-access submodule is used to determine that the target terminal does not have access authority to access the network server when the blacklist ID list includes the target ID.

[0124] The present application also provides a computing device, including:

[0125] a memory configured to store instructions;

[0126] The processor is configured to call instructions from the memory and implement the above-mentioned network protection method when executing the instructions.

[0127] The ID acquisition module 210, terminal determination module 220, authority determination module 230, network status acquisition module 240 and protection strategy determination module 250 in this embodiment are all stored in the memory as program units, and the processor executes the above program units stored in the memory to implement corresponding functions.

[0128] The processor includes a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the above network protection method can be implemented by adjusting kernel parameters.

[0129] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0130] An embodiment of the present application also provides a machine-readable storage medium, on which instructions are stored. When the instructions are executed by a processor, the processor is configured to execute the above-mentioned network protection method.

[0131] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above-mentioned network protection method when executed by a processor.

[0132] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0133] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0134] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0135] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0136] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0137] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0138] Machine-readable storage media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0139] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0140] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A network protection method, characterized in that: Applied to a gateway device, the network protection method includes: Responding to a target access request to a network server, obtaining a target ID in the target access request; Determine a target terminal corresponding to the target ID; Determining whether the target terminal has access rights to the network service end; In the case that the target terminal has access rights to the network service end, obtaining a network status of the target terminal, wherein the network status includes online and offline; A protection strategy for the network service end is determined according to the network status of the target terminal.

2. The network protection method according to claim 1, characterized in that: Determining the protection strategy for the network service end according to the network status of the target terminal includes: When the network status of the target terminal is offline, obtaining a first request number corresponding to the target ID, wherein the first request number is the number of access requests including the target ID received within a first time; A protection strategy for the network server is determined according to the first request number.

3. The network protection method according to claim 2, characterized in that: The determining, according to the first request number, a protection strategy for the network server includes: Extract the target IP in the target access request; Obtain a second request count corresponding to the target IP, wherein the second request count is the number of access requests including the target IP received within a second time period; A protection strategy for the network server is determined according to the first request number and / or the second request number.

4. The network protection method according to claim 3, characterized in that: The determining, according to the first request number and / or the second request number, a protection strategy for the network server includes: When the first request number is less than a first number threshold, and the second request number is less than a second number threshold, determining the protection strategy for the network server to release the target access request to the network server; When the first request number is greater than or equal to the first number threshold, determining the protection strategy to block all access requests including the target ID within a third time; When the second request number is greater than or equal to the second request threshold, the protection strategy is determined to block all access requests including the target IP within a fourth time.

5. The network protection method according to claim 1, characterized in that: Determining a protection strategy for the network server according to the network status of the target terminal includes: When the network status of the target terminal is online, the protection strategy for the network service end is determined to block the target access request.

6. The network protection method according to claim 1, characterized in that: The network protection method also includes: When the target terminal does not have access authority to access the network service end, the target access request is blocked.

7. The network protection method according to claim 1, characterized in that: The determining whether the target terminal has access authority to access the network service end includes: Obtain all blacklist ID lists, and determine whether the blacklist ID lists include the target ID; In the case that the blacklist ID list does not include the target ID, determining that the target terminal has access authority to access the network service end; In the case that the blacklist ID list includes the target ID, it is determined that the target terminal does not have access authority to access the network service end.

8. A computing device, characterized in that include: a memory configured to store instructions; A processor is configured to call the instructions from the memory and implement the network protection method according to any one of claims 1 to 7 when executing the instructions.

9. A machine-readable storage medium having instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor is configured to execute the network protection method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the network protection method according to any one of claims 1 to 7.

Images