High-frequency access detection method and device

Abstract

The invention relates to a high-frequency access detection method and device. The method comprises the following steps: acquiring a source IP address and browser fingerprint information from an access request; generating a unique access identifier corresponding to the access request based on the source IP address and the browser fingerprint information; counting the access frequency of the access request based on the unique access identifier in a preset time window; comparing the access frequency with a preset access threshold value; and when the access frequency exceeds the access threshold, judging that the access request is a high-frequency access request. According to the high-frequency access detection method and device, more accurate high-frequency access detection and protection can be realized, the problem of misjudgment in an NAT environment can be effectively solved, and the capability of identifying proxy switching attacks is improved, so that the system security is enhanced.

Description

Technical Field

[0001] This application relates to the field of computer information processing, and more specifically, to a high-frequency access detection method and apparatus. Background Technology

[0002] In the field of internet security, high-frequency access behavior is often considered a potential malicious attack, such as web scraping, DDoS attacks, and brute-force attacks. These behaviors can severely consume server resources, impact the access experience of normal users, and even cause service unavailability. Therefore, how to effectively detect and protect against high-frequency access behavior is an important research direction in network security defense.

[0003] Currently, common detection methods mainly rely on IP address statistics, which determine whether there is abnormal access behavior by calculating the number of times a single IP address accesses the network within a unit of time. Once the IP access frequency exceeds a set threshold, a blocking or rate limiting mechanism is triggered to reduce the impact of malicious traffic. However, with the development of internet technology, the statistical method based solely on IP addresses has many limitations in practical applications.

[0004] Therefore, a new high-frequency access detection method and device are needed.

[0005] The information disclosed in the background section is only intended to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] In view of this, this application provides a high-frequency access detection method and apparatus, which can achieve more accurate high-frequency access detection and protection, effectively address the problem of NAT environment misjudgment, and improve the ability to identify proxy switching attacks, thereby enhancing system security.

[0007] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0008] According to one aspect of this application, a high-frequency access detection method is proposed, the method comprising: obtaining a source IP address and browser fingerprint information from an access request; generating a unique access identifier corresponding to the access request based on the source IP address and the browser fingerprint information; calculating the access frequency of the access request based on the unique access identifier within a preset time window; comparing the access frequency with a preset access threshold; and determining that the access request is a high-frequency access request when the access frequency exceeds the access threshold.

[0009] In one exemplary embodiment of this application, the method further includes: executing corresponding access control or protection policies on the access requests that are determined to be high-frequency access requests.

[0010] In one exemplary embodiment of this application, obtaining the source IP address and browser fingerprint information from the access request includes: receiving an access request from a client; and obtaining the source IP address and browser fingerprint information from the access request.

[0011] In one exemplary embodiment of this application, generating a unique access identifier corresponding to the access request based on the source IP address and the browser fingerprint information includes: concatenating the source IP address and the browser fingerprint information; and performing a hash operation on the concatenation result to generate the unique access identifier.

[0012] In one exemplary embodiment of this application, the access frequency includes a first access frequency and / or a second access frequency. Within a preset time window, the access frequency of the access request is counted based on the unique access identifier, including: within the preset time window, counting the access requests according to the unique access identifier to obtain the first access frequency; and / or within the preset time window, aggregating and counting access requests with the same browser fingerprint information but corresponding to different source IP addresses to obtain the second access frequency.

[0013] In one exemplary embodiment of this application, the access threshold includes a first access threshold and / or a second access threshold, and comparing the access frequency with a preset access threshold includes: comparing the first access frequency with a preset first access threshold; and / or comparing the second access frequency with a preset second access threshold.

[0014] In one exemplary embodiment of this application, the method further includes: when the access frequency does not exceed the access threshold, determining that the access request is a normal access request; allowing the access request and updating the access count corresponding to the access request.

[0015] In one exemplary embodiment of this application, the execution of corresponding access control or protection policies includes: executing a verification code policy; and / or executing a human-machine verification policy; and / or executing a blocking policy.

[0016] In one exemplary embodiment of this application, executing a verification code policy includes: executing a verification code verification policy for access requests that are frequent but exhibit normal behavior patterns within a short period of time.

[0017] According to one aspect of this application, a high-frequency access detection device is proposed, comprising: an information module for obtaining a source IP address and browser fingerprint information from an access request; an identification module for generating a unique access identifier corresponding to the access request based on the source IP address and the browser fingerprint information; a statistics module for calculating the access frequency of the access request based on the unique access identifier within a preset time window; a comparison module for comparing the access frequency with a preset access threshold; and a determination module for determining that the access request is a high-frequency access request when the access frequency exceeds the access threshold.

[0018] According to one aspect of this application, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs; and, when the one or more programs are executed by the one or more processors, causing the one or more processors to implement the method as described above.

[0019] According to one aspect of this application, a computer-readable medium is provided having a computer program stored thereon that, when executed by a processor, implements the method described above.

[0020] According to the high-frequency access detection method and apparatus of this application, the following steps are taken: obtaining the source IP address and browser fingerprint information from the access request; generating a unique access identifier corresponding to the access request based on the source IP address and the browser fingerprint information; statistically analyzing the access frequency of the access request based on the unique access identifier within a preset time window; comparing the access frequency with a preset access threshold; and determining that the access request is a high-frequency access request when the access frequency exceeds the access threshold. This approach can achieve more accurate high-frequency access detection and protection, effectively address NAT environment misjudgment issues, and improve the ability to identify proxy switching attacks, thereby enhancing system security.

[0021] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this application. Attached Figure Description

[0022] The above and other objects, features, and advantages of this application will become more apparent from the detailed description of exemplary embodiments with reference to the accompanying drawings. The drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0023] Figure 1 This is a flowchart illustrating a high-frequency access detection method according to an exemplary embodiment.

[0024] Figure 2This is a flowchart illustrating a high-frequency access detection method according to an exemplary embodiment.

[0025] Figure 3 This is a schematic diagram illustrating a high-frequency access detection method according to another exemplary embodiment.

[0026] Figure 4 This is a schematic diagram illustrating a high-frequency access detection method according to another exemplary embodiment.

[0027] Figure 5 This is a block diagram illustrating a high-frequency access detection device according to an exemplary embodiment.

[0028] Figure 6 This is a block diagram illustrating an electronic device according to an exemplary embodiment.

[0029] Figure 7 This is a block diagram illustrating a computer-readable medium according to an exemplary embodiment. Detailed Implementation

[0030] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, they are provided so that this application will be thorough and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted.

[0031] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0032] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0033] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily need to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0034] It should be understood that although the terms first, second, third, etc., may be used herein to describe various components, these components should not be limited by these terms. These terms are used to distinguish one component from another. Therefore, the first component discussed below may be referred to as the second component without departing from the teachings of this application. As used herein, the term "and / or" includes all combinations of any one and more of the associated listed items.

[0035] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of exemplary embodiments, and the modules or processes in the drawings are not necessarily essential for implementing this application, and therefore cannot be used to limit the scope of protection of this application.

[0036] The applicant in this case discovered that current high-frequency access detection primarily relies on IP-based statistical methods. Specifically, the server counts the source IPs of access requests and sets certain thresholds, for example: Time window statistics: The number of IP accesses is counted within a certain time window (such as 1 minute). If the threshold is exceeded, restrictions will be triggered.

[0037] Blacklist mechanism: IPs that trigger restrictions multiple times within a short period of time are added to the blacklist to prevent further access.

[0038] However, existing solutions suffer from a high false positive rate in NAT scenarios: due to NAT (Network Address Translation) technology, multiple users may share the same external IP address. For example, multiple users on a company or school's internal network may be mistakenly identified as frequently accessing the network due to the same IP address, leading to restrictions on legitimate users.

[0039] Existing solutions cannot distinguish between different users under the same IP address: current methods can only collect data at the IP level and cannot identify the specific user behind the IP. In NA scenarios, different users share the same IP, making it impossible to accurately distinguish between normal and abnormal users.

[0040] Existing solutions struggle to identify proxy and VPN access: attackers can use proxy servers or VPNs to change their IP addresses, thereby bypassing IP statistics-based detection mechanisms and rendering IP blocking policies ineffective.

[0041] The existing solution may mistakenly block legitimate users, affecting the user experience: Since the existing technology blocks users based on their IP addresses, some legitimate users who frequently access the site (such as enterprise users who crawl legitimate data or users who download from cloud storage) may be mistakenly blocked, thus affecting the user experience.

[0042] These shortcomings indicate that existing IP statistics-based detection schemes have significant limitations. Therefore, a more accurate detection method is needed that can effectively identify high-frequency access behaviors in complex network environments such as NAT, proxies, and VPNs, while reducing false positive rates and improving protection effectiveness.

[0043] In view of the technical deficiencies in existing technologies, this application proposes a high-frequency access detection and protection method based on IP + browser fingerprinting to overcome the limitations of relying solely on IP statistics in existing technologies. This method combines the user's IP address and browser fingerprint information for multi-dimensional statistics, improving the accuracy of high-frequency access detection.

[0044] The contents of this application will be described in detail below with reference to specific embodiments.

[0045] Figure 1 This is a flowchart illustrating a high-frequency access detection method according to an exemplary embodiment. The high-frequency access detection method 10 includes at least steps S102 to S110.

[0046] like Figure 1 As shown, in S102, the source IP address and browser fingerprint information are obtained from the access request. More specifically, an access request from a client can be received; the source IP address and browser fingerprint information can be obtained from the access request.

[0047] More specifically, when the server receives an access request from a client, it records the source IP address. Simultaneously, it collects browser fingerprint information (such as font, screen resolution, plugin list, time zone, Canvas fingerprint, etc.) through JavaScript code running on the client side and sends this information to the server along with the access request.

[0048] In step S104, a unique access identifier corresponding to the access request is generated based on the source IP address and the browser fingerprint information. For example, the source IP address and the browser fingerprint information can be concatenated; a hash operation is then performed on the concatenated result to generate the unique access identifier.

[0049] For example, the source IP address string can be concatenated with the browser fingerprint information string to form a combined string; then, a hash operation (such as MD5, SHA-1, etc.) can be performed on this combined string, and the resulting hash value can be used as the unique access identifier. The server will store this generated identifier, the corresponding access source IP, the browser fingerprint, and the initial access count.

[0050] In S106, within a preset time window, the access frequency of the access request is counted based on the unique access identifier.

[0051] In one specific embodiment, the access frequency includes a first access frequency and / or a second access frequency. Within a preset time window, the access frequency of the access requests is statistically analyzed based on the unique access identifier. This includes: within the preset time window, counting access requests according to the unique access identifier to obtain the first access frequency; for example, counting access requests according to the unique access identifier within the preset time window. For instance, for the identifier "192.168.1.1_FINGERPRINT_A", the total number of requests for it within that time window is counted.

[0052] In one embodiment, for example, within a preset time window, access requests with the same browser fingerprint information but corresponding to different source IP addresses are aggregated and counted to obtain a second access frequency. Within the preset time window, all access requests with the same browser fingerprint information but corresponding to different source IP addresses are aggregated and counted. This method is specifically designed to detect access made by the same user (identified by browser fingerprint) by switching proxies or using a VPN to change their IP address.

[0053] In S108, the access frequency is compared with a preset access threshold.

[0054] In one specific embodiment, the access threshold includes a first access threshold and / or a second access threshold, and comparing the access frequency with a preset access threshold includes: comparing the first access frequency with a preset first access threshold; and / or comparing the second access frequency with a preset second access threshold.

[0055] In S110, when the access frequency exceeds the access threshold, the access request is determined to be a high-frequency access request. Specifically, the determination logic may be: if the first access frequency exceeds the first access threshold, or the second access frequency exceeds the second access threshold, then a high-frequency access anomaly is determined to exist.

[0056] The specific judgment logic could also be: if the first access frequency exceeds the first access threshold and the second access frequency exceeds the second access threshold, then a high-frequency access anomaly is determined to exist. This application is not limited to this.

[0057] In one embodiment, when the access frequency does not exceed the access threshold, the access request is determined to be a normal access request; the access request is allowed, and the access count corresponding to the access request is updated.

[0058] In one embodiment, the method further includes: executing corresponding access control or protection policies on access requests determined to be high-frequency access requests. Specific protection policies may include: implementing a CAPTCHA policy; implementing a human-machine verification policy; and implementing a blocking policy.

[0059] More specifically, CAPTCHA verification can be implemented for access requests that are frequent but exhibit normal behavior patterns within a short period. Furthermore, the implementation of this policy can incorporate intelligent differentiation. For example, for users making frequent requests within a short period with generally normal behavior patterns (such as access paths and parameters) (potentially legitimate web scraping or downloading activities), CAPTCHA verification should be prioritized over direct blocking, ensuring security while minimizing false positives on legitimate users. Conversely, for clearly malicious high-frequency attacks, direct blocking can be implemented.

[0060] According to the high-frequency access detection method of this application, the source IP address and browser fingerprint information are obtained from the access request; a unique access identifier corresponding to the access request is generated based on the source IP address and the browser fingerprint information; within a preset time window, the access frequency of the access request is counted based on the unique access identifier; the access frequency is compared with a preset access threshold; when the access frequency exceeds the access threshold, the access request is determined to be a high-frequency access request. This method can achieve more accurate high-frequency access detection and protection, effectively address the problem of NAT environment misjudgment, and improve the ability to identify proxy switching attacks, thereby enhancing system security.

[0061] It should be clearly understood that this application describes how specific examples are formed and used, but the principles of this application are not limited to any details of these examples. Rather, based on the teachings of the disclosure of this application, these principles can be applied to many other embodiments.

[0062] Figure 2 This is a flowchart illustrating a high-frequency access detection method according to another exemplary embodiment. Figure 2 The process shown in step 20 is... Figure 1 A detailed description of the process shown.

[0063] like Figure 2As shown, in S202, the server parses the request to generate a unique access identifier. Upon receiving an access request, the server records the accessing IP address and browser fingerprint information. Browser fingerprints (such as font, resolution, plugins, time zone, Canvas fingerprint, etc.) can also be collected on the client side via JavaScript and sent to the server.

[0064] It can also combine IP address and browser fingerprint to calculate a unique identifier (such as a hash value).

[0065] In S204, it is determined whether the unique access identifier exists in the server.

[0066] In S206, the access count corresponding to this unique access identifier is incremented by 1. The access count is recorded based on an identifier generated from the IP address and browser fingerprint.

[0067] In S208, is the number of accesses greater than the first threshold?

[0068] More specifically, the number of accesses can be extracted based on the identifier within a time window. A threshold for the number of access requests is then set to determine whether an access is flagged as abnormal; for example, an identifier exceeding 100 requests within one minute would be flagged as abnormal.

[0069] In S210, protective actions are performed.

[0070] In S212, the total number of requests for browser fingerprints is calculated.

[0071] More specifically, it can count the frequency of requests. Within a time window, based on the browser fingerprint, it can calculate the total number of accesses for a particular browser. For example, if a browser makes more than 100 requests within one minute, it is marked as abnormal.

[0072] In S214, is the total number of requests greater than the second threshold?

[0073] In S216, update the number of request attempts.

[0074] In S218, the request is granted.

[0075] If multiple different browser fingerprints exist under the same IP address, it may be a NAT sharing environment, and the restrictions should be relaxed appropriately.

[0076] If the same browser fingerprint corresponds to multiple IP addresses, it may be due to proxy or VPN access, thus increasing the detection efforts.

[0077] When the access frequency of a certain IP address and browser fingerprint combination exceeds the normal range, an alarm is triggered or protective measures (such as CAPTCHA, human verification, or blocking policies) are taken.

[0078] For users who make frequent requests in a short period of time but have normal behavior patterns, use CAPTCHA instead of direct blocking.

[0079] In S220, the identifier, fingerprint, IP address, and initial access count are saved. The server stores the generated identifier, the source IP address, the browser fingerprint, and the number of accesses.

[0080] Alternatively, a time window (such as 1 minute) can be set, and expired identifiers will be deleted by the server. More specifically, the statistical data construction process in this application is as follows: Within a statistical period, the server stores information such as the access IP, browser fingerprint, and number of accesses based on the generated unique identifier for each access request, and sets an identifier timeout period. Identifiers that exceed the statistical period will be cleared.

[0081] When a client (browser) accesses a page, the server receives the message, parses the browser fingerprint (FINGERPRINT_A) and IP address (192.168.1.1), and constructs a unique identifier for this access. 192.168.1.1_FINGERPRINT_A, and query this unique identifier in the server.

[0082] If the server does not store this unique identifier, then it considers this access to be the first access by a certain client and its IP, saves this identifier, its accessing IP and client fingerprint information, and sets the access count to 1.

[0083] If the server stores this unique identifier, then retrieve the value corresponding to this identifier, increment its access count by one, and compare the access count with the preset access threshold.

[0084] (1) If the access threshold is greater than the preset threshold, then the server will need to perform the preset protection actions for this browser and IP.

[0085] (2) If the number of accesses is not greater than the preset access threshold, then continue to calculate a total number of browser requests based on the browser fingerprint (FINGERPRINT_A), and compare it with the access threshold. If it is still not greater than the preset access threshold, then store the number of accesses calculated this time in the corresponding unique request identifier and allow the access request.

[0086] If the access threshold is exceeded, the preset protection action will be executed.

[0087] A specific application example could be an anomaly detection in a NAT environment.

[0088] Suppose multiple employees on a company's local area network share a single public IP address (192.168.1.100). Traditional IP-based statistical methods might mistakenly count all user access requests as a single user's requests, misclassifying them as high-frequency users. However, the method described in this application can detect multiple different browser fingerprints originating from that IP address. like Figure 3 As shown, assuming the access threshold is set to 100 within a statistical period, using the traditional IP statistics method, the total number of accesses by all users would be 105, exceeding the threshold. If the IP address (192.168.1.100) is blocked, then three users would be mistakenly identified as high-frequency users. However, in reality, no user exceeded the access threshold. But by using the method of this application to count the three users separately, then no misjudgment will occur.

[0089] If the access frequency of a certain fingerprint is abnormally high within a statistical period, such as the access volume of FINGERPRINT_2 surging to 1000 times in a short period of time, it can be determined that the user may have abnormal behavior, and further protective measures can be taken for this user, so as not to affect other users.

[0090] A specific application example could be: proxy IP switching attack detection.

[0091] Suppose an attacker uses a proxy server for frequent access, changing the IP address with each request while maintaining a consistent browser environment (FINGERPRINT_A). Because the attacker frequently updates the proxy IP, traditional IP-based statistical methods will not detect each IP address exceeding a set threshold, and the server will not provide protection. However, the method described in this application can detect multiple IP addresses from different browser fingerprints, such as: like Figure 4 As shown, assuming the access threshold is set to 100 within a statistical period, using the traditional IP statistics method, the user's access count by IP would be 30, 35, and 40, none of which exceed the threshold. However, the user's total request count is actually 105. The user passed the detection by changing the proxy IP, but by using the browser fingerprinting method of this application, the total request count is calculated to be 105, which is greater than the access threshold of 100, and can still be blocked.

[0092] In summary, this application employs multi-dimensional statistics using IP and browser fingerprints: by comprehensively analyzing the IP address and browser fingerprint information of the access request, the source of access is determined, which improves the accuracy of detection compared to traditional IP-based methods.

[0093] This application can solve the IP sharing problem in NAT scenarios: by adding a browser fingerprint recognition dimension, even if multiple users share the same IP, browser fingerprints can distinguish different users, reducing the false positive rate. This application can identify proxies, VPNs, and malicious requests: by tracking browser fingerprints to count accesses, attackers using proxies or VPNs to change their IP addresses can be detected, thereby strengthening protection strategies.

[0094] Those skilled in the art will understand that all or part of the steps of the above embodiments are implemented as a computer program executed by a CPU. When the computer program is executed by the CPU, it performs the functions defined by the method provided in this application. The program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk.

[0095] Furthermore, it should be noted that the above figures are merely illustrative representations of the processes included in the method according to exemplary embodiments of this application, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0096] The following are embodiments of the apparatus of this application, which can be used to execute the embodiments of the method of this application. For details not disclosed in the embodiments of the apparatus of this application, please refer to the embodiments of the method of this application.

[0097] Figure 5 This is a block diagram illustrating a high-frequency access detection device according to an exemplary embodiment. Figure 5 As shown, the high-frequency access detection device 50 includes: an information module 502, an identification module 504, a statistics module 506, a comparison module 508, and a judgment module 510. The high-frequency access detection device 50 may also include: a protection module 512 and a release module 514.

[0098] The information module 502 is used to obtain the source IP address and browser fingerprint information from the access request; the information module 502 is also used to receive the access request from the client; and obtain the source IP address and browser fingerprint information from the access request.

[0099] The identification module 504 is used to generate a unique access identifier corresponding to the access request based on the source IP address and the browser fingerprint information; the identification module 504 is also used to concatenate the source IP address and the browser fingerprint information; and perform a hash operation on the concatenation result to generate the unique access identifier.

[0100] The statistics module 506 is used to count the access frequency of the access request based on the unique access identifier within a preset time window; the statistics module 506 is also used to count the access requests according to the unique access identifier within the preset time window to obtain a first access frequency; the statistics module 506 is also used to aggregate and count access requests with the same browser fingerprint information but corresponding to different source IP addresses within the preset time window to obtain a second access frequency.

[0101] The comparison module 508 is used to compare the access frequency with a preset access threshold; the comparison module 508 is also used to compare the first access frequency with a preset first access threshold; the comparison module 508 is also used to compare the second access frequency with a preset second access threshold.

[0102] The determination module 510 is used to determine that the access request is a high-frequency access request when the access frequency exceeds the access threshold.

[0103] The protection module 512 is used to execute corresponding access control or protection policies on access requests determined to be high-frequency access requests. The protection module 512 is also used to execute CAPTCHA policies; the protection module 512 is also used to execute human-machine verification policies; and the protection module 512 is also used to execute blocking policies.

[0104] The release module 514 is used to determine that the access request is a normal access request when the access frequency does not exceed the access threshold; to release the access request and update the access count corresponding to the access request.

[0105] The high-frequency access detection device according to this application obtains the source IP address and browser fingerprint information from the access request; generates a unique access identifier corresponding to the access request based on the source IP address and the browser fingerprint information; counts the access frequency of the access request based on the unique access identifier within a preset time window; compares the access frequency with a preset access threshold; and determines the access request as a high-frequency access request when the access frequency exceeds the access threshold. This method can achieve more accurate high-frequency access detection and protection, effectively address NAT environment misjudgment issues, and improve the ability to identify proxy switching attacks, thereby enhancing system security.

[0106] Figure 6 This is a block diagram illustrating an electronic device according to an exemplary embodiment.

[0107] The following reference Figure 6 To describe an electronic device 600 according to this embodiment of the present application. Figure 6 The electronic device 600 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0108] like Figure 6 As shown, the electronic device 600 is presented in the form of a general-purpose computing device. The components of the electronic device 600 may include, but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different system components (including storage unit 620 and processing unit 610), a display unit 640, etc.

[0109] The storage unit stores program code that can be executed by the processing unit 610, causing the processing unit 610 to perform the steps described in this specification according to various exemplary embodiments of this application. For example, the processing unit 610 can perform actions such as... Figure 1 , Figure 2 The steps are shown in the figure.

[0110] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache storage unit 6202, and may further include a read-only memory unit (ROM) 6203.

[0111] The storage unit 620 may also include a program / utility 6204 having a set (at least one) program module 6205, such program module 6205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0112] Bus 630 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0113] Electronic device 600 can also communicate with one or more external devices 600' (e.g., keyboard, pointing device, Bluetooth device, etc.), enabling users to communicate with devices that interact with electronic device 600, and / or any device that allows electronic device 600 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 650. Furthermore, electronic device 600 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 660. Network adapter 660 can communicate with other modules of electronic device 600 via bus 630. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0114] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software, or by combining software with necessary hardware. Therefore, as... Figure 7 As shown, the technical solution according to the embodiments of this application can be embodied in the form of a software product. The software product can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, mobile hard drive, etc.) or on a network, and includes several instructions to cause a computing device (such as a personal computer, server, or network device, etc.) to execute the above-described method according to the embodiments of this application.

[0115] Overall, this disclosure expands the statistical dimension from a single IP address to two statistical dimensions: IP address and browser fingerprint, to more accurately distinguish different users and improve the accuracy of detection and protection capabilities. First, data collection is performed: (1) When the server receives an access request, it records the accessing IP address and browser fingerprint information; (2) Browser fingerprints (such as font, resolution, plugins, time zone, Canvas fingerprint, etc.) are collected on the client side via JavaScript and sent to the server. Second, unique identifier generation is performed: (1) A unique identifier (such as a hash value) is calculated by combining the IP address and browser fingerprint; (2) The server stores the generated identifier, the accessing source IP address, the browser fingerprint, and the number of accesses. Third, access frequency calculation is performed: A time window (such as 1 minute) is set, and expired identifiers are deleted by the server; the number of accesses is recorded based on the identifier generated by the IP address and browser fingerprint; the method for calculating the frequency of requests is as follows: within the time window, the number of accesses is extracted based on the identifier. Based on the set access request frequency threshold, determine whether to mark it as abnormal. For example, if a single identifier makes more than 100 requests within 1 minute, it is marked as abnormal. And the statistical request frequency calculation method 2; within the time window, calculate the total number of accesses of a certain browser based on the browser fingerprint. For example, if a certain browser makes more than 100 requests within 1 minute, it is marked as abnormal. Further, perform anomaly detection and dynamic adjustment: (1) If there are multiple different browser fingerprints under the same IP, it may be a NAT shared environment, and the restrictions should be relaxed appropriately; (2) If the same browser fingerprint corresponds to multiple IP addresses, it may be proxy or VPN access, and the detection efforts should be strengthened. Finally, perform policy execution: when the access frequency of a certain IP address and browser fingerprint combination exceeds the normal range, trigger an alarm or take protective measures (such as verification code, human verification or blocking policy); and for users with high frequency requests in a short period of time but normal behavior patterns, use verification code instead of direct blocking.

[0116] Statistical data construction process: 1. Within a statistical period, for each access request, the server stores information such as the accessing IP, browser fingerprint, and access count based on a generated unique identifier, and sets an identifier timeout. Identifiers exceeding the statistical period are cleared. 2. When a client (browser) accesses a page, the server receives the message, parses the browser fingerprint (FINGERPRINT_A) and IP address (192.168.1.1), constructs a unique identifier for this access (192.168.1.1_FINGERPRINT_A), and queries this unique identifier in the server. 3. If the server does not store this unique identifier, then this access is considered to be the first access by a certain client and its IP. The identifier, along with the accessing IP and client fingerprint information, is saved, and the access count is set to 1. 4. If the server stores this unique identifier, the value corresponding to this identifier is retrieved, the access count is incremented by one, and the access count is compared with a preset access threshold. Based on the comparison results, (1) if the number of requests exceeds the preset access threshold, the server will perform the preset protection actions for this browser and IP address; (2) if the number of requests does not exceed the preset access threshold, the server will continue to calculate a total number of requests based on the browser fingerprint (FINGERPRINT_A), and then compare it with the access threshold. If the number of requests still does not exceed the preset access threshold, the server will store the calculated number of requests in the corresponding unique request identifier and allow the current access request. If the number of requests exceeds the preset access threshold, the server will perform the preset protection actions.

[0117] The software product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0118] The computer-readable storage medium may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0119] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0120] The aforementioned computer-readable medium carries one or more programs. When the one or more programs are executed by a device, the computer-readable medium performs the following functions: obtaining the source IP address and browser fingerprint information from the access request; generating a unique access identifier corresponding to the access request based on the source IP address and the browser fingerprint information; calculating the access frequency of the access request based on the unique access identifier within a preset time window; comparing the access frequency with a preset access threshold; and determining that the access request is a high-frequency access request when the access frequency exceeds the access threshold.

[0121] Those skilled in the art will understand that the above modules can be distributed in the device as described in the embodiments, or they can be modified accordingly and located in one or more devices that are unique to this embodiment. The modules in the above embodiments can be combined into one module, or they can be further divided into multiple sub-modules.

[0122] Through the description of the above embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this application.

[0123] Exemplary embodiments of this application have been specifically shown and described above. It should be understood that this application is not limited to the detailed structures, arrangements, or implementation methods described herein; rather, this application is intended to cover various modifications and equivalent arrangements contained within the spirit and scope of the appended claims.

Claims

1. A high-frequency access detection method, characterized in that, include: Obtain the source IP address and browser fingerprint information from the access request; A unique access identifier corresponding to the access request is generated based on the source IP address and the browser fingerprint information; Within a preset time window, the access frequency of the access request is statistically analyzed based on the unique access identifier; Compare the access frequency with a preset access threshold; When the access frequency exceeds the access threshold, the access request is determined to be a high-frequency access request.

2. The method as described in claim 1, characterized in that, Also includes: For access requests that are determined to be high-frequency access requests, corresponding access control or protection policies are implemented.

3. The method as described in claim 1, characterized in that, The source IP address and browser fingerprint information are obtained from the access request, including: Receive access requests from clients; Obtain the source IP address and browser fingerprint information from the access request.

4. The method as described in claim 1, characterized in that, Generate a unique access identifier corresponding to the access request based on the source IP address and the browser fingerprint information, including: The source IP address and the browser fingerprint information are concatenated; A hash operation is performed on the concatenated result to generate the unique access identifier.

5. The method as described in claim 1, characterized in that, The access frequency includes a first access frequency and / or a second access frequency. Within a preset time window, the access frequency of the access request is statistically analyzed based on the unique access identifier, including: Within a preset time window, access requests are counted based on the unique access identifier to obtain a first access frequency; and / or Within a preset time window, access requests with the same browser fingerprint information but corresponding to different source IP addresses are aggregated and counted to obtain a second access frequency.

6. The method as described in claim 5, characterized in that, The access threshold includes a first access threshold and / or a second access threshold. Comparing the access frequency with a preset access threshold includes: Compare the first access frequency with a preset first access threshold; and / or The second access frequency is compared with the preset second access threshold.

7. The method as described in claim 1, characterized in that, Also includes: When the access frequency does not exceed the access threshold, the access request is determined to be a normal access request; Allow the access request and update the access count corresponding to the access request.

8. The method as described in claim 2, characterized in that, Implement appropriate access control or protection policies, including: Execute CAPTCHA policies; and / or Implement human-machine verification policies; and / or Implement the blocking policy.

9. The method as described in claim 8, characterized in that, Enforcing CAPTCHA policies includes: For access requests that are frequent but exhibit normal behavior patterns within a short period of time, a CAPTCHA verification strategy should be implemented.

10. A high-frequency access detection device, characterized in that, include: The information module is used to obtain the source IP address and browser fingerprint information from the access request; The identification module is used to generate a unique access identifier corresponding to the access request based on the source IP address and the browser fingerprint information; The statistics module is used to count the access frequency of the access request based on the unique access identifier within a preset time window; The comparison module is used to compare the access frequency with a preset access threshold; The determination module is used to determine that the access request is a high-frequency access request when the access frequency exceeds the access threshold.

Images