Malicious behavior punishment fusing system, method and device and medium

Abstract

The invention discloses a punishment fusing system, method and device for malicious behaviors and a medium, and belongs to the technical field of computers. The system comprises a server cluster and a second server, wherein the server cluster comprises one or more first servers; the server cluster is used for updating to obtain first statistical data according to the first data, the first data is used for indicating that a first malicious behavior occurs once, the first malicious behavior is a malicious webpage access request of a first type, and the first statistical data is used for indicating the occurrence frequency of the first malicious behavior; sending the first statistical data to a second server; and the second server is used for determining to stop punishment of the first malicious behavior or continue punishment of the first malicious behavior according to the first statistical data and the fusing threshold, the distributed fusing system is designed, and the distributed fusing system can bear higher business pressure.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a system, method, device, and medium for punishing malicious behavior. Background Art

[0002] With the continuous evolution of Internet technology, malicious behaviors of users may exist on web pages. Malicious behaviors refer to malicious web page access requests.

[0003] In the process of punishing malicious behavior, in order to avoid the occurrence of large-scale accidental punishment, when the number of penalties for malicious behavior increases abnormally, the punishment will be automatically intercepted through the fuse system to avoid punishment failure.

[0004] In related technologies, the circuit breaker system is deployed only on a single machine. When using a PV (Page View) absolute value circuit breaker solution, a single machine needs to count the number of malicious requests. Each time a malicious behavior occurs, the corresponding behavior statistics variable value is incremented by one. When the value reaches the absolute threshold, an interception penalty is issued. When the number of web page requests is extremely large, a single machine will be under tremendous computing pressure, and the circuit breaker system will be highly unstable. Summary of the Invention

[0005] This application provides a system, method, device, and medium for punishing malicious behavior. This application designs a distributed circuit breaker system that can handle greater business pressure. The technical solution includes the following.

[0006] According to one aspect of the present application, a malicious behavior penalty fuse system is provided, the system comprising: a server cluster and a second server, the server cluster comprising one or more first servers;

[0007] The server cluster is configured to update first statistical data based on first data, wherein the first data is configured to indicate a first malicious behavior has occurred, the first malicious behavior being a malicious webpage access request of a first category, and the first statistical data is configured to indicate a number of times the first malicious behavior has occurred; and send the first statistical data to the second server;

[0008] The second server is used to determine whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior based on the first statistical data and the fuse threshold.

[0009] According to one aspect of the present application, a method for punishing and fusing malicious behavior is provided. The method is performed by a server cluster, the server cluster including one or more first servers, and the method includes:

[0010] Obtaining first data, where the first data is used to indicate that a first malicious behavior has occurred, where the first malicious behavior is a malicious webpage access request of a first category;

[0011] updating first statistical data based on the first data, where the first statistical data is used to count the number of times the first malicious behavior has occurred;

[0012] The first statistical data is sent to the second server, and the first statistical data is used by the second server to determine whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior in combination with a fuse threshold.

[0013] According to one aspect of the present application, a method for punishing and fusing malicious behavior is provided, the method being executed by a second server and comprising:

[0014] Obtaining first statistical data, where the first statistical data is updated by the server cluster based on first data, the first data is used to indicate the occurrence of a first malicious behavior, the first malicious behavior is a malicious webpage access request of a first category, the first statistical data is used to count the number of occurrences of the first malicious behavior, and the server cluster includes one or more first servers;

[0015] Determine whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior based on the first statistical data and the fuse threshold.

[0016] According to another aspect of the present application, a malicious behavior penalty fuse device is provided, the device comprising:

[0017] an acquisition module, configured to acquire first data, wherein the first data is used to indicate the occurrence of a first malicious behavior, wherein the first malicious behavior is a malicious webpage access request of a first category;

[0018] a statistics module, configured to update first statistical data based on the first data, wherein the first statistical data is used to count the number of occurrences of the first malicious behavior;

[0019] The sending module is used to send the first statistical data to the second server, and the first statistical data is used by the second server to determine whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior in combination with a fuse threshold.

[0020] According to another aspect of the present application, a malicious behavior penalty fuse device is provided, the device comprising:

[0021] an acquisition module, configured to acquire first statistical data, the first statistical data being updated by a server cluster based on first data, the first data being used to indicate an occurrence of a first malicious behavior, the first malicious behavior being a malicious webpage access request of a first category, the first statistical data being used to count the number of occurrences of the first malicious behavior, the server cluster comprising one or more first servers;

[0022] A fusing module is configured to determine whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior based on the first statistical data and a fusing threshold.

[0023] According to one aspect of the present application, a server cluster or a second server is provided, the server cluster includes one or more first servers, the server cluster or the second server includes: a processor and a memory, the memory stores a computer program, and the computer program is loaded and executed by the processor to implement the above-mentioned penalty fuse method for malicious behavior.

[0024] According to another aspect of the present application, a computer-readable storage medium is provided, wherein the storage medium stores a computer program, and the computer program is loaded and executed by a processor to implement the above-mentioned penalty fuse method for malicious behavior.

[0025] According to another aspect of the present application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the aforementioned method for punishing and fusing malicious behavior.

[0026] The beneficial effects of the technical solutions provided in the embodiments of the present application include at least:

[0027] This application performs data statistics through a server cluster, which includes one or more first servers. The server cluster collects first statistical data based on the received first data, and then sends the first statistical data to the second server. The second server makes a circuit breaking judgment based on the circuit breaking threshold to determine whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior.

[0028] Specifically, this application forms a distributed circuit breaker system by combining a pre-installed server cluster and a subsequent second server. The server cluster stores a large amount of statistical data, avoiding the need for a single-server deployment of the circuit breaker system. A distributed circuit breaker system can handle greater workloads, with both the server cluster and the second server experiencing lower operational pressures than a single server. For the second server, the pre-installed server cluster handles a significant portion of the operational pressure, allowing the second server to make decisions based solely on the circuit breaker threshold. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0030] Figure 1 This is a schematic diagram of a penalty fuse system for malicious behavior provided by an embodiment of the present application.

[0031] Figure 2 This is a schematic diagram of multiple first servers in a server cluster provided by an embodiment of the present application.

[0032] Figure 3 This is a schematic diagram of a penalty fuse system for malicious behavior provided by an embodiment of the present application.

[0033] Figure 4 Schematic diagram of a relative fusing system in PV mode provided by one embodiment of the present application.

[0034] Figure 5 Schematic diagram of an absolute fusing system in PV mode provided by one embodiment of the present application.

[0035] Figure 6 This is a schematic diagram of a relative fusing system in UV mode provided by an embodiment of the present application.

[0036] Figure 7 This is a schematic diagram of an absolute fusing system in UV mode provided by an embodiment of the present application.

[0037] Figure 8 This is a flowchart of a method for punishing malicious behavior provided by an embodiment of the present application.

[0038] Figure 9 This is a flowchart of a method for punishing malicious behavior provided by an embodiment of the present application.

[0039] Figure 10This is a flowchart of a method for punishing malicious behavior provided by an embodiment of the present application.

[0040] Figure 11 This is a structural block diagram of a malicious behavior penalty fuse device provided by an embodiment of the present application.

[0041] Figure 12 This is a structural block diagram of a malicious behavior penalty fuse device provided by an embodiment of the present application.

[0042] Figure 13 This is a structural block diagram of a computer device provided in one embodiment of the present application.

[0043] Figure 14 This is a structural block diagram of a computer device provided in another embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0045] First, a brief introduction is given to the terms involved in the embodiments of this application.

[0046] Circuit Breaker: Internet websites may contain malicious user behavior. Malicious behavior is defined as violations of national laws and regulations or the relevant website usage agreement. To prevent widespread misjudgment during the penalty process, a circuit breaker system automatically intercepts penalties when the number of penalties for malicious behavior increases abnormally, preventing penalty failures. In this application, the circuit breaker system is also referred to as the penalty circuit breaker system.

[0047] Malicious behavior refers to malicious access requests to web pages. Optionally, malicious access requests include requests to browse malicious web pages. Optionally, malicious access requests include invalid access requests to web pages. Malicious behavior can be configured by operators. Optionally, there are multiple types of malicious behavior, depending on the type of malicious web page.

[0048] The circuit breaker systems of related technologies usually support absolute value circuit breaking and are only deployed on a single machine, such as Redis (an open source memory-based data structure server). The circuit breaker systems of related technologies are unreliable. When the volume of web page requests is very large, a single machine will find it difficult to withstand the huge pressure.

[0049] In the case of percentage circuit breakers, the business-end device needs to directly report the total number of requests. All non-malicious requests from non-malicious users need to be included in the statistics. The circuit breaker of just one malicious behavior may reach hundreds of millions of operations per minute. In this case, the computing pressure of a single machine is enormous.

[0050] PV (Page View) mode: PV refers to the number of page views of a web page, and in this application, it refers to the number of web page requests. Each time a request to access a web page is received, the statistical data corresponding to the PV mode will increase by one.

[0051] UV (Unique Visitor) mode: UV represents the number of users browsing a web page. Access requests from the same user will be deduplicated and counted only once.

[0052] Figure 1 A schematic diagram of a malicious behavior penalty circuit breaker system according to an exemplary embodiment of the present application is shown. Circuit breaker system 100 includes a service-end device 10, a server cluster 20, and a second server 30. Service-end device 10 is configured to generate first data indicating the occurrence of a first malicious behavior. Service-end device 10 then sends the first data to server cluster 20.

[0053] The server cluster 20 includes one or more first servers. The server cluster 20 updates and obtains first statistical data based on the first data. The first statistical data is used to indicate the number of times the first malicious behavior has occurred. Optionally, the server cluster 20 includes multiple first servers, each of which is a cache server (CacheServer). The counting operation is performed by the statistical manager (RateLimiter) in the multiple cache servers. For example, when one of the multiple first servers receives the first data, the statistical manager in the first server counts and adds one to the statistical value value of the first malicious behavior corresponding to the first server. The first statistical data includes the statistical value value e of each of the multiple first servers for the first malicious behavior, that is, the first statistical data includes multiple sub-statistical data for the first malicious behavior. Optionally, the server cluster 20 includes a first server, which is a cache server. The counting operation is performed by the statistical manager in the cache server. For example, when the first server receives the first data, the statistical manager in the first server counts and adds one to the statistical value value of the first malicious behavior. The first statistical data includes a statistical value Value for the first malicious behavior.

[0054] When the server cluster 20 includes multiple first servers, the circuit breaker system of the present application includes multiple first servers in advance and second servers in the rear. The computing pressure of any one of the first servers and the second server is greatly reduced compared to the single machine of the related art, and the storage pressure of each of the multiple first servers is also relatively small. The circuit breaker system provided by the present application can bear greater business pressure, and can carry more users, more behavior types, more circuit breaker modes (PV mode, UV mode, absolute circuit breaker, relative circuit breaker), etc.

[0055] Server cluster 20 sends the first statistical data to second server 30. Second server 30 is a master server (MasterServer) and is also pre-configured with a circuit breaker threshold 40. Optionally, circuit breaker threshold 40 is configured by operators. Second server 30 performs the following steps: Based on the first statistical data and the circuit breaker threshold, it determines whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior.

[0056] In one embodiment, in the absolute value fuse mode, the fuse threshold is the absolute fuse threshold, and the second server 30 determines the size relationship between the first statistical data and the absolute fuse threshold. When the first statistical data is greater than the absolute fuse threshold, it is determined to stop punishing the first malicious behavior; when the first statistical data is not greater than the absolute fuse threshold, it is determined to continue punishing the first malicious behavior. If the first statistical data is sent from multiple first servers to the second server, that is, the first statistical data includes multiple sub-statistical data for the first malicious behavior, the second server 30 sums the multiple sub-statistical data for the first malicious behavior and then compares it with the absolute fuse threshold. If the first statistical data is sent from a first server to the second server, the second server 30 directly compares the first statistical data with the absolute fuse threshold.

[0057] In one embodiment, in the relative value fuse mode (percentage fuse mode), the fuse threshold is a relative fuse threshold. The server cluster 20 also determines a target behavior set based on the first malicious behavior indicated by the first statistical data; determines other behavior types in the target behavior set except the first malicious behavior; and sends other statistical data corresponding to other behavior types and the first statistical data to the second server. Optionally, the target behavior set is a behavior set that supports preconfiguration, and the behavior types in the target behavior set are configured by the operator. The second server 30 is used to accumulate the first statistical data and other statistical data to obtain cumulative statistical data, and the other statistical data are used to indicate the number of times other behavior types have occurred. The target behavior set does not necessarily only include malicious behaviors, but may also include normal behaviors. Optionally, the target behavior set includes all possible behavior types.

[0058] The second server 30 is further used to divide the first statistical data by the cumulative statistical data to obtain a first ratio; when the first ratio is greater than the relative fuse threshold, determine to stop punishing the first malicious behavior; when the first ratio is not greater than the relative fuse threshold, determine to continue punishing the first malicious behavior.

[0059] For example, the operator pre-configures the target behavior set total_key, and the target behavior set total_key includes the first malicious behavior key1, the second malicious behavior key2, and the third malicious behavior key3. The server cluster 30 stores the above configuration results. The server cluster 20 determines the target behavior set total_key based on the first malicious behavior key1 indicated by the first data, and then determines the other behavior types in the target behavior set total_key except the first malicious behavior key1. The server cluster 20 obtains statistical data of the other behavior types and sends the first statistical data and the statistical data of the other behavior types together (consistent hash reporting) to the second server 30. Consistent hash reporting ensures that the behavior types belonging to the same target behavior set total_key are all sent to the same machine (second server 30).

[0060] In one embodiment, Figure 2 As shown, the server cluster includes multiple first servers (first server 21, first server 22...first server N), and one of the multiple first servers receives the first data (not shown in the figure). The first server synchronizes the information indicating the first malicious behavior key1 in the first data to other first servers. The multiple first servers all determine the target behavior set total_key through the first malicious behavior key1, and then determine the second malicious behavior key2 and the third malicious behavior key3 also included in the target behavior set total_key. The multiple first servers send all the statistical values ​​of the first malicious behavior key1, the statistical values ​​of the second malicious behavior key2, and the statistical values ​​of the third malicious behavior key3 to the second server 30 (consistent hash reporting). Figure 2 It is shown in the figure that all first servers contain statistical data of all behavior types. In fact, each first server may contain all behavior types or only some behavior types. Each first server can report the statistical data of all behavior types under the total_key of the target behavior set contained in it through consistent hashing.

[0061] The second server 30 sums the received sub-statistical data for the first malicious behavior key1 to obtain the first statistical data, sums the received sub-statistical data for the second malicious behavior key2 to obtain the second statistical data, sums the received sub-statistical data for the third malicious behavior key3 to obtain the third statistical data, and sums the first statistical data, the second statistical data, and the third statistical data to obtain the cumulative statistical data. The second server 30 divides the first statistical data by the cumulative statistical data to obtain a first ratio. If the first ratio is greater than a relative fuse threshold (such as a preset 50%, 60%), etc., it determines to stop punishing the first malicious behavior. Punishing the first malicious behavior includes banning the malicious webpage corresponding to the first malicious behavior and / or prohibiting the user corresponding to the first data from accessing the current webpage.

[0062] In one embodiment, the business-end device 10 may be one device or multiple devices. The device type of the business-end device 10 may be a terminal device, a server, or may include both a terminal device and a server. For example, the business-end device 10 includes a terminal device, and the terminal device supports the operator to configure the circuit breaker rules (which will be described in detail below). The business-end device 10 includes a routing server, and the routing server decides to route the first data to a first server in the server cluster (which will be described in detail below). The device types of the terminal device include: at least one of a smart phone, a smart watch, a vehicle-mounted terminal, a wearable device, a smart TV, a tablet computer, an e-book reader, an MP3 player, an MP4 player, a laptop computer, and a desktop computer. Terminal devices include but are not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle-mounted terminals, aircraft, etc.

[0063] In some embodiments, the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CD N (Content Delivery Network), and big data and artificial intelligence platforms.

[0064] Figure 3 A schematic diagram of a malicious behavior penalty fuse system provided by an exemplary embodiment of the present application is shown, the system includes a service end device 10, a server cluster (including multiple first servers, Figure 3 One of the first server 21) and the second server 30 is shown.

[0065] The service end device 10 is used to obtain the configuration rules of each first server and the configuration rules of the second server 30 on the operation page. Optionally, the configuration rules of multiple first servers and the configuration rules of the second server 30 are the same.

[0066] The first server 21 generates and verifies the rule file 212 locally based on the configuration rules through the fuse configuration agent thread (RuleAgent asynchronous thread) 211. Similarly, the second server 30 generates and verifies the rule file 302 locally based on the configuration rules through the fuse configuration agent thread (RuleAgent asynchronous thread) 301.

[0067] Figure 3 The rule file 212 of the first server 21 and the rule file 302 of the second server 30 are shown. The rule file 212 at least includes the malicious behavior type targeted by the statistical data stored by the first server 21. Figure 3 The diagram shows the first server 21's actions for the first malicious behavior Key1, the second malicious behavior Key2, and so on, for the Nth malicious behavior KeyN. Rule file 302 includes at least a circuit breaker threshold. If the absolute circuit breaker mode is used, the circuit breaker threshold includes an absolute circuit breaker threshold. Optionally, the absolute circuit breaker threshold includes a daily absolute circuit breaker threshold, an hourly absolute circuit breaker threshold, and so on. If the relative circuit breaker mode is used, the circuit breaker threshold includes a relative circuit breaker threshold. Optionally, the relative circuit breaker threshold includes a daily relative circuit breaker threshold (percentage of the day), an hourly relative circuit breaker threshold (percentage of the hour), and so on.

[0068] The first server 21 periodically reads the rule file 212 through the rule manager 213 and generates a rule map (Rule_map) to manage the circuit breaker rules. Before reading the rule file 212, the rule manager 213 initializes the rule map data using data in the shared memory 214. Initially, the shared memory 214 allocates sufficient memory for statistical data in the PV mode and UV mode. The PV mode and UV mode are described in detail below. The first server 21 obtains the business data reported by the business terminal device 10, updates the statistical data in the PV mode and UV mode respectively according to the circuit breaker rules in the rule file 212, and reports the statistical data to the second server 30 via the rule reporting thread (RuleReport) 215. The rule reporting thread 215 is an asynchronous thread that reports data to the second server 30 every 6 seconds.

[0069] Similarly, the second server 30 reads the rule file 302 regularly through the rule manager 303 and generates a rule map (Rule_map) to manage the fuse rules. After obtaining statistical data, the second server 300 performs the step of determining whether to generate an interception or not according to the fuse rules in the rule file 302.

[0070] Next, we will introduce the PV mode and UV mode.

[0071] For PV mode: In this application, the first statistical data is the updated first mode statistical data, and the first mode statistical data is used to count the total number of occurrences of the first malicious behavior in multiple first objects. Each first object occupies one or more occurrences in the total number of occurrences, and multiple first objects are objects that execute the first malicious behavior.

[0072] Each time an access occurs to the first malicious behavior, the statistical data value in the PV mode increases by one.

[0073] For UV mode: In this application, the first statistical data is the updated second mode statistical data, and the second mode statistical data is used to count the number of occurrences of the first malicious behavior in multiple first objects. Each first object occupies one occurrence in the object occurrence number, and multiple first objects are objects that execute the first malicious behavior.

[0074] For the same malicious behavior against the same object, regardless of how many times it occurs, the statistical value in UV mode is always one.

[0075] Figure 4 A schematic diagram of a relative fusing system in PV mode, provided by an exemplary embodiment of the present application, is shown. A relative fusing system refers to a system that performs fusing based on relative fusing thresholds. The system includes a service-end device 10, a server cluster 20, and a second server 30. Server cluster 20 includes multiple first servers (target first server 21, first server 22, and first server 23 are shown in the figure).

[0076] The service-end device 10 generates first data, which is used to indicate the occurrence of a first malicious behavior. Optionally, the first data is also used to indicate the execution of the first malicious behavior by a first object. The first data is represented as (key1, uin1), where key1 represents the first malicious behavior and uin1 represents the first object. The service-end device 10 has a routing service. In PV mode, the routing service randomly routes the first data to a first server, which is the target first server 21 in the figure.

[0077] The target first server 21 adds one to the sub-statistical data value corresponding to the stored first malicious behavior key1 according to the first malicious behavior indicated by the first data. The target first server 21 also synchronizes the first malicious behavior key1 to other first servers. The target first server 21 and other first servers both determine the pre-configured target behavior set total_key based on the first malicious behavior key1, and perform consistent hashing on the sub-statistical data value of all behavior types contained in the target behavior set total_key and report it to the second server 30. Figure 4 The target behavior set shown in FIG includes behavior types including first malicious behavior key 1, second malicious behavior key 2, and third malicious behavior key 3. Consistent hash reporting ensures that sub-statistical data of all behavior types under the same target behavior set total_key are sent to the same machine (second server 30).

[0078] The second server 30 accumulates all sub-statistical data for the first malicious behavior key 1 to obtain first statistical data. The second server 30 accumulates all sub-statistical data for the second malicious behavior key 2 to obtain second statistical data. Furthermore, the second server 30 accumulates all sub-statistical data for the third malicious behavior key 3 to obtain third statistical data. The second server 30 calculates the sum of the first statistical data, the second statistical data, and the third statistical data to obtain cumulative statistical data. The second server 30 divides the first statistical data by the cumulative statistical data to obtain a first ratio. If the first ratio is greater than the relative fuse threshold, it is determined that the penalty for the first malicious behavior will cease; if the first ratio is not greater than the relative fuse threshold, it is determined that the penalty for the first malicious behavior will continue.

[0079] Figure 5 A schematic diagram of an absolute circuit breaker system in PV mode, provided by an exemplary embodiment of the present application, is shown. An absolute circuit breaker system is a system that performs circuit breaking based on an absolute circuit breaker threshold. The system includes a service-end device 10, a server cluster 20, and a second server 30. Server cluster 20 includes multiple first servers (target first server 21, first server 22, and first server 23 are shown in the figure).

[0080] The service-end device 10 generates first data, which is used to indicate the occurrence of a first malicious behavior. Optionally, the first data is also used to indicate the execution of the first malicious behavior by a target first object. The first data is represented as (key1, uin1), where key1 represents the first malicious behavior and uin1 represents the target first object. The service-end device 10 has a routing service. In PV mode, the routing service randomly routes the first data to a first server, which is the target first server 21 in the figure.

[0081] The target first server 21 adds one to the sub-statistical data value corresponding to the stored first malicious behavior key1 according to the first malicious behavior indicated by the first data. The target first server also synchronizes the first malicious behavior key1 to other first servers. The target first server 21 and other first servers each report their respective statistical data for the first malicious behavior key1 to the second server 30.

[0082] That is, the server cluster 20 is used to determine, based on the first data, to add one to the first mode statistical data before the update to obtain the updated first mode statistical data when the first statistical data is the updated first mode statistical data (ie, in the PV mode).

[0083] The second server 30 accumulates all sub-statistical data for the first malicious behavior key1 to obtain first statistical data. If the first statistical data is greater than the absolute circuit breaker threshold, the second server 30 determines to stop punishing the first malicious behavior. If the first statistical data is not greater than the absolute circuit breaker threshold, the second server 30 continues to punish the first malicious behavior.

[0084] Figure 6 A schematic diagram of a relative fusing system in UV mode, provided by an exemplary embodiment of the present application, is shown. A relative fusing system refers to a system that performs fusing based on relative fusing thresholds. The system includes: a service-end device 10, a server cluster 20, and a second server 30. Server cluster 20 includes multiple first servers (target first server 21, first server 22, and first server 23 are shown in the figure).

[0085] The business-end device 10 generates first data, and the first data is used to indicate that a first malicious behavior has occurred. Optionally, the first data carries an identifier of the object that performs the first malicious behavior, and the first data is used to indicate that the target first object performs the first malicious behavior. The first data is represented as (key1, uin1), where key1 represents the first malicious behavior and uin1 represents the target first object. There is a routing service in the business-end device 10. In UV mode, the routing service executes an object consistency algorithm on the first data (key1, uin1) and multiple second other data to obtain multiple second object category data. Each second other data of the multiple second other data is used to indicate that any object performs an arbitrary behavior once.

[0086] Figure 6 It shows that the routing service clusters the first data (key1, uin1) and a plurality of second other data by objects to obtain a plurality of second object category data. Each of the plurality of second object category data includes at least one data indicating that the objects are the same.

[0087] Figure 6A plurality of second object category data is shown. Figure 6 Three second object category data are shown. One second object category data includes: (key1, uin1), (key2, uin1), (key3, uin1), (key1, uin2), (key2, uin2), (key3, uin2). Another second object category data includes: (key1, uin3), (key2, uin3), (key3, uin3), (key1, uin4), (key2, uin4), (key3, uin4). Another second object category data includes: (key1, uin5), (key2, uin5), (key3, uin5), (key1, uin6), (key2, uin6), (key3, uin6).

[0088] The routing service sends the plurality of second object category data to different first servers, and objects counted by any two of the plurality of first servers are different.

[0089] At this time, the routing service in the business-end device 10 performs the first classification operation, so that the objects counted by any two first servers are different, and each first server will count at least one object. The first classification operation is beneficial to reducing the number of first servers required in the UV mode, and is also beneficial to the execution of the UIN deduplication algorithm in the subsequent first server.

[0090] Through the routing service of the service-end device 10, the first data (key1, uin1) is routed to the target first server 21. Each of the multiple first servers executes the object consistency algorithm and further classifies the acquired second object category data by object to obtain multiple first object category data, each of which corresponds to an object.

[0091] The target first server 21 is used to execute an object consistency algorithm on the first data and multiple first other data to obtain multiple first object category data, each of the multiple first other data indicates that any object performs an arbitrary behavior once, and each of the multiple first object category data includes at least one data indicating that the object is the same.

[0092] Figure 6 The target first server 21 executes the object consistency algorithm to obtain two first object category data. One of the first object category data includes: (key1, uin1), (key2, uin1), and (key3, uin1); the other first object category data includes: (key1, uin2), (key2, uin2), and (key3, uin2).

[0093] After classification, each first server will execute the uin deduplication algorithm. The purpose of the uin deduplication algorithm is to count the number of times the same malicious behavior is performed from the same object as only one. No matter how many times the malicious behavior is performed, the count value is only one. For example, the target first server 21 will obtain three (can be any number not less than one) first data (key1, uin1) and perform uin deduplication to obtain statistical data (key1, value), and the value of value is one. Therefore, the target first server 21 will obtain the statistical data (key1, value), (key2, value) and (key3, value) corresponding to uin 1, and the statistical data (key1, value), (key2, value) and (key3, value) corresponding to uin2.

[0094] In one embodiment, the UIN deduplication algorithm can be any of a hash map algorithm, a Bloom filter, and a HyperLogLog algorithm. While the first two algorithms utilize time-based duplication detection, the HyperLogLog algorithm is more sophisticated and can directly calculate UVs without requiring duplicate detection. HyperLogLog is also a probabilistic algorithm. Its unique characteristic is that, even if the number of elements to be counted is very large, the required storage space is always fixed and small. Furthermore, HyperLogLog does not require duplicate detection, so identical elements are not counted repeatedly. The statistics manager (RateLimiter) in the first server uses this algorithm to calculate UVs. Each key uses 32KB (2^15) of memory, allowing it to count 2^64 unique UINs with an error of less than 1%. However, even though the HyperLogLog algorithm requires minimal storage space, transmitting all the data collected by HyperLogLog is very time-consuming, especially when a large number of incoming services are connected. Therefore, this application utilizes the consistent hashing algorithm described above to distribute all data across multiple first servers, ensuring a low total processing time.

[0095] In this application, there are two object classifications, which facilitates each first server to perform statistics in UV mode. In UV mode, even if a first server fails, it will not affect the statistics of other uins by other first servers. The failure of a single machine will only affect part of the data, and the impact can be almost ignored in the circuit breaker scenario.

[0096] The target first server 21 determines a target first object based on the first data. The target first object is the object indicated by the first data as performing the first malicious behavior. If the number of occurrences previously occupied by the target first object is zero, the target first server 21 increments the pre-update second pattern statistical data by one to obtain updated second pattern statistical data. If the number of occurrences previously occupied by the target first object is one, the second pattern statistical data remains unchanged.

[0097] The target first server 21 determines whether sub-statistical data for the first malicious behavior of the target first object is stored based on the first malicious behavior indicated by the first data. If not, the target first server 21 increments the value of the sub-statistical data corresponding to the first malicious behavior key 1 by one. If present, the target first server 21 does not change the value of the sub-statistical data corresponding to the first malicious behavior key 1. The target first server 21 obtains the stored sub-statistical data values ​​for all objects of the target first malicious behavior.

[0098] The target first server 21 also synchronizes the first malicious behavior key1 to other first servers. The target first server 21 and other first servers determine the pre-configured target behavior set total_key based on the first malicious behavior key1, and perform consistent hashing on the sub-statistical data value of all objects targeted by all behavior types contained in the target behavior set total_key, and report it to the second server 30. Figure 6 The target behavior set shown in FIG includes behavior types including the first malicious behavior key 1, the second malicious behavior key 2, and the third malicious behavior key 3. Consistent hash reporting ensures that all sub-statistical data for behavior types under the same target behavior set total_key are sent to the same machine (second server 30). Optionally, each first server carries its own IP address when reporting.

[0099] The second server 30 obtains data represented as a nested data structure map <Total_key,map<ip,value> >, when calculating the total amount of the first malicious behavior key1, the second server 30 enumerates and accumulates all the values ​​of key1 corresponding to all IPs. When calculating the total amount of the target behavior set Total_key, the second server 30 enumerates and accumulates all the values ​​of all keys corresponding to all IPs.

[0100] Second server 30 divides the total amount of the first malicious behavior key1 by the total amount of the target behavior set Total_key to obtain a first ratio. If the first ratio is greater than the relative circuit breaker threshold, second server 30 determines to stop punishing the first malicious behavior; if the first ratio is not greater than the relative circuit breaker threshold, second server 30 determines to continue punishing the first malicious behavior.

[0101] Figure 7 A schematic diagram of an absolute fusing system in UV mode provided by an exemplary embodiment of the present application is shown. The absolute fusing system refers to a system that performs fusing based on an absolute fusing threshold.

[0102] and Figure 6 The difference between the described relative circuit breaker system is that each first server only reports its own sub-statistical data for the first malicious behavior key1, and does not report statistics for other behavior types belonging to the target behavior set. Optionally, each first server also carries an IP identifier when reporting.

[0103] When calculating the total amount of the first malicious behavior key1, the second server 30 enumerates and accumulates all the value values ​​of key1 corresponding to all the IP addresses to obtain first statistical data.

[0104] The second server 30 determines to stop punishing the first malicious behavior when the first statistical data is greater than the absolute fuse threshold; and determines to continue punishing the first malicious behavior when the first statistical data is not greater than the absolute fuse threshold.

[0105] Figure 8 A flowchart of a method for punishing malicious behavior provided by an exemplary embodiment of the present application is shown. The method includes:

[0106] Step 801: A service-end device generates first data, where the first data is used to indicate that a first malicious behavior has occurred.

[0107] Step 802: The service end device sends the first data to the server cluster;

[0108] Step 803: The server cluster updates and obtains first statistical data based on the first data, where the first statistical data is used to count the number of occurrences of the first malicious behavior.

[0109] Step 804: the server cluster sends the first statistical data to the second server;

[0110] In one embodiment, in the case of relative circuit breaking, the server cluster also determines a target behavior set based on the first malicious behavior indicated by the first statistical data; determines other behavior types in the target behavior set except the first malicious behavior; and sends other statistical data corresponding to other behavior types and the first statistical data to the second server together.

[0111] Step 805: The second server determines whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior based on the first statistical data and the fuse threshold.

[0112] In one embodiment, in the case of a relative circuit breaker, the circuit breaker threshold is a relative circuit breaker threshold. The second server accumulates the first statistical data and other statistical data to obtain cumulative statistical data, where the other statistical data is used to indicate the number of occurrences of other behavior types; divides the first statistical data by the cumulative statistical data to obtain a first ratio; determines to stop punishing the first malicious behavior if the first ratio is greater than the relative circuit breaker threshold; and determines to continue punishing the first malicious behavior if the first ratio is not greater than the relative circuit breaker threshold.

[0113] For example, the configured relative circuit breaker threshold for the first malicious behavior every two hours is 30%. When the first ratio of the first statistical data reaches 30%, the circuit breaker is triggered, that is, the punishment for the first malicious behavior is stopped.

[0114] In one embodiment, in the case of an absolute circuit breaker, the circuit breaker threshold is the absolute circuit breaker threshold. The second server determines a magnitude relationship between the first statistical data and the absolute circuit breaker threshold; if the first statistical data is greater than the absolute circuit breaker threshold, the second server determines to stop punishing the first malicious behavior; if the first statistical data is not greater than the absolute circuit breaker threshold, the second server determines to continue punishing the first malicious behavior.

[0115] Figure 9 A flowchart of a method for punishing malicious behavior in a PV mode provided by an exemplary embodiment of the present application is shown. The method includes:

[0116] Step 901: A service-end device generates first data, where the first data is used to indicate that a first malicious behavior has occurred.

[0117] Step 902: The service end device randomly routes the first data to a target first server in the server cluster;

[0118] Step 903: If the first statistical data is updated first mode statistical data, the server cluster determines, based on the first data, to add one to the first mode statistical data before the update to obtain updated first mode statistical data;

[0119] The updated first mode statistics, i.e., the statistics in the PV mode, are incremented by one each time an access targeting the first malicious behavior occurs.

[0120] Step 904: The server cluster sends the updated first mode statistical data to the second server;

[0121] In step 903 and step 904, the specific introduction of the relative fusing method and the absolute fusing method can be referred to the above introduction to the system, which will not be repeated here.

[0122] Step 905: The second server determines whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior based on the updated first mode statistical data and the fuse threshold.

[0123] In step 905, for the specific introduction of the relative fusing method and the absolute fusing method, please refer to the above introduction to the system, which will not be repeated here.

[0124] Figure 10 A flowchart of a method for punishing malicious behavior in UV mode according to an exemplary embodiment of the present application is shown. The method includes:

[0125] Step 1001: A service-end device generates first data, where the first data is used to indicate that a first malicious behavior has occurred.

[0126] Step 1002: The service end device performs an object consistency algorithm on the first data and the plurality of second other data to obtain a plurality of second object category data;

[0127] Each second object category data in the plurality of second object category data includes at least one data indicating that the objects are the same, and each second other data in the plurality of second other data is used to instruct any object to perform an arbitrary behavior once.

[0128] For information about the object consistency algorithm executed by the business-end device and how to perform object consistency routing, please refer to the above introduction and will not be repeated here.

[0129] Step 1003: The service end device sends at least two second object category data among the plurality of second object category data to the same first server, and objects counted by any two of the plurality of first servers are different;

[0130] The first data is sent to a target first server in the server cluster.

[0131] Step 1004: The target first server executes an object consistency algorithm on the first data and the plurality of first other data to obtain a plurality of first object category data;

[0132] Each of the plurality of first object category data includes at least one data indicating that the objects are the same, and each of the plurality of first other data indicates that any one of the objects performs an arbitrary behavior once.

[0133] Regarding the object consistency algorithm executed by each first server and the related content of performing object consistency classification, please refer to the relevant introduction on the system side above, which will not be repeated here.

[0134] Step 1005: When the first statistical data is updated second mode statistical data, the server cluster determines a target first object based on the first data, where the target first object is the object that performs the first malicious behavior as indicated by the first data;

[0135] The updated second-mode statistics, also known as UV mode statistics, are all equal to one for the same malicious behavior against the same object, regardless of how many times it occurs.

[0136] Regarding the UIN deduplication algorithm executed by each first server, please refer to the relevant introduction on the system side above, which will not be repeated here.

[0137] Step 1006: If the number of occurrences of the target first object before the server cluster is zero, the server cluster increments the second mode statistical data before the update by one to obtain updated second mode statistical data; if the number of occurrences of the target first object before the server cluster is one, the server cluster does not change the second mode statistical data;

[0138] Step 1007: The server cluster sends the updated second mode statistical data to the second server;

[0139] In step 1006 and step 1007, the specific introduction of the relative fusing method and the absolute fusing method can be referred to the above introduction to the system, which will not be repeated here.

[0140] Step 1008: The second server determines whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior based on the updated second mode statistical data and the fuse threshold.

[0141] In step 1008, for the specific introduction of the relative fusing method and the absolute fusing method, please refer to the above introduction to the system, which will not be repeated here.

[0142] Figure 11The following is a block diagram of a malicious behavior penalty fuse device provided by an exemplary embodiment of the present application. The fuse device (punishment fuse device) includes one or more fuse sub-devices, including an acquisition module 1110, a statistics module 1120, and a sending module 1130. If the fuse device includes multiple fuse sub-devices, each fuse sub-device is identical and includes an acquisition sub-module, a statistics sub-module, and a sending sub-module.

[0143] An acquisition module 1110 is configured to acquire first data, where the first data indicates that a first malicious behavior has occurred, where the first malicious behavior is a malicious webpage access request of a first category;

[0144] A statistics module 1120 is configured to update first statistical data based on the first data, where the first statistical data is used to count the number of occurrences of the first malicious behavior;

[0145] The sending module 1130 is configured to send the first statistical data to the second server. The first statistical data is used by the second server to determine whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior in combination with the fuse threshold.

[0146] In an optional embodiment, the circuit breaker threshold is a relative circuit breaker threshold. The sending module 1130 is further configured to determine a target behavior set based on the first malicious behavior indicated by the first statistical data; determine other behavior types in the target behavior set other than the first malicious behavior; and send other statistical data corresponding to the other behavior types together with the first statistical data to the second server.

[0147] In an optional embodiment, the first statistical data is an updated first pattern statistical data, which is used to count the total number of occurrences of the first malicious behavior in multiple first objects, each first object occupies one or more occurrences in the total number of occurrences, and multiple first objects are objects that perform the first malicious behavior.

[0148] In an optional embodiment, the first statistical data is an updated second mode statistical data, and the second mode statistical data is used to count the number of occurrences of the first malicious behavior among multiple first objects, each first object occupies one occurrence in the object occurrence number, and multiple first objects are objects that perform the first malicious behavior.

[0149] In an optional embodiment, the statistical module 1120 is further configured to, when the first statistical data is updated first pattern statistical data, determine, based on the first data, to add one to the first pattern statistical data before the update to obtain updated first pattern statistical data.

[0150] In an optional embodiment, the first data carries an identification of the object that performs the first malicious behavior, and the statistical module 1120 is also used to determine the target first object based on the first data when the first statistical data is the updated second mode statistical data, and the target first object is the object that performs the first malicious behavior indicated by the first data; when the number of occurrences previously occupied by the target first object is zero, the second mode statistical data before the update is added by one to obtain the updated second mode statistical data; when the number of occurrences previously occupied by the target first object is one, the second mode statistical data is not changed.

[0151] In an optional embodiment, the fuse device includes multiple fuse sub-devices, the first statistical data is updated second mode statistical data, and the first data is sent to a target sub-fuse device among the multiple sub-fuse devices. The statistical submodule 1121 in the target sub-fuse device is configured to execute an object consistency algorithm on the first data and the multiple first other data to obtain multiple first object category data, each of the multiple first object category data including at least one data indicating that the objects are identical, and each of the multiple first other data indicating that any object has performed an arbitrary behavior once.

[0152] To sum up, the present application performs data statistics through a server cluster, which includes one or more first servers. The server cluster obtains first statistical data based on the received first data, and then sends the first statistical data to the second server. The second server makes a circuit breaking judgment based on the circuit breaking threshold to determine whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior.

[0153] Specifically, this application forms a distributed circuit breaker system by combining a pre-installed server cluster and a subsequent second server. The server cluster stores a large amount of statistical data, avoiding the need for a single-server deployment of the circuit breaker system. A distributed circuit breaker system can handle greater workloads, with both the server cluster and the second server experiencing lower operational pressures than a single server. For the second server, the pre-installed server cluster handles a significant portion of the operational pressure, allowing the second server to make decisions based solely on the circuit breaker threshold.

[0154] Figure 12 The following is a structural block diagram of a device for punishing malicious behavior provided by an exemplary embodiment of the present application, the device comprising:

[0155] An acquisition module 1201 is configured to acquire first statistical data, the first statistical data being updated by the server cluster based on first data, the first data being used to indicate an occurrence of a first malicious behavior, the first malicious behavior being a malicious webpage access request of a first category, the first statistical data being used to count the number of occurrences of the first malicious behavior, and the server cluster including one or more first servers;

[0156] The fusing module 1202 is configured to determine whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior based on the first statistical data and the fusing threshold.

[0157] In an optional embodiment, the fusing threshold is a relative fusing threshold. The fusing module 1202 is further configured to obtain cumulative statistical data from the first statistical data and other statistical data, where the other statistical data is used to indicate the number of occurrences of other behavior types.

[0158] Divide the first statistical data by the cumulative statistical data to obtain a first ratio; when the first ratio is greater than the relative fuse threshold, determine to stop punishing the first malicious behavior; when the first ratio is not greater than the relative fuse threshold, determine to continue punishing the first malicious behavior.

[0159] In an optional embodiment, the fuse threshold is an absolute fuse threshold. Fusing module 1202 is further configured to determine a magnitude relationship between the first statistical data and the absolute fuse threshold; determine to stop punishing the first malicious behavior if the first statistical data is greater than the absolute fuse threshold; and determine to continue punishing the first malicious behavior if the first statistical data is not greater than the absolute fuse threshold.

[0160] In an optional embodiment, the first statistical data is updated first mode statistical data, the first mode statistical data is used to count the total number of occurrences of the first malicious behavior in multiple first objects, each first object occupies one or more occurrences in the total number of occurrences, and the multiple first objects are objects that perform the first malicious behavior;

[0161] In an optional embodiment, the first statistical data is an updated second mode statistical data, and the second mode statistical data is used to count the number of occurrences of the first malicious behavior among multiple first objects, each first object occupies one occurrence in the object occurrence number, and multiple first objects are objects that perform the first malicious behavior.

[0162] To sum up, the present application performs data statistics through a server cluster, which includes one or more first servers. The server cluster obtains first statistical data based on the received first data, and then sends the first statistical data to the second server. The second server makes a circuit breaking judgment based on the circuit breaking threshold to determine whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior.

[0163] Specifically, this application forms a distributed circuit breaker system by combining a pre-installed server cluster and a subsequent second server. The server cluster stores a large amount of statistical data, avoiding the need for a single-server deployment of the circuit breaker system. A distributed circuit breaker system can handle greater workloads, with both the server cluster and the second server experiencing lower operational pressures than a single server. For the second server, the pre-installed server cluster handles a significant portion of the operational pressure, allowing the second server to make decisions based solely on the circuit breaker threshold.

[0164] Figure 13 13 is a schematic diagram illustrating the structure of a computer device according to an exemplary embodiment. The computer device 1300 includes a central processing unit (CPU) 1301, a system memory 1304 including a random access memory (RAM) 1302 and a read-only memory (ROM) 1303, and a system bus 1305 connecting the system memory 1304 and the CPU 1301. The computer device 1300 also includes a basic input / output system (I / O system) 1306 for facilitating information transmission between various components within the computer device, and a mass storage device 1307 for storing an operating system 1313, application programs 1314, and other program modules 1315.

[0165] The basic input / output system 1306 includes a display 1308 for displaying information and an input device 1309, such as a mouse or keyboard, for user input. Both the display 1308 and the input device 1309 are connected to the central processing unit 1301 via an input / output controller 1310 connected to the system bus 1305. The basic input / output system 1306 may also include an input / output controller 1310 for receiving and processing input from a variety of other devices, such as a keyboard, mouse, or electronic stylus. Similarly, the input / output controller 1310 also provides output to a display screen, printer, or other types of output devices.

[0166] The mass storage device 1307 is connected to the central processing unit 1301 via a mass storage controller (not shown) connected to the system bus 1305. The mass storage device 1307 and its associated computer-readable medium provide non-volatile storage for the computer device 1300. In other words, the mass storage device 1307 may include computer-readable media (not shown) such as a hard disk or a CD-ROM drive.

[0167] Without loss of generality, the computer device readable medium may include computer device storage media and communication media. Computer device storage media include volatile and non-volatile, removable and non-removable media implemented by any method or technology for storing information such as computer device readable instructions, data structures, program modules or other data. Computer device storage media include RAM, ROM, Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), CD-ROM, Digital Video Disc (DVD) or other optical storage, tape cassettes, magnetic tape, disk storage or other magnetic storage devices. Of course, those skilled in the art will appreciate that the computer device storage media is not limited to the above-mentioned ones. The above-mentioned system memory 1304 and mass storage device 1307 can be collectively referred to as memory.

[0168] According to various embodiments of the present disclosure, the computer device 1300 may also be connected to a remote computer device on a network such as the Internet for operation. That is, the computer device 1300 may be connected to the network 1311 via the network interface unit 1312 connected to the system bus 1305, or the network interface unit 1312 may be used to connect to other types of networks or remote computer device systems (not shown).

[0169] The memory also includes one or more programs, which are stored in the memory. The central processing unit 1301 implements all or part of the steps of the above-mentioned model training method or behavior coding method by executing the one or more programs.

[0170] Figure 14The following is a block diagram of a computer device 1400 provided in accordance with an exemplary embodiment of the present application. Computer device 1400 may be a service-end device. Computer device 1400 may be a portable mobile terminal, such as a smartphone, a tablet computer, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 player (Moving Picture Experts Group Audio Layer IV), a laptop computer, or a desktop computer. Computer device 1400 may also be referred to as a user device, a portable terminal, a laptop terminal, a desktop terminal, or other similar names.

[0171] Typically, the computer device 1400 includes a processor 1401 and a memory 1402 .

[0172] The processor 1401 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 1401 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), or PLA (Programmable Logic Array). The processor 1401 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 1401 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 1401 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0173] Memory 1402 may include one or more computer-readable storage media, which may be non-transitory. Memory 1402 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices and flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in memory 1402 is used to store at least one instruction, which is used to be executed by processor 1401 to implement the penalty fuse method for malicious behavior provided in the method embodiment of the present application.

[0174] In some embodiments, computer device 1400 may optionally include a peripheral device interface 1403 and at least one peripheral device. Processor 1401, memory 1402, and peripheral device interface 1403 may be connected via a bus or signal lines. Each peripheral device may be connected to peripheral device interface 1403 via a bus, signal lines, or circuit boards. For example, the peripheral device may include at least one of a radio frequency circuit 1404, a display screen 1405, a camera assembly 1406, an audio circuit 1407, and a power supply 1408.

[0175] The peripheral device interface 1403 can be used to connect at least one I / O (Input / Output)-related peripheral device to the processor 1401 and the memory 1402. In some embodiments, the processor 1401, the memory 1402, and the peripheral device interface 1403 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 1401, the memory 1402, and the peripheral device interface 1403 can be implemented on separate chips or circuit boards, which is not limited in this embodiment.

[0176] RF circuit 1404 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. RF circuit 1404 communicates with communication networks and other communication devices via electromagnetic signals. RF circuit 1404 converts electrical signals into electromagnetic signals for transmission, or converts received electromagnetic signals into electrical signals. RF circuit 1404 may optionally include an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a user identity module card, and the like. RF circuit 1404 may communicate with other terminals via at least one wireless communication protocol. Such wireless communication protocols include, but are not limited to, the World Wide Web, metropolitan area networks, intranets, various generations of mobile communication networks (2G, 3G, 4G, and 5G), wireless local area networks, and / or WiFi (Wireless Fidelity) networks. In some embodiments, RF circuit 1404 may also include circuitry related to Near Field Communication (NFC), although this application does not limit this.

[0177] The display screen 1405 is used to display a UI (User Interface). The UI may include graphics, text, icons, videos, and any combination thereof. When the display screen 1405 is a touch screen display, the display screen 1405 also has the ability to collect touch signals on the surface or above the surface of the display screen 1405. The touch signal can be input as a control signal to the processor 1401 for processing. At this time, the display screen 1405 can also be used to provide virtual buttons and / or virtual keyboards, also known as soft buttons and / or soft keyboards. In some embodiments, there can be one display screen 1405, which is set on the front panel of the computer device 1400; in other embodiments, there can be at least two display screens 1405, which are respectively set on different surfaces of the computer device 1400 or in a folding design; in other embodiments, the display screen 1405 can be a flexible display screen, which is set on the curved surface or folding surface of the computer device 1400. Even more, the display screen 1405 can be set to a non-rectangular irregular shape, that is, a special-shaped screen. The display screen 1405 can be made of materials such as LCD (Liquid Crystal Display) and OLED (Organic Light-Emitting Diode).

[0178] The camera assembly 1406 is used to capture images or videos. Optionally, the camera assembly 1406 includes a front camera and a rear camera. Typically, the front camera is arranged on the front panel of the terminal, and the rear camera is arranged on the back of the terminal. In some embodiments, there are at least two rear cameras, which are any one of a main camera, a depth of field camera, a wide-angle camera, and a telephoto camera, so as to realize the fusion of the main camera and the depth of field camera to realize the background blur function, the fusion of the main camera and the wide-angle camera to realize panoramic shooting and VR (Virtual Reality) shooting function or other fusion shooting functions. In some embodiments, the camera assembly 1406 may also include a flash. The flash can be a single-color temperature flash or a dual-color temperature flash. A dual-color temperature flash refers to a combination of a warm light flash and a cold light flash, which can be used for light compensation at different color temperatures.

[0179] The audio circuit 1407 may include a microphone and a speaker. The microphone is used to collect sound waves from the user and the environment, and convert the sound waves into electrical signals that are input into the processor 1401 for processing, or input into the radio frequency circuit 1404 to achieve voice communication. For the purpose of stereo sound collection or noise reduction, there may be multiple microphones, each located in different parts of the computer device 1400. The microphone may also be an array microphone or an omnidirectional collection microphone. The speaker is used to convert electrical signals from the processor 1401 or the radio frequency circuit 1404 into sound waves. The speaker may be a traditional thin film speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, it can not only convert electrical signals into sound waves audible to humans, but also convert electrical signals into sound waves inaudible to humans for purposes such as distance measurement. In some embodiments, the audio circuit 1407 may also include a headphone jack.

[0180] Power supply 1408 is used to power various components in computer device 1400. Power supply 1408 can be AC ​​power, DC power, a disposable battery, or a rechargeable battery. When power supply 1408 includes a rechargeable battery, the rechargeable battery can be wired or wirelessly rechargeable. A wired rechargeable battery is charged via a wired line, while a wireless rechargeable battery is charged via a wireless coil. The rechargeable battery can also support fast charging technology.

[0181] In some embodiments, the computer device 1400 further includes one or more sensors 1409 , including but not limited to an acceleration sensor 1410 , a gyroscope sensor 1411 , a pressure sensor 1412 , an optical sensor 1413 , and a proximity sensor 1414 .

[0182] The accelerometer 1410 can detect the magnitude of acceleration along the three coordinate axes of the coordinate system established by the computer device 1400. For example, the accelerometer 1410 can be used to detect the components of gravity acceleration along the three coordinate axes. The processor 1401 can control the display screen 1405 to display the user interface in a landscape or portrait view based on the gravity acceleration signal collected by the accelerometer 1410. The accelerometer 1410 can also be used to collect game or user motion data.

[0183] The gyroscope sensor 1411 can detect the orientation and rotation angle of the computer device 1400. It can also work with the accelerometer 1410 to collect 3D motions of the user on the computer device 1400. Based on the data collected by the gyroscope sensor 1411, the processor 1401 can implement the following functions: motion sensing (e.g., changing the UI based on the user's tilt), image stabilization during shooting, game control, and inertial navigation.

[0184] Pressure sensor 1412 can be installed on the side frame of computer device 1400 and / or below display screen 1405. When installed on the side frame of computer device 1400, pressure sensor 1412 can detect the user's gripping signal of computer device 1400, and processor 1401 can perform left-hand or right-hand recognition or shortcut operations based on the gripping signal collected by pressure sensor 1412. When pressure sensor 1412 is installed below display screen 1405, processor 1401 controls the operable controls on the UI interface based on the user's pressure operation on display screen 1405. Operable controls include at least one of button controls, scroll bar controls, icon controls, and menu controls.

[0185] Optical sensor 1413 is used to detect ambient light intensity. In one embodiment, processor 1401 can control the display brightness of display screen 1405 based on the ambient light intensity detected by optical sensor 1413. For example, when the ambient light intensity is high, the display brightness of display screen 1405 is increased; when the ambient light intensity is low, the display brightness of display screen 1405 is decreased. In another embodiment, processor 1401 can also dynamically adjust the shooting parameters of camera assembly 1406 based on the ambient light intensity detected by optical sensor 1413.

[0186] Proximity sensor 1414, also known as a distance sensor, is typically located on the front panel of computer device 1400. Proximity sensor 1414 is used to detect the distance between the user and the front of computer device 1400. In one embodiment, when proximity sensor 1414 detects that the distance between the user and the front of computer device 1400 is gradually decreasing, processor 1401 controls display screen 1405 to switch from the screen-on state to the screen-off state. When proximity sensor 1414 detects that the distance between the user and the front of computer device 1400 is gradually increasing, processor 1401 controls display screen 1405 to switch from the screen-off state to the screen-on state.

[0187] Those skilled in the art will understand that Figure 14 The structure shown in the figure does not constitute a limitation on the computer device 1400, and the computer device 1400 may include more or fewer components than shown in the figure, or combine some components, or adopt a different component arrangement.

[0188] The present application also provides a computer-readable storage medium, which stores at least one instruction, at least one program, code set or instruction set. The at least one instruction, the at least one program, the code set or instruction set is loaded and executed by a processor to implement the penalty fuse method for malicious behavior provided in the above method embodiment.

[0189] The present application provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to implement the penalty fuse method for malicious behavior provided in the above method embodiment.

[0190] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0191] Those skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware, or by a program to instruct the relevant hardware, and the program may be stored in a computer-readable storage medium, which may be a read-only memory, a disk, or an optical disk, etc.

[0192] The above description is merely an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A penalty circuit breaker system for malicious behavior, characterized in that: The system includes: a server cluster and a second server, the server cluster including one or more first servers; The server cluster is configured to update first statistical data based on first data, wherein the first data is configured to indicate a first malicious behavior has occurred, the first malicious behavior being a malicious webpage access request of a first category, and the first statistical data is configured to indicate a number of times the first malicious behavior has occurred; and send the first statistical data to the second server; The second server is used to determine whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior based on the first statistical data and the fuse threshold.

2. The system according to claim 1, wherein: The fuse threshold is a relative fuse threshold; The second server is configured to accumulate the first statistical data and other statistical data to obtain cumulative statistical data, wherein the other statistical data is used to indicate the number of occurrences of other behavior types; The second server is further configured to divide the first statistical data by the accumulated statistical data to obtain a first ratio; and determine to stop punishing the first malicious behavior if the first ratio is greater than the relative fuse threshold; When the first ratio is not greater than the relative fuse threshold, it is determined to continue punishing the first malicious behavior.

3. The system according to claim 2, characterized in that The server cluster is further configured to determine a target behavior set based on the first malicious behavior indicated by the first statistical data; and determine the other behavior types in the target behavior set except the first malicious behavior; The other statistical data corresponding to the other behavior type and the first statistical data are sent together to the second server.

4. The system according to claim 1, wherein: The fuse threshold is an absolute fuse threshold; The second server is also used to determine the size relationship between the first statistical data and the absolute circuit breaker threshold; when the first statistical data is greater than the absolute circuit breaker threshold, determine to stop punishing the first malicious behavior; when the first statistical data is not greater than the absolute circuit breaker threshold, determine to continue punishing the first malicious behavior.

5. The system according to any one of claims 1 to 4, characterized in that: The first statistical data is updated first pattern statistical data, the first pattern statistical data is used to count the total number of occurrences of the first malicious behavior in multiple first objects, each first object occupies one or more occurrences in the total number of occurrences, and the multiple first objects are objects that perform the first malicious behavior; or, The first statistical data is the updated second mode statistical data, which is used to count the number of occurrences of the first malicious behavior among multiple first objects, each first object occupies one occurrence in the object occurrence number, and the multiple first objects are the objects that perform the first malicious behavior.

6. The system according to claim 5, characterized in that The server cluster is configured to determine, based on the first data, if the first statistical data is the updated first pattern statistical data, to add one to the first pattern statistical data before the update to obtain the updated first pattern statistical data.

7. The system according to claim 5, characterized in that The first data carries an identifier of the object that performs the first malicious behavior; The server cluster is further configured to, when the first statistical data is the updated second-mode statistical data, determine a target first object based on the first data, where the target first object is an object indicated by the first data to execute the first malicious behavior; The server cluster is further configured to, when the number of occurrences previously occupied by the target first object is zero, increment the second pattern statistical data before updating by one to obtain the updated second pattern statistical data; In a case where the number of occurrences of the target first object previously occupying the target first object is one, the second mode statistical data is not changed.

8. The system according to claim 7, characterized in that The server cluster includes a plurality of first servers, the first statistical data is the updated second mode statistical data, and the first data is sent to a target first server among the plurality of first servers; The target first server is used to execute an object consistency algorithm on the first data and multiple first other data to obtain multiple first object category data, each of the multiple first object category data includes at least one data indicating that the objects are the same, and each of the multiple first other data indicates that any one object performs an arbitrary behavior once.

9. The system according to claim 8, characterized in that The system also includes a service end device; The service end device is configured to execute an object consistency algorithm on the first data and a plurality of second other data to obtain a plurality of second object category data, wherein each second object category data in the plurality of second object category data includes at least one data indicating that the objects are identical, and each second other data in the plurality of second other data is configured to instruct any object to perform an arbitrary action once; The service end device is further configured to send at least two second object category data among the plurality of second object category data to the same first server, and objects counted by any two first servers among the plurality of first servers are different.

10. A method for punishing malicious behavior by breaking the circuit breaker, characterized in that: The method is performed by a server cluster, the server cluster including one or more first servers, and the method includes: Obtaining first data, where the first data is used to indicate that a first malicious behavior has occurred, where the first malicious behavior is a malicious webpage access request of a first category; updating first statistical data based on the first data, where the first statistical data is used to count the number of times the first malicious behavior has occurred; The first statistical data is sent to the second server, and the first statistical data is used by the second server to determine whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior in combination with a fuse threshold.

11. A method for punishing malicious behavior by breaking the circuit breaker, characterized in that: The method is performed by the second server, and the method includes: Obtaining first statistical data, where the first statistical data is updated by the server cluster based on first data, the first data is used to indicate the occurrence of a first malicious behavior, the first malicious behavior is a malicious webpage access request of a first category, the first statistical data is used to count the number of occurrences of the first malicious behavior, and the server cluster includes one or more first servers; Determine whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior based on the first statistical data and the fuse threshold.

12. A penalizing fuse device for malicious behavior, characterized in that: The device comprises: an acquisition module, configured to acquire first data, wherein the first data is used to indicate the occurrence of a first malicious behavior, wherein the first malicious behavior is a malicious webpage access request of a first category; a statistics module, configured to update first statistical data based on the first data, wherein the first statistical data is used to count the number of occurrences of the first malicious behavior; The sending module is used to send the first statistical data to the second server, and the first statistical data is used by the second server to determine whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior in combination with a fuse threshold.

13. A penalizing fuse device for malicious behavior, characterized in that: The device comprises: an acquisition module, configured to acquire first statistical data, the first statistical data being updated by a server cluster based on first data, the first data being used to indicate an occurrence of a first malicious behavior, the first malicious behavior being a malicious webpage access request of a first category, the first statistical data being used to count the number of occurrences of the first malicious behavior, the server cluster comprising one or more first servers; A fusing module is configured to determine whether to stop punishing the first malicious behavior or continue punishing the first malicious behavior based on the first statistical data and a fusing threshold.

14. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which is loaded and executed by a processor to implement the penalty fuse method for malicious behavior as described in claim 10 or 11.

15. A computer program product, characterized in that The computer program product stores a computer program, which is loaded and executed by a processor to implement the penalty fuse method for malicious behavior as claimed in claim 10 or 11.

Images