Request processing method and device and electronic equipment
By determining the risk score of service requests across multiple dimensions, the problem of service request parameters being easily forged is solved, achieving more efficient and flexible risk control.
Patent Information
- Application Number
- CN202511340656.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-18
- Publication Date
- 2025-12-19
AI Technical Summary
In existing request processing methods, service request parameters are easily forged, leading to missed interceptions and reducing request processing efficiency.
By acquiring the service requests from clients, we determine the dimensional risk scores of the service requests in terms of risk events, client environment, client behavior indicators, and client behavior sequences. Based on these scores, we determine the total risk score of the service requests and then carry out risk control processing.
This effectively avoids missed interceptions when parameters are forged, improves request processing efficiency, and enhances the flexibility and accuracy of risk control.
Smart Images
Figure CN121173531A_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the field of artificial intelligence technology, and in particular to the fields of deep learning, cloud computing, large models, and information flow, and especially to a request processing method, apparatus, and electronic device. Background Technology
[0002] The current request processing method mainly involves: obtaining the service request; intercepting the service request if the IP address or other parameters in the service request match; and responding to the service request if the IP address or other parameters in the service request do not match.
[0003] In the above scheme, the parameters in the service request are easily forged, which can lead to missed interceptions and reduce the efficiency of request processing. Summary of the Invention
[0004] This disclosure provides a request processing method, apparatus, and electronic device.
[0005] According to one aspect of this disclosure, a request processing method is provided, the method comprising: obtaining a service request from a client; determining a dimensional risk score of the service request in at least two dimensions; the dimensions including at least two of the following: risk event dimension, client environment dimension, client behavior indicator dimension, and client behavior sequence dimension; determining a risk score of the service request based on the dimensional risk scores in the at least two dimensions; and performing risk control processing on the service request based on the risk scores.
[0006] According to another aspect of this disclosure, a request processing apparatus is provided, the apparatus comprising: a first acquisition module for acquiring a service request from a client; a first determination module for determining a dimensional risk score of the service request in at least two dimensions; the dimensions including at least two of the following: risk event dimension, client environment dimension, client behavior indicator dimension, and client behavior sequence dimension; a second determination module for determining a risk score of the service request based on the dimensional risk scores in the at least two dimensions; and a risk control module for performing risk control processing on the service request based on the risk scores.
[0007] According to another aspect of this disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the request processing method proposed above in this disclosure.
[0008] According to another aspect of this disclosure, a non-transitory computer-readable storage medium is provided that stores computer instructions for causing a computer to perform the request processing method described above.
[0009] According to another aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the request processing method described above.
[0010] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description
[0011] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein: Figure 1 This is a schematic diagram based on the first embodiment of the present disclosure; Figure 2 This is a schematic diagram according to the second embodiment of the present disclosure; Figure 3 This is a schematic diagram according to the third embodiment of the present disclosure; Figure 4 This is a schematic diagram of the request processing framework; Figure 5 This is a schematic diagram according to the fourth embodiment of the present disclosure; Figure 6 This is a block diagram of an electronic device used to implement the request processing method of the embodiments of this disclosure. Detailed Implementation
[0012] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.
[0013] The current request processing method mainly involves: obtaining the service request; intercepting the service request if the IP address or other parameters in the service request match; and responding to the service request if the IP address or other parameters in the service request do not match.
[0014] In the above scheme, the parameters in the service request are easily forged, which can lead to missed interceptions and reduce the efficiency of request processing.
[0015] To address the aforementioned issues, this disclosure provides a request processing method, apparatus, and electronic device.
[0016] Figure 1 This is a schematic diagram based on the first embodiment of the present disclosure. It should be noted that the request processing method of the present disclosure can be applied to a request processing device, which can be configured in an electronic device so that the electronic device can perform request processing functions.
[0017] Among them, electronic devices can be any device with computing capabilities, such as personal computers (PCs), mobile terminals, servers, etc. Mobile terminals can be, for example, in-vehicle devices, mobile phones, tablets, personal digital assistants, wearable devices, smart speakers, servers, server clusters, and other hardware devices with various operating systems, touch screens and / or displays.
[0018] The request processing device can also be software in an electronic device, such as request processing software. In the following embodiments, a server is used as an example for illustration.
[0019] like Figure 1 As shown, the request processing method may include the following steps: Step 101: Obtain the client's service request.
[0020] In this embodiment of the disclosure, a service request can be a request message sent by a client to a server for obtaining or manipulating resources on the server. The service request can be, for example, a Hypertext Transfer Protocol (HTTP) request.
[0021] The business to which the service request belongs can be, for example, e-commerce, financial services, social networking, ticketing, or application programming interface (API) services.
[0022] Automated attacks in e-commerce include, for example, protecting against coupon grabbing, flash sales, fraudulent orders, and scraping of product and price information. Automated attacks in financial services include, for example, spam registration, scraping of public information, and API abuse. Automated attacks in social networks include, for example, boosting likes and followers, and scraping content and relationship chains. Automated attacks in ticketing include, for example, protecting against ticket grabbing and fraudulent activities. Automated attacks in API services include, for example, protecting against vulnerability scanning, content scraping, and Distributed Denial of Service (DDoS) attacks.
[0023] In this embodiment of the disclosure, the service request may include at least one of the following parameters: the client's IP address, the client's environment information, the client's object identification information, etc. The client's environment information may include at least one of the following parameters: User-Agent (UA) string, software type, software version, operating system, device information, etc.
[0024] Step 102: Determine the dimensional risk score of the service request in at least two dimensions; the dimensions include at least two of the following: risk event dimension, client environment dimension, client behavior indicator dimension, and client behavior sequence dimension.
[0025] In this embodiment of the disclosure, the dimensional risk score on the risk event dimension can be determined by combining the client's IP address in the service request. Specifically, when the service request includes the client's IP address, the process by which the server determines the dimensional risk score on the risk event dimension can be, for example, querying the risk event database based on the IP address to obtain the risk event corresponding to the IP address; and then determining the risk score of the risk event as the dimensional risk dimension on the risk event dimension.
[0026] The risk event database can be stored using a key-value pair database, such as Redis. Storing the risk event database in a key-value pair database improves the speed of risk event queries, thereby increasing the efficiency of determining dimensional risk scores for each risk event dimension.
[0027] The risk events and their corresponding risk scores in the risk event database are determined based on historical service request data or historical abnormal service request data. Risk events in the database can be categorized by IP address source type or allocation type. IP addresses are classified by source, such as data center IPs, residential IPs, and mobile IPs. Similarly, the source type of a client's IP address can be residential or mobile. Therefore, a data center IP address can be identified as a risk event.
[0028] IP addresses can be categorized based on their allocation method, such as static IPs, dynamic IPs, or instant-dial IPs. Client IP addresses are typically either static or dynamic. Therefore, instant-dial IPs can be identified as a risk event.
[0029] Specifically, the risk score on the risk event dimension is determined based on the client's IP address in the service request. This allows the server to combine the risk event dimension risk score to determine the risk score of the service request, thereby improving the accuracy of risk score determination.
[0030] In this embodiment of the disclosure, the dimensional risk score on the client environment dimension can be determined by combining the client's environment information in the service request. Specifically, when the service request includes the client's environment information, the process by which the server determines the dimensional risk score on the client environment dimension can be, for example, determining the environment type based on the environment information; and then determining the risk score of the environment type as the dimensional risk score on the client environment dimension.
[0031] The environment type includes, for example, crawler type, scanning type, etc. The environment type can be determined by querying an environment type library based on at least one parameter in the environment information. The environment type library can include the environment type corresponding to each piece of environment information.
[0032] Specifically, the environment type is determined based on the client's environment information included in the service request, and then the dimensional risk score on the client's environment dimension is determined. This allows the server to combine the dimensional risk score on the client's environment dimension to determine the risk score of the service request, thereby improving the accuracy of the risk score determination.
[0033] In this embodiment of the disclosure, the dimensional risk score on the client behavior indicator dimension can be determined by combining indicator data from at least one behavioral feature indicator corresponding to the object identification information in the service request. Specifically, when the service request includes object identification information, the process by which the server determines the dimensional risk score on the client behavior indicator dimension can be as follows: Based on the object identification information, obtain the client's object behavior sequence; based on the object behavior sequence, determine indicator data from at least one behavioral feature indicator; and based on the indicator data from at least one behavioral feature indicator, determine the dimensional risk score on the client behavior indicator dimension.
[0034] The object behavior sequence can be a sequence of actions performed by the object corresponding to the object's identification information during a login process. Object actions can include client-sent service requests. For example, an object behavior sequence could be a service request sequence.
[0035] Among them, behavioral characteristic indicators may include at least one of the following: number of service requests per minute (Query Per Minute, QPM), URL types, login duration, etc.
[0036] In this embodiment of the disclosure, the process by which the server determines the dimensional risk score of the client behavior indicator dimension based on the indicator data of at least one behavioral feature indicator can be, for example, determining multiple risk levels; determining the membership degree of at least one behavioral feature indicator to multiple risk levels based on the indicator data of at least one behavioral feature indicator; and determining the dimensional risk score of the client behavior indicator dimension based on the membership degree of at least one behavioral feature indicator to multiple risk levels and the level score corresponding to the risk level.
[0037] The process by which the server determines the membership degree of at least one behavioral feature indicator to multiple risk levels can be, for example, as follows: for the unprocessed indicator of at least one behavioral feature indicator and the unprocessed risk levels among multiple risk levels, based on the indicator data on the unprocessed indicator, determine the membership function that matches the indicator data in at least one membership function of the unprocessed risk level; and then, in combination with the membership function, determine the membership degree of the unprocessed indicator to the unprocessed risk level.
[0038] The process by which the server determines the dimensional risk score on the client behavior indicator dimension based on the membership degree of at least one behavioral feature indicator to multiple risk levels and the level score corresponding to the risk level can be as follows: determining the weight of at least one behavioral feature indicator; for each risk level to be processed among multiple risk levels, determining the weight of the risk level to be processed based on the weight of at least one behavioral feature indicator and the membership degree of at least one behavioral feature indicator to the risk level to be processed; and then combining the weights of multiple risk levels and the level score corresponding to the risk level to be processed to determine the dimensional risk score on the client behavior indicator dimension.
[0039] Specifically, based on the object identification information contained in the service request, an object behavior sequence is obtained; based on the object behavior sequence, indicator data on at least one behavioral feature indicator is determined, and then the dimensional risk score on the client behavior indicator dimension is determined, so that the server can combine the dimensional risk score on the client behavior indicator dimension to determine the risk score of the service request, thereby improving the accuracy of the risk score determination.
[0040] In this embodiment of the disclosure, the dimensional risk score on the client behavior sequence dimension can be determined by combining the object behavior sequence corresponding to the object identification information in the service request. Specifically, when the service request includes object identification information, the process by which the server determines the dimensional risk score on the client behavior sequence dimension can be as follows: Based on the object identification information, obtain the client's object behavior sequence; input the object behavior sequence into a risk score assessment model, obtain the risk score output by the risk score assessment model; and determine the risk score as the dimensional risk score on the client behavior sequence dimension.
[0041] The risk score assessment model is trained by combining historical risk scores on the dimensions of historical object behavior sequences and client behavior sequences.
[0042] Specifically, based on the object identification information contained in the service request, the object behavior sequence is obtained; based on the object behavior sequence, the dimensional risk score on the client behavior sequence dimension is determined, so that the server can combine the dimensional risk score on the client behavior sequence dimension to determine the risk score of the service request, thereby improving the accuracy of the risk score determination.
[0043] Step 103: Determine the risk score of the service request based on the dimensional risk scores on at least two dimensions.
[0044] In this embodiment of the disclosure, the server may use any of the following methods to determine the risk score of a service request.
[0045] Method 1: The server can sum and average the risk scores of at least two dimensions to obtain the processing result; the processing result is then determined as the risk score of the service request.
[0046] Method 2: The server can determine the weights of at least two dimensions; perform a weighted summation of the dimensional risk scores on the at least two dimensions based on the weights to obtain the processing result; and determine the processing result as the risk score for the service request.
[0047] Method 3: The server can input the dimensional risk scores of at least two dimensions into the evaluation model, obtain the scores output by the evaluation model, and determine the risk score of the service request.
[0048] Method 4: The server can input the dimensional risk scores of at least two dimensions into the classification model, obtain the risk classification results output by the classification model, and determine the risk score of the service request based on the risk classification results.
[0049] Method 5: The server can determine the conditions that the risk scores of at least two dimensions must meet based on the condition judgment rules; and determine the risk score of the service request based on the scores corresponding to the met conditions.
[0050] Step 104: Perform risk control processing on service requests based on risk scores.
[0051] The request processing method of this disclosure embodiment obtains a service request from a client; determines the dimensional risk score of the service request in at least two dimensions; the dimensions include at least two of the following: risk event dimension, client environment dimension, client behavior indicator dimension, and client behavior sequence dimension; determines the risk score of the service request based on the dimensional risk scores in at least two dimensions; and performs risk control processing on the service request based on the risk scores. Specifically, determining the risk score of the service request based on the dimensional risk scores in at least two of the risk event dimension, client environment dimension, client behavior indicator dimension, and client behavior sequence dimension, and then performing risk control processing, can avoid missed interception when parameters in the service request are forged, improve request processing efficiency, and enhance the flexibility of risk control.
[0052] To further improve the accuracy of determining the risk score of service requests and facilitate the adjustment of the risk score determination process, the server can determine the membership degree of at least two dimensions to multiple risk levels based on the risk scores of at least two dimensions, thereby determining the risk score of the service request. This adjustment can be achieved through a membership function. Figure 2 As shown, Figure 2 This is a schematic diagram based on the second embodiment of the present disclosure. Figure 2 The illustrated embodiment may include the following steps: Step 201: Obtain the client's service request.
[0053] Step 202: Determine the dimensional risk score of the service request in at least two dimensions; the dimensions include at least two of the following: risk event dimension, client environment dimension, client behavior indicator dimension, and client behavior sequence dimension.
[0054] Step 203: Determine multiple risk levels.
[0055] In this embodiment of the disclosure, the risk level can be, for example, a malicious level, a suspicious level, a normal level, etc.
[0056] Step 204: Determine the membership degree of at least two dimensions to multiple risk levels based on the dimensional risk scores on at least two dimensions.
[0057] In this embodiment of the disclosure, the process of the server executing step 204 may be as follows: for the dimension to be processed in at least two dimensions and the risk level to be processed in multiple risk levels, based on the dimension risk score on the dimension to be processed, determine a first membership function that matches the dimension risk score in at least one membership function of the risk level to be processed; the at least one membership function uses the dimension risk score as a variable; and determine the membership degree of the dimension to be processed to the risk level to be processed based on the dimension risk score on the dimension to be processed and the first membership function.
[0058] Each risk level to be processed can have at least one membership function. If only one membership function is set for a risk level, that function can be designated as the first membership function matching the dimensional risk score. If multiple membership functions are set for a risk level, different membership functions correspond to different dimensional risk score ranges. The membership function whose corresponding dimensional risk score range includes the dimensional risk score of the dimension to be processed can be designated as the first membership function matching the dimensional risk score.
[0059] The membership function may include at least one of the following: a membership function with all values of 0; a membership function with all values of 1; a membership function with values that increase linearly from 0 to 1; a membership function with values that decrease linearly from 1 to 0, etc.
[0060] In this embodiment of the disclosure, the process by which the server determines the membership degree of the dimension to be processed to the level of risk to be processed based on the dimension risk score of the dimension to be processed and the first membership function can be, for example, by substituting the dimension risk score of the dimension to be processed into the first membership function to obtain the value of the first membership function; and determining the value as the membership degree of the dimension to be processed to the level of risk to be processed.
[0061] Specifically, based on the dimension risk score on the dimension to be processed, the first membership function that matches the dimension risk score is determined among at least one membership function of the risk level to be processed, thereby determining the membership degree of the dimension to be processed to the risk level to be processed. This can determine the degree to which a service request belongs to the risk level to be processed on the dimension to be processed, thereby further improving the accuracy of determining the risk score of the service request.
[0062] Step 205: Determine the risk score of the service request based on the membership degree of at least two dimensions to multiple risk levels and the level score corresponding to the risk level.
[0063] In one example of this disclosure, the process of the server performing step 205 may include: determining the weights of at least two dimensions; for each risk level to be processed in a plurality of risk levels, determining the weight of the risk level to be processed based on the weights of at least two dimensions and the membership degree of the risk level to be processed in at least two dimensions; and determining the risk score of the service request based on the weights of the plurality of risk levels and the level score corresponding to the risk level.
[0064] The setting of weights for at least two dimensions allows the server to adjust the weights of at least two dimensions according to actual risk control needs, thereby improving the flexibility of risk score determination and enabling risk score determination to be processed for different risk control needs, thus expanding the applicable scenarios for risk score determination.
[0065] The following example illustrates this. Assume that at least two dimensions include a risk event dimension, a client environment dimension, a client behavior metric dimension, and a client behavior sequence dimension. The set of risk scores across these four dimensions could be, for example, S = {threat_intelligence, ua_strategy, ai_strategy, intelligent_stats}.
[0066] Among them, threat_intelligence represents the dimensional risk score on the risk event dimension; ua_strategy represents the dimensional risk score on the client environment dimension; ai_strategy represents the dimensional risk score on the client behavior sequence dimension; and intelligent_stats represents the dimensional risk score on the client behavior metric dimension.
[0067] Here, we assume there are three risk levels: malicious, suspicious, and normal. The membership function of the risk level can be, for example, shown in formula (1).
[0068] (1) in, This represents the dimensional risk score on a single dimension. This represents the membership function for the risk level. a, b, c, and d represent the boundary scores of the risk score range for each dimension.
[0069] Based on the above formula, the membership degree of each dimension to each risk level can be determined, and then the risk score of the service request can be determined by combining the level score corresponding to each risk level.
[0070] In this embodiment of the disclosure, in order to further improve the accuracy of the risk score of the obtained service request, after determining the weight of each risk level, the weight of each risk level can be normalized; then, the risk score of the service request is determined according to the normalized weight of each risk level and the risk score corresponding to the risk level.
[0071] In another example of this disclosure, the process of the server performing step 205 may be as follows: determining the weights of at least two dimensions; for each risk level to be processed in a plurality of risk levels, determining the weight of the risk level to be processed based on the weights of at least two dimensions and the membership degree of the risk level to be processed in at least two dimensions; obtaining the maximum weight among the weights of the plurality of risk levels; and determining the risk score of the service request based on the level score of the risk level corresponding to the maximum weight and the maximum weight.
[0072] The risk score for a service request can be the product of the risk level score corresponding to the highest weight and the highest weight itself.
[0073] Step 206: Perform risk control processing on service requests based on risk scores.
[0074] It should be noted that for details regarding steps 201 to 202 and steps 206, please refer to [the relevant documentation / reference]. Figure 1 Steps 101 to 102 and 104 in the illustrated embodiment will not be described in detail here.
[0075] The request processing method of this disclosure embodiment obtains a service request from a client; determines the dimensional risk score of the service request in at least two dimensions; the dimensions include at least two of the following: risk event dimension, client environment dimension, client behavior indicator dimension, and client behavior sequence dimension; determines multiple risk levels; determines the membership degree of at least two dimensions to multiple risk levels based on the dimensional risk scores in the at least two dimensions; determines the risk score of the service request based on the membership degree of at least two dimensions to multiple risk levels and the level score corresponding to the risk level; and performs risk control processing on the service request based on the risk score. Specifically, determining the membership degree of at least two dimensions to multiple risk levels based on the dimensional risk scores in the at least two dimensions, and then determining the risk score of the service request, can further improve the accuracy of determining the risk score of the service request and facilitate the adjustment and processing of the risk score determination process.
[0076] To further enhance the flexibility of risk control, a set of control strategies can be queried based on the risk score to obtain a control strategy that matches the risk score. This control strategy can then be used to process service requests for risk control. For example... Figure 3 As shown, Figure 3 This is a schematic diagram based on the third embodiment of the present disclosure. Figure 3 The illustrated embodiment may include the following steps: Step 301: Obtain the client's service request.
[0077] Step 302: Determine the dimensional risk score of the service request in at least two dimensions; the dimensions include at least two of the following: risk event dimension, client environment dimension, client behavior indicator dimension, and client behavior sequence dimension.
[0078] In this embodiment of the disclosure, in order to reduce the number of service requests that need to be processed, improve the accuracy of request processing, and increase the efficiency of request processing, the server can process only some service requests. Correspondingly, before step 302, the server can also perform the following process: determine whether the business to which the service request belongs is located in the target business database; the business in the target business database is a business that needs to be subject to risk control processing; if the business to which the service request belongs is not located in the target business database, stop the risk control processing of the service request.
[0079] In one example, the target service library can be determined based on the corresponding control policy for each service request of the request interception policy. In another example, the target service library can be determined based on historical service requests in the request log.
[0080] The process by which the server determines the target business database based on historical service requests in the request log can be as follows: obtain the request log; the request log includes at least one historical service request; determine the risk score of the historical service request and the control policy based on the risk score; and, if the control policy is a request interception policy, update the business to which the historical service request belongs to the target business database.
[0081] In addition, when the control policy is a request verification policy, the server can also update the business to which the historical service request belongs to the target business database.
[0082] The process of determining the risk score of historical service requests can be referenced. Figure 1 or Figure 2 The process of determining the risk score of service requests in the embodiments will not be described in detail here.
[0083] Specifically, risk scores and control strategies are determined based on historical service requests in the request logs, and then the target business database is updated. This enables risk control processing for subsequent similar service requests, avoiding risk control processing for other service requests, thereby improving the accuracy of risk control and further improving request processing efficiency.
[0084] Step 303: Determine the risk score of the service request based on the dimensional risk scores on at least two dimensions.
[0085] Step 304: Query the control strategy set based on the risk score to obtain the first score range in the control strategy set that includes the risk score.
[0086] In this embodiment of the disclosure, the control strategy includes at least one of the following: a request interception strategy, a request verification strategy, a request observation strategy, and a request trust strategy; wherein, the request interception strategy instructs the interception of service requests; the request verification strategy instructs the verification of service requests and, upon successful verification, the response to the service request; the request observation strategy instructs the tagging and response to service requests; and the request trust strategy instructs the response to service requests.
[0087] Specifically, the score within the range corresponding to the request interception policy can be greater than the score within the range corresponding to the request verification policy. The score within the range corresponding to the request verification policy can be greater than the score within the range corresponding to the request observation policy. The score within the range corresponding to the request observation policy can be greater than the score within the range corresponding to the request trust policy.
[0088] The set of control strategies allows the server to flexibly select a control strategy based on the risk score, thereby improving the richness and flexibility of risk control.
[0089] Step 305: Perform risk control processing on the service request according to the control policy corresponding to the first score range in the control policy set.
[0090] In this process, after the server tags and processes the service requests according to the request observation policy, it can provide the tagged service requests to the observers for verification, so as to adjust the score range corresponding to each control policy.
[0091] In this embodiment of the disclosure, to facilitate objects in setting control policy sets according to business needs, and to enable the server to perform risk control processing in a timely manner based on the control policy sets set by the objects, thereby further improving risk control efficiency, the server can select a control policy set for risk control processing based on the correspondence between the modes set by the objects and the control policy sets, as well as the current mode. Correspondingly, as an alternative to steps 304 and 305, the server can perform the following process to perform risk control processing on service requests: In the case of multiple modes and corresponding control policy sets, obtain the current mode and the current control policy set corresponding to the current mode; query the current control policy set based on the risk score to obtain a second score range including the risk score in the current control policy set; and perform risk control processing on the service request based on the control policy corresponding to the second score range in the current control policy set.
[0092] These modes include strict mode, medium mode, and lenient mode. When the control policies include request interception, request verification, and request trust, for example, in strict mode, the score range for the request interception policy could be (50, 100); the score range for the request verification policy could be (25, 50); and the score range for the request trust policy could be (0, 25). In medium mode, the score range for the request interception policy could be (75, 100); the score range for the request verification policy could be (25, 75); and the score range for the request trust policy could be (0, 25).
[0093] For example, in the lenient mode, the score range corresponding to the request interception policy can be (75, 100); the score range corresponding to the request verification policy can be (50, 75); and the score range corresponding to the request trust policy can be (0, 50).
[0094] It should be noted that for details of steps 301 to 303, please refer to [the relevant documentation / reference]. Figure 1 Steps 101 to 103 in the illustrated embodiment will not be described in detail here.
[0095] The request processing method of this disclosure embodiment obtains a service request from a client; determines a dimensional risk score for the service request in at least two dimensions; the dimensions include at least two of the following: risk event dimension, client environment dimension, client behavior indicator dimension, and client behavior sequence dimension; determines a risk score for the service request based on the dimensional risk scores in at least two dimensions; queries a set of control strategies based on the risk score to obtain a first score range in the set of control strategies that includes the risk score; and performs risk control processing on the service request based on the control strategy corresponding to the first score range in the set of control strategies. The method of querying the set of control strategies based on the risk score to obtain a control strategy matching the risk score, and then combining the control strategy with the risk control processing of the service request, can further improve the flexibility of risk control.
[0096] The following example illustrates this. For example... Figure 4 The diagram shown is a schematic representation of the request processing framework. Figure 4 The process includes the following steps.
[0097] Step 401: Obtain raw traffic. For example, logs (i.e., request logs) and HTTP requests (i.e., service requests).
[0098] Step 402: The server's data access layer receives the raw traffic.
[0099] Step 403: In the server's multi-dimensional tagging modeling layer, the raw traffic is processed by the threat intelligence engine, UA policy engine, intelligent statistics engine, and AI policy engine to generate a four-dimensional risk score (i.e., a risk event dimension risk score, a client environment dimension risk score, a client behavior indicator dimension risk score, and a client behavior sequence dimension risk score). The threat intelligence engine determines the risk event dimension risk score by querying the intelligence DBRedis (i.e., risk events).
[0100] Step 404: In the server's traffic risk identification and classification layer, scores and weights are aggregated using a fuzzy comprehensive evaluation algorithm (i.e., a membership degree determination algorithm) to output a BOT type label + handling action (control strategy and risk level determined based on the score range corresponding to the control strategy). When a handling strategy mapping is set, a strategy can be selected based on the mode (i.e., the control strategy is determined based on the current mode and the control strategy library corresponding to each mode).
[0101] Step 405: The server's policy execution layer processes the raw traffic according to the control policy. The control policy includes at least one of the following: interception (i.e., request interception policy), challenge (i.e., request verification policy), observation (i.e., request observation policy), and trust (i.e., request trust policy).
[0102] The following example illustrates this. Assume the original traffic is a request initiated by a user accessing a coupon-grabbing page. The threat intelligence engine detects that the IP in the request is a data center IP, thus determining a dimensional risk score of 85. The UA policy engine determines that the UA in the request is a Python web crawler, thus determining a dimensional risk score of 60. The intelligent statistics engine detects that the session to which the request belongs has an extremely high QPM within a short period, thus determining a dimensional risk score of 90. The AI policy engine determines that the behavior sequence of the IP in the request is abnormal, thus determining a dimensional risk score of 70. The traffic risk identification and classification layer, combined with a fuzzy comprehensive evaluation algorithm, determines the weight combination for each risk level as [0.05, 0.2, 0.75]. Here, 0.05 represents the weight of the normal risk level; 0.2 represents the weight of the suspicious risk level; and 0.75 represents the weight of the malicious risk level.
[0103] Among these, the malicious level has the highest weight, so the risk level can be determined as malicious; the risk score of the original traffic is determined to be 78. In the current mode of "strict mode," the control strategy determined based on this risk score is a request interception strategy, which then intercepts the original traffic, resulting in the failure to claim the coupon.
[0104] To implement the above embodiments, this disclosure also provides a request processing apparatus. For example... Figure 5 As shown, Figure 5 This is a schematic diagram according to the fourth embodiment of the present disclosure. The request processing device 50 may include: a first acquisition module 501, a first determination module 502, a second determination module 503, and a risk control module 504.
[0105] The system includes a first acquisition module 501 for acquiring a service request from a client; a first determination module 502 for determining the dimensional risk score of the service request in at least two dimensions; the dimensions include at least two of the following: risk event dimension, client environment dimension, client behavior indicator dimension, and client behavior sequence dimension; a second determination module 503 for determining the risk score of the service request based on the dimensional risk scores in the at least two dimensions; and a risk control module 504 for performing risk control processing on the service request based on the risk score.
[0106] As one possible implementation of this disclosure, the service request includes: the IP address of the client; the first determining module 502 is specifically used to: query the risk event database according to the IP address, obtain the risk event corresponding to the IP address; and determine the risk score of the risk event as the dimensional risk dimension of the risk event dimension.
[0107] As one possible implementation of this disclosure, the service request includes: the client's environment information; the first determining module 502 is specifically used to: determine the environment type based on the environment information; and determine the risk score of the environment type as the dimensional risk score on the client's environment dimension.
[0108] As one possible implementation of this disclosure, the service request includes: object identification information; the first determining module 502 is specifically configured to: obtain the object behavior sequence of the client based on the object identification information; determine indicator data on at least one behavioral feature indicator based on the object behavior sequence; and determine the dimensional risk score on the client behavior indicator dimension based on the indicator data on the at least one behavioral feature indicator.
[0109] As one possible implementation of this disclosure, the service request includes: object identification information; the first determining module 502 is specifically configured to: obtain the object behavior sequence of the client based on the object identification information; input the object behavior sequence into a risk score assessment model to obtain the risk score output by the risk score assessment model; and determine the risk score as the dimensional risk score on the dimension of the client behavior sequence.
[0110] As one possible implementation of this disclosure, the second determining module 503 includes: a first determining unit, a second determining unit, and a third determining unit; the first determining unit is used to determine multiple risk levels; the second determining unit is used to determine the membership degree of the at least two dimensions to the multiple risk levels based on the dimensional risk scores on at least two dimensions; the third determining unit is used to determine the risk score of the service request based on the membership degree of the at least two dimensions to the multiple risk levels and the level score corresponding to the risk level.
[0111] As one possible implementation of this disclosure, the second determining unit is specifically configured to, for the dimension to be processed in the at least two dimensions and the risk level to be processed in the plurality of risk levels, determine a first membership function that matches the dimension risk score in at least one membership function of the risk level to be processed, based on the dimension risk score in the dimension to be processed; the at least one membership function uses the dimension risk score as a variable; and determine the membership degree of the dimension to be processed to the risk level to be processed based on the dimension risk score in the dimension to be processed and the first membership function.
[0112] As one possible implementation of this disclosure, the third determining unit is specifically configured to: determine the weights of the at least two dimensions; for each of the plurality of risk levels to be processed, determine the weight of the risk level to be processed based on the weights of the at least two dimensions and the membership degree of the at least two dimensions to the risk level to be processed; and determine the risk score of the service request based on the weights of the plurality of risk levels and the level score corresponding to the risk level.
[0113] As one possible implementation of this disclosure, the risk control module 504 is specifically configured to: query a set of control strategies based on the risk score, obtain a first score range in the set of control strategies that includes the risk score; and perform risk control processing on the service request based on the control strategy corresponding to the first score range in the set of control strategies.
[0114] As one possible implementation of this disclosure, the control strategy includes at least one of the following: a request interception strategy, a request verification strategy, a request observation strategy, and a request trust strategy; the request interception strategy instructs the interception of service requests; the request verification strategy instructs the verification of service requests, and responds to the service requests after successful verification; the request observation strategy instructs the tagging and response of service requests; and the request trust strategy instructs the response of service requests.
[0115] As one possible implementation of this disclosure, the risk control module 504 is specifically configured to: obtain the current mode and the current control strategy set corresponding to the current mode when multiple modes and control strategy sets corresponding to the modes exist; query the current control strategy set according to the risk score to obtain a second score range in the current control strategy set that includes the risk score; and perform risk control processing on the service request according to the control strategy corresponding to the second score range in the current control strategy set.
[0116] As one possible implementation of this disclosure, the apparatus further includes: a third determining module, configured to determine whether the service request belongs to a service in a target service database; the service in the target service database is a service that requires risk control processing; the risk control module 504 is further configured to stop performing risk control processing on the service request if the service request does not belong to the target service database.
[0117] As one possible implementation of this disclosure, the apparatus further includes: a second acquisition module, a fourth determination module, and an update module; the second acquisition module is used to acquire a request log; the request log includes at least one historical service request; the fourth determination module is used to determine the risk score of the historical service request and a control policy based on the risk score; the update module is used to update the service to which the historical service request belongs to the target service database when the control policy is an interception control policy.
[0118] The request processing apparatus of this disclosure acquires a service request from a client; determines a dimensional risk score for the service request in at least two dimensions; the dimensions include at least two of the following: risk event dimension, client environment dimension, client behavior indicator dimension, and client behavior sequence dimension; determines a risk score for the service request based on the dimensional risk scores in at least two dimensions; and performs risk control processing on the service request based on the risk scores. Specifically, determining the risk score of the service request based on the dimensional risk scores in at least two of the risk event dimension, client environment dimension, client behavior indicator dimension, and client behavior sequence dimension, and then performing risk control processing, can avoid missed interception when parameters in the service request are forged, improve request processing efficiency, and enhance the flexibility of risk control.
[0119] In the technical solutions disclosed herein, the collection, storage, use, processing, transmission, provision, and disclosure of users' personal information are all carried out with the consent of the users, and all comply with the provisions of relevant laws and regulations, and do not violate public order and good morals.
[0120] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.
[0121] Figure 6 A schematic block diagram of an example electronic device 600 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.
[0122] like Figure 6 As shown, device 600 includes a computing unit 601, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 602 or a computer program loaded into random access memory (RAM) 603 from storage unit 608. RAM 603 may also store various programs and data required for the operation of device 600. The computing unit 601, ROM 602, and RAM 603 are interconnected via bus 604. Input / output (I / O) interface 605 is also connected to bus 604.
[0123] Multiple components in device 600 are connected to I / O interface 605, including: input unit 606, such as keyboard, mouse, etc.; output unit 607, such as various types of monitors, speakers, etc.; storage unit 608, such as disk, optical disk, etc.; and communication unit 609, such as network card, modem, wireless transceiver, etc. Communication unit 609 allows device 600 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.
[0124] The computing unit 601 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 601 performs the various methods and processes described above, such as request processing methods. For example, in some embodiments, the request processing method may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by the computing unit 601, one or more steps of the request processing method described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to perform request processing methods by any other suitable means (e.g., by means of firmware).
[0125] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.
[0126] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.
[0127] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.
[0128] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).
[0129] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.
[0130] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.
[0131] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.
[0132] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.
Claims
1. A request processing method, the method comprising: Obtain the client's service request; Determine the dimensional risk score of the service request in at least two dimensions; The dimensions include at least two of the following: risk event dimension, client environment dimension, client behavior indicator dimension, and client behavior sequence dimension; The risk score of the service request is determined based on the dimensional risk scores on at least two of the dimensions. The service request is subject to risk control processing based on the risk score.
2. The method according to claim 1, wherein, The service request includes: the client's IP address; determining the dimensional risk score of the service request on the risk event dimension includes: The risk event corresponding to the IP address is retrieved from the risk event database. The risk score of the risk event is determined as the dimensional risk dimension of the risk event dimension.
3. The method according to claim 1, wherein, The service request includes: the client's environment information; determining the dimensional risk score of the service request on the client's environment dimension includes: The environment type is determined based on the environmental information; The risk score of the environment type is determined as the dimensional risk score of the client environment dimension.
4. The method according to claim 1, wherein, The service request includes: object identification information; determining the dimensional risk score of the service request on the client behavior indicator dimension includes: Based on the object identification information, obtain the object behavior sequence of the client; Based on the object's behavior sequence, determine indicator data for at least one behavioral characteristic indicator; Based on the indicator data of the at least one behavioral characteristic indicator, determine the dimensional risk score of the client behavior indicator dimension.
5. The method according to claim 1, wherein, The service request includes: object identification information; determining the dimensional risk score of the service request on the client behavior sequence dimension includes: Based on the object identification information, obtain the object behavior sequence of the client; Input the object behavior sequence into the risk score assessment model and obtain the risk score output by the risk score assessment model; The risk score is determined as the dimensional risk score on the dimension of the client behavior sequence.
6. The method according to claim 1, wherein, Determining the risk score of the service request based on the dimensional risk scores across the at least two dimensions includes: Multiple risk levels were identified; Determine the membership degree of the at least two dimensions to the multiple risk levels based on the dimensional risk scores on at least two dimensions; The risk score of the service request is determined based on the membership degree of the at least two dimensions to the plurality of risk levels and the level score corresponding to the risk level.
7. The method according to claim 6, wherein, The step of determining the membership degree of the at least two dimensions to the multiple risk levels based on dimensional risk scores on at least two dimensions includes: For the unprocessed dimension among the at least two dimensions and the unprocessed risk level among the multiple risk levels, based on the dimension risk score on the unprocessed dimension, determine the first membership function among at least one membership function of the unprocessed risk level that matches the dimension risk score; the at least one membership function uses the dimension risk score as a variable. The membership degree of the dimension to be processed to the risk level is determined based on the dimensional risk score on the dimension to be processed and the first membership function.
8. The method according to claim 6, wherein, Determining the risk score of the service request based on the membership degree of the multiple risk levels according to the at least two dimensions and the level score corresponding to the risk level includes: Determine the weights of the at least two dimensions; For each risk level to be processed among the plurality of risk levels, the weight of the risk level to be processed is determined according to the weights of the at least two dimensions and the membership degree of the at least two dimensions to the risk level to be processed. The risk score of the service request is determined based on the weights of the multiple risk levels and the corresponding level scores.
9. The method according to claim 1 or 6, wherein, The risk control process for the service request based on the risk score includes: Based on the risk score, query the control strategy set to obtain a first score range in the control strategy set that includes the risk score; The service request is subject to risk control processing based on the control policy corresponding to the first score range in the control policy set.
10. The method according to claim 9, wherein, The control strategy includes at least one of the following: request interception strategy, request verification strategy, request observation strategy, and request trust strategy; The request interception policy instructs that service requests be intercepted and processed. The request verification strategy instructs that service requests be verified, and that a response be processed after successful verification. The request observation strategy instructs the tagging and response processing of service requests. The request trust policy instructs the response processing of service requests.
11. The method according to claim 1 or 6, wherein, The risk control process for the service request based on the risk score includes: In the case of multiple modes and a set of control strategies corresponding to the modes, obtain the current mode and the current set of control strategies corresponding to the current mode; Based on the risk score, query the current control strategy set to obtain a second score range in the current control strategy set that includes the risk score; The service request is subject to risk control processing based on the control policy corresponding to the second score range in the current control policy set.
12. The method according to claim 1, wherein, Before determining the dimensional risk scores of the service request across at least two dimensions, the method further includes: Determine whether the service request belongs to a business within the target business database; the business in the target business database is one that requires risk control processing. If the service request belongs to a service that is not located in the target service database, the risk control process for the service request shall be stopped.
13. The method according to claim 12, wherein, The method further includes: Obtain the request log; the request log includes at least one historical service request. Determine the risk score of the historical service requests and the control strategy based on the risk score; When the control policy is a request interception policy, the service to which the historical service request belongs will be updated in the target service database.
14. A request processing apparatus, the apparatus comprising: The first acquisition module is used to acquire service requests from clients; The first determining module is used to determine the dimensional risk score of the service request in at least two dimensions; the dimensions include at least two of the following: risk event dimension, client environment dimension, client behavior indicator dimension, and client behavior sequence dimension. The second determining module is used to determine the risk score of the service request based on the dimensional risk scores on the at least two dimensions; The risk control module is used to perform risk control processing on the service request based on the risk score.
15. An electronic device comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 13.
16. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1 to 13.
17. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 13.