Data processing method and device, non-volatile storage medium, and electronic device

Abstract

The present application discloses a data processing method and device, a non-volatile storage medium, and an electronic device. The method includes: obtaining a first application log of a network application from a historical log record of a network application firewall, and obtaining a first URL address corresponding to a preset interface in the first application log; receiving an alarm log sent by the network application firewall, and obtaining a second URL address in the alarm log; sending a first configuration policy to the network application firewall; obtaining a second application log of a target URL address sent by the network application firewall, and determining a target IP address that meets preset conditions in the second application log; and sending the target IP address to the network firewall. The present application solves the technical problem that the protection effect against CC attacks is poor because the traffic data monitored by the method for protecting against distributed denial of service attacks is mainly the traffic data of the network layer.

Description

Technical Field

[0001] The present application relates to the field of network security, and specifically, to a data processing method and device, a non-volatile storage medium, and an electronic device. Background Art

[0002] With the development of mobile Internet services, malware has emerged in an endless stream, and a large number of mobile devices or IoT devices have been maliciously controlled. The scale of DDOS attacks has also increased with the expansion of botnets. With the popularity of mini-programs, the business of WEB interfaces has flourished, and network security issues at the WEB level have become increasingly prominent. Among them, the FLOOD attack specifically targeting the WEB application layer in the Distributed Denial of Service attack (DDOS), that is, the Challenge Collapsar (CC) attack, has become more active, seriously threatening the stability and availability of network systems.

[0003] In a CC attack, the attacker sends a large number of seemingly legitimate requests to the target web server through a proxy server or a computer on the network used to perform malicious tasks, causing the web server resources to be exhausted until it crashes and becomes unable to respond to normal user requests.

[0004] The design ideas of related CC attack protection methods are mostly to solve the macro traffic flooding problem of the Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) at the network layer. However, the Hypertext Transfer Protocol (HTTP), which is a branch of TCP, is rarely the main protection target, and the protection against CC attacks is slightly insufficient.

[0005] In addition, CC attacks occupy server resources through a large number of legitimate requests, making it impossible for legitimate users to receive normal services. In view of the characteristics of CC attacks, related defense technologies mostly rely on attack features for early warning, which often leads to low efficiency and untimely response in actual applications.

[0006] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0007] The embodiments of the present application provide a data processing method and device, a non-volatile storage medium, and an electronic device to at least solve the technical problem that the protection effect against CC attacks is poor because the traffic data monitored by the method for protecting against distributed denial of service attacks is mainly network layer traffic data.

[0008] According to one aspect of an embodiment of the present application, a data processing method is provided, including: obtaining a first application log of a network application from a historical log record of a network application firewall, and obtaining a first uniform resource locator (Uniform Resource Locator, URL) address corresponding to a preset interface in the first application log; receiving an alarm log sent by the network application firewall, and obtaining a second URL address in the alarm log; sending a first configuration policy to the network application firewall, wherein the first configuration policy includes: logging a target URL address, the target URL address includes: a first URL address and a second URL address; obtaining a second application log of the target URL address sent by the network application firewall, and determining a target Internet Protocol (Internet Protocol, IP) address that meets preset conditions in the second application log; sending the target IP address to the network firewall, wherein the network firewall is used to perform access control on the target IP address.

[0009] Optionally, the second application log includes: a first parameter of a first request sent by a first IP address that accesses a target URL address, wherein the first parameter includes at least: a request frequency and a request quantity; in the second application log, determining a target IP address that meets preset conditions, including: if the request frequency of the first IP address is greater than a first preset threshold, scoring the first IP address to obtain a first score, and determining the first IP address as the target IP address when the first score is greater than the first preset score; if the request quantity of the first IP address is greater than a second preset threshold, scoring the first IP address to obtain a second score, and determining the first IP address as the target IP address when the second score is greater than the second preset score; if the request quantity of the first IP address is greater than a third preset threshold, and the request frequency of the first IP address is greater than a fourth preset threshold, scoring the first IP address to obtain a third score, and determining the first IP address as the target IP address when the third score is greater than the third preset score.

[0010] Optionally, if the request frequency of the first IP address is greater than a first preset threshold, the method also includes: determining whether the CPU usage of the server supporting the network application within a first target preset time range is greater than the first preset usage, and whether the memory usage is greater than a second preset usage, wherein the first target preset time range is a time range in which the request frequency of the first IP address is greater than the first preset threshold; if the CPU usage of the server within the first target preset time range is greater than the first preset usage, and the memory usage is greater than the second preset usage, the first IP address is determined as the target IP address; if the number of requests from the first IP address is greater than the second preset threshold, the method also includes: determining whether the CPU usage of the server within the second target preset time range is greater than the third preset usage, and whether the memory usage is greater than the fourth preset usage, wherein the second target preset time range is a time range in which the number of requests from the first IP address is greater than the second preset threshold; if the CPU usage of the server within the second target preset time range is greater than the third preset usage, and the memory usage is greater than the fourth preset usage, the first IP address is determined as the target IP address.

[0011] Optionally, in the second application log, a target IP address that meets a preset condition is determined, and the method also includes: if the request headers in the first requests sent by different first IP addresses all include the same string, determining whether the number of different first IP addresses is greater than a fifth preset threshold; if the number of different first IP addresses is greater than the fifth preset threshold, determining all different first IP addresses as target IP addresses.

[0012] Optionally, sending the target IP address to the network firewall includes: obtaining authentication information, wherein the authentication information includes at least one of the following: an application programming interface key, an access token, and access information, wherein the access information includes: an account number and a password; calling the application programming interface of the network firewall through the authentication information, and determining target data in a preset format according to the application programming interface document, wherein the call type in the target data is: IP address, and the value is the address corresponding to the target IP address; sending the target data carrying the target IP address to the network firewall through the application programming interface.

[0013] Optionally, before receiving the alarm log sent by the network application firewall, the method further includes: sending a second configuration policy to the network application firewall, wherein the second configuration policy is used to instruct the network application firewall to send the alarm log to the target platform.

[0014] Optionally, the first configuration strategy also includes: allowing traffic data corresponding to the target URL address to pass.

[0015] According to another aspect of the embodiment of the present application, a data processing device is also provided, including: an acquisition module, used to obtain a first application log of a network application from a historical log record of a network application firewall, and obtain a first uniform resource locator URL address corresponding to a preset interface in the first application log; a receiving module, used to receive an alarm log sent by the network application firewall, and obtain a second URL address in the alarm log; a first sending module, used to send a first configuration policy to the network application firewall, wherein the first configuration policy includes: logging a target URL address, the target URL address includes: a first URL address and a second URL address; a determination module, used to obtain a second application log of the target URL address sent by the network application firewall, and determine a target Internet Protocol IP address that meets preset conditions in the second application log; a second sending module, used to send the target IP address to the network firewall, wherein the network firewall is used to perform access control on the target IP address.

[0016] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, the storage medium includes a stored program, wherein when the program is executed, the device where the storage medium is located is controlled to execute the above data processing method.

[0017] According to another aspect of the embodiments of the present application, there is further provided an electronic device, including: a memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the above data processing method is executed when the program is run.

[0018] According to yet another aspect of the embodiments of the present application, a computer program is further provided, wherein the above data processing method is implemented when the computer program is executed by a processor.

[0019] According to another aspect of the embodiments of the present application, a computer program product is provided, which includes a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above data processing method is implemented.

[0020] In an embodiment of the present application, a first application log of a network application is obtained from a historical log record of a network application firewall, and a first uniform resource locator URL address corresponding to a preset interface is obtained in the first application log; an alarm log sent by the network application firewall is received, and a second URL address is obtained in the alarm log; a first configuration policy is sent to the network application firewall, wherein the first configuration policy includes: logging a target URL address, and the target URL address includes: a first URL address and a second URL address; a second application log of the target URL address sent by the network application firewall is obtained, and in the second application log, a target Internet Protocol IP address that meets preset conditions is determined; the target IP address is sent to the network firewall, wherein the network firewall is used to perform access control on the target IP address, thereby achieving the purpose of comprehensively monitoring traffic data, thereby achieving the technical effect of improving the protection capability against CC attacks, and further solving the technical problem of poor protection against CC attacks caused by the traffic data monitored by the method for protecting against distributed denial of service attacks being mainly network layer traffic data. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0022] Figure 1 A DDOS defense system is shown;

[0023] Figure 2 is a flow chart of a data processing method according to an embodiment of the present application;

[0024] Figure 3 is a schematic diagram of a DDOS defense system according to an embodiment of the present application;

[0025] Figure 4 is a structural diagram of a data processing device according to an embodiment of the present application;

[0026] Figure 5 It is a hardware structure block diagram of a computer terminal according to a data processing method of an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] In related technologies, in order to effectively prevent DDOS malicious attack traffic from the Internet area, filter abnormal traffic, and ensure normal access, DDOS defense equipment can be deployed in the Internet entry and exit areas. Figure 1 A DDOS defense system is shown, such as Figure 1 As shown in the figure, DDOS defense equipment is often deployed in the network link in a bypass manner, and is divided into DDOS detection equipment and DDOS cleaning equipment; the principle of DDOS defense is a genetic management solution for traffic restriction, which uses DDOS detection equipment to detect before the attacked WEB application, and then uses DDOS cleaning equipment to filter and clean. These devices use various technical means to filter the traffic entering the WEB application, intercept malicious traffic, and only allow legal data packets to pass, thereby ensuring that the attacked WEB application can operate normally. The DDOS detection device is responsible for collecting real-time traffic information. When it exceeds the preset bandwidth threshold, the DDOS cleaning device runs the verification rules to identify and filter abnormal traffic.

[0030] Therefore, the above method has the following problems:

[0031] 1. High cost: Because of the need to introduce specific software or hardware equipment, a large amount of expenses will be incurred.

[0032] 2. There is a certain amount of impact on the existing network links. The introduction of DDOS devices requires adjustments to the existing network links, and also introduces uncertainties to the network links. Assuming that the DDOS devices are deployed in series in the link, the introduced DDOS devices may become a shortcoming in the network link threshold.

[0033] 3. The defense method is more targeted at the overall traffic, and it is difficult to nip CC attacks in the bud. Because DDOS devices focus more on the network congestion of a single application or the entire application system, they will only start cleaning after the bandwidth reaches the threshold. The perception ability of single application or small-scale CC attacks is weak, and it is difficult to generate alarms and deal with small-scale and medium-sized CC attacks accordingly.

[0034] In order to solve the above problems, relevant solutions are provided in the embodiments of the present application, which are described in detail below.

[0035] According to an embodiment of the present application, a method embodiment of a data processing method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0036] Figure 2 is a flow chart of a data processing method according to an embodiment of the present application, such as Figure 2 As shown, the method comprises the following steps:

[0037] Step S202: obtaining a first application log of the network application from the historical log record of the network application firewall, and obtaining a first URL address corresponding to the preset interface from the first application log.

[0038] Web Application Firewall (WAF) is mainly used to monitor and protect web applications from various network attacks. WAF records a large amount of network activity information, including requests, responses, abnormal behaviors, etc., which are usually stored in the form of logs.

[0039] The historical log records include: timestamp, source IP, destination IP, request method, URL, response status code and other information. To obtain the first application log of a network application from the historical log records of the network application firewall, you can do the following: Determine the IP address corresponding to the network application. Use a text editor, log analysis tool (such as Logstash, Splunk) or programming language (such as Python, Perl) to filter and extract the application log of the IP address corresponding to the network application.

[0040] The preset interface may be, for example, a popular resource interface or an interface suspected of being attacked.

[0041] Step S204: Receive the alarm log sent by the network application firewall, and obtain the second URL address in the alarm log.

[0042] The firewall's alarm log is a log that records security events or abnormal behaviors detected by the firewall during its operation. These logs are crucial for network security management because they provide real-time information about potential threats, helping administrators respond in a timely manner and take measures to protect the network from attacks.

[0043] To receive the alarm logs sent by the network application firewall, you first need to ensure that the WAF log service has been enabled and the log collection function has been turned on. Secondly, you need to set the alarm parameters. In the WAF management interface, you can customize the monitoring charts and alarm services. For example, you can set a 4XX ratio abnormal alarm or a 5XX ratio abnormal alarm, and define under what conditions the alarm will be triggered.

[0044] Step S206: Send the first configuration policy to the network application firewall, wherein the first configuration policy includes: logging the target URL address, and the target URL address includes: a first URL address and a second URL address.

[0045] Preferably, the first configuration strategy also includes: allowing traffic data corresponding to the target URL address to pass.

[0046] Step S208, obtaining a second application log of the target URL address sent by the network application firewall, and determining a target IP address that meets a preset condition in the second application log.

[0047] Preset conditions, for example: request frequency is greater than a threshold.

[0048] Step S210, sending the target IP address to a network firewall, wherein the network firewall is used to perform access control on the target IP address.

[0049] For example, if the request frequency of the target IP address is greater than a threshold, the network firewall is used to block the target IP address.

[0050] According to the above steps, a first application log of a network application is obtained from a historical log record of a network application firewall, and a first uniform resource locator URL address corresponding to a preset interface is obtained in the first application log; an alarm log sent by the network application firewall is received, and a second URL address is obtained in the alarm log; a first configuration policy is sent to the network application firewall, wherein the first configuration policy includes: logging a target URL address, and the target URL address includes: a first URL address and a second URL address; a second application log of the target URL address sent by the network application firewall is obtained, and a target Internet Protocol IP address that meets preset conditions is determined in the second application log; and the target IP address is sent to the network firewall, wherein the network firewall is used to control access to the target IP address, thereby achieving the purpose of comprehensively monitoring traffic data, thereby realizing the technical effect of improving the protection capability against CC attacks.

[0051] The following Figure 2 The steps shown are exemplary and explanatory.

[0052] According to some optional embodiments of the present application, the second application log includes: a first parameter of a first request sent by a first IP address accessing a target URL address, wherein the first parameter includes at least: a request frequency and a request quantity.

[0053] Further, in the second application log, the target IP address that meets the preset conditions is determined, which can be determined by the following method: if the request frequency of the first IP address is greater than the first preset threshold, the first IP address is scored to obtain a first score, and when the first score is greater than the first preset score, the first IP address is determined as the target IP address; if the number of requests of the first IP address is greater than the second preset threshold, the first IP address is scored to obtain a second score, and when the second score is greater than the second preset score, the first IP address is determined as the target IP address; if the number of requests of the first IP address is greater than the third preset threshold, and the request frequency of the first IP address is greater than the fourth preset threshold, the first IP address is scored to obtain a third score, and when the third score is greater than the third preset score, the first IP address is determined as the target IP address.

[0054] For example, if the request frequency of the first IP address is greater than 25 times / second, the first IP address is scored to obtain a first score, such as 10 points. If the request frequency of the first IP address is still greater than 25 times / second in the next detection cycle, the first IP address is scored to obtain 20 points. The above scoring process is repeated until the first score is greater than the first preset score, such as 100 points, at which time the first IP address is determined as the target IP address (abnormal IP address).

[0055] If the number of requests from the first IP address is greater than 10, the first IP address is scored to obtain a second score, such as 5 points. If the number of requests from the first IP address is still greater than 10 in the next detection cycle, the first IP address is scored to obtain 10 points. The above scoring process is repeated until the second score is greater than the second preset score, such as 80 points, at which time the first IP address is determined to be an abnormal IP address.

[0056] If the request frequency of the first IP address is greater than 15 times / second, and the number of requests of the first IP address is greater than 8, the first IP address is scored to obtain a third score, such as 10 points. If in the next detection cycle, the request frequency of the first IP address is still greater than 15 times / second, and the number of requests of the first IP address is still greater than 8, the first IP address is scored to obtain 20 points. Repeat the above scoring process until the third score is greater than the third preset score, such as 100 points, at which time the first IP address is determined to be an abnormal IP address.

[0057] Preferably, if the request frequency of the first IP address is greater than a first preset threshold, the following steps can also be performed: determine whether the CPU usage of the server supporting the network application within a first target preset time range is greater than the first preset usage, and whether the memory usage is greater than a second preset usage, wherein the first target preset time range is a time range in which the request frequency of the first IP address is greater than the first preset threshold; if the CPU usage of the server within the first target preset time range is greater than the first preset usage, and the memory usage is greater than the second preset usage, the first IP address is determined as the target IP address.

[0058] For example, if the request frequency of the first IP address is greater than the first preset threshold at 2024-08-08, 08:00, the CPU usage and memory usage of the server supporting the network application at that time are determined. If the CPU usage at that time is greater than 85% and the memory usage is greater than 95%, it means that the first IP address is very likely to be the IP address that initiates the CC attack. At this time, the first IP address is determined as the target IP address.

[0059] Preferably, if the number of requests from the first IP address is greater than the second preset threshold, the following steps can also be performed: determine whether the CPU usage of the server within the second target preset time range is greater than the third preset usage, and whether the memory usage is greater than the fourth preset usage, wherein the second target preset time range is the time range in which the number of requests from the first IP address is greater than the second preset threshold; if the CPU usage of the server within the second target preset time range is greater than the third preset usage, and the memory usage is greater than the fourth preset usage, the first IP address is determined as the target IP address.

[0060] For example, if the number of requests from the first IP address during the period from 08:00 to 08:05 on 2024-08-08 is greater than the second preset threshold, the CPU usage and memory usage of the server supporting the network application during the period are determined. If the CPU usage during the period is greater than 90% and the memory usage is greater than 95%, it means that the first IP address is very likely to be the IP address that initiated the CC attack. At this time, the first IP address is determined as the target IP address.

[0061] Furthermore, the target IP address that meets the preset conditions can also be determined in the second application log by the following method: if the request headers in the first requests sent by different first IP addresses all include the same character string, determine whether the number of different first IP addresses is greater than a fifth preset threshold; if the number of different first IP addresses is greater than the fifth preset threshold, determine all the different first IP addresses as target IP addresses.

[0062] For example, if the request headers of the first requests sent by different first IP addresses all include the same character string, determine whether the number of different first IP addresses is greater than 50; if the number of different first IP addresses is greater than 50, it is very likely that these 50 first IP addresses are the IP addresses that initiate the CC attack, and these 50 first IP addresses are determined as the target IP addresses.

[0063] According to other optional embodiments of the present application, sending the target IP address to the network firewall can be achieved by the following method: obtaining authentication information, wherein the authentication information includes at least one of the following: an application programming interface key, an access token, and access information, wherein the access information includes: an account number and a password; calling the application programming interface of the network firewall through the authentication information, and determining the target data in a preset format according to the application programming interface document, wherein the call type in the target data is: IP address, and the value is the address corresponding to the target IP address; sending the target data carrying the target IP address to the network firewall through the application programming interface.

[0064] For example, the requested JSON or XML format data is constructed according to the API documentation. For example, to block an IP address, data in the following format may be required:

[0065]

[0066] In some optional embodiments of the present application, before receiving the alarm log sent by the network application firewall, the following steps can also be performed: sending a second configuration policy to the network application firewall, wherein the second configuration policy is used to instruct the network application firewall to send the alarm log to the target platform.

[0067] It is worth noting that Figure 2 The method shown can be applied to a security-aware platform (target platform), Figure 3 is a schematic diagram of a DDOS defense system according to an embodiment of the present application, such as Figure 3 As shown, the security perception platform calls the application log to sort out the URL addresses that need attention (which can be popular resource interfaces or interfaces suspected of being attacked). The WEB application firewall sends the alarm log to the security perception platform.

[0068] The security awareness platform sends configuration policies to the WEB application firewall based on the sorted URL address list. The policy configuration standard is to target URL addresses, not intercept them, and only log them.

[0069] According to the baseline pre-configuration, the threshold strategy of the security perception platform is adjusted, and the scoring level is set. The IP addresses that exceed the threshold multiple times are cumulatively scored, which speeds up the next ban while increasing the attack cost for attackers.

[0070] The IP addresses exceeding the threshold are removed, and the security perception platform calls the network firewall API interface to block them in real time. The network firewall blocks the IP addresses according to the issued IP addresses to prevent the spread of CC attacks.

[0071] In summary, the present application provides a joint prevention and control CC detection and interception method that is efficient and does not affect application changes. The cost is low, and it can be completed by relying on the linkage of existing security protection products. It can be solved by using existing equipment such as WEB application firewall, log platform and network firewall, without the need to modify the existing network architecture. In addition, the protection of this method is more subtle, and it can intercept small and medium-sized CC attack attempts in a timely manner and nip them in the bud. Make full use of the characteristics of the WEB application firewall, configure a sophisticated URL monitoring strategy on it, monitor and leave traces for all accesses, and improve the ability to detect small and medium-sized CC attacks. The security perception platform built through the log platform sends risky IPs to the firewall for blocking through the configured rules to achieve real-time blocking.

[0072] This method makes full use of the equipment of the existing security system, empowers product functions through linkage and joint defense, and protects the business. This method makes full use of the fine monitoring capabilities of the WEB application firewall at the WEB layer to achieve trace processing of all URL logs, and packages the logs with the processing capabilities of the log platform; by developing a security perception platform based on the log platform, the alarm logs are analyzed by splitting fields in addition to aggregation, establishing a unified policy platform, configuring application thresholds and scoring strategies in the platform, and using the API interface of the firewall to achieve real-time blocking of attacking IPs. In addition, this method uses the security perception platform as the processing core to collect information on security devices and schedule the functions of security devices, thereby achieving subtle protection against CC attacks. The multi-level policy scoring system gradually increases the IP blocking of CC attacks, and achieves accurate interception levels for IPs according to magnitude and wave.

[0073] Figure 4 is a structural diagram of a data processing device according to an embodiment of the present application, such as Figure 4 As shown, the device comprises:

[0074] The acquisition module 40 is used to acquire a first application log of the network application from the historical log records of the network application firewall, and acquire a first uniform resource locator URL address corresponding to the preset interface in the first application log.

[0075] The receiving module 42 is used to receive the alarm log sent by the network application firewall, and obtain the second URL address in the alarm log.

[0076] The first sending module 44 is used to send the first configuration policy to the network application firewall, wherein the first configuration policy includes: logging the target URL address, and the target URL address includes: a first URL address and a second URL address.

[0077] The determination module 46 is used to obtain a second application log of the target URL address sent by the network application firewall, and determine a target Internet Protocol IP address that meets a preset condition in the second application log.

[0078] The second sending module 48 is used to send the target IP address to the network firewall, wherein the network firewall is used to perform access control on the target IP address.

[0079] Optionally, the second application log includes: a first parameter of a first request sent by a first IP address that accesses a target URL address, wherein the first parameter includes at least: a request frequency and a request quantity; in the second application log, determining a target IP address that meets preset conditions, including: if the request frequency of the first IP address is greater than a first preset threshold, scoring the first IP address to obtain a first score, and determining the first IP address as the target IP address when the first score is greater than the first preset score; if the request quantity of the first IP address is greater than a second preset threshold, scoring the first IP address to obtain a second score, and determining the first IP address as the target IP address when the second score is greater than the second preset score; if the request quantity of the first IP address is greater than a third preset threshold, and the request frequency of the first IP address is greater than a fourth preset threshold, scoring the first IP address to obtain a third score, and determining the first IP address as the target IP address when the third score is greater than the third preset score.

[0080] Optionally, if the request frequency of the first IP address is greater than a first preset threshold, the method also includes: determining whether the CPU usage of the server supporting the network application within a first target preset time range is greater than the first preset usage, and whether the memory usage is greater than a second preset usage, wherein the first target preset time range is a time range in which the request frequency of the first IP address is greater than the first preset threshold; if the CPU usage of the server within the first target preset time range is greater than the first preset usage, and the memory usage is greater than the second preset usage, the first IP address is determined as the target IP address; if the number of requests from the first IP address is greater than the second preset threshold, the method also includes: determining whether the CPU usage of the server within the second target preset time range is greater than the third preset usage, and whether the memory usage is greater than the fourth preset usage, wherein the second target preset time range is a time range in which the number of requests from the first IP address is greater than the second preset threshold; if the CPU usage of the server within the second target preset time range is greater than the third preset usage, and the memory usage is greater than the fourth preset usage, the first IP address is determined as the target IP address.

[0081] Optionally, in the second application log, a target IP address that meets a preset condition is determined, and the method also includes: if the request headers in the first requests sent by different first IP addresses all include the same string, determining whether the number of different first IP addresses is greater than a fifth preset threshold; if the number of different first IP addresses is greater than the fifth preset threshold, determining all different first IP addresses as target IP addresses.

[0082] Optionally, sending the target IP address to the network firewall includes: obtaining authentication information, wherein the authentication information includes at least one of the following: an application programming interface key, an access token, and access information, wherein the access information includes: an account number and a password; calling the application programming interface of the network firewall through the authentication information, and determining target data in a preset format according to the application programming interface document, wherein the call type in the target data is: IP address, and the value is the address corresponding to the target IP address; sending the target data carrying the target IP address to the network firewall through the application programming interface.

[0083] Optionally, before receiving the alarm log sent by the network application firewall, the method further includes: sending a second configuration policy to the network application firewall, wherein the second configuration policy is used to instruct the network application firewall to send the alarm log to the target platform.

[0084] Optionally, the first configuration strategy also includes: allowing traffic data corresponding to the target URL address to pass.

[0085] It should be noted that the above Figure 4 The modules in the embodiment may be program modules (e.g., a set of program instructions for implementing a specific function) or hardware modules. For the latter, they may be expressed in the following forms, but are not limited thereto: the expression form of the above modules is a processor, or the functions of the above modules are implemented by a processor.

[0086] It should be noted that Figure 4 The preferred implementation of the illustrated embodiment can be found in Figure 2 The relevant description of the illustrated embodiment will not be repeated here.

[0087] Figure 5 FIG. 1 shows a hardware structure block diagram of a computer terminal for implementing a data processing method. Figure 5 As shown, the computer terminal 50 may include one or more (502a, 502b, ..., 502n are used to illustrate) processors 502 (the processor 502 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 504 for storing data, and a transmission module 506 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 5 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 5 More or fewer components as shown, or with Figure 5 Different configurations are shown.

[0088] It should be noted that the one or more processors 502 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 50. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0089] The memory 504 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the data processing method in the embodiment of the present application. The processor 502 executes various functional applications and data processing by running the software programs and modules stored in the memory 504, that is, realizing the above-mentioned data processing method. The memory 504 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 504 may further include a memory remotely arranged relative to the processor 502, and these remote memories may be connected to the computer terminal 50 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0090] The transmission module 506 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 50. In one example, the transmission module 506 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 506 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0091] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 50 .

[0092] It should be noted that, in some optional embodiments, the above Figure 5 The computer terminal shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 5This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computer terminal described above.

[0093] It should be noted that Figure 5 The computer terminal shown is used to execute Figure 2 The data processing method shown, therefore the relevant explanations in the execution method of the above command are also applicable to the electronic device and will not be repeated here.

[0094] An embodiment of the present application further provides a non-volatile storage medium, which includes a stored program, wherein when the program is executed, the device where the storage medium is located is controlled to execute the above data processing method.

[0095] A program for a non-volatile storage medium to perform the following functions: obtaining a first application log of a network application from a historical log record of a network application firewall, and obtaining a first uniform resource locator URL address corresponding to a preset interface in the first application log; receiving an alarm log sent by the network application firewall, and obtaining a second URL address in the alarm log; sending a first configuration policy to the network application firewall, wherein the first configuration policy includes: logging a target URL address, the target URL address includes: a first URL address and a second URL address; obtaining a second application log of the target URL address sent by the network application firewall, and determining a target Internet Protocol IP address that meets preset conditions in the second application log; and sending the target IP address to the network firewall, wherein the network firewall is used to perform access control on the target IP address.

[0096] An embodiment of the present application further provides an electronic device, including: a memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the above data processing method is executed when the program is run.

[0097] The processor is used to run a program that performs the following functions: obtain a first application log of a network application from a historical log record of a network application firewall, and obtain a first uniform resource locator URL address corresponding to a preset interface in the first application log; receive an alarm log sent by the network application firewall, and obtain a second URL address in the alarm log; send a first configuration policy to the network application firewall, wherein the first configuration policy includes: logging a target URL address, the target URL address includes: a first URL address and a second URL address; obtain a second application log of the target URL address sent by the network application firewall, and determine a target Internet Protocol IP address that meets preset conditions in the second application log; send the target IP address to the network firewall, wherein the network firewall is used to perform access control on the target IP address.

[0098] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0099] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0100] In the above-mentioned embodiments of the present application, the collected information is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary protection measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0101] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0102] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0103] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0104] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0105] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A data processing method, characterized in that: include: Obtaining a first application log of the network application from the historical log record of the network application firewall, and obtaining a first uniform resource locator URL address corresponding to the preset interface in the first application log; Receiving an alarm log sent by the network application firewall, and obtaining a second URL address in the alarm log; Sending a first configuration policy to the network application firewall, wherein the first configuration policy includes: logging a target URL address, wherein the target URL address includes: the first URL address and the second URL address; Obtaining a second application log of the target URL address sent by the network application firewall, and determining a target Internet Protocol IP address that meets a preset condition in the second application log; The target IP address is sent to a network firewall, wherein the network firewall is used to perform access control on the target IP address.

2. The method according to claim 1, characterized in that The second application log includes: a first parameter of a first request sent by a first IP address accessing the target URL address, wherein the first parameter includes at least: a request frequency and a request quantity; In the second application log, determining a target IP address that meets a preset condition includes: If the request frequency of the first IP address is greater than a first preset threshold, score the first IP address to obtain a first score, and if the first score is greater than the first preset score, determine the first IP address as the target IP address; If the number of requests from the first IP address is greater than a second preset threshold, score the first IP address to obtain a second score, and if the second score is greater than a second preset score, determine the first IP address as the target IP address; If the number of requests of the first IP address is greater than the third preset threshold, and the request frequency of the first IP address is greater than the fourth preset threshold, the first IP address is scored to obtain a third score. If the third score is greater than the third preset score, the first IP address is determined as the target IP address.

3. The method according to claim 2, characterized in that If the request frequency of the first IP address is greater than a first preset threshold, the method further includes: Determine whether the CPU usage rate of the server supporting the network application within a first target preset time range is greater than a first preset usage rate, and whether the memory usage rate is greater than a second preset usage rate, wherein the first target preset time range is a time range in which the request frequency of the first IP address is greater than the first preset threshold; If the CPU usage of the server within the first target preset time range is greater than the first preset usage, and the memory usage is greater than the second preset usage, determining the first IP address as the target IP address; If the number of requests from the first IP address is greater than a second preset threshold, the method further includes: Determine whether the CPU usage of the server within a second target preset time range is greater than a third preset usage rate, and whether the memory usage is greater than a fourth preset usage rate, wherein the second target preset time range is a time range in which the number of requests from the first IP address is greater than the second preset threshold; If the CPU usage of the server within the second target preset time range is greater than the third preset usage, and the memory usage is greater than the fourth preset usage, the first IP address is determined as the target IP address.

4. The method according to claim 2, characterized in that: In the second application log, determining a target IP address that meets a preset condition, the method further includes: If the request headers in the first requests sent by different first IP addresses all include the same character string, determining whether the number of different first IP addresses is greater than a fifth preset threshold; If the number of different first IP addresses is greater than the fifth preset threshold, all different first IP addresses are determined as the target IP addresses.

5. The method according to claim 1, characterized in that Sending the target IP address to a network firewall includes: Obtaining authentication information, wherein the authentication information includes at least one of the following: an application programming interface key, an access token, and access information, wherein the access information includes: an account number and a password; Using the authentication information, calling the application programming interface of the network firewall, and determining the target data in a preset format according to the application programming interface document, wherein the calling type in the target data is: IP address, and the value is the address corresponding to the target IP address; The target data carrying the target IP address is sent to the network firewall through the application programming interface.

6. The method according to claim 1, characterized in that Before receiving the alarm log sent by the network application firewall, the method further includes: A second configuration policy is sent to the network application firewall, wherein the second configuration policy is used to instruct the network application firewall to send the alarm log to a target platform.

7. The method according to claim 1, characterized in that The first configuration strategy also includes: allowing traffic data corresponding to the target URL address to pass.

8. A data processing device, characterized in that: include: An acquisition module, configured to acquire a first application log of a network application from a historical log record of a network application firewall, and acquire a first uniform resource locator URL address corresponding to a preset interface from the first application log; A receiving module, used for receiving the alarm log sent by the network application firewall, and obtaining a second URL address in the alarm log; A first sending module is used to send a first configuration policy to the network application firewall, wherein the first configuration policy includes: logging a target URL address, and the target URL address includes: the first URL address and the second URL address; A determination module, configured to obtain a second application log of the target URL address sent by the network application firewall, and determine a target Internet Protocol IP address that meets a preset condition in the second application log; The second sending module is used to send the target IP address to a network firewall, wherein the network firewall is used to perform access control on the target IP address.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored program, wherein when the program is executed, the device where the non-volatile storage medium is located is controlled to execute the data processing method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the program executes the data processing method according to any one of claims 1 to 7 when running.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the data processing method according to any one of claims 1 to 7 is implemented.

Images