Traffic processing method and device, equipment, readable storage medium and product

Abstract

The embodiment of the invention discloses a traffic processing method, device and equipment, a readable storage medium and a product, and is applied to target traffic limiting equipment, and the method comprises the steps: determining the sum of traffic received in a preset time period; the flow comprises first flow and second flow; obtaining the weight of a target current limiting device, and calculating a current limiting threshold value corresponding to the target current limiting device based on the weight and a total current limiting threshold value corresponding to the device cluster; if the traffic sum of the target traffic limiting equipment is greater than a traffic limiting threshold value corresponding to the target traffic limiting equipment, performing traffic limiting processing on the traffic exceeding the traffic limiting threshold value corresponding to the second traffic in the second traffic to obtain the second traffic after the traffic limiting processing; and if the traffic sum obtained based on the second traffic after the traffic limiting processing and the first traffic is smaller than or equal to a traffic limiting threshold value corresponding to the target traffic limiting equipment, distributing the first traffic and the second traffic after the traffic limiting processing to a back-end service. By adopting the embodiment of the invention, the stability of back-end service operation can be improved.

Description

Technical Field

[0001] The present application relates to the field of the Internet, specifically to the field of flow control technology, and in particular to a flow processing method, device, equipment, readable storage medium and product. Background Art

[0002] With the development of the Internet, more and more attack traffic has caused the backend services of applications to frequently fail due to insufficient capacity or trigger current limiting, resulting in some functions of the application being unavailable or intermittently unavailable, thus affecting the stability of the backend services. Therefore, how to improve the stability of the backend service operation in the event of attack traffic is an urgent problem to be solved. Summary of the invention

[0003] The embodiments of the present application provide a traffic processing method, device, equipment, readable storage medium and product, which can improve the stability of backend service operation in the event of attack traffic.

[0004] In a first aspect, the present application provides a traffic processing method, which is applied to a target current limiting device in a device cluster, where the target current limiting device is any current limiting device in the device cluster, and the method includes:

[0005] Determine the total amount of traffic received within a preset time period; the traffic includes a first traffic and a second traffic, the first traffic includes traffic with a first traffic attribute, and the second traffic includes traffic with a second traffic attribute;

[0006] Obtain the weight of the target current limiting device, and calculate the current limiting threshold corresponding to the target current limiting device based on the weight of the target current limiting device and the total current limiting threshold corresponding to the device cluster;

[0007] If the total amount of traffic received by the target current limiting device within the preset time period is greater than the current limiting threshold corresponding to the target current limiting device, current limiting processing is performed on the traffic in the second traffic that exceeds the current limiting threshold corresponding to the second traffic to obtain the second traffic after current limiting processing;

[0008] If the sum of the traffic obtained based on the second traffic after the current limiting processing and the first traffic is less than or equal to the current limiting threshold corresponding to the target current limiting device, the first traffic and the second traffic after the current limiting processing are allocated to the backend service.

[0009] In a second aspect, the present application provides another traffic processing method, the method comprising:

[0010] Determine the total amount of traffic received within a preset time period; the traffic includes a first traffic and a second traffic, the first traffic includes traffic with a first traffic attribute, and the second traffic includes traffic with a second traffic attribute;

[0011] Obtaining a preset current limiting ratio between a current limiting threshold corresponding to the first flow and a current limiting threshold corresponding to the second flow, and determining the current limiting threshold corresponding to the second flow based on the preset current limiting ratio and the preset current limiting threshold;

[0012] If the total flow is greater than the preset current limiting threshold, current limiting processing is performed on the second flow that exceeds the current limiting threshold corresponding to the second flow to obtain the second flow after current limiting processing;

[0013] If the total flow obtained based on the second flow after the flow limiting process and the first flow is less than or equal to the preset flow limiting threshold, the first flow and the second flow after the flow limiting process are allocated to the backend service.

[0014] In a third aspect, the present application provides a flow processing device, which is applied to a target flow limiting device in a device cluster, where the target flow limiting device is any flow limiting device in the device cluster, and the device includes:

[0015] A first flow receiving unit, used to determine the total flow received within a preset time period; the flow includes a first flow and a second flow, the first flow includes a flow with a first flow attribute, and the second flow includes a flow with a second flow attribute;

[0016] A first threshold acquisition unit, configured to acquire a weight of a target current limiting device, and calculate a current limiting threshold corresponding to the target current limiting device based on the weight of the target current limiting device and a total current limiting threshold corresponding to the device cluster;

[0017] A first current limiting unit is used to perform current limiting processing on the flow in the second flow that exceeds the current limiting threshold corresponding to the second flow if the total flow received by the target current limiting device within a preset time period is greater than the current limiting threshold corresponding to the target current limiting device, so as to obtain the second flow after the current limiting processing;

[0018] The first traffic allocation unit is used to allocate the first traffic and the second traffic after the current limiting processing to the backend service if the sum of the traffic obtained based on the second traffic after the current limiting processing and the first traffic is less than or equal to the current limiting threshold corresponding to the target current limiting device.

[0019] In a fourth aspect, the present application provides another flow processing device, the device comprising:

[0020] A second flow receiving unit, used to determine the total flow received within a preset time period; the flow includes a first flow and a second flow, the first flow includes a flow with a first flow attribute, and the second flow includes a flow with a second flow attribute;

[0021] A second threshold value acquisition unit, used to acquire a preset current limiting ratio between a current limiting threshold value corresponding to the first flow and a current limiting threshold value corresponding to the second flow, and determine the current limiting threshold value corresponding to the second flow based on the preset current limiting ratio and the preset current limiting threshold value;

[0022] A second current limiting unit is used for performing current limiting processing on the second flow that exceeds the current limiting threshold corresponding to the second flow if the total flow is greater than a preset current limiting threshold, so as to obtain the second flow after the current limiting processing;

[0023] The second traffic allocation unit is configured to allocate the first traffic and the second traffic after the current limiting processing to the backend service if the sum of the traffic obtained based on the second traffic after the current limiting processing and the first traffic is less than or equal to a preset current limiting threshold.

[0024] In a fifth aspect, the present application provides a computer device, including: a processor, a memory, and a network interface;

[0025] The above-mentioned processor is connected to a memory and a network interface, wherein the network interface is used to provide a data communication function, the above-mentioned memory is used to store computer program code, and the above-mentioned processor is used to call the above-mentioned computer program code so that a computer device including the processor executes the traffic processing method of the first aspect and the second aspect.

[0026] In a sixth aspect, the present application provides a computer-readable storage medium, which stores a computer program, and the computer program is suitable for being loaded and executed by a processor so that a computer device having the processor executes the traffic processing methods of the first and second aspects mentioned above.

[0027] In a seventh aspect, the present application provides a computer program product or a computer program, wherein the computer program product or the computer program includes computer instructions, and when the computer instructions are executed by a processor, the traffic processing methods of the first and second aspects described above are implemented.

[0028] In the embodiment of the present application, by determining the total amount of traffic received within a preset time period; the traffic includes a first traffic and a second traffic, the first traffic refers to traffic with a first traffic attribute, and the second traffic refers to traffic with a second traffic attribute; the weight of the target current limiting device is obtained, and the current limiting threshold corresponding to the target current limiting device is calculated based on the weight of the target current limiting device and the total current limiting threshold corresponding to the device cluster; if the total amount of traffic is greater than the current limiting threshold corresponding to the target current limiting device, the second traffic in the second traffic that exceeds the current limiting threshold corresponding to the second traffic is subjected to current limiting processing to obtain the second traffic after current limiting processing; if the total amount of traffic obtained based on the second traffic after current limiting processing and the first traffic is less than or equal to the current limiting threshold corresponding to the target current limiting device, the first traffic and the second traffic after current limiting processing are allocated to the backend service. Since the current limiting threshold corresponding to the target current limiting device is determined in combination with the weight of the target current limiting device, the current limiting threshold corresponding to the target current limiting device is more accurate. If the weight of the target current limiting device is large, the current limiting threshold corresponding to the target current limiting device is large, and more first traffic such as white traffic can be processed. If the weight of the target current limiting device is small, the current limiting threshold corresponding to the target current limiting device is small, and more current limiting thresholds can be allocated to current limiting devices in other device clusters to avoid idle resources and improve resource utilization. When the total flow is greater than the current limiting threshold corresponding to the target current limiting device, the total flow can be reduced by current limiting the second flow, ensuring that the backend service can normally handle more first flows such as white flows, thereby improving the stability of white flow processing. In addition, in the event of attack traffic, the second flow after current limiting processing, such as gray traffic and white traffic, is allocated to the backend service for processing, thereby avoiding the crash of the backend service due to excessive traffic allocated to the backend service for processing, thereby improving the stability of the backend service operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 It is a network architecture diagram of a traffic processing system provided by an embodiment of the present application;

[0031] Figure 2 It is a flow chart of a flow processing method provided in an embodiment of the present application;

[0032] Figure 3 This is a schematic diagram of a traffic processing scenario provided by an embodiment of the present application;

[0033] Figure 4This is a schematic diagram of a fixed ratio current limiting scenario provided in an embodiment of the present application;

[0034] Figure 5 It is a flow chart of another flow processing method provided in an embodiment of the present application;

[0035] Figure 6 It is a schematic diagram of the composition structure of a current limiter in a current limiting device provided in an embodiment of the present application;

[0036] Figure 7 This is a schematic diagram of traffic distribution provided by an embodiment of the present application;

[0037] Figure 8 It is a flow chart of another flow processing method provided in an embodiment of the present application;

[0038] Fig. 9 It is a schematic diagram of the composition structure of a flow processing device provided in an embodiment of the present application;

[0039] Fig.10 It is a schematic diagram of the composition structure of another flow processing device provided in an embodiment of the present application;

[0040] Fig.11 It is a schematic diagram of the composition structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0042] The traffic involved in this application may refer to a request sent by any terminal device to an application, and any terminal sends a request to an application, thereby requesting to access the application, obtain data in the application, or use the corresponding function in the application. The technical solution of this application can be applied to the first traffic such as white traffic protection scenario, for example, white traffic can refer to a request initiated by a legitimate object using a terminal device, and a legitimate object can refer to a normal registered object of an application, for example. For example, it can be applied to a variety of applications such as audio applications, video applications, or other data interaction applications, and so on. For example, when abnormal traffic arrives, the abnormal traffic may include attack traffic and suspicious traffic. Attack traffic may refer to a request initiated by an illegal object using a terminal device, for example, and an illegal object may refer to an abnormal registered object of an application. Suspicious traffic may refer to a request initiated by a suspicious object using a terminal device, that is, suspicious traffic may refer to traffic that is not sure to be white traffic or attack traffic, for example, suspicious traffic may refer to a second traffic such as gray traffic. Suspicious objects may include objects that are not sure to be illegal objects or legal objects. Since white traffic refers to traffic that a legal object needs to access an application or use the corresponding function in an application, the normal use of the legal object for the application can be achieved by ensuring the normal processing of white traffic. This can prevent illegal or suspicious objects from using the application and occupying processing resources, which can cause the application's backend service to crash, and can improve the user experience of the application.

[0043] It is understandable that the collection, use and processing of the relevant data (such as flow rate, total flow rate, total flow limit threshold corresponding to the device cluster, preset flow limit threshold, etc.) involved in the embodiments of this application requires the consent of the corresponding personal information subject and needs to comply with the provisions of relevant laws and regulations. The object mentioned in the embodiments of this application may refer to the user of the terminal device.

[0044] Please refer to Figure 1 , Figure 1 is a network architecture diagram of a traffic processing system provided in an embodiment of the present application, such as Figure 1 As shown, the computer device can exchange data with the terminal device, and the number of the terminal devices can be one or at least two. For example, when the number of the terminal devices is multiple, the terminal device may include Figure 1The terminal device 101a, the terminal device 101b and the terminal device 101c, etc. Among them, taking the terminal device 101a as an example, the terminal device 101a can send an access request to the computer device 102, and the access request can refer to traffic. After the computer device 102 receives the traffic sent by the terminal device 101a, it can determine the total traffic received within the preset time period. If the total traffic is greater than the current limiting threshold corresponding to the target current limiting device, the computer device 102 performs current limiting processing on the second traffic, such as the gray traffic, which exceeds the current limiting threshold corresponding to the second traffic, to obtain the gray traffic after the current limiting processing. Furthermore, if the total traffic obtained by the computer device 102 based on the second traffic after the current limiting processing and the first traffic, such as the white traffic, is less than or equal to the current limiting threshold corresponding to the target current limiting device, the white traffic and the gray traffic after the current limiting processing are allocated to the backend service 103. Optionally, the computer device 102 may receive a processing result of the traffic by the backend service 103 , for example, if the processing result is an access result for an application, the access result may be returned to the terminal device 101a to display the access result for the application on the terminal device 101a .

[0045] The computer device mentioned in the embodiment of the present application may refer to a server or a terminal device, or may also be a system composed of a server and a terminal device, or may also refer to a gateway deployed on a server, which is not limited in the embodiment of the present application. The back-end service may refer to the back-end service of an application that the terminal device needs to access. The terminal device may be an electronic device, including but not limited to a mobile phone, a tablet computer, a laptop computer, a vehicle-mounted device, etc. The server mentioned above may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, and big data and artificial intelligence platforms.

[0046] For further information, see Figure 2 , Figure 2 is a flow chart of a flow processing method provided by an embodiment of the present application; Figure 2 As shown, the traffic processing method can be applied to a computer device, which can be, for example, a gateway. The gateway is used to perform flow limiting processing on the traffic and then forward it to the corresponding backend service. The gateway can be deployed on a server or a terminal device. The traffic processing method includes but is not limited to the following steps:

[0047] S101, determining the total amount of traffic received within a preset time period.

[0048] In some scenarios, the backend service of the application can handle multiple flows at the same time, but the number of flows that the backend service can handle simultaneously is limited. When attack traffic occurs, the attack traffic will occupy the processing capacity of the backend service, resulting in the backend service having no capacity to handle normal traffic. As a result, the initiator of normal traffic becomes unavailable or intermittently unavailable when using the backend service of the application, causing unstable use of the application and affecting the object's experience of using the application.

[0049] In view of this, an embodiment of the present application provides a traffic processing method, which can limit the flow of traffic other than normal traffic when the total flow is large, such as limiting the flow of suspicious traffic, providing more processing capacity for normal traffic, ensuring that the processing of normal traffic is not affected, and improving the stability of use of the application.

[0050] In the embodiment of the present application, the current limiting process is essentially that when the system capacity is sufficient, normal traffic such as white traffic and questionable traffic such as gray traffic can be processed normally. When the capacity is insufficient, the gray traffic is current limited, such as discarding the gray traffic, that is, not forwarding the gray traffic to the back-end service for processing, so as to protect the normal processing of the white traffic. In the embodiment of the present application, by performing current limiting processing on all received traffic at the gateway, there is no need to split the back-end service, that is, there is no need to split the back-end service into two parts, one of which is used to process white traffic and the other is used to process gray traffic. By allocating the traffic after the current limiting process to the back-end service for processing, the availability of the back-end service can be guaranteed, and there is no need to rely on the splitting of the back-end service, which can reduce the workload.

[0051] In the embodiment of the present application, when any terminal device or a terminal device with a third-party service deployed needs to access an application, it can send traffic to the gateway associated with the application, that is, send an access request for the application, so that the gateway processes the traffic accordingly and allocates the traffic to the corresponding backend service in the application, processes the traffic through the backend service to achieve access to the application, and returns the access result for the application. For example, the access result may include but is not limited to access data for the backend service of the application, or access success or failure data for the backend service, etc. Alternatively, when the terminal device needs to obtain data in the application, it can send traffic to the gateway associated with the application, that is, send a data acquisition request for the application, and the data acquisition request is used to request to obtain the corresponding data in the application, so that the gateway processes the traffic accordingly and allocates the traffic to the corresponding backend service in the application, and the backend service can obtain the corresponding data in the application, thereby returning the data to the terminal device.

[0052] It is understandable that any terminal device can send traffic to the application to access the application. For example, the traffic received by the gateway for the application may include the first traffic, the second traffic and the third traffic. Among them, the first traffic may refer to normal traffic such as white traffic. The second traffic may refer to suspicious traffic such as gray traffic, and the third traffic may refer to attack traffic such as black traffic. Since it is uncertain whether the second traffic is normal traffic or attack traffic, if the second traffic is directly intercepted, and the second traffic is normal traffic, it will affect the access or use of the application by the legitimate object. Therefore, the second traffic cannot be directly intercepted. When the processing resources are sufficient, the second traffic can be forwarded to the backend service for processing to ensure the access or use of the application by the legitimate object as much as possible.

[0053] Optionally, for example, the first traffic may include traffic with a first traffic attribute. The first traffic attribute may include an attribute that the access frequency of the terminal device that initiates the traffic is less than the minimum value in the preset traffic interval, or the identity information of the terminal device that initiates the traffic belongs to the preset whitelist identity information. Among them, the access frequency of the terminal device may refer to the number of requests per second QPS (Query Per Second, i.e., query rate per second) of the terminal device accessing a single IP (Internet Protocol, a protocol for interconnection between networks) address. If the access frequency of the terminal device that initiates the traffic is less than the minimum value in the preset traffic interval, it means that the number of requests per second of the terminal device accessing a single IP address is lower than the minimum value in the preset traffic interval, and the traffic sent by the terminal device may refer to white traffic. Alternatively, the traffic whose identity information of the terminal device that initiates the traffic belongs to the preset whitelist identity information may refer to white traffic. The preset whitelist identity information may include but is not limited to a whitelist list, a whitelist configuration list of the terminal device, a whitelist behavior list of the terminal device, and the like. The whitelist list may refer to an IP whitelist, and the whitelist list may include the IP address of at least one terminal device. If the IP address of the terminal device that initiates the traffic belongs to the whitelist list, it can be determined that the traffic is white traffic. The whitelist configuration list of terminal devices may include the configuration information of each type of terminal device. For example, the configuration information of the terminal device of model A includes configuration parameter A. When the model of the terminal device initiating the traffic is model A, it can be determined whether the configuration parameter of the terminal device initiating the traffic is configuration parameter A. If it is configuration parameter A, the traffic is considered to be white traffic. For example, the configuration parameters may include the hardware configuration parameters and software configuration parameters of the terminal device, etc. The whitelist behavior list of the terminal device may include but is not limited to whitelist user operation behaviors for the terminal device, such as mouse, keyboard, touch screen events and other operation behaviors. By pre-setting the whitelist user operation behavior of the terminal device, when the user operation behavior of the terminal device initiating the traffic is collected and matches the pre-set whitelist user operation behavior of the terminal device, the traffic is determined to be white traffic.

[0054] Furthermore, the second traffic, such as gray traffic, includes traffic with a second traffic attribute, and the second traffic attribute is different from the first traffic attribute. For example, the second traffic attribute may include an attribute that the access frequency of the terminal device that initiates the traffic belongs to a preset traffic interval, or the identity information of the terminal device that initiates the traffic does not belong to the preset whitelist identity information. The access frequency of the terminal device that initiates the traffic belongs to the preset traffic interval, which may mean that the access frequency is greater than or equal to the minimum value of the preset traffic interval, and less than or equal to the maximum value of the preset traffic interval. If the access frequency of the terminal device that initiates the traffic belongs to the preset traffic interval, which means that the number of requests per second QPS of the terminal device accessing a single IP address belongs to the preset traffic interval, then the traffic sent by the terminal device may refer to gray traffic. Or if the identity information of the terminal device that initiates the traffic does not belong to the preset whitelist identity information, then the traffic is determined to be gray traffic.

[0055] Further, the third traffic, such as black traffic, includes traffic with a third traffic attribute, and the third traffic attribute is different from the second traffic attribute and the first traffic attribute. For example, the third traffic attribute may include an attribute that the access frequency of the terminal device that initiates the traffic is greater than the maximum value of the preset traffic interval, or the identity information of the terminal device that initiates the traffic belongs to the preset blacklist identity information. Among them, if the access frequency of the terminal device that initiates the traffic is greater than the maximum value of the preset traffic interval, it means that the number of requests per second QPS of the terminal device accessing a single IP address is greater than the maximum value of the preset traffic interval, and the traffic sent by the terminal device may refer to black traffic. Alternatively, the traffic whose identity information of the terminal device that initiates the traffic belongs to the preset blacklist identity information may refer to black traffic. The preset blacklist identity information may include but is not limited to a blacklist list, a blacklist configuration list of the terminal device, a blacklist behavior list of the terminal device, and the like. The blacklist list may include the IP address of at least one terminal device. If the IP address of the terminal device that initiates the traffic belongs to the blacklist list, it can be determined that the traffic is black traffic. The terminal device blacklist configuration list may include configuration information for each type of terminal device. For example, when the configuration parameters included in the configuration information of a terminal device of a certain type that initiates traffic match the blacklist configuration list, the traffic is considered to be black traffic. The terminal device blacklist behavior list may include, but is not limited to, preset blacklist user operation behaviors for terminal devices, such as mouse, keyboard, touch screen events, and other operation behaviors. By presetting the blacklist user operation behaviors of the terminal device, when the user operation behaviors of the terminal device that initiates traffic are collected and match the user operation behaviors of the preset blacklist terminal device, the traffic is determined to be black traffic.

[0056] Optionally, for example, the second traffic attribute may also refer to an attribute that the identity information of the terminal device initiating the traffic does not belong to the preset whitelist identity information, nor to the preset blacklist identity information. That is, if the identity information of the terminal device initiating the traffic does not belong to the preset blacklist identity information and does not belong to the preset whitelist identity information, the traffic is determined to be gray traffic.

[0057] In the embodiments of the present application, attack traffic mainly refers to black traffic. For example, attack traffic may also include some gray traffic that has not been identified as black traffic and white traffic. Black traffic may also refer to traffic that maliciously attacks the IP (Internet Protocol, a protocol for interconnection between networks) addresses of applications to achieve the purpose of crawling and making profits (such as scanning numbers, flash sales), etc. For example, attack traffic may include crawler traffic, CC attacks (Challenge Collapsar Attack, an attack on a server or application), various types of cheating traffic, etc.

[0058] In an embodiment of the present application, since the terminal device of an illegal object may initiate a traffic of 100QPS per second when accessing an application (such as a single IP address), the terminal device of a legal object may initiate a traffic of less than 5QPS per second when accessing an application. Therefore, if there is an object that accesses an application at a frequency greater than 5QPS and less than 100QPS per second, the object may be a long-tail object or an illegal object, and therefore the traffic that cannot be clearly identified as black traffic or white traffic is identified as gray traffic. Long-tail objects refer to legal objects that access applications at a frequency lower than the frequency threshold. Since white traffic refers to the normal traffic of legal objects, when the gateway receives white traffic and gray traffic, more white traffic can be allocated to the corresponding back-end services by limiting the gray traffic, thereby ensuring the normal processing of white traffic and the normal use of the application.

[0059] In an embodiment of the present application, since the gateway can receive traffic sent by all terminal devices or third-party services that need to access the application, the gateway can determine the total traffic received within a preset time period. Among them, the traffic includes white traffic and gray traffic, and the preset time period can refer to a time period consisting of any one second or any number of seconds. By limiting the flow of traffic received within the preset time period, the back-end service can process the limited traffic within the preset time period to ensure the normal operation of the back-end service. It is understandable that the gateway will also receive black traffic in each time period. When the received traffic is identified as black traffic, the black traffic can be directly intercepted and processed to avoid forwarding the black traffic to the back-end service, causing the back-end service to be abnormal. Therefore, the gateway only needs to determine the total flow of white traffic and gray traffic received within the preset time period, and then determine whether to perform current limiting processing in combination with the total flow of white traffic and gray traffic.

[0060] In the embodiment of the present application, the gateway can determine whether the traffic received by the gateway is too much by determining the sum of the traffic received within the preset time period. If the traffic received within the preset time period is too much, the received traffic can be limited to reduce the amount of traffic, so that the backend service of the application can process the limited traffic. If the gateway receives less traffic within the preset time period, it means that the backend service of the application can process the received traffic, and the gateway can allocate the traffic to the corresponding backend service for processing.

[0061] In the embodiment of the present application, since the system capacity of the application is limited, that is, the amount of traffic (including white traffic and gray traffic) that the back-end service can handle is limited, when the system capacity is insufficient, in order to protect the normal use of the application and prevent the back-end service from being interrupted, the traffic that exceeds the system capacity can be discarded at the entrance, and services within the capacity can be provided to ensure the stability of the service.

[0062] The following describes the specific application scenarios in the embodiments of the present application. Figure 3 , Figure 3 is a schematic diagram of a traffic processing scenario provided by an embodiment of the present application, such as Figure 3 As shown, the object uses a terminal device to send the traffic of the external network to the entrance of the cloud service network of the public cloud in the traffic processing system corresponding to the application, and then enters the gateway. The gateway may include an access layer gateway and a business gateway, for example. At the access layer gateway, the full amount of traffic can be identified by a firewall such as WAF (Web Application Firewall, a firewall deployed at the front end of the application to detect and defend against network attacks) such as DDOS (Distributed Denial of Service) attack, CC attack and other network attack traffic, thereby dividing the full amount of traffic into black traffic, white traffic and gray traffic. The firewall can divide black, white and gray traffic based on the IP frequency control strategy (i.e., whether the access frequency belongs to the preset traffic interval). When it is determined to be black traffic, it will be directly intercepted at the access layer gateway. After passing through the access layer gateway, the white traffic and the gray traffic will enter the business gateway cluster, which includes multiple business gateways. The business gateway can realize more refined crawler identification of the traffic through the anti-crawling system by opening the interface of the anti-crawling system, such as identifying and intercepting crawler traffic and attack traffic. Furthermore, after the traffic is identified as passed, the service gateway can distribute the identified traffic to the service backend (ie, backend service) of the application program for corresponding service processing.

[0063] It is understandable that when attack traffic is not identified, intercepted and allocated to backend services, there is a risk of the business backend being disrupted due to insufficient buffering capacity of some business gateways and business backends. Therefore, it is necessary to perform resource isolation / flow limiting on the gateway and its subsequent links for the identified traffic, such as gray traffic and white traffic, so that when there is attack traffic, the availability of white traffic can be prioritized, black traffic is discarded, and gray traffic competes for resources to ensure the availability of the application's backend services.

[0064] In one embodiment, the method of resource isolation for backend services is to isolate resources for all gateway clusters that have capacity risks, with a small portion of resources given to gray traffic and most of the resources allocated to white traffic, to ensure that attack traffic does not occupy the resources of white traffic, and to ensure that most legitimate objects can use the application when there is attack traffic. However, the method of resource isolation for backend services requires physically splitting the gateway cluster and the business backend into two at the business gateway layer, which requires too high a cost. In order to ensure the supply of service resources for white traffic when the amount of gray traffic and black traffic is large, the use experience of legitimate objects for backend services is guaranteed. Therefore, after distinguishing black, gray, and white traffic at the access layer, black traffic is intercepted, and when the system capacity is insufficient (when the corresponding current limiting threshold of the gateway is reached), gray traffic can be discarded to protect white traffic.

[0065] S102, obtaining a preset current limiting ratio between a current limiting threshold corresponding to a first flow and a current limiting threshold corresponding to a second flow, and determining a current limiting threshold corresponding to the second flow based on the preset current limiting ratio and the preset current limiting threshold.

[0066] In an embodiment of the present application, the current limiting threshold corresponding to the white traffic can be determined by setting a fixed ratio current limiting method, and then the current limiting threshold corresponding to the gray traffic, that is, the current limiting threshold corresponding to the second traffic, is determined according to the preset current limiting threshold and the current limiting threshold corresponding to the white traffic. The preset current limiting threshold can indicate the upper limit of the traffic that the gateway can handle, that is, the system capacity of each gateway. The preset current limiting threshold may refer to the upper limit of the traffic that any current limiting device in the device cluster can handle, and the upper limit of the traffic that any current limiting device can handle may refer to the upper limit of the traffic that the backend service corresponding to any current limiting device can handle. The current limiting device refers to a gateway, and may also refer to multiple instances for current limiting. The preset current limiting thresholds of each current limiting device in the device cluster may be the same or different, and this is not limited in the embodiment of the present application.

[0067] Among them, the preset current limiting ratio may refer to the ratio between the current limiting threshold corresponding to the white flow and the current limiting threshold corresponding to the gray flow. By presetting the ratio between the current limiting threshold corresponding to the white flow and the current limiting threshold corresponding to the gray flow, when determining the preset current limiting threshold of each current limiting device, the current limiting threshold corresponding to the white flow can be calculated by multiplying the proportion of the current limiting threshold corresponding to the white flow in the preset current limiting ratio with the preset current limiting threshold, and then the current limiting threshold corresponding to the gray flow can be calculated according to the difference between the preset current limiting threshold and the current limiting threshold corresponding to the white flow. Alternatively, the current limiting threshold corresponding to the gray flow can also be calculated by multiplying the proportion of the current limiting threshold corresponding to the gray flow in the preset current limiting ratio with the preset current limiting threshold.

[0068] For example, the preset current limiting ratio between the current limiting threshold corresponding to the first flow and the current limiting threshold corresponding to the second flow can be 0.8:0.2, and the preset current limiting threshold is 100, then the current limiting threshold corresponding to the white flow is 0.8*100=80, and the current limiting threshold corresponding to the gray flow is 100-80=20.

[0069] In one implementation, when the total amount of received traffic is greater than a preset current limiting threshold, the white traffic can be limited based on the current limiting threshold corresponding to the white traffic, and the gray traffic can be limited based on the current limiting threshold corresponding to the gray traffic, thereby preventing the traffic from exceeding the processing upper limit of the backend service and ensuring the normal operation of the backend service.

[0070] In another implementation, in order to ensure that more white traffic passes through, gray traffic can be first limited based on the current limiting threshold corresponding to gray traffic. When the total flow of gray traffic and white traffic after current limiting is less than the preset current limiting threshold, the gray traffic and white traffic after current limiting are allocated to the backend service. After the gray traffic is limited, the gateway has sufficient capacity to process the white traffic and the remaining gray traffic, so there is no need to limit the white traffic, thereby protecting the normal processing of the white traffic.

[0071] In an embodiment of the present application, if the sum of the flows received within a preset time period is greater than a preset current limiting threshold, it means that the capacity of the system is insufficient to handle all flows, and the white flow and the gray flow can be simultaneously subjected to current limiting processing, so that the sum of the flows of the white flow and the gray flow after the current limiting processing is less than or equal to the preset current limiting threshold, and the system capacity can process the white flow and the gray flow after the current limiting processing. Alternatively, the gray flow can also be subjected to current limiting processing to reduce the sum of flows and thus ensure the normal processing of the white flow. Current limiting is performed by setting a fixed ratio current limiting method, which is equivalent to setting a current limiting ratio between the current limiting threshold corresponding to the white flow and the current limiting threshold corresponding to the gray flow, so that when the sum of flows is greater than the preset current limiting threshold, the white flow can be subjected to current limiting processing based on the current limiting threshold corresponding to the white flow, and the gray flow can be subjected to current limiting processing based on the current limiting threshold corresponding to the gray flow, thereby avoiding the flow exceeding the processing upper limit of the back-end service and ensuring the normal operation of the back-end service.

[0072] In the embodiment of the present application, any current limiting device in the device cluster can be used as an example to illustrate that when the total flow received by any current limiting device within a preset time period is greater than the preset current limiting threshold corresponding to any current limiting device, the gray flow in the flow received by any current limiting device is current limited, or the white flow and gray flow in the flow received by any current limiting device are current limited. For other current limiting devices in the device cluster, this method can also be used to limit the gray flow in the received flow, or the gray flow and white flow in the received flow can be current limited. The embodiment of the present application does not explain this in detail.

[0073] S103: If the total flow is greater than the preset flow limiting threshold, flow limiting processing is performed on the flow in the second flow that exceeds the flow limiting threshold corresponding to the second flow to obtain the second flow after the flow limiting processing.

[0074] In the embodiment of the present application, the current limiting threshold corresponding to the second flow may refer to the current limiting threshold corresponding to the gray flow. Since the total flow of the white flow and the gray flow is greater than the preset current limiting threshold, it indicates that the capacity of the system is insufficient. In order to ensure the normal processing of the white flow, the gray flow that exceeds the current limiting threshold corresponding to the gray flow can be current limited to obtain the gray flow after current limiting. By current limiting the gray flow, a part of the gray flow can be discarded, that is, the gray flow that exceeds the current limiting threshold corresponding to the gray flow is discarded, which can reduce the amount of the remaining total flow, which is equivalent to reducing the system capacity required to process the remaining flow, so that the remaining gray flow and the white flow received within the preset time period can be processed normally.

[0075] In the embodiment of the present application, by performing flow limiting processing on the gray traffic that exceeds the flow limiting threshold corresponding to the gray traffic, there is no need to occupy the processing resources of the white traffic. Only multiple gray traffic need to compete for resources internally. This can ensure that when attack traffic is generated, the server processing resources of the white traffic will not be occupied, thereby not affecting the normal processing of the white traffic. This ensures the availability of most legitimate objects to back-end services when attack traffic exists, thereby achieving white traffic protection.

[0076] In one embodiment, the second flow, i.e., the ash flow that exceeds the current limiting threshold corresponding to the ash flow, is subjected to current limiting processing, and the method for obtaining the ash flow after current limiting processing may include: intercepting the flow in the second flow that exceeds the current limiting threshold corresponding to the second flow, and determining the second flow after interception processing as the second flow after current limiting processing.

[0077] Among them, intercepting the traffic in the second traffic that exceeds the current limiting threshold corresponding to the second traffic may refer to discarding the gray traffic that exceeds the current limiting threshold corresponding to the gray traffic, and not allocating this part of the gray traffic to the backend service for subsequent processing. When discarding the gray traffic, the gray traffic can be randomly selected for discarding, which is not limited in the embodiments of the present application. For example, if the number of gray traffic is 30, and the current limiting threshold corresponding to the second traffic, that is, the current limiting threshold corresponding to the gray traffic, is 15, then 15 gray traffics can be randomly selected from the 30 gray traffics for interception processing, and the 15 gray traffics that are not intercepted are determined as gray traffics after current limiting processing, and the 15 gray traffics can be subsequently allocated to the corresponding backend service for processing.

[0078] In the embodiment of the present application, by intercepting the gray flow that exceeds the current limiting threshold corresponding to the gray flow, the amount of gray flow can be reduced, thereby reducing the processing pressure of the backend service on the gray flow and ensuring the normal operation of the backend service.

[0079] In one embodiment, if the total amount of traffic received within a preset time period is less than or equal to a preset current limiting threshold, gray traffic and / or white traffic will not be subjected to current limiting. Since the total amount of traffic received within a preset time period is less than or equal to a preset current limiting threshold, it means that the capacity of the gateway is sufficient to handle all traffic, and there is no need to perform current limiting on gray traffic or white traffic, that is, all traffic can be processed normally, for example, white traffic can be allocated to backend services for processing, and gray traffic can be allocated to backend services for processing, to ensure normal processing of gray traffic and white traffic.

[0080] S104: If the total flow obtained based on the second flow after the flow limiting process and the first flow is less than or equal to the preset flow limiting threshold, the first flow and the second flow after the flow limiting process are allocated to the backend service.

[0081] In an embodiment of the present application, if the total flow obtained based on the gray flow and white flow after the flow limiting process is less than or equal to the preset flow limiting threshold, it means that the total flow remaining after the gray flow is flow limited is less than or equal to the system capacity, that is, the system capacity of the back-end service is sufficient to process the remaining gray flow and white flow, and the gateway can allocate the white flow and the gray flow after the flow limiting process to the back-end service for processing. By performing flow limiting on the gray flow when the total flow of the white flow and the gray flow exceeds the upper limit of the capacity of the gateway to process the flow, the amount of flow that needs to be processed can be reduced, and there is no need to limit the white flow, which can ensure the normal processing of the white flow and the normal processing of the gray flow remaining after the flow limiting process.

[0082] Among them, the backend service can refer to the business backend in the application, and the backend service can perform corresponding business processing on the received traffic. The gateway in the embodiment of the present application can be used to process the traffic sent by the terminal device to the application, such as intercepting and limiting the traffic sent by the terminal device to the application, and allocating it to the backend service of the application, so as to realize the access and data processing of the terminal device to the application. The backend service can process both the white traffic allocated by the gateway and the gray traffic allocated by the gateway. Since the backend service needs to consume processing resources to process both white traffic and gray traffic, the total amount of traffic can be reduced by limiting the flow of more gray traffic and white traffic on the gateway side, and allocating the gray traffic and / or white traffic after the flow limiting process to the backend service for processing, so as to reduce the amount of resources for the backend service to process the remaining traffic, and avoid the backend service from hanging up due to the large processing pressure caused by processing too much traffic, so as to ensure the operation stability of the backend service.

[0083] It is understandable that in the embodiment of the present application, after the gateway performs flow limiting processing on the gray traffic, or performs flow limiting processing on the gray traffic and the white traffic, the gray traffic and the white traffic after the flow limiting processing can be allocated to the same backend service for subsequent processing. For example, each gateway can be associated with a backend service. Since the amount of traffic that can be processed simultaneously by the backend service associated with each gateway is limited, after each gateway performs flow limiting processing on a large amount of received traffic, the remaining white traffic and gray traffic are allocated to the backend service associated with each gateway for corresponding processing, which can reduce the amount of traffic processed by the backend service, ensure that the backend service associated with each gateway can process the traffic after flow limiting, and thus ensure the stability of the operation of the backend service.

[0084] In a possible implementation, if the amount of traffic remaining after the gray traffic is limited is still greater than the capacity that the backend service can handle, the white traffic can be limited to ensure normal traffic processing. For example, if the sum of the traffic based on the second traffic and the first traffic after the limited traffic is greater than the preset limited traffic threshold, the first traffic in the first traffic that exceeds the limited traffic threshold corresponding to the first traffic is limited to obtain the first traffic after the limited traffic; the limited traffic threshold corresponding to the first traffic is greater than the limited traffic threshold corresponding to the second traffic.

[0085] Among them, the flow limiting threshold corresponding to the first flow refers to the flow limiting threshold corresponding to the white flow. If the total flow of the gray flow and the white flow after the flow limiting processing is greater than the preset current limiting threshold, it means that the amount of white flow is too much. Even after the gray flow is limited, the total flow of the remaining gray flow and the white flow is still greater than the preset current limiting threshold, or after all gray flows are limited, the total amount of the remaining white flow is still greater than the preset current limiting threshold. In this case, the white flow can be further limited to reduce the amount of white flow and ensure normal flow processing.

[0086] In the embodiment of the present application, since the flow limiting threshold corresponding to the white traffic is greater than the flow limiting threshold corresponding to the gray traffic, white traffic protection can be achieved, ensuring the normal processing of more white traffic, and improving the user experience of the backend service of the application for the legitimate object. In the case where the remaining traffic is still large after the gray traffic is flow limited, the amount of white traffic can be reduced by flow limiting the white traffic, reducing the processing pressure of the backend service for the white traffic, and ensuring the operation stability of the backend service.

[0087] Furthermore, since the sum of the second flow and the first flow after the flow limiting processing is greater than the preset flow limiting threshold, after the white flow is flow limited, the first flow after the flow limiting processing can be allocated to the backend service so that the backend service can process the first flow after the flow limiting processing.

[0088] Optionally, the white traffic that exceeds the current limiting threshold corresponding to the white traffic is subjected to current limiting processing, and the method for obtaining the white traffic after current limiting processing can be: intercepting the traffic that exceeds the current limiting threshold corresponding to the first traffic, and determining the first traffic after interception processing as the first traffic after current limiting processing. By intercepting the white traffic that exceeds the current limiting threshold corresponding to the white traffic, the remaining white traffic is determined as the white traffic after current limiting processing, and the white traffic after current limiting processing can be subsequently allocated to the backend service for processing.

[0089] Optionally, when limiting the gray flow and white flow, the gray flow limiter and the white flow limiter can be started respectively, the white flow limiter is used to limit the white flow, and the gray flow limiter is used to limit the gray flow. For example, a total flow counter can be used to count the received flow, and the total flow can be limited in combination with the white flow limiter and the gray flow limiter. The specific process is as follows:

[0090] When the counter counts that the total received traffic does not reach the preset flow limit threshold: all traffic enters the gateway, and the gateway distributes all traffic to the corresponding backend service to achieve normal processing of all traffic.

[0091] When the counter counts that the total received flow reaches the preset limiting threshold, the white flow limiter and the gray flow limiter are enabled. For example, the limiting threshold of the white flow limiter is 80%*the preset limiting threshold, and the limiting threshold of the gray flow limiter is 20%*the preset limiting threshold. The white flow limiter will limit the white flow that exceeds 80%*the preset limiting threshold, and the gray flow limiter will limit the gray flow that exceeds 20%*the preset limiting threshold.

[0092] The following are some examples of fixed ratio current limiting:

[0093] In the first case, for example, the preset flow limiting threshold is 100QPS, the amount of white traffic is 40QPS, and the amount of gray traffic is 50QPS, then the white traffic + gray traffic = 90QPS is less than the preset flow limiting threshold 100QPS, and all white traffic and gray traffic can be served normally, that is, all white traffic and gray traffic can be allocated to the corresponding backend services for processing.

[0094] In the second case, for example, the preset current limiting threshold is 100QPS, the amount of white traffic is 40QPS, the amount of gray traffic is 80QPS, and the white traffic + gray traffic = 120QPS is greater than the preset current limiting threshold 100QPS, then the white traffic passes 40QPS and the gray traffic passes 20QPS.

[0095] In the third case, for example, the preset current limiting threshold is 100QPS, the amount of white flow is 120QPS, the amount of gray flow is 50QPS, and the preset current limiting ratio is 0.8:0.2, that is, the current limiting threshold of the white flow limiter is 80QPS, and the current limiting threshold of the gray flow limiter is 20QPS. The white flow + gray flow = 170QPS is greater than the preset current limiting threshold of 100QPS, then the white flow passes 80QPS and the gray flow passes 20QPS.

[0096] It can be seen that in the fixed ratio flow limiting method, if the total flow of white traffic and gray traffic does not reach the preset flow limiting threshold, all white traffic and gray traffic can be normally allocated to the backend service for processing. If the total flow of white traffic and gray traffic reaches the preset flow limiting threshold, the gray traffic can be flow limited according to a fixed ratio, which is equivalent to allocating more processing resources to the white traffic to ensure the normal processing of the white traffic. Furthermore, if the amount of white traffic after flow limiting is still large, the white traffic can be further flow limited by the white traffic limiter, so that the white traffic after flow limiting can be allocated to the corresponding backend service for processing.

[0097] In the embodiment of the present application, flow limiting is performed by setting a fixed ratio flow limiting method, which is equivalent to setting the flow limiting ratio between the flow limiting threshold of the white flow limiter and the flow limiting threshold of the gray flow limiter, so that when the total flow rate of the flow is greater than the preset flow limiting threshold, the white flow limiter and the gray flow limiter can be started respectively, and the white flow limiter can limit the white flow based on the flow limiting threshold corresponding to the white flow, and the gray flow limiter can limit the gray flow based on the current limiting threshold corresponding to the gray flow.

[0098] For further information, see Figure 4 , Figure 4 is a schematic diagram of a fixed ratio current limiting scenario provided by an embodiment of the present application, such as Figure 4 As shown in the above Figure 3 On the basis of, after the full amount of traffic is colored by the firewall, the black traffic is intercepted, and the white traffic and gray traffic will enter the flow limiting operation after passing through the access layer gateway. For example, by turning on the flow limiter switch, the gray traffic is limited by the gray traffic flow limiter, and the gray traffic that exceeds the flow limiting threshold corresponding to the gray flow limiter is discarded according to the preset flow limiting ratio between the white traffic and the gray traffic. In addition, the white traffic that passes through the white traffic flow limiter is forwarded to the business gateway cluster, and the business gateway in the business gateway cluster, such as the community gateway, forwards the white traffic to the old gateway of the application, and the old gateway distributes the white traffic to the corresponding backend service in the business backend cluster.

[0099] In one embodiment, since multiple types of traffic can be received within a preset time period, the multiple types of traffic received can be initially filtered to filter out attack traffic, thereby performing subsequent flow limiting processing on the remaining traffic. For example, an initial traffic set received within a preset time period can be obtained; the initial traffic set includes at least one traffic; the third traffic in the initial traffic set is intercepted, and the initial traffic set remaining after the interception is determined as the target traffic set; the third traffic refers to traffic with a third traffic attribute; and the sum of the first traffic and the second traffic is determined from the target traffic set.

[0100] In the embodiment of the present application, the third traffic may refer to black traffic, for example. By filtering the black traffic, it is possible to avoid the occupation of the application's system resources due to frequent access of the attack traffic to the application, resulting in the inability to process the traffic of the legitimate object, thereby improving the user experience of the application. For example, since the frequency of the black industry attacking a single IP is greater than the maximum value in the preset traffic interval, it is possible to determine whether the traffic is black traffic by judging whether the traffic is greater than the maximum value in the preset traffic interval, thereby filtering the black traffic.

[0101] Alternatively, by increasing the recognition capability for black traffic, white traffic, and gray traffic, and increasing the processing capability, it is possible to add gray traffic discrimination logic to the current black-or-white discrimination logic and improve the accuracy of traffic processing.

[0102] For example, the identification capability may refer to the WAF layer injecting a Web SDK (Software Development Kit) collector into a Web (World Wide Web, browser) / H5 (HyperTextMarkup Language5, a language description method for building Web content) request, adding features collected in the browser or container environment, and identifying abnormal traffic in conjunction with the IP whitelist, IP frequency control and other information provided by anti-crawling. Among them, the IP whitelist may include a whitelist address list, that is, the IP addresses of terminal devices belonging to the whitelist, and the IP whitelist is pre-placed for use by the firewall. If the IP address of the terminal device used by the initiator of the traffic belongs to the IP whitelist, the traffic is considered to be white traffic, otherwise the traffic is considered to be gray traffic. And through IP frequency control (i.e., access frequency), the traffic initiated by the terminal device that exceeds the normal object access frequency (i.e., the access frequency is greater than the minimum value in the preset traffic interval) but is lower than the black industry access frequency (i.e., the access frequency is less than the maximum value in the preset traffic interval) is judged as gray traffic.

[0103] Optionally, the Web collector identifies Bot (robot) behavior, for example, browser or container environment information can be collected to identify whether the traffic is black traffic, for example, the browser or container environment information can include but is not limited to browser model version, screen resolution, time zone characteristics and timestamp, etc. When Bot behaviors such as abnormal browser model version, abnormal screen resolution, abnormal time zone characteristics or abnormal timestamp are collected, the traffic with this behavior is considered to be attack traffic. For example, the model of the terminal device that sends a certain traffic is type A, and the type A terminal device corresponds to a specific device attribute. When the device attribute of the type A terminal device collected is different from the specific device attribute, the traffic is considered to be black traffic. Or, for example, the User Agent (UA) of the collected traffic, the UA obtained by parsing does not conform to the preset UA format, then the traffic is considered to be black traffic. Or the screen resolution of the terminal device corresponding to a certain traffic does not belong to the preset resolutions, then the traffic is considered to be black traffic, and so on. Furthermore, some common browser-level Bot scripts, drivers (a part of the automated testing framework, used to control and operate the system under test), and automated containers can also be identified through specific attack and defense probes. Taking driver as an example, since the automated testing framework can automatically simulate operations such as clicking on controls in the browser, but the simulated operations are different from the operations of the legitimate object using the mouse, or the browser address is taken out without parsing the header and UA, and the headless browser address is identified, it can be considered as black traffic. Furthermore, user operation behaviors such as the mouse, keyboard, and touch screen events of the object on the page can also be collected to determine whether they are the same as normal user operations, thereby identifying black traffic.

[0104] Furthermore, the handling capability can mean that on the basis of the current black traffic handling such as status code 418 / 405 interception and white traffic handling logic such as status code 200 release, the logic of gray traffic release can be added. For example, the added black, white and gray logic is: status code 418 / 405 black traffic-interception; status code 430 gray traffic-release; status code 200 white traffic-release, etc. For example, black traffic can be identified through Web vulnerability exploitation feature rules, or IP frequency control identification, or Bot feature identification, etc. Gray traffic can be identified through Bot behavior identification, IP frequency control identification, IP whitelist identification, IP threat information identification, etc. For example, if it does not belong to IP threat information, it is considered gray traffic.

[0105] In the embodiment of the present application, fixed current limiting can be used to achieve the situation where there is no need to re-split the device cluster and deploy services. When attack traffic comes, gray traffic can compete for a small amount of resources internally, protecting the service stability of white traffic and reducing operation and maintenance costs. WAF can use the IP data of the refined identification of the back link for front-end layout, intercept and color traffic in advance, and the back-end anti-climbing and risk control to form a defense depth, protecting a longer link.

[0106] In the embodiment of the present application, by determining the total amount of traffic received within a preset time period; the traffic includes a first traffic and a second traffic, the first traffic refers to traffic with a first traffic attribute, and the second traffic refers to traffic with a second traffic attribute; obtaining a preset current limiting ratio between a current limiting threshold corresponding to the first traffic and a current limiting threshold corresponding to the second traffic, and determining a current limiting threshold corresponding to the second traffic based on the preset current limiting ratio and the preset current limiting threshold; if the total amount of traffic is greater than the preset current limiting threshold, the second traffic in the second traffic that exceeds the current limiting threshold corresponding to the second traffic is subjected to current limiting processing to obtain a second traffic after current limiting processing; if the total amount of traffic obtained based on the second traffic after current limiting processing and the first traffic is less than or equal to the preset current limiting threshold, the first traffic and the second traffic after current limiting processing are allocated to the backend service. By combining the preset current limiting ratio to determine the current limiting threshold corresponding to the first traffic such as white traffic and the current limiting threshold corresponding to the second traffic such as gray traffic, current limiting processing of gray traffic and white traffic can be achieved in proportion, thereby reducing the amount of gray traffic and white traffic, and ensuring the stability of the backend service operation. When the total traffic is greater than the preset flow-limiting threshold, the total traffic can be reduced by limiting the second traffic, such as gray traffic, to ensure that the backend service can normally process more first traffic, such as white traffic, and improve the stability of white traffic processing. In addition, in the case of attack traffic, the gray traffic and white traffic after flow-limiting processing are allocated to the backend service for processing, avoiding the backend service crash due to excessive traffic allocated to the backend service, which can improve the stability of the backend service operation.

[0107] For further information, see Figure 5 , Figure 5 is a flow chart of another flow processing method provided in an embodiment of the present application; Figure 5 As shown, the traffic processing method can be applied to a computer device, which can refer to a gateway. The gateway is used to limit the traffic and then forward it to the corresponding backend service. The gateway can be deployed on a server or a terminal device. The traffic processing method includes but is not limited to the following steps:

[0108] S201, determining the total amount of traffic received within a preset time period.

[0109] The technical solution of the present application can be applied to the target current limiting device in the device cluster. The target current limiting device can be any current limiting device in the device cluster. The device cluster can refer to a gateway cluster, for example. The gateway cluster can include multiple current limiting devices such as gateways. The gateway can be used to limit the flow, and can also perform load balancing and forward the flow to the corresponding back-end service. It can be understood that the gateway mentioned in the embodiment of the present application can refer to a general term. The gateway can include, for example, an access layer gateway and a business gateway. The access layer gateway and the business gateway collaborate to realize the identification of black traffic, gray traffic and white traffic, and the gray traffic and white traffic are processed and forwarded to the back-end service. For example, the access layer gateway can perform preliminary identification of the traffic through the firewall, and the business gateway can perform more refined crawler identification on the traffic through the anti-crawling system, so as to identify the white traffic and gray traffic, and the business gateway performs current limiting processing on the gray traffic and white traffic, and then allocates it to the back-end service to process the traffic after the current limiting processing.

[0110] In an embodiment of the present application, the preset time period may refer to any time period, such as a time period in which it is necessary to determine whether to perform current limiting. The preset time period may refer to a time period consisting of a certain moment or multiple moments, etc., or the preset time period may also refer to the moment when current limiting is started. Specifically, when the target current limiting device receives traffic sent by any terminal device within the preset time period, the total amount of traffic received within the preset time period may be determined, so that it may be determined whether to start current limiting based on the total amount of traffic. If it is determined to start current limiting, current limiting may be started in the preset time period, so that current limiting may be performed on the received traffic in the preset time period or in a time period after the preset time period.

[0111] S202: Obtain the weight of the target current limiting device.

[0112] In the embodiment of the present application, since the device cluster includes multiple current limiting devices, the amount of traffic received by each current limiting device may be equal or unequal, so the weight of each current limiting device may be determined for each current limiting device, and then the corresponding current limiting threshold may be assigned to each current limiting device in combination with the weight of each current limiting device. In the embodiment of the present application, any current limiting device, i.e., the target current limiting device, is used as an example for explanation, and the processing method of other current limiting devices in the device cluster may refer to the processing method of the target current limiting device, and no further explanation is given in the embodiment of the present application.

[0113] In one embodiment, the weight of the target current limiting device can be determined in combination with the amount of traffic in the historical time period. For example, the first historical traffic sum of the historical traffic received by the target current limiting device in the historical time period before the preset time period can be obtained; the second historical traffic sum of the historical traffic received by each current limiting device in the device cluster in the historical time period can be obtained; and the weight of the target current limiting device can be determined based on the first historical traffic sum and the second historical traffic sum.

[0114] Among them, the historical time period may refer to a time period composed of one or more moments before the preset time period, that is, a time period before the moment when the current limiting process is required. The preset time period may also refer to the moment when the current limiter is turned on. Determining the weight of the target current limiting device according to the sum of the first historical flow and the sum of the second historical flow, for example, may refer to determining the ratio between the sum of the first historical flow and the sum of the second historical flow as the weight of the target current limiting device. For example, if the preset time period is the 14th second, and the historical time period includes 3 seconds, namely the 11th second, the 12th second, and the 13th second, then the first historical flow sum of the historical flow received by the target current limiting device within the 3 seconds (11th second to 13th second) of the historical time period can be obtained, such as 49, and the second historical flow sum of the historical flow received by all current limiting devices in the device cluster, such as 3 current limiting devices within 3 seconds, such as 124, then the weight of the target current limiting device is 49 / 124. That is, the weight of the target current limiting device within the preset time period is determined based on the flow situation of the historical time period before the preset time period.

[0115] In the embodiment of the present application, the weight of each current limiting device is determined by combining the actual flow quantity of each current limiting device in the device cluster in the historical time period, and then combining the weight of each current limiting device to determine whether to limit the flow of each current limiting device, which can improve the accuracy of the weight calculation of the current limiting device, thereby improving the accuracy of the predicted current limiting for the current limiting device. In addition, since the historical time period before the preset time period is combined to predict whether to start the current limiting, the accuracy of the current limiting can be improved.

[0116] In an optional implementation, each current limiting device in the device cluster can report in real time the amount of traffic it receives at each moment to the device cluster, and the target current limiting device can obtain the amount of traffic of each current limiting device at each moment from the device cluster in real time, or each current limiting device in the device cluster can report to other current limiting devices the amount of traffic it receives at each moment.

[0117] In one embodiment, the weight of the target current limiting device can be determined by the sum of the white traffic in the historical traffic received by the target current limiting device in the historical time period before the preset time period. For example, the third historical traffic sum of the first traffic in the historical traffic received by the target current limiting device in the historical time period before the preset time period can be obtained; the fourth historical traffic sum of the first traffic in the historical traffic received by each current limiting device in the device cluster in the historical time period can be obtained; and the weight of the target current limiting device can be determined based on the third historical traffic sum and the fourth historical traffic sum.

[0118] For example, if the preset time period is the 14th second, and the historical time period includes 3 seconds, namely the 11th second, the 12th second, and the 13th second, then the third historical flow sum of the first flow, i.e., the white flow, in the historical flow received by the target current limiting device within the 3 seconds (11th second to 13th second) of the historical time period can be obtained, such as 30, and the fourth historical flow sum of the white flow in the historical flow received by all current limiting devices in the device cluster, such as 3 current limiting devices within 3 seconds, such as 88, can be obtained, then the weight of the target current limiting device is 30 / 88.

[0119] In the embodiment of the present application, the weight of the target current limiting device is determined by the sum of the white flows received by the target current limiting device in the historical time period before the preset time period, so that the current limiting threshold corresponding to the first flow, that is, the current limiting threshold corresponding to the white flow, is allocated to the target current limiting device according to the determined weight of the target current limiting device, and then the current limiting is performed based on the current limiting threshold corresponding to the white flow. By determining the weight of the target current limiting device in combination with the amount of white flow, the accuracy of determining the current limiting threshold corresponding to the white flow can be improved, thereby increasing the protection of the white flow.

[0120] In an optional implementation, each current limiting device in the device cluster can report in real time the number of white flows or gray flows received by each device at each moment to the device cluster, and the target current limiting device can obtain in real time from the device cluster the number of white flows or gray flows of each current limiting device at each moment including the historical time period, or each current limiting device in the device cluster can report to other current limiting devices the number of white flows or gray flows received by each device at each moment.

[0121] S203: Calculate the current limiting threshold corresponding to the target current limiting device based on the weight of the target current limiting device and the total current limiting threshold corresponding to the device cluster.

[0122] In the embodiment of the present application, the larger the weight of the target current limiting device, the larger the current limiting threshold corresponding to the calculated target current limiting device can be, and the smaller the weight of the target current limiting device, the smaller the current limiting threshold corresponding to the calculated target current limiting device can be. For current limiting devices with higher weights, that is, devices that receive a larger amount of traffic, a higher current limiting threshold corresponding to the target current limiting device can be set later, so that the current limiting device with higher weight can process more traffic. For current limiting devices with lower weights, that is, devices that receive a smaller amount of traffic, a lower current limiting threshold corresponding to the target current limiting device can be set later, so that resource idleness can be reduced and resource utilization can be improved.

[0123] The total current limiting threshold corresponding to the device cluster may refer to the total amount of traffic that the device cluster can handle within a preset period of time. Optionally, for example, the product of the weight of the target current limiting device and the total current limiting threshold corresponding to the device cluster may be used as the current limiting threshold corresponding to the target current limiting device.

[0124] For example, if the weight of the target current limiting device is 49 / 124, and the total current limiting threshold corresponding to the device cluster is 100, then the current limiting threshold corresponding to the target current limiting device may be (49 / 124)*100≈40.

[0125] It can be understood that in the initial state, the current limiting threshold corresponding to the target current limiting device is equal to the preset current limiting threshold, for example, the preset current limiting threshold is 100, then in the initial state, the current limiting threshold corresponding to the target current limiting device is 100. However, since the current limiting threshold corresponding to the target current limiting device can be calculated based on the weight of the target current limiting device and the total current limiting threshold corresponding to the device cluster, the size of the current limiting threshold corresponding to the target current limiting device can be adjusted based on the weight of the target current limiting device and the total current limiting threshold corresponding to the device cluster. That is, the larger the weight of the target current limiting device, the larger the current limiting threshold corresponding to the target current limiting device can be adjusted, and the smaller the weight of the target current limiting device, the smaller the current limiting threshold corresponding to the target current limiting device can be adjusted. When the target current limiting device receives more traffic, by increasing the current limiting threshold corresponding to the target current limiting device, more white traffic can be processed. When the target current limiting device receives less traffic, by reducing the current limiting threshold corresponding to the target current limiting device, more processing resources can be allocated to other current limiting devices in the device cluster, avoiding idle processing resources and improving resource utilization.

[0126] S204: Determine a current limiting threshold corresponding to the first flow according to the total flow of the first flow received by the target current limiting device within a preset time period and the current limiting threshold corresponding to the target current limiting device.

[0127] In the embodiment of the present application, the current limiting threshold corresponding to the white flow may be, for example, greater than or equal to the total flow of the white flow, and less than or equal to the current limiting threshold corresponding to the target current limiting device. For example, according to the total flow of the white flow received by the target current limiting device within a preset time period and the current limiting threshold corresponding to the target current limiting device, the method of determining the current limiting threshold corresponding to the white flow may refer to: selecting the current limiting threshold corresponding to the white flow from the first value interval consisting of the total flow of the white flow received by the target current limiting device within the preset time period and the current limiting threshold corresponding to the target current limiting device, the minimum value in the first value interval is the total flow of the white flow received by the target current limiting device within the preset time period, and the maximum value in the first value interval is the current limiting threshold corresponding to the target current limiting device. For example, the first value interval is [the total flow of the white flow received within the preset time period, the current limiting threshold corresponding to the target current limiting device].

[0128] For example, if the total flow of white traffic received by the target current limiting device within a preset time period (such as the 15th second) is 20, and the current limiting threshold corresponding to the target current limiting device is 40, then the first value interval is [20, 40].

[0129] Optionally, for example, the minimum value of the first value interval can be directly determined as the current limiting threshold corresponding to the white flow, so that the amount of gray flow passing through can be increased while ensuring the white flow passing through. Alternatively, the maximum value of the first value interval can be determined as the current limiting threshold corresponding to the white flow, so that more white flow can be ensured to pass through when the white flow suddenly increases. Alternatively, an intermediate value can be selected from the first value interval to ensure the amount of gray flow passing through, and the part of the white flow that suddenly increases can also be processed, which is not limited in the embodiments of the present application.

[0130] S205: Determine a current limiting threshold corresponding to the second flow rate according to the current limiting threshold corresponding to the target current limiting device and the current limiting threshold corresponding to the first flow rate.

[0131] In the embodiment of the present application, since the current limiting threshold corresponding to the white flow of the target current limiting device is determined, the current limiting threshold corresponding to the gray flow can be determined according to the current limiting threshold of the target current limiting device and the current limiting threshold corresponding to the white flow. The current limiting threshold corresponding to the gray flow is less than or equal to the current limiting threshold corresponding to the target current limiting device. For example, the difference between the current limiting threshold corresponding to the target current limiting device and the current limiting threshold corresponding to the white flow and 0 can be used as the second value interval of the current limiting threshold corresponding to the gray flow, that is, the second value interval is [0, the current limiting threshold corresponding to the target current limiting device-the current limiting threshold corresponding to the white flow], and then the current limiting threshold corresponding to the gray flow can be determined from the second value interval. For example, if the current limiting threshold corresponding to the white flow is 20, the second value interval of the current limiting threshold corresponding to the gray flow can be [0, 20].

[0132] In the embodiment of the present application, since the current limiting threshold corresponding to the white flow is obtained by predicting the flow of the target current limiting device in the historical time period, the accuracy of current limiting for the white flow can be improved. In addition, since the current limiting threshold corresponding to the gray flow is predicted by the flow of the target current limiting device in the historical time period and the current limiting threshold corresponding to the white flow, the accuracy of current limiting for the gray flow can be improved. Subsequently, the white flow can be subjected to current limiting processing based on the current limiting threshold corresponding to the white flow of the target current limiting device, and the gray flow can be subjected to current limiting processing based on the current limiting threshold corresponding to the gray flow of the target current limiting device, so that the processing of the gray flow can be increased while protecting the white flow as much as possible, so that the processing resource occupancy rate of the backend service can be improved, and the normal access of the white flow can be guaranteed, the normal operation of the backend service can be guaranteed, and the user experience can be improved.

[0133] S206: If the total flow received by the target current limiting device within the preset time period is greater than the current limiting threshold corresponding to the target current limiting device, current limiting processing is performed on the flow in the second flow that exceeds the current limiting threshold corresponding to the second flow to obtain the second flow after current limiting processing.

[0134] For example, if the preset time period is the 14th second, the target current limiting device is instance 1, the current limiting threshold corresponding to the target current limiting device is 40, and the total flow received by instance 1 within the preset time period is 41, which is greater than the current limiting threshold 40 corresponding to the target current limiting device, then the gray flow that exceeds the current limiting threshold corresponding to the gray flow can be current limited at the 14th second to obtain the gray flow after current limiting processing.

[0135] S207: If the total flow obtained based on the second flow after the flow limiting process and the first flow is less than or equal to the flow limiting threshold corresponding to the target flow limiting device, the first flow and the second flow after the flow limiting process are allocated to the backend service.

[0136] For example, the current limiting threshold corresponding to the target current limiting device is 40, and the total traffic received within the preset time period is 41, of which the amount of first traffic is 35 and the amount of second traffic is 6. The maximum current limiting threshold corresponding to the first traffic is 35, and the current limiting threshold corresponding to the second traffic is 40-35=5. Then, the traffic in the second traffic that exceeds the current limiting threshold corresponding to the second traffic is current limiting, that is, any one of the six second traffic is intercepted, and the number of second traffic after current limiting is 5. Then, the 5 second traffic after current limiting and 35 first traffic are allocated to the backend service.

[0137] S208, if the sum of the flows obtained based on the second flow after flow limiting processing and the first flow is greater than the flow limiting threshold corresponding to the target flow limiting device, flow limiting processing is performed on the flow in the first flow that exceeds the flow limiting threshold corresponding to the first flow to obtain the first flow after flow limiting processing, and the first flow after flow limiting processing is allocated to the backend service.

[0138] It is understandable that in order to protect the amount of white traffic, when the gray traffic is subjected to current limiting processing, if the sum of the gray traffic and the white traffic after the current limiting processing is greater than the preset current limiting threshold, all the gray traffic can be subjected to current limiting processing. If the remaining traffic and the amount of white traffic after the current limiting processing of all the gray traffic are still greater than the current limiting threshold corresponding to the target current limiting device, the white traffic in the white traffic that exceeds the current limiting threshold corresponding to the white traffic is subjected to current limiting processing to obtain the white traffic after the current limiting processing, and the white traffic is allocated to the back-end service. Since all the gray traffic is subjected to current limiting processing at this time, all the gray traffic after the current limiting processing is discarded and will not be allocated to the back-end service for subsequent processing. By performing current limiting processing on all the gray traffic when the amount of white traffic is large, it is possible to ensure the processing of more white traffic, avoid occupying the processing resources of the back-end service, and improve the effect of white traffic protection.

[0139] For example, if the current limiting threshold corresponding to the target current limiting device is 40, and the total amount of traffic received within the preset time period is 50, of which the amount of first traffic is 44 and the amount of second traffic is 6, then the maximum current limiting threshold corresponding to the first traffic is 40. The current limiting threshold corresponding to the second traffic is 40-40=0, that is, all second traffic received within the preset time period is current limited, and the sum of the traffic obtained by the second traffic and the first traffic after the current limiting process is 0+44=44, that is, the sum of the traffic obtained by the second traffic and the first traffic after the current limiting process is greater than the current limiting threshold 40 corresponding to the target current limiting device. Then, the traffic in the first traffic that exceeds the current limiting threshold corresponding to the first traffic is current limited, that is, any 4 traffic among the 44 first traffics are current limited, and the number of first traffic after the current limiting process is 40, and the 40 first traffic after the current limiting process are allocated to the backend service. Since all the second traffic is intercepted by the current limiting process at this time, there is no remaining second traffic at this time, that is, all the second traffic will not be allocated to the backend service.

[0140] In the embodiment of the present application, the specific implementation methods not mentioned in steps S206 to S208 can refer to the implementation methods in steps S101 to S104, which will not be repeated here.

[0141] In an optional implementation, each current limiting device in the device cluster can use a white flow limiter and a gray flow limiter to implement current limiting processing for white flow and current limiting processing for gray flow. Taking the target current limiting device as an example, the target current limiting device can use a white flow limiter and a gray flow limiter to implement current limiting processing for white flow and current limiting processing for gray flow. For example, a white flow limiter and a gray flow limiter can be set in the target current limiting device, respectively, and the current limiting threshold of the white flow limiter is the current limiting threshold corresponding to the white flow, and the current limiting threshold of the gray flow limiter is the current limiting threshold corresponding to the gray flow. When current limiting processing is required, the white flow limiter and the gray flow limiter can be started respectively, and the two limiters can limit the flow that exceeds the current limiting threshold according to their corresponding current limiting thresholds, thereby improving the convenience of current limiting processing.

[0142] Further optionally, if the total flow received by the target current limiting device within a preset time period is greater than the current limiting threshold corresponding to the target current limiting device, the target current limiting device may first start the gray flow limiter, and use the gray flow limiter to perform current limiting processing on the gray flow that exceeds the current limiting threshold corresponding to the gray flow, so as to obtain the gray flow after current limiting processing. If the total flow obtained based on the gray flow and white flow after current limiting processing is less than or equal to the current limiting threshold corresponding to the target current limiting device, the white flow limiter may not be started, and the white flow is allocated to the backend service, and the gray flow after current limiting processing is allocated to the backend service.

[0143] Further optionally, if the sum of the gray traffic and white traffic after the current limiting processing is greater than the current limiting threshold corresponding to the target current limiting device, the target current limiting device can start the white traffic limiter, and use the white traffic limiter to perform current limiting processing on the white traffic that exceeds the current limiting threshold corresponding to the white traffic, obtain the white traffic after the current limiting processing, and allocate the white traffic to the back-end service.

[0144] In an embodiment of the present application, the current limiting process may refer to that if the sum of the flows received within a preset time period is greater than the current limiting threshold corresponding to the target current limiting device, then the current limiter is turned on at the next moment of the preset time period to limit the received flow. For example, if the sum of the flows received by the target current limiting device within the preset time period is greater than the current limiting threshold corresponding to the target current limiting device, then the target current limiting device may turn on the gray flow limiter at the next moment of the preset time period, and use the gray flow limiter to perform current limiting process on the gray flow at the next moment of the preset time period that exceeds the current limiting threshold corresponding to the gray flow, to obtain the gray flow after the current limiting process. If the sum of the flows received by the target current limiting device within the preset time period is less than or equal to the current limiting threshold corresponding to the target current limiting device, then the target current limiting device will not turn on the gray flow limiter at the next moment of the preset time period, that is, will not perform current limiting process.

[0145] It is understandable that the target current limiting device can start the white flow limiter and the gray flow limiter at the same time. When the total flow is greater than the current limiting threshold corresponding to the target current limiting device, the gray flow limiter can perform current limiting processing on the flow that exceeds the current limiting threshold corresponding to the gray flow. When the amount of gray flow and white flow after the current limiting processing still exceeds the current limiting threshold corresponding to the target current limiting device, the white flow limiter can perform current limiting processing on the white flow to improve the efficiency of the current limiting processing. If the total flow of the gray flow and the white flow after the current limiting processing is less than the current limiting threshold corresponding to the target current limiting device, there is no need to perform current limiting processing on the white flow, which can improve the convenience of the current limiting processing.

[0146] In the specific implementation, in order to enhance the protection strength for white traffic, a periodic scheduling thread is added to calculate the current limiting threshold corresponding to white traffic and the current limiting threshold corresponding to gray traffic according to the number of white traffic and gray traffic per second in the historical time window (i.e., the historical time period). For example, when the predicted white traffic is less than the current limiting threshold corresponding to the target current limiting device, for example, the current limiting threshold corresponding to the target current limiting device is 100QPS, and the predicted white traffic per second is 70QPS, then the current limiting threshold corresponding to the white traffic is adjusted to 70QPS, and the current limiting threshold corresponding to the gray traffic is 100-70=30. When the predicted white traffic is greater than or equal to the current limiting threshold corresponding to the target current limiting device, for example, the current limiting threshold corresponding to the target current limiting device is 100QPS, and the predicted white traffic per second is 170QPS, then the current limiting threshold corresponding to the white traffic is adjusted to 100QPS, and the current limiting threshold corresponding to the gray traffic is 0, that is, all gray traffic is rejected, and resources are left for white traffic, thereby achieving a greater degree of protection for white traffic.

[0147] In the embodiment of the present application, since the traffic of the gateway cluster is extremely large, often with millions of QPS, if the commonly used redis (a data storage system based on key-value pairs) counting in the industry is directly used for distributed current limiting, serious hot key problems will occur and slow down the performance. Therefore, a current limiting method is needed that does not cause excessive pressure on external storage and can accurately limit the current. For example, a current limiter can be deployed on each current limiting device to limit the traffic through the current limiter.

[0148] like Figure 6 As shown, Figure 6 is a schematic diagram of the composition structure of a current limiter in a current limiting device provided in an embodiment of the present application, Figure 6It includes cache, gateway, single instance limiter and slot. The cache is implemented using redis cluster, generating a key-value pair of a window per second. The kv records the total traffic of the entire device cluster within that second. The gateway here refers to the device cluster, which includes multiple instances such as instance 1, instance 2, instance 3, and instance 4. Each instance can refer to a flow-limiting device. Each instance (i.e., flow-limiting device) in the device cluster will report the amount of traffic it receives to the cache periodically (such as 1s). The cache can summarize the traffic of each window in the entire device cluster. Single instance limiter (Limiter): Each flow-limiting device is deployed with a Limiter. The Limiter of each flow-limiting device stores the weight of its own flow-limiting device (Weight) and the cumulative remaining number of tokens that can be issued (Remain). Here, Token is an access token. Only traffic that obtains Token can access the backend service. Token can be updated once per second. When the remaining Token is 0, flow limiting is triggered. In other words, the remaining number of tokens that can be issued can reflect the remaining amount of traffic that each flow-limiting device can currently handle. Optionally, the Limiter deployed in each current limiting device may include a white traffic limiter and a gray traffic limiter. Slot: Each Limiter creates a slot per second, which stores the timeInSecond time (aligned in seconds), that is, the second-level timestamp (indicating the current second), the instanceReleaseCount instance release quantity (i.e., the current limiting threshold of the current limiting device at the current moment), the instanceRequestCount instance request quantity (i.e., the total traffic received by the current limiting device at the current moment), and the clusterRequestCount cluster request quantity (the total traffic received by all current limiting devices in the device cluster at the current moment).

[0149] That is to say, the total amount of traffic received by the entire device cluster per second can be recorded through the cache, and each current limiting device can create a slot in its own current limiter to record the second timestamp, the current limiting threshold of the current limiting device corresponding to the second timestamp, the total amount of traffic received by the current limiting device corresponding to the second timestamp, the total amount of traffic received by all current limiting devices in the device cluster corresponding to the second timestamp, and so on. Therefore, the current limiter of each current limiting device can calculate the weight of each current limiting device and the number of tokens that can be issued by each current limiting device based on this information.

[0150] For further information, see Figure 7 , Figure 7 is a flow distribution diagram provided in an embodiment of the present application, such as Figure 7As shown, assuming that the prediction window is 3 seconds, that is, the historical time period of the preset time period is 3 seconds, the preset time period is the 14th second, the historical time period is the 11th to 13th seconds, and the total current limiting threshold of the device cluster is 100QPS (totalLimit), then the process of calculating the current limiting threshold corresponding to the white flow and the current limiting threshold corresponding to the gray flow of the target current limiting device (such as Example 1) in the preset time period (such as the 14th second) based on the prediction window is as follows:

[0151] First, the total traffic received by the device cluster per second is calculated through scale exploration. By using time alignment technology on redis, each current limiting device reports the number of traffic received per second (that is, the sum of white traffic and gray traffic), which is summarized in the corresponding window of redis. For example, the device cluster includes 3 current limiting devices (that is, instance 1, instance 2, and instance 3). At the 11th second, the device cluster received a total of 30 requests (that is, 30 traffic), at the 12th second, the device cluster received a total of 54 requests, and at the 13th second, the device cluster received a total of 40 requests. Figure 7 The number of requests for the current instance refers to the amount of traffic received by the current instance, i.e., the current limiting device. The number of requests for the entire cluster refers to the total amount of traffic received by the entire device cluster, which is equal to the sum of the current amounts of traffic received by all current limiting devices in the device cluster.

[0152] Furthermore, the weight of each current limiting device is calculated by weight calculation. Specifically, the slot of each current limiting device stores the total traffic received by the instance. For example, if instance 1 receives 15 requests at the 11th second, 14 requests at the 12th second, and 20 requests at the 13th second, the weight of instance 1 is the number of requests received by instance 1 in the last three seconds / the total number of requests in the cluster = 49 / 124.

[0153] Furthermore, the current limiting threshold of a single current limiting device is calculated by the total tokens of a single instance. For example, the token is refreshed every second when the prediction window is newly created, and the refresh logic is TokenNum = weight * totalLimit. Taking instance 1 as an example, the number of tokens at the 14th second is (49 / 124) * 100 ≈ 40.

[0154] Further, the flow limiting threshold corresponding to the white flow and the flow limiting threshold corresponding to the gray flow are calculated respectively. Among them, the flow limiting threshold (whiteToken) corresponding to the white flow limiter can be min (white flow QPS, the flow limiting threshold corresponding to the single flow limiting device), and the white flow QPS can refer to the sum of the flow of white flow received by instance 1 within the preset time period (the 14th second). The flow limiting threshold (grayToken) corresponding to the gray flow limiter can be, for example, max (0, the flow limiting threshold corresponding to the single flow limiting device-the flow limiting threshold corresponding to the white flow limiter). Taking instance 1 as an example, if the sum of the flow in the last second of the preset time period, that is, the last second of the historical time period (such as the 13th second, that is, the last second in the prediction window) exceeds the flow limiting threshold 40QPS corresponding to the single flow limiting device, it means that the flow in the preset time period (that is, the 14th second, that is, the next second of the last second in the prediction window) is likely to exceed the flow limiting threshold of the single flow limiting device, then the white flow limiter and the gray flow limiter corresponding to instance 1 can be started in the preset time period (the 14th second) to limit the flow that exceeds. Furthermore, after the white traffic limiter and the gray traffic limiter are started, when the target limiter receives each traffic, it determines whether the traffic is gray traffic or white traffic. The white traffic will be deducted from the whiteToken accordingly, and the gray traffic will be deducted from the grayToken accordingly. When the whiteToken is 0, the white traffic is limited, and when the grayToken is 0, the gray traffic is limited.

[0155] In the embodiment of the present application, the idea of ​​obtaining a token from redis when each flow arrives is abandoned, thereby avoiding the problem of redis hot key caused by extremely high QPS. The weight of each flow-limiting device is calculated by using dynamic scale exploration and single instance counting, and the flow-limiting thresholds corresponding to the gray flow limiter and white flow limiter of each flow-limiting device are further calculated according to the weight of each flow-limiting device, the total flow-limiting threshold of the device cluster, and the flow number of the historical time period. Statistical calculation, thereby using single-machine flow limiting to replace cluster flow limiting, and can dynamically allocate flow limiting Tokens to different traffic types such as gray traffic and white traffic, which can reduce the access pressure of the device cluster and improve the flow limiting efficiency.

[0156] In one implementation, since the amount of traffic received by each current limiting device in each time period is not equal, in order to improve the current limiting accuracy of each current limiting device and improve the resource utilization of each current limiting device, the weight corresponding to each current limiting device in each time period can be calculated separately, and the current limiting threshold corresponding to each current limiting device in each time period can be adjusted based on the weight corresponding to each current limiting device in each time period. This is equivalent to dynamically adjusting the current limiting threshold corresponding to each current limiting device in each time period according to the amount of traffic in each time period.

[0157] For example, Figure 7 As shown, the 14th second is taken as a preset time period, and the historical time period includes, for example, 3 seconds, then the corresponding historical time period is the 11th to 13th seconds, and the weight corresponding to the target current limiting device (such as Example 1) within the 11th to 13th seconds is calculated to be (15+14+20) / (30+54+40)=49 / 124. The 15th second is taken as a preset time period, and the corresponding historical time period is the 12th to 14th seconds, and the weight corresponding to the target current limiting device (such as Example 1) within the 12th to 14th seconds is calculated to be (14+20+16) / (54+40+45)=50 / 139.

[0158] It can be seen from this that the weight of each current limiting device in each time period calculated in combination with the corresponding number of historical flows in each time period is different. Therefore, the current limiting threshold corresponding to each current limiting device in each time period is different. For example, at the 14th second, the current limiting threshold corresponding to the target current limiting device is (49 / 124)*100≈40, and at the 15th second, the current limiting threshold corresponding to the target current limiting device is (50 / 139)*100≈36. Then, the current limiting threshold corresponding to each current limiting device can be combined in each time period to perform current limiting processing on the traffic received in each time period, thereby improving the current limiting accuracy of each time period and improving the resource utilization in the device cluster.

[0159] In an embodiment of the present application, the flow limiting thresholds of the gray traffic limiter and the white traffic limiter can be adaptively adjusted according to the historical traffic in the historical time period by predicting the flow limiting method, and the back-end processing resources can be allocated to the white traffic to the maximum extent, thereby ensuring the normal use of the application by legitimate objects, thereby improving the user experience of the back-end services for the application.

[0160] In the embodiment of the present application, by determining the total amount of traffic received within a preset time period; the traffic includes a first traffic and a second traffic, the first traffic refers to traffic with a first traffic attribute, and the second traffic refers to traffic with a second traffic attribute; the weight of the target current limiting device is obtained, and the current limiting threshold corresponding to the target current limiting device is calculated based on the weight of the target current limiting device and the total current limiting threshold corresponding to the device cluster; if the total amount of traffic is greater than the current limiting threshold corresponding to the target current limiting device, the second traffic in the second traffic that exceeds the current limiting threshold corresponding to the second traffic is subjected to current limiting processing to obtain the second traffic after current limiting processing; if the total amount of traffic obtained based on the second traffic after current limiting processing and the first traffic is less than or equal to the current limiting threshold corresponding to the target current limiting device, the first traffic and the second traffic after current limiting processing are allocated to the backend service. Since the current limiting threshold corresponding to the target current limiting device is determined in combination with the weight of the target current limiting device, the current limiting threshold corresponding to the target current limiting device is more accurate. If the weight of the target current limiting device is large, the current limiting threshold corresponding to the target current limiting device is large, and more first traffic such as white traffic can be processed. If the weight of the target current limiting device is small, the current limiting threshold corresponding to the target current limiting device is small, and more current limiting thresholds can be allocated to current limiting devices in other device clusters to avoid idle resources and improve resource utilization. When the total flow is greater than the current limiting threshold corresponding to the target current limiting device, the total flow can be reduced by current limiting the second flow, ensuring that the backend service can normally handle more first flows such as white flows, thereby improving the stability of white flow processing. In addition, in the event of attack traffic, the second flow after current limiting processing, such as gray traffic and white traffic, is allocated to the backend service for processing, thereby avoiding the crash of the backend service due to excessive traffic allocated to the backend service for processing, thereby improving the stability of the backend service operation.

[0161] For further information, see Figure 8 , Figure 8 is a flow chart of another flow processing method provided in an embodiment of the present application; Figure 8 As shown, the traffic processing method can be applied to a traffic processing system, which may include a terminal device, at least one flow-limiting device in a device cluster such as a gateway, and a backend service. The number of terminal devices may be one or more. The traffic processing method includes but is not limited to the following steps:

[0162] S301, the terminal device sends traffic to the gateway.

[0163] In the embodiment of the present application, the terminal device may refer to any device that needs to access the application, or a device that is deployed with a website, applet, business service, etc. that needs to access the application. Any terminal device that needs to access the application can initiate traffic to the current limiting device in the device cluster. The traffic here may refer to an access request for requesting access to the page of the application, or a data acquisition request for requesting data from the application, so that the access result for the application or the acquired data can be displayed on the page of the terminal device later.

[0164] S302: The gateway determines the total amount of traffic received within a preset time period.

[0165] In an embodiment of the present application, when each current limiting device (i.e., gateway) in the device cluster receives traffic, it can determine the total amount of traffic received by itself within a preset time period, so that each subsequent current limiting device can determine whether it is necessary to perform current limiting processing on the received traffic based on the total amount of traffic.

[0166] S303, if the total flow is greater than the preset flow limiting threshold, the gateway starts the second flow limiter, and uses the second flow limiter to perform flow limiting processing on the flow in the second flow that exceeds the flow limiting threshold corresponding to the second flow, to obtain the second flow after flow limiting processing.

[0167] Among them, the second flow limiter may refer to a gray flow limiter, and the second flow limiter is used to perform flow limiting processing on the flow that exceeds the flow limiting threshold corresponding to the second flow. The preset flow limiting threshold here can be determined as in the above step S102, for example, directly taking the upper limit value of the flow that the gateway can handle as the preset flow limiting threshold. Alternatively, the preset flow limiting threshold here can also be determined in the manner of the above step S203, for example, the flow limiting threshold corresponding to the target flow limiting device is calculated based on the weight of the target flow limiting device and the total flow limiting threshold corresponding to the device cluster, then the preset flow limiting threshold here can also refer to the flow limiting threshold corresponding to the target flow limiting device, and the embodiment of the present application does not limit this.

[0168] S304, if the sum of the traffic obtained based on the second traffic after the current limiting processing and the first traffic is less than or equal to the preset current limiting threshold, the gateway allocates the first traffic to the backend service, and allocates the second traffic after the current limiting processing by the second traffic limiter to the backend service.

[0169] S305, if the sum of the second flow and the first flow after the flow limiting processing is greater than the preset flow limiting threshold, the gateway starts the first flow limiter, and uses the first flow limiter to perform flow limiting processing on the flow in the first flow that exceeds the flow limiting threshold corresponding to the first flow, to obtain the first flow after the flow limiting processing, and allocate the first flow after the flow limiting processing to the backend service.

[0170] The first flow limiter may refer to a gray flow limiter, and the first flow limiter is used to perform flow limiting processing on a flow exceeding a flow limiting threshold corresponding to the first flow.

[0171] In the embodiment of the present application, the specific implementation methods not mentioned in steps S303 to S305 can refer to the implementation methods in steps S101 to S104, which will not be repeated here.

[0172] S306, the backend service processes the received traffic and returns the corresponding processing result to the gateway.

[0173] S307, the gateway forwards the processing result to the terminal device.

[0174] In an embodiment of the present application, the traffic received by the backend service may include gray traffic and white traffic. After receiving the gray traffic and white traffic, the backend service may respectively process the gray traffic and white traffic accordingly. For example, traffic refers to an access request for requesting access to a page of an application. The corresponding backend service in the application queries from the database corresponding to the application whether the terminal that initiates the access request has access rights to the page, thereby returning a result of having access rights or not having access rights to the terminal device to the gateway, and the gateway forwards the result of having access rights or not having access rights to the terminal device. If the terminal device has access rights, the page data corresponding to the page may be further returned to the gateway, and the gateway forwards the page data corresponding to the page to the terminal device. Alternatively, for example, traffic refers to a data acquisition request for requesting to obtain a certain application data in an application. The backend service in the application for querying the application data queries the application data from the database corresponding to the application. The backend service may return the queried application data to the gateway, thereby forwarding the queried application data to the terminal device, and so on.

[0175] In the embodiment of the present application, by determining the total amount of traffic received within a preset time period; the traffic includes a first traffic and a second traffic, the first traffic refers to traffic with a first traffic attribute, and the second traffic refers to traffic with a second traffic attribute; if the total amount of traffic is greater than the preset current limiting threshold, the second traffic in the second traffic that exceeds the current limiting threshold corresponding to the second traffic is subjected to current limiting processing to obtain the second traffic after current limiting processing; if the total amount of traffic obtained based on the second traffic after current limiting processing and the first traffic is less than or equal to the preset current limiting threshold, the first traffic and the second traffic after current limiting processing are allocated to the backend service. When the total amount of traffic is greater than the preset current limiting threshold, by performing current limiting processing on the gray traffic, the total amount of traffic can be reduced, ensuring the normal processing of more white traffic by the backend service, and improving the stability of white traffic processing. In addition, in the case of attack traffic, by allocating the gray traffic and white traffic after current limiting processing to the backend service for processing, the backend service crashes due to excessive traffic allocated to the backend service processing, and the stability of the backend service operation can be improved.

[0176] The method of the embodiment of the present application is introduced above, and the device of the embodiment of the present application is introduced below.

[0177] See also Fig. 9 , Fig. 9 : is a schematic diagram of the composition structure of a traffic processing device provided in an embodiment of the present application. The above-mentioned traffic processing device can be applied to a target current limiting device in a device cluster. The target current limiting device is any current limiting device in the device cluster. The current limiting device may refer to a gateway, for example; the traffic processing device can be used to execute the corresponding steps in the traffic processing method provided in an embodiment of the present application. The traffic processing device 90 includes:

[0178] The first flow receiving unit 901 is used to determine the total flow received within a preset time period; the flow includes a first flow and a second flow, the first flow includes a flow with a first flow attribute, and the second flow includes a flow with a second flow attribute;

[0179] A first threshold acquisition unit 902 is used to acquire the weight of the target current limiting device, and calculate the current limiting threshold corresponding to the target current limiting device based on the weight of the target current limiting device and the total current limiting threshold corresponding to the device cluster;

[0180] The first current limiting unit 903 is used to perform current limiting processing on the flow exceeding the current limiting threshold corresponding to the second flow in the second flow if the total flow received by the target current limiting device within a preset time period is greater than the current limiting threshold corresponding to the target current limiting device, so as to obtain the second flow after the current limiting processing;

[0181] The first traffic allocation unit 904 is configured to allocate the first traffic and the second traffic after the current limiting processing to the backend service if the sum of the traffic obtained based on the second traffic after the current limiting processing and the first traffic is less than or equal to the current limiting threshold corresponding to the target current limiting device.

[0182] Optionally, the first threshold acquisition unit 902 is specifically configured to:

[0183] Obtaining a first historical flow sum of historical flows received by the target current limiting device in a historical time period before a preset time period;

[0184] Obtain the second historical flow sum of the historical flow received by each current limiting device in the device cluster within the historical time period;

[0185] The weight of the target current limiting device is determined according to the first historical traffic sum and the second historical traffic sum.

[0186] Optionally, the traffic processing device 90 further includes a first threshold determination unit 905, which is used to:

[0187] Determine the current limiting threshold corresponding to the first flow according to the total flow of the first flow received by the target current limiting device within a preset time period and the current limiting threshold corresponding to the target current limiting device, where the current limiting threshold corresponding to the first flow is greater than or equal to the total flow of the first flow and less than or equal to the current limiting threshold corresponding to the target current limiting device;

[0188] The current limiting threshold corresponding to the second flow is determined according to the current limiting threshold corresponding to the target current limiting device and the current limiting threshold corresponding to the first flow, and the current limiting threshold corresponding to the second flow is less than or equal to the current limiting threshold corresponding to the target current limiting device.

[0189] Optionally, the flow processing device 90 further includes a third flow limiting unit 906, which is used to:

[0190] If the sum of the second flow and the first flow after the current limiting process is greater than the current limiting threshold corresponding to the target current limiting device, the first flow in the first flow that exceeds the current limiting threshold corresponding to the first flow is subjected to current limiting process to obtain the first flow after the current limiting process; the current limiting threshold corresponding to the first flow is greater than the current limiting threshold corresponding to the second flow;

[0191] The first flow distribution unit 904 is specifically used for:

[0192] Allocate the first flow after the flow limiting process to the backend service.

[0193] Optionally, the first current limiting unit 903 is specifically used for:

[0194] Intercept the flow in the second flow that exceeds the current limiting threshold corresponding to the second flow, and determine the second flow after the interception processing as the second flow after the current limiting processing.

[0195] It should be noted that Fig. 9 For the contents not mentioned in the corresponding embodiments, please refer to the description of the method embodiments, which will not be repeated here.

[0196] In the embodiment of the present application, by determining the total amount of traffic received within a preset time period; the traffic includes a first traffic and a second traffic, the first traffic refers to traffic with a first traffic attribute, and the second traffic refers to traffic with a second traffic attribute; the weight of the target current limiting device is obtained, and the current limiting threshold corresponding to the target current limiting device is calculated based on the weight of the target current limiting device and the total current limiting threshold corresponding to the device cluster; if the total amount of traffic is greater than the current limiting threshold corresponding to the target current limiting device, the second traffic in the second traffic that exceeds the current limiting threshold corresponding to the second traffic is subjected to current limiting processing to obtain the second traffic after current limiting processing; if the total amount of traffic obtained based on the second traffic after current limiting processing and the first traffic is less than or equal to the current limiting threshold corresponding to the target current limiting device, the first traffic and the second traffic after current limiting processing are allocated to the backend service. Since the current limiting threshold corresponding to the target current limiting device is determined in combination with the weight of the target current limiting device, the current limiting threshold corresponding to the target current limiting device is more accurate. If the weight of the target current limiting device is large, the current limiting threshold corresponding to the target current limiting device is large, and more first traffic such as white traffic can be processed. If the weight of the target current limiting device is small, the current limiting threshold corresponding to the target current limiting device is small, and more current limiting thresholds can be allocated to current limiting devices in other device clusters to avoid idle resources and improve resource utilization. When the total flow is greater than the current limiting threshold corresponding to the target current limiting device, the total flow can be reduced by current limiting the second flow, ensuring that the backend service can normally handle more first flows such as white flows, thereby improving the stability of white flow processing. In addition, in the event of attack traffic, the second flow after current limiting processing, such as gray traffic and white traffic, is allocated to the backend service for processing, thereby avoiding the crash of the backend service due to excessive traffic allocated to the backend service for processing, thereby improving the stability of the backend service operation.

[0197] See also Fig.10 , Fig.10 1 is a schematic diagram of the composition structure of another traffic processing device provided in an embodiment of the present application. The above-mentioned traffic processing device can be applied to a gateway; the traffic processing device can be used to execute the corresponding steps in the traffic processing method provided in an embodiment of the present application. The traffic processing device 100 includes:

[0198] The second flow receiving unit 1001 is used to determine the total flow received within a preset time period; the flow includes a first flow and a second flow, the first flow includes a flow with a first flow attribute, and the second flow includes a flow with a second flow attribute;

[0199] The second threshold value acquisition unit 1002 is used to acquire a preset current limiting ratio between a current limiting threshold value corresponding to the first flow rate and a current limiting threshold value corresponding to the second flow rate, and determine the current limiting threshold value corresponding to the second flow rate based on the preset current limiting ratio and the preset current limiting threshold value;

[0200] The second current limiting unit 1003 is used to perform current limiting processing on the second flow that exceeds the current limiting threshold corresponding to the second flow if the total flow is greater than the preset current limiting threshold, so as to obtain the second flow after the current limiting processing;

[0201] The second traffic allocating unit 1004 is configured to allocate the first traffic and the second traffic after the current limiting processing to the backend service if the sum of the traffic obtained based on the second traffic after the current limiting processing and the first traffic is less than or equal to a preset current limiting threshold.

[0202] Optionally, the flow processing device 100 further includes a fourth flow limiting unit 1005, which is used to:

[0203] Determine a current limiting threshold corresponding to the first flow rate based on a preset current limiting ratio and a preset current limiting threshold;

[0204] If the sum of the flow rates of the second flow rate and the first flow rate after the flow limiting process is greater than the preset flow limiting threshold, the first flow rate in the first flow rate that exceeds the flow limiting threshold value corresponding to the first flow rate is subjected to flow limiting process to obtain the first flow rate after the flow limiting process; the flow limiting threshold value corresponding to the first flow rate is greater than the flow limiting threshold value corresponding to the second flow rate;

[0205] The second flow distribution unit 1004 is specifically used for:

[0206] The first flow after the flow limiting process and the second flow after the flow limiting process are allocated to the backend service.

[0207] Optionally, the second current limiting unit 1003 is specifically used for:

[0208] Intercept the flow in the second flow that exceeds the current limiting threshold corresponding to the second flow, and determine the second flow after the interception processing as the second flow after the current limiting processing.

[0209] It should be noted that Fig.10 For the contents not mentioned in the corresponding embodiments, please refer to the description of the method embodiments, which will not be repeated here.

[0210] In the embodiment of the present application, by determining the total amount of traffic received within a preset time period; the traffic includes a first traffic and a second traffic, the first traffic refers to traffic with a first traffic attribute, and the second traffic refers to traffic with a second traffic attribute; obtaining a preset current limiting ratio between a current limiting threshold corresponding to the first traffic and a current limiting threshold corresponding to the second traffic, and determining a current limiting threshold corresponding to the second traffic based on the preset current limiting ratio and the preset current limiting threshold; if the total amount of traffic is greater than the preset current limiting threshold, the second traffic in the second traffic that exceeds the current limiting threshold corresponding to the second traffic is subjected to current limiting processing to obtain a second traffic after current limiting processing; if the total amount of traffic obtained based on the second traffic after current limiting processing and the first traffic is less than or equal to the preset current limiting threshold, the first traffic and the second traffic after current limiting processing are allocated to the backend service. By combining the preset current limiting ratio to determine the current limiting threshold corresponding to the first traffic such as white traffic and the current limiting threshold corresponding to the second traffic such as gray traffic, current limiting processing of gray traffic and white traffic can be achieved in proportion, thereby reducing the amount of gray traffic and white traffic, and ensuring the stability of the backend service operation. When the total traffic is greater than the preset flow-limiting threshold, the total traffic can be reduced by limiting the second traffic, such as gray traffic, to ensure that the backend service can normally process more first traffic, such as white traffic, and improve the stability of white traffic processing. In addition, in the case of attack traffic, the gray traffic and white traffic after flow-limiting processing are allocated to the backend service for processing, avoiding the backend service crash due to excessive traffic allocated to the backend service, which can improve the stability of the backend service operation.

[0211] See also Fig.11 , Fig.11 Schematic diagram of the structure of a computer device provided in an embodiment of the present application. Fig.11 As shown, the above-mentioned computer device 110 may include: a processor 1101, a network interface 1104 and a memory 1105. In addition, the above-mentioned computer device 110 may also include: a user interface 1103 and at least one communication bus 1102. Among them, the communication bus 1102 is used to realize the connection and communication between these components. Among them, the user interface 1103 may include a display screen (Display), a keyboard (Keyboard), and the optional user interface 1103 may also include a standard wired interface and a wireless interface. The network interface 1104 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1105 may be a high-speed RAM memory, or it may be a non-volatile memory (non-volatile memory), such as at least one disk storage. The memory 1105 may optionally also be at least one storage device located away from the aforementioned processor 1101. As Fig.11As shown, the memory 1105 as a computer-readable storage medium may include an operating system, a network communication module, a user interface module, and a device control application program.

[0212] exist Fig.11 In the computer device 110 shown, the network interface 1104 can provide a network communication function; the user interface 1103 is mainly used to provide an input interface for the user; and the processor 1101 can be used to call the device control application stored in the memory 1105 to achieve:

[0213] Determine the total amount of traffic received within a preset time period; the traffic includes a first traffic and a second traffic, the first traffic includes traffic with a first traffic attribute, and the second traffic includes traffic with a second traffic attribute;

[0214] Obtain the weight of the target current limiting device, and calculate the current limiting threshold corresponding to the target current limiting device based on the weight of the target current limiting device and the total current limiting threshold corresponding to the device cluster;

[0215] If the total amount of traffic received by the target current limiting device within the preset time period is greater than the current limiting threshold corresponding to the target current limiting device, current limiting processing is performed on the traffic in the second traffic that exceeds the current limiting threshold corresponding to the second traffic to obtain the second traffic after current limiting processing;

[0216] If the sum of the traffic obtained based on the second traffic after the current limiting processing and the first traffic is less than or equal to the current limiting threshold corresponding to the target current limiting device, the first traffic and the second traffic after the current limiting processing are allocated to the backend service.

[0217] Optionally, the processor 1101 may also be used to call a device control application stored in the memory 1105 to implement:

[0218] Determine the total amount of traffic received within a preset time period; the traffic includes a first traffic and a second traffic, the first traffic includes traffic with a first traffic attribute, and the second traffic includes traffic with a second traffic attribute;

[0219] Obtaining a preset current limiting ratio between a current limiting threshold corresponding to the first flow and a current limiting threshold corresponding to the second flow, and determining the current limiting threshold corresponding to the second flow based on the preset current limiting ratio and the preset current limiting threshold;

[0220] If the total flow is greater than the preset current limiting threshold, current limiting processing is performed on the second flow that exceeds the current limiting threshold corresponding to the second flow to obtain the second flow after current limiting processing;

[0221] If the total flow obtained based on the second flow after the flow limiting processing and the first flow is less than or equal to the preset flow limiting threshold, the first flow and the second flow after the flow limiting processing are allocated to the backend service.

[0222] It should be understood that the computer device 110 described in the embodiments of the present application can execute the above Figure 2 , Figure 5 and Figure 8 The description of the above-mentioned traffic processing method in the corresponding embodiment can also be performed as described above. Fig. 9 and Fig.10 The description of the flow processing device in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated here.

[0223] In the embodiment of the present application, by determining the total amount of traffic received within a preset time period; the traffic includes a first traffic and a second traffic, the first traffic refers to traffic with a first traffic attribute, and the second traffic refers to traffic with a second traffic attribute; the weight of the target current limiting device is obtained, and the current limiting threshold corresponding to the target current limiting device is calculated based on the weight of the target current limiting device and the total current limiting threshold corresponding to the device cluster; if the total amount of traffic is greater than the current limiting threshold corresponding to the target current limiting device, the second traffic in the second traffic that exceeds the current limiting threshold corresponding to the second traffic is subjected to current limiting processing to obtain the second traffic after current limiting processing; if the total amount of traffic obtained based on the second traffic after current limiting processing and the first traffic is less than or equal to the current limiting threshold corresponding to the target current limiting device, the first traffic and the second traffic after current limiting processing are allocated to the backend service. Since the current limiting threshold corresponding to the target current limiting device is determined in combination with the weight of the target current limiting device, the current limiting threshold corresponding to the target current limiting device is more accurate. If the weight of the target current limiting device is large, the current limiting threshold corresponding to the target current limiting device is large, and more first traffic such as white traffic can be processed. If the weight of the target current limiting device is small, the current limiting threshold corresponding to the target current limiting device is small, and more current limiting thresholds can be allocated to current limiting devices in other device clusters to avoid idle resources and improve resource utilization. When the total flow is greater than the current limiting threshold corresponding to the target current limiting device, the total flow can be reduced by current limiting the second flow, ensuring that the backend service can normally handle more first flows such as white flows, thereby improving the stability of white flow processing. In addition, in the event of attack traffic, the second flow after current limiting processing, such as gray traffic and white traffic, is allocated to the backend service for processing, thereby avoiding the crash of the backend service due to excessive traffic allocated to the backend service for processing, thereby improving the stability of the backend service operation.

[0224] The embodiment of the present application also provides a computer-readable storage medium, which stores a computer program, which includes program instructions, which, when executed by a computer, causes the computer to execute the method of the aforementioned embodiment, and the computer may be part of the computer device mentioned above. For example, it is the above-mentioned processor 1101. As an example, the program instructions may be deployed on a computer device for execution, or deployed on multiple computer devices located at one location for execution, or, executed on multiple computer devices distributed at multiple locations and interconnected by a communication network, and multiple computer devices distributed at multiple locations and interconnected by a communication network may constitute a blockchain network.

[0225] The embodiment of the present application also provides a computer program product or a computer program, which includes a computer instruction, and when the computer instruction is executed by a processor, some or all of the steps in the above method are implemented. For example, the computer instruction is stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device performs the steps performed in the embodiments of the above methods.

[0226] Those skilled in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0227] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A traffic processing method, characterized in that: Applied to a target current limiting device in a device cluster, the target current limiting device is any current limiting device in the device cluster, and the method includes: Determine the total amount of traffic received within a preset time period; the traffic includes a first traffic and a second traffic, the first traffic includes traffic with a first traffic attribute, and the second traffic includes traffic with a second traffic attribute; Obtaining the weight of the target current limiting device, and calculating the current limiting threshold corresponding to the target current limiting device based on the weight of the target current limiting device and the total current limiting threshold corresponding to the device cluster; If the total amount of traffic received by the target current limiting device within the preset time period is greater than the current limiting threshold corresponding to the target current limiting device, current limiting processing is performed on the traffic in the second traffic that exceeds the current limiting threshold corresponding to the second traffic to obtain a second traffic after current limiting processing; If the sum of the traffic obtained based on the second traffic after the current limiting processing and the first traffic is less than or equal to the current limiting threshold corresponding to the target current limiting device, the first traffic and the second traffic after the current limiting processing are allocated to the backend service.

2. The method according to claim 1, characterized in that The obtaining the weight of the target current limiting device includes: Obtain a first historical flow sum of historical flows received by the target current limiting device in a historical time period before the preset time period; Obtain a second historical flow sum of historical flows received by each current limiting device in the device cluster within the historical time period; The weight of the target current limiting device is determined according to the first historical traffic sum and the second historical traffic sum.

3. The method according to claim 1, characterized in that The method further comprises: Determine, according to the total flow of the first flow received by the target current limiting device within the preset time period, and the current limiting threshold corresponding to the target current limiting device, the current limiting threshold corresponding to the first flow being greater than or equal to the total flow of the first flow and less than or equal to the current limiting threshold corresponding to the target current limiting device; The current limiting threshold corresponding to the second flow is determined according to the current limiting threshold corresponding to the target current limiting device and the current limiting threshold corresponding to the first flow, and the current limiting threshold corresponding to the second flow is less than or equal to the current limiting threshold corresponding to the target current limiting device.

4. The method according to claim 1, characterized in that: The method further comprises: If the sum of the second flow after the current limiting process and the first flow is greater than the current limiting threshold corresponding to the target current limiting device, current limiting process is performed on the first flow in the first flow that exceeds the current limiting threshold corresponding to the first flow to obtain the first flow after the current limiting process; the current limiting threshold corresponding to the first flow is greater than the current limiting threshold corresponding to the second flow; The allocating the first flow and the second flow after the flow limiting process to the backend service includes: Allocate the first flow after the flow limiting process to the backend service.

5. The method according to claim 1, characterized in that The performing flow limiting processing on the flow in the second flow that exceeds the flow limiting threshold corresponding to the second flow to obtain the second flow after the flow limiting processing includes: Intercepting the flow in the second flow that exceeds the current limiting threshold corresponding to the second flow, and determining the second flow after the interception processing as the second flow after the current limiting processing.

6. A traffic processing method, characterized in that: The method comprises: Determine the total amount of traffic received within a preset time period; the traffic includes a first traffic and a second traffic, the first traffic includes traffic with a first traffic attribute, and the second traffic includes traffic with a second traffic attribute; Obtaining a preset current limiting ratio between a current limiting threshold corresponding to the first flow rate and a current limiting threshold corresponding to the second flow rate, and determining a current limiting threshold corresponding to the second flow rate based on the preset current limiting ratio and the preset current limiting threshold; If the total flow is greater than the preset current limiting threshold, current limiting processing is performed on the second flow that exceeds the current limiting threshold corresponding to the second flow to obtain the second flow after current limiting processing; If the sum of the traffic obtained based on the second traffic after the current limiting processing and the first traffic is less than or equal to the preset current limiting threshold, the first traffic and the second traffic after the current limiting processing are allocated to the backend service.

7. The method according to claim 6, characterized in that The method further comprises: Determining a current limiting threshold corresponding to the first flow rate based on the preset current limiting ratio and the preset current limiting threshold; If the sum of the second flow after the current limiting process and the first flow is greater than the preset current limiting threshold, current limiting process is performed on the first flow in the first flow that exceeds the current limiting threshold corresponding to the first flow to obtain the first flow after the current limiting process; the current limiting threshold corresponding to the first flow is greater than the current limiting threshold corresponding to the second flow; The allocating the first flow and the second flow after the flow limiting process to the backend service includes: Allocate the first flow after the flow limiting process and the second flow after the flow limiting process to the backend service.

8. The method according to claim 6, characterized in that The performing flow limiting processing on the flow in the second flow that exceeds the flow limiting threshold corresponding to the second flow to obtain the second flow after the flow limiting processing includes: Intercepting the flow in the second flow that exceeds the current limiting threshold corresponding to the second flow, and determining the second flow after the interception processing as the second flow after the current limiting processing.

9. A flow processing device, characterized in that: A target current limiting device applied to a device cluster, wherein the target current limiting device is any current limiting device in the device cluster, and the device comprises: A first flow receiving unit, configured to determine a total flow received within a preset time period; the flow includes a first flow and a second flow, the first flow includes a flow having a first flow attribute, and the second flow includes a flow having a second flow attribute; A first threshold acquisition unit, configured to acquire a weight of the target current limiting device, and calculate a current limiting threshold corresponding to the target current limiting device based on the weight of the target current limiting device and a total current limiting threshold corresponding to the device cluster; A first current limiting unit, configured to perform current limiting processing on a portion of the second flow exceeding the current limiting threshold corresponding to the second flow, if the total flow received by the target current limiting device within the preset time period is greater than the current limiting threshold corresponding to the target current limiting device, to obtain a second flow after current limiting processing; The first traffic allocation unit is configured to allocate the first traffic and the second traffic after the current limiting processing to a backend service if the sum of the traffic obtained based on the second traffic after the current limiting processing and the first traffic is less than or equal to the current limiting threshold corresponding to the target current limiting device.

10. A flow processing device, characterized in that: The device comprises: A second flow receiving unit, used to determine the total flow received within a preset time period; the flow includes a first flow and a second flow, the first flow includes a flow with a first flow attribute, and the second flow includes a flow with a second flow attribute; A second threshold value acquisition unit, configured to acquire a preset current limiting ratio between a current limiting threshold value corresponding to the first flow rate and a current limiting threshold value corresponding to the second flow rate, and determine the current limiting threshold value corresponding to the second flow rate based on the preset current limiting ratio and the preset current limiting threshold value; A second current limiting unit is used for, if the total flow is greater than the preset current limiting threshold, performing current limiting processing on a second flow in the second flow that exceeds the current limiting threshold corresponding to the second flow, to obtain a second flow after current limiting processing; The second traffic allocation unit is used to allocate the first traffic and the second traffic after the current limiting processing to the backend service if the sum of the traffic obtained based on the second traffic after the current limiting processing and the first traffic is less than or equal to the preset current limiting threshold.

11. A computer device, characterized in that: include: Processor, memory, and network interface; The processor is connected to the memory and the network interface, wherein the network interface is used to provide a data communication function, the memory is used to store program code, and the processor is used to call the program code so that the computer device executes the method described in any one of claims 1 to 5, or executes the method described in any one of claims 6 to 8.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which is suitable for being loaded and executed by a processor, so that a computer device having the processor executes the method according to any one of claims 1 to 5, or executes the method according to any one of claims 6 to 8.

13. A computer program product, characterized in that The computer program product comprises computer instructions, and when the computer instructions are executed by a processor, the method according to any one of claims 1 to 5 is implemented, or the method according to any one of claims 6 to 8 is executed.

Images