Abnormal access protection method, system, device, equipment, medium and product

Abstract

The invention relates to the technical field of network security, and provides an abnormal access protection method, system, device and equipment, a medium and a product.The abnormal access protection method comprises the steps that an access log uploaded by an edge node is acquired, the access log is acquired after the edge node verifies an access request for a target service resource initiated by the client; an access feature vector is constructed by extracting various types of access attributes in an access log, and an abnormal access mode is identified based on the access feature vector, so that a target abnormal access object is determined; and finally, generating a target protection strategy for the target abnormal access object, and indicating the edge node to execute the target protection strategy. According to the invention, the recognition accuracy and protection efficiency of complex abnormal access behaviors can be effectively improved.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, specifically to methods, systems, devices, equipment, media, and products for protecting against abnormal access. Background Technology

[0002] With the development of internet services, malicious access and attack methods targeting business resources are becoming increasingly complex. Existing protection technologies typically rely on single methods, such as IP address-based access frequency limiting (rate limiting) or static blacklist mechanisms. However, this passive defense approach has significant drawbacks: on the one hand, it cannot effectively distinguish between requests initiated by automated scripts and legitimate requests from real users, easily leading to false positives or false negatives; on the other hand, faced with low-frequency, distributed, and complex attack patterns, existing protection mechanisms struggle to accurately define the boundary between attack traffic and normal business traffic, resulting in ineffective protection and significant consumption of business resources.

[0003] Therefore, there is an urgent need for a method to protect against abnormal access in order to solve the problems of low accuracy in identifying abnormal access and poor protection effectiveness in related technologies. Summary of the Invention

[0004] This disclosure provides a method, system, device, equipment, medium, and product for protecting against abnormal access, in order to solve the problems of low accuracy in identifying abnormal access and poor protection effectiveness in related technologies.

[0005] Firstly, this disclosure provides a method for protecting against abnormal access, the method comprising: Obtain access logs uploaded by edge nodes; access logs are collected by edge nodes after they have verified the access request initiated by the client for the target business resource. Extract various types of access attributes from access logs to construct access feature vectors, and identify abnormal access patterns based on access feature vectors to determine the target abnormal access object; Generate a target protection policy for the target abnormal access object, and instruct the edge nodes to execute the target protection policy.

[0006] In one alternative implementation, prior to the step of obtaining the access logs uploaded by the edge node, the method further includes: Generate a verification interaction strategy and distribute it to the edge nodes; the verification interaction strategy is used to instruct the edge nodes to send a verification script to the client when they receive an access request from the client for the target business resource; the verification script is used to instruct the client to execute a preset computing task; If the verification information returned by the client based on the verification script meets the preset legality conditions, then the access request initiated by the client for the target business resource is deemed to have passed verification.

[0007] In one optional implementation, the verification information includes: a timestamp generated by the client executing a preset computing task, a one-time token, browser fingerprint information, and a digital signature; The preset legality conditions include: the digital signature's consistency verification is passed, the one-time token has not been reused and the timestamp is within the preset valid time window, and the browser fingerprint information conforms to the preset real browser environment characteristics.

[0008] In one alternative implementation, multiple types of access attributes include: the client's IP address, the Uniform Resource Locator (URL) of the accessed resource, the user agent, and the source page information; Construct the access feature vector, including: The client's IP address, the Uniform Resource Locator (URL) of the accessed resource, the user agent, and the source page information extracted from the access logs are standardized to construct an access feature vector.

[0009] In one optional implementation, identifying abnormal access patterns based on access feature vectors includes: A density-based clustering algorithm is used to perform cluster analysis on the access feature vectors; If an access cluster that meets the preset clustering conditions is identified, it is determined to be an abnormal access pattern; The preset aggregation conditions include: the client's IP address comes from a centralized IP address range, the single access resource uses a Uniform Resource Locator (URL), the user agent has non-business characteristics, and the source page information is empty.

[0010] In one alternative implementation, prior to the step of obtaining the access logs uploaded by the edge node, the method further includes: The network bandwidth data is divided into multiple monitoring grids based on a combination of geographical regions and network operators. The bandwidth data for each monitoring grid is calculated separately. When the bandwidth data of any monitoring grid meets the preset bandwidth surge condition, the access log acquisition operation for that monitoring grid during the surge period is triggered.

[0011] In one optional implementation, detecting that the bandwidth data of any monitored grid meets a preset bandwidth surge condition includes: The calculation includes the first growth rate of the bandwidth value at the current time relative to the bandwidth value before the first preset time interval, and the second growth rate of the bandwidth value at the current time relative to the bandwidth value before the second preset time interval. If the first growth rate exceeds the first growth threshold, or the second growth rate exceeds the second growth threshold, then the bandwidth surge condition is determined to be met. The first preset time interval is less than the second preset time interval.

[0012] In one optional implementation, a target protection policy is generated for the target abnormal access object, including: Statistically determine the concentration of traffic distribution within a preset time window; If a preset proportion of traffic is concentrated on a first proportion of IP addresses, a protection strategy is generated that instructs edge nodes to implement rate limiting on IP addresses whose traffic exceeds a preset multiple of the average. If a preset proportion of traffic is concentrated on the second proportion of IP network segments, a protection policy is generated that instructs edge nodes to implement rate limiting on IP network segments whose traffic exceeds a preset multiple of the average.

[0013] In one alternative implementation, the method further includes: Generate a version control policy and distribute it to the edge nodes; the version control policy is used to instruct the edge nodes to perform version control. Version control includes: Extract the client version number identifier from the access request targeting the business resource; The client version number identifier is matched with a list of preset version policies to determine the version category to which the client version number identifier belongs; If the client version number indicates that it belongs to a preset old version or an expired version, then the access request will be blocked or the access request will be rate-limited. If the client version number belongs to the preset online version, the access request will be verified.

[0014] Secondly, this disclosure provides a protection system for abnormal access, the system including an edge node and a server that communicates with the edge node; Edge nodes are used to receive access requests from clients for target business resources, send verification scripts to clients, receive and verify the verification information returned by clients, allow access requests after verification, and collect access logs during the client's access process. The server is used to execute the abnormal access protection method of the first aspect or any of its corresponding embodiments, to determine the target abnormal access object based on the access logs uploaded by the edge node, and to generate a target protection policy for the target abnormal access object. Edge nodes are also used to receive and execute target protection policies to intercept or rate-limit abnormal access to target objects.

[0015] Thirdly, this disclosure provides a protection device against abnormal access, the device comprising: The acquisition module is used to acquire access logs uploaded by edge nodes; access logs are collected by edge nodes after they have verified the access request initiated by the client for the target business resource. The determination module is used to extract various types of access attributes from the access logs to construct access feature vectors, and to identify abnormal access patterns based on the access feature vectors in order to determine the target abnormal access object. The generation module is used to generate target protection policies for target abnormal access objects, so as to instruct edge nodes to execute the target protection policies.

[0016] Fourthly, this disclosure provides an electronic device, including: a memory and a processor, which are communicatively connected to each other. The memory stores computer instructions, and the processor executes the computer instructions to perform the abnormal access protection method of the first aspect or any corresponding embodiment described above.

[0017] Fifthly, this disclosure provides a computer-readable storage medium storing computer instructions for causing a computer to execute the abnormal access protection method of the first aspect or any corresponding embodiment described above.

[0018] In a sixth aspect, this disclosure provides a computer program product, including computer instructions for causing a computer to execute the abnormal access protection method described in the first aspect or any corresponding embodiment.

[0019] The abnormal access protection method provided in this disclosure firstly eliminates interference from invalid data by acquiring access logs collected by edge nodes after the access request is verified, ensuring the high value and relevance of the analysis data. Secondly, by extracting multiple types of access attributes to construct access feature vectors and identifying abnormal access patterns, compared to traditional detection based on a single rule, it can discover hidden abnormal behaviors with specific patterns from the perspective of multi-dimensional feature combinations, thereby accurately identifying the target abnormal access object and significantly improving the identification accuracy. Finally, by generating a target protection strategy for the object and instructing the edge nodes to execute it, the analysis results are automatically converted into protection actions, enabling timely interception or control of abnormal objects at the network edge, thereby effectively improving the protection effect and security. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the specific embodiments of this disclosure or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram illustrating an application scenario according to an embodiment of this disclosure; Figure 2 This is a schematic flowchart of a first method for protecting against abnormal access according to an embodiment of the present disclosure; Figure 3 This is a schematic diagram of a second method for protecting against abnormal access according to an embodiment of the present disclosure; Figure 4 This is a schematic diagram of the JS challenge interaction process of CDN edge nodes according to an embodiment of this disclosure; Figure 5 This is a schematic diagram of the overall data processing flow of the abnormal access protection system according to an embodiment of the present disclosure; Figure 6 This is a structural block diagram of a protection device against abnormal access according to an embodiment of the present disclosure; Figure 7 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of this disclosure. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0023] It should be noted that the information (including but not limited to user input information, such as information entered into input boxes), data (including but not limited to data used for analysis, stored data, and displayed data, such as context code, all code of the current project, service pressure corresponding to operations performed on all code of the current project, and code development status of the current project), and signals involved in this disclosure are all authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with relevant laws, regulations, and standards. For example, the context code, operations performed on all code of the current project, the corresponding service pressure, and code development status involved in this disclosure were all obtained with full authorization.

[0024] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this disclosure, "a plurality of" means two or more, unless otherwise expressly specified.

[0025] Before providing a detailed description of the embodiments of this disclosure, some of the nouns and terms involved in the embodiments of this disclosure will be explained.

[0026] (1) CDN (Content Delivery Network): A smart virtual network built on the existing Internet. By deploying edge servers in various locations, it enables users to obtain the content they need from the nearest location, solves network congestion, and improves response speed.

[0027] (2) Edge Node: The server node closest to the user in the CDN network, responsible for directly handling the user's HTTP / HTTPS requests, caching content, executing edge security policies (such as JS verification), and collecting access logs.

[0028] (3) JS Challenge: A network security technology that requires the client to execute specific JavaScript code to verify whether the visitor is a real user (usually with a full JS engine) or an automated program (usually without or with only limited JS execution capabilities).

[0029] (4) DBSCAN (Density-Based Spatial Clustering of Applications with Noise): A density-based spatial clustering algorithm. It can discover clusters of arbitrary shapes and effectively identify noise points (outliers) that do not belong to any cluster.

[0030] (5) User-Agent (UA): Part of the HTTP request header, which contains environmental characteristics such as the client's operating system, browser version, and CPU type. It is often used to identify the client's identity.

[0031] (6) Referer: An HTTP request header field that records which page the current request was redirected from, used to analyze the user's access path logic.

[0032] (7) IP (Internet Protocol): Internet Protocol address, a unique address identifier used to identify devices in a network, and is the basis of network communication.

[0033] (8) URL (Uniform Resource Locator): A string used to identify the location of a resource on the Internet, containing information such as protocol, domain name, and path.

[0034] (9) Rate Limiting: Using technical means to limit the access frequency or traffic volume of a specific user or IP address within a unit of time to prevent resource exhaustion.

[0035] (10) Version lifecycle: refers to the entire process of software version from release, maintenance to obsolescence, including different stages such as current version, historical version and expired version.

[0036] As one optional application scenario of this disclosure embodiment, such as Figure 1 As shown, this method for preventing abnormal access can be implemented in systems that include at least one client and at least one server. Figure 1 The example shows that the system includes a first client 101, a second client 102, and a server 103, and the first client 101 and the second client 102 are connected to the server 103 through network 110.

[0037] The client can be a terminal device capable of initiating network requests, such as a smartphone, tablet, laptop, or desktop computer. The server 103 can include edge nodes responsible for business access and initial verification, and a central server or cloud processing system responsible for log analysis and policy generation. Edge nodes can be edge servers in a Content Delivery Network (CDN), and the central server can be a standalone physical server, a server cluster, or a distributed system. The network 110 can be a wired or wireless network, including but not limited to the Internet, corporate intranets, local area networks (LANs), wide area networks (WANs), mobile communication networks, and combinations thereof. In this scenario, the edge nodes verify the client's requests and collect logs, while the analysis portion of the server 103, based on the log generation policy, feeds back to the edge nodes for execution.

[0038] In related technologies, protection against abnormal network access typically relies on static rule matching or simple frequency limits, lacking mechanisms for in-depth behavioral analysis of traffic that has passed initial verification. This leads to technical problems such as delayed identification, high false positive rates, and inability to accurately pinpoint the attacker when facing highly disguised abnormal access attacks that exploit legitimate identities. This disclosure provides a method for protecting against abnormal access. This method acquires access logs generated by edge nodes after initial verification of requests, uses extracted multi-dimensional attributes to construct feature vectors to identify deep-seated abnormal access patterns, and generates protection policies for specific targets, which are then distributed to the edge nodes for execution. This achieves the technical effect of accurately separating abnormal traffic from legitimate traffic and providing dynamic and targeted security protection.

[0039] According to an embodiment of this disclosure, an embodiment of a method for protecting against abnormal access is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0040] This embodiment provides a method for protecting against abnormal access, which can be used in the aforementioned server. Figure 2 This is a flowchart of a method for protecting against abnormal access according to an embodiment of this disclosure, such as... Figure 2 As shown, the process includes the following steps: Step S201: Obtain the access log uploaded by the edge node; the access log is collected by the edge node after the client's access request for the target business resource has been verified.

[0041] Edge nodes refer to computing devices or servers deployed at the edge of the network, physically close to users, to handle user access requests. Examples include edge caching servers or distributed gateway nodes in a content delivery network (CDN).

[0042] Access logs are files that record detailed information about client requests for resources. Examples include log entries containing fields such as timestamps, source IP addresses, requested URL paths, and request methods.

[0043] Verification refers to the initial checks performed on the legitimacy of a request. For example, it may involve checking whether the request carries a valid identity token, whether the signature is correct, or whether it conforms to basic protocol format requirements.

[0044] Uploading refers to the action of aggregating data from various locations to a processing center. For example, edge nodes send locally generated log files to the central analysis server via network transmission protocols (such as FTP or HTTP streaming).

[0045] Data collection refers to the act of recording data under specific conditions. For example, when a request passes the signature verification of an edge node (i.e., verification is successful), logging is triggered, and detailed information about the request is written to the log file; if verification fails, the data may be discarded or recorded as an error log.

[0046] This step forms the data foundation of the protection process. In practical applications, a large number of network requests first reach the edge nodes. The edge nodes first verify the legitimacy of client requests targeting business resources (such as web pages, video files, and API interfaces). Only when a request passes this layer of verification (e.g., the authentication field in the request header is successfully validated), proving the request is formally legitimate, will the edge node respond and collect the corresponding access logs. Subsequently, the edge nodes upload these access logs to the server for data processing or analysis. This ensures that the data source for subsequent analysis excludes obvious invalid and spam traffic, focusing on more deceptive and potentially anomalous access.

[0047] Step S202: Extract various types of access attributes from the access log to construct an access feature vector, and identify abnormal access patterns based on the access feature vector to determine the target abnormal access object.

[0048] Access attributes refer to specific dimensional information parsed from logs that reflects the characteristics of access behavior. Examples include the client's IP address, user-agent string, requested resource path, request time interval, and referrer page.

[0049] Access feature vector refers to the mathematical vector representation formed by combining multiple extracted access attributes after numerical or standardized processing.

[0050] Abnormal access patterns refer to data patterns that deviate from the natural access patterns of normal users and have the potential for attack or abuse. Examples include frequent and repeated requests for the same non-popular resource within a short period of time, or various regular traversal behaviors that exhibit machine script characteristics.

[0051] The target of abnormal access refers to the specific entity identifier that is determined to have initiated abnormal access. For example, a specific IP address, a specific user account (User ID), or a specific device fingerprint.

[0052] Extraction refers to the process of parsing and retrieving the values ​​of specific fields from raw log text. For example, using regular expressions to extract the content of the User-Agent field from a log string.

[0053] Construction refers to the process of combining scattered attributes and converting them into a processable format. For example, the extracted IP address and access time are converted into a numerical feature, "the number of times this IP has been accessed in the past minute," using a statistical algorithm, and then placed into a vector.

[0054] Identification refers to the action of determining whether the current feature meets the definition of an anomaly through comparison or calculation. For example, calculating the distance between the currently accessed feature vector and a preset normal baseline vector; if the distance exceeds a threshold, it is identified as an anomaly.

[0055] "Identification" refers to the action of ultimately pinpointing a specific target. For example, after identifying an abnormal set of access behaviors, the source IP address associated with that behavior is marked as a target object that needs to be processed.

[0056] This step is the core analysis phase. After receiving the logs, the server first parses them, extracting various access attributes such as IP address, request frequency, and request path distribution. To facilitate subsequent processing, these attributes are used to construct a multi-dimensional access feature vector. Next, this vector is analyzed (e.g., using clustering algorithms or threshold matching) to identify any abnormal access patterns. For example, if a vector shows that a client has passed initial verification but accesses the platform with extremely high frequency and only accesses specific interfaces, this does not conform to the behavior patterns of normal human users. Once this pattern is identified, the client initiating these requests can be accurately identified (i.e., the target abnormal access object), thus separating it from a large pool of legitimate users.

[0057] Step S203: Generate a target protection policy for the target abnormal access object to instruct the edge node to execute the target protection policy.

[0058] Targeted protection policies refer to restrictions or blocking rules specifically designed for locked abnormal objects. For example, the policy content could be "add IP address 192.168.xx to the blacklist and block it for 1 hour" or "limit the request rate of user ID 12345 to 1 per second".

[0059] Generation refers to the process of dynamically creating corresponding handling rules based on the type and severity of the anomaly. For example, generating an immediate blocking policy for high-frequency web crawlers, and generating a secondary verification policy using CAPTCHAs for suspected anomalies.

[0060] An instruction refers to the action of distributing or synchronizing the generated policy information to the execution end. For example, the central server sends a control command to all associated edge nodes by configuring a synchronization interface.

[0061] Execution refers to the actions taken by edge nodes to intervene in actual traffic based on received instructions. For example, after receiving a blocking instruction, an edge node updates its local access control list, and when the target abnormal access object makes another request, the service is directly denied.

[0062] Once a target of abnormal access is identified, a matching protection policy is immediately generated. This policy is not general but specific to that target (e.g., targeting only a particular malicious IP address). Subsequently, the edge nodes at the forefront of the network are instructed to respond to this policy. Upon receiving the instruction, the edge nodes immediately execute corresponding blocking or rate limiting operations. In this way, although anomaly detection is performed on the server side after log upload, the final protection action returns to the edge nodes, achieving rapid and accurate blocking of the target of abnormal access and preventing it from continuing to consume business resources.

[0063] In summary, the abnormal access protection method provided in this disclosure firstly, by acquiring access logs collected by edge nodes after the access request has been verified, interference from invalid data is effectively eliminated, ensuring the high value and relevance of the analysis data. Secondly, by extracting multiple types of access attributes to construct access feature vectors and identifying abnormal access patterns, compared to traditional detection based on a single rule, it can discover hidden abnormal behaviors with specific patterns from the perspective of multi-dimensional feature combinations, thereby accurately identifying the target abnormal access object and significantly improving the identification accuracy. Finally, by generating a target protection strategy for the object and instructing edge nodes to execute it, the analysis results are automatically converted into protection actions, enabling timely interception or control of abnormal objects at the network edge, thereby effectively improving the protection effect and security.

[0064] This embodiment provides a method for protecting against abnormal access, which can be used in the aforementioned server. Figure 3 This is a flowchart of a method for protecting against abnormal access according to an embodiment of this disclosure, such as... Figure 3 As shown, the process includes the following steps: Step S301: Obtain the access log uploaded by the edge node; the access log is collected by the edge node after the client's access request for the target business resource has been verified.

[0065] Before this step is executed, in order to ensure the timeliness and necessity of obtaining logs and to avoid resource waste caused by massive log transmission, a trigger mechanism based on network-wide monitoring is first executed.

[0066] Specifically, the network bandwidth data is divided into multiple monitoring grids based on a combination of geographical regions (e.g., region A, region B) and network operators (e.g., operator a, operator b). For example, region A-operator a and region B-operator b can each be considered an independent monitoring grid. Then, the bandwidth data for each monitoring grid is calculated separately. Access log retrieval for that monitoring grid during the surge period is only triggered when the bandwidth data of any monitoring grid meets a preset bandwidth surge condition. The advantage of this mechanism is that it enables precise location of distributed attacks, retrieves logs only from the source when an anomaly occurs, and significantly reduces data transmission and storage costs.

[0067] The determination of bandwidth surge conditions involves a dual-dimensional detection process. Specifically, it calculates the first growth rate (month-on-month growth) of the bandwidth value at the current moment relative to the bandwidth value at a first preset time interval (e.g., 5 minutes ago), and the second growth rate (year-on-year growth) of the bandwidth value at the current moment relative to the bandwidth value at a second preset time interval (e.g., 24 hours ago, i.e., the same time yesterday). If the first growth rate exceeds a first growth threshold (e.g., 50%), or the second growth rate exceeds a second growth threshold (e.g., 100%), the bandwidth surge condition is deemed met. The first preset time interval must be less than the second preset time interval. The beneficial effect of this dual-verification mechanism is that it can both capture instantaneous burst attacks and identify abnormal traffic deviating from the normal business baseline, effectively reducing false alarms caused by normal business fluctuations.

[0068] Furthermore, to filter out obvious automated script attacks before log collection, a proactive verification process is executed pre-emptively. Before log acquisition, a verification interaction policy is generated and distributed to edge nodes. This policy instructs edge nodes to send a verification script (such as a piece of JavaScript code) to the client when they receive an access request from a client for a target business resource (e.g., a user clicking to play music). This verification script instructs the client to perform a pre-defined computational task (e.g., mathematical operations or environmental checks). If the client's verification information based on the verification script meets the pre-defined legality conditions, the client's access request for the target business resource is deemed successful, and subsequent access logs are allowed. The advantage of this step is that it can filter out simple crawlers or botnets that lack script execution capabilities through computational challenge at the initial stage of connection establishment.

[0069] Furthermore, the aforementioned verification information and legitimacy conditions include strict security checks. The verification information specifically includes: a timestamp generated by the client executing a preset computation task, a one-time token, browser fingerprint information (such as Canvas fingerprint, User-Agent characteristics), and a digital signature. The preset legitimacy conditions require that: the digital signature's consistency check must pass (to prevent tampering), the one-time token must not have been reused and the timestamp must be within a preset valid time window (to prevent replay attacks), and the browser fingerprint information must conform to preset real browser environment characteristics (to prevent environment forgery). This ensures that only genuine user requests with a valid browser environment can pass verification and be logged.

[0070] Meanwhile, to further narrow the attack surface, version-level pre-control is introduced. Version control policies are generated and distributed to edge nodes, instructing them to perform version control. Specifically, the client version number identifier is extracted from access requests targeting business resources (e.g., version number 9.0.1 extracted from the URL filename); the client version number identifier is matched against a pre-defined list of version policies to determine its version category. If the identifier belongs to a pre-defined old version or an expired version (a version known to have vulnerabilities), the access request is directly blocked or rate-limited; if it belongs to a pre-defined online version, the access request undergoes the aforementioned verification process. The beneficial effect of this strategy is that it can forcibly eliminate insecure old version clients, preventing attackers from exploiting vulnerabilities in older protocols for fraudulent transactions.

[0071] Step S302: Extract various types of access attributes from the access log to construct an access feature vector, and identify abnormal access patterns based on the access feature vector to determine the target abnormal access object.

[0072] The specific construction process involves the standardization of key attributes. These various access attributes primarily include: the client's IP address, the Uniform Resource Locator (URL, i.e., the path to the accessed file), the User-Agent (a string identifying the client), and the referrer information. When constructing the access feature vector, these four attributes extracted from the access logs are standardized (e.g., the URL is hashed, and the User-Agent is categorized), thus creating a standardized access feature vector. The advantage of this multi-dimensional feature construction is that it is difficult for attackers to bypass through single-dimensional forgery (such as simply changing the IP address or spoofing the User-Agent).

[0073] The anomaly identification process based on feature vectors employs density-based clustering algorithms (such as DBSCAN) to perform cluster analysis on access feature vectors. Its core logic is that normal user access is typically discrete in the feature space, while attackers' automated scripts often exhibit high similarity and clustering. If an access cluster that meets preset clustering conditions is identified, it is determined to be an abnormal access pattern. These preset clustering conditions specifically include: client IP addresses originating from a concentrated IP address range (e.g., a large number of IPs belonging to the same internet data center), a single Uniform Resource Locator (URL) for a single accessed resource (a large number of requests concentrated on attacking a popular file), user agents exhibiting non-business characteristics (e.g., all showing the same uncommon browser), and empty source page information (missing Referer). The advantage of this algorithm is that it can automatically discover unknown and novel attack patterns without prior knowledge of the attack signature database.

[0074] Step S303: Generate a target protection policy for the target abnormal access object to instruct the edge node to execute the target protection policy.

[0075] The generated protection strategy is a fine-grained control based on traffic statistics, specifically including the following steps: Step S3031: Calculate the concentration of traffic distribution within the preset time window.

[0076] Traffic distribution concentration is judged by the Pareto principle or similar statistical laws, determining whether a very small number of IPs account for the vast majority of traffic.

[0077] Step S3032: If a preset proportion of traffic is concentrated on a first proportion of IP addresses, a protection strategy is generated that instructs edge nodes to implement rate limiting on IP addresses whose traffic exceeds a preset multiple of the average value.

[0078] The first ratio is, for example, 80% of the traffic is concentrated on 20% of the IPs (IP-level concentration).

[0079] This step involves rate limiting on a single IP. If a scattered IP attack is detected (traffic concentrated in 20% of the IPs), a rate limiting command will be issued to the individual IP whose traffic exceeds 20 times the average.

[0080] Step S3033: If a preset proportion of traffic is concentrated on the second proportion of IP network segments, a protection strategy is generated that instructs edge nodes to implement rate limiting on IP network segments whose traffic exceeds a preset multiple of the average value.

[0081] The second proportion is, for example, 80% of the traffic is concentrated on 1% of the IP network segments (network segment-level concentration).

[0082] This step involves network segment rate limiting. If it is found that the attacker has used the entire IP segment (traffic is highly concentrated in 1% of the network segment), then the IPs in the network segment that exceed the traffic limit will be subject to batch rate limiting.

[0083] This step in generating the protection strategy involves statistically analyzing the concentration of traffic distribution within a preset time window (e.g., analyzing traffic composition over the past 5 minutes). Based on the Pareto principle (80 / 20 rule) or similar statistical principles: if a preset percentage (e.g., 80%) of the traffic is concentrated on a first percentage (e.g., 20%) of IP addresses, these header IPs are identified as abnormal, and a protection strategy is generated instructing edge nodes to implement rate limiting on IP addresses whose traffic exceeds a preset multiple (e.g., 20 times) of the average. Similarly, if a preset percentage (e.g., 80%) of the traffic is concentrated on a second percentage (e.g., 1%) of IP network segments, a protection strategy is generated instructing edge nodes to implement rate limiting on IP network segments whose traffic exceeds a preset multiple of the average. The beneficial effect of this strategy is that it can accurately target the malicious sources contributing the vast majority of attack traffic, while maximizing the protection of potentially collateral damage to legitimate users, achieving a balance between ensuring business availability and curbing attack costs.

[0084] In summary, the abnormal access protection method provided in this disclosure firstly effectively filters out attacks exploiting vulnerabilities in older versions and automated scripts lacking a real browser environment through version control and proactive verification scripts at edge nodes, significantly reducing the backend load. Building upon this, a fine-grained monitoring system based on a spatiotemporal grid is introduced, enabling keen perception of localized abnormal traffic and on-demand log collection, solving the problem of high costs associated with full log analysis. Furthermore, for deep abnormal traffic that has passed edge verification, multi-dimensional feature vector construction and density-based clustering analysis are used to uncover hidden attacks and unknown abnormal patterns from multiple dimensions such as IP, application layer, and client fingerprints, overcoming the limitations of traditional rule-based protection. Finally, through an adaptive protection strategy based on traffic concentration, precise rate-limiting instructions can be automatically generated based on the clustering characteristics of attacks and fed back to edge nodes for execution. This significantly reduces bandwidth costs and the risk of misjudgment while ensuring business continuity.

[0085] This embodiment provides a protection system against abnormal access, which includes an edge node and a server that communicates with the edge node.

[0086] Edge nodes serve as the system's access points, receiving access requests from clients for target business resources.

[0087] Upon receiving a request, the edge node can extract the client version number identifier from the request and match it against a pre-defined version policy list. If the identifier belongs to a pre-defined old or expired version, the edge node directly intercepts the request or applies rate limiting; if it belongs to a pre-defined online version, further verification is performed.

[0088] Edge nodes send verification scripts to clients, instructing them to execute preset computation tasks.

[0089] Edge nodes receive verification information from clients based on verification scripts. This verification information includes a timestamp, a one-time token, browser fingerprint information, and a digital signature. The edge nodes verify this information. If it meets preset validity conditions (i.e., digital signature consistency verification passes, the one-time token has not been reused, the timestamp is within a preset valid time window, and the browser fingerprint information matches preset real browser environment characteristics), the verification is considered successful, and the access request is allowed.

[0090] After the verification is successful and the request is allowed, the edge node collects the access logs during the client's access process and uploads them to the server.

[0091] The server is used to implement protection methods against abnormal access based on the access logs uploaded by the edge nodes.

[0092] The server can divide the entire network bandwidth data into multiple monitoring grids based on a combination of geographical regions and network operators. When the calculation finds that the bandwidth data of any monitoring grid meets the preset bandwidth surge conditions (i.e., the first growth rate exceeds the first growth threshold or the second growth rate exceeds the second growth threshold), the log retrieval operation for that grid during the surge period is triggered.

[0093] The server retrieves access logs, extracts various access attributes including client IP address, accessed resource URL, user agent, and source page information, and performs standardization processing to construct an access feature vector. The server uses a density-based clustering algorithm to analyze the feature vector. If an access cluster that meets preset clustering conditions (such as concentrated IP addresses, single URL, non-business-specific user agent, and empty source page) is identified, it is determined to be an abnormal access pattern, and the corresponding object is identified as the target abnormal access object.

[0094] The server analyzes the concentration of traffic distribution within a preset time window. If a preset proportion of traffic is concentrated on the first proportion of IP addresses or the second proportion of IP network segments, and the traffic exceeds a preset multiple of the average value, the server generates a target protection policy (such as a rate limiting policy) for the target abnormal access object (IP address or IP network segment).

[0095] Edge nodes are also used to receive target protection policies generated by the server and execute the policies to intercept or rate-limit abnormal access to target objects, thereby protecting against abnormal access.

[0096] In summary, the abnormal access protection system provided in this embodiment achieves high processing efficiency, deep defense layers, and real-time response by constructing a collaborative architecture of edge node pre-verification and execution combined with server-side intelligent analysis. Specifically, edge nodes undertake the functions of high-concurrency traffic access and initial cleaning. Through localized verification script distribution and verification, low-level automated attacks lacking script execution capabilities can be directly filtered out at the network edge, greatly reducing the load on the core network. Simultaneously, as the final execution point of the policy, edge nodes ensure low latency for interception and rate-limiting actions. The server focuses on computationally intensive deep analysis tasks. By receiving log information after successful verification from edge nodes, it utilizes a network-wide clustering algorithm and traffic surge detection logic to uncover distributed and highly concealed abnormal access. This architecture leverages the distributed processing capabilities of edge nodes to ensure user experience while utilizing the computing power advantage of the server to ensure identification accuracy, effectively resolving the contradiction between insufficient single-point defense capabilities and high latency in centralized full-scale analysis.

[0097] To better illustrate the above-described protection system against abnormal access, a preferred embodiment will be provided below. This embodiment is intended to detail the implementation process of this disclosure, but is not intended to limit the scope of protection of this disclosure.

[0098] This embodiment provides a protection system against abnormal access, which mainly consists of two parts: edge nodes deployed on the network side and a server. In this embodiment, the edge nodes are exemplified by CDN (Content Delivery Network) edge nodes distributed at the edge of the Internet and closest to the user; the server is exemplified by a data analysis and decision-making center deployed in the cloud, which includes components such as Kafka message queues, stream computing clusters, and offline computing clusters. This system achieves accurate identification and interception of malicious traffic through the collaborative work of proactive verification on the edge side and big data analysis on the center side.

[0099] Edge nodes, as the first line of defense, are responsible for handling access requests initiated by clients (such as music apps, browsers, etc.) for target business resources (such as high-quality music files).

[0100] Edge nodes first execute the version control policy, as follows: Extract the client version number from the request URL initiated by the client (e.g., / NeteaseCloudMusic_9.4.28.apk). Based on the policy list issued by the server, if it is identified as an online version, allow it to proceed to the next step; if it is a nearby version, limit its access rate; if it is an older version with known vulnerabilities or an expired version, block it directly.

[0101] Figure 4This diagram illustrates the JavaScript challenge interaction process at a CDN edge node. For requests that pass the version check, the edge node does not immediately return business data (status code 200), but instead... Figure 4 The process shown involves sending a verification script (JS code) containing a pre-defined calculation task to the client. This script requires the client to perform mathematical operations or extract browser fingerprints such as Canvas. The specific process is as follows: The business client initiates a resource request to the CDN edge node.

[0102] When a CDN edge node identifies a new request, it does not return data directly, but instead returns a 200 page containing JavaScript challenge code.

[0103] The client loads and executes the JS code. If it is a real browser used by a normal user, it can parse and execute the JS code, generate encrypted information containing timestamps, one-time tokens, digital signatures and fingerprint information, and send it back with the second request.

[0104] CDN edge nodes perform validity checks on the encrypted information in the request, confirming that the signature has not been tampered with, the token has not been reused, and the timestamp is within the valid window (to prevent replay attacks). Specifically, this includes: If the verification fails (Case 1), the system will be blocked and a 403 status code will be returned.

[0105] If the verification passes (Case 2), the traffic is considered legitimate and allowed to pass, and detailed access logs (including IP, URL, User-Agent, Referer, etc.) will be collected for the client during subsequent access processes.

[0106] The overall data processing flow of the abnormal access protection system is as follows: Figure 5 As shown, the specific process includes the following: The server does not perform full analysis of all logs in real time. Instead, it uses a mechanism of macro-level monitoring to trigger micro-level analysis in order to reduce costs.

[0107] The server is divided by region and carrier. For example, the entire network bandwidth is divided into 93 independent monitoring grids, consisting of "31 regions × 3 major carriers".

[0108] The server calculates the bandwidth change rate for each grid in real time. Specifically, a two-dimensional dynamic threshold algorithm is used: calculating the month-on-month growth rate of the current bandwidth relative to 5 minutes ago and the year-on-year growth rate relative to the same time yesterday. For example, when the month-on-month growth rate of the "Region A - Operator a" grid is detected to be greater than 50% or the year-on-year growth rate is greater than 100%, an abnormal surge is determined. At this time, the server automatically triggers a command to pull detailed access logs for that grid during the surge period from the edge nodes for analysis.

[0109] After receiving the logs, the server uses an offline computing cluster to perform in-depth analysis to identify hidden attack patterns.

[0110] The server extracts four core attributes from the logs: IP address, access URL, User-Agent, and Referer. These attributes are then standardized (e.g., numericalized or hashed) to construct a multidimensional access feature vector.

[0111] Given the typically highly clustered nature of attack traffic, the server employs DBSCAN (density-based clustering algorithm) for unsupervised learning of feature vectors. The algorithm automatically clusters high-density points into anomalous patterns. For example, a cluster containing a large number of requests might be identified with the following characteristics: "IP addresses concentrated in a specific network segment (e.g., 10.10.xx)" + "Frequent access to a single URL" + "User-Agent is a non-standard browser identifier" + "Referer is empty." Objects meeting these predefined clustering criteria are identified as target anomalous access objects.

[0112] Based on the analysis results, the server generates dynamic protection policies and sends them back to the edge nodes.

[0113] The server analyzes the concentration of sudden traffic spikes. If it finds that 80% of the abnormal traffic is contributed by the top 20% of IP addresses, and the traffic of these IPs exceeds 20 times the average, a rate-limiting policy is generated for these specific IPs (e.g., limiting bandwidth to 100KB / s for 7 days). If the traffic is highly concentrated in a certain IP network segment (1% of the network segment contributes 80% of the traffic), a rate-limiting policy is generated for that IP network segment.

[0114] Upon receiving the aforementioned target protection policy, the edge node immediately loads it into the gateway. When the target abnormal access object (a specific IP or network segment) initiates a request again, the edge node directly performs rate limiting or blocking operations.

[0115] Through the above process, this system achieves closed-loop protection from real-time computing capability verification (JS Challenge) on the edge side to behavioral pattern analysis (DBSCAN) on the central side, effectively solving the problems of sudden increase in bandwidth cost and difficulty in accurately identifying malicious crawlers in related technologies.

[0116] This embodiment also provides a protection device against abnormal access, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0117] This embodiment provides a protection device against abnormal access, such as... Figure 6 As shown, it includes: The acquisition module 601 is used to acquire access logs uploaded by the edge nodes; the access logs are collected by the edge nodes after they have verified the access request initiated by the client for the target business resource. The determination module 602 is used to extract various types of access attributes from the access log to construct an access feature vector, and to identify abnormal access patterns based on the access feature vector in order to determine the target abnormal access object. The generation module 603 is used to generate a target protection policy for the target abnormal access object, so as to instruct the edge node to execute the target protection policy.

[0118] In one alternative implementation, the acquisition module 601 is further configured to: Generate a verification interaction strategy and distribute it to the edge nodes; the verification interaction strategy is used to instruct the edge nodes to send a verification script to the client when they receive an access request from the client for the target business resource; the verification script is used to instruct the client to execute a preset computing task; If the verification information returned by the client based on the verification script meets the preset legality conditions, then the access request initiated by the client for the target business resource is deemed to have passed verification.

[0119] The verification information includes: timestamps generated by the client executing preset computing tasks, one-time tokens, browser fingerprint information, and digital signatures; The preset legality conditions include: the digital signature's consistency verification is passed, the one-time token has not been reused and the timestamp is within the preset valid time window, and the browser fingerprint information conforms to the preset real browser environment characteristics.

[0120] In one optional implementation, the various types of access attributes include: the client's IP address, the Uniform Resource Locator (URL) of the accessed resource, the user agent, and the source page information; the determination module 602 is used for: The client's IP address, the Uniform Resource Locator (URL) of the accessed resource, the user agent, and the source page information extracted from the access logs are standardized to construct an access feature vector.

[0121] In one alternative implementation, the determining module 602 is configured to: A density-based clustering algorithm is used to perform cluster analysis on the access feature vectors; If an access cluster that meets the preset clustering conditions is identified, it is determined to be an abnormal access pattern; The preset aggregation conditions include: the client's IP address comes from a centralized IP address range, the single access resource uses a Uniform Resource Locator (URL), the user agent has non-business characteristics, and the source page information is empty.

[0122] In one alternative implementation, the acquisition module 601 is further configured to: The network bandwidth data is divided into multiple monitoring grids based on a combination of geographical regions and network operators. The bandwidth data for each monitoring grid is calculated separately. When the bandwidth data of any monitoring grid meets the preset bandwidth surge condition, the access log acquisition operation for that monitoring grid during the surge period is triggered.

[0123] In one alternative implementation, the acquisition module 601 is further configured to: The calculation includes the first growth rate of the bandwidth value at the current time relative to the bandwidth value before the first preset time interval, and the second growth rate of the bandwidth value at the current time relative to the bandwidth value before the second preset time interval. If the first growth rate exceeds the first growth threshold, or the second growth rate exceeds the second growth threshold, then the bandwidth surge condition is determined to be met. The first preset time interval is less than the second preset time interval.

[0124] In one alternative implementation, the generation module 603 is used for: Statistically determine the concentration of traffic distribution within a preset time window; If a preset proportion of traffic is concentrated on a first proportion of IP addresses, a protection strategy is generated that instructs edge nodes to implement rate limiting on IP addresses whose traffic exceeds a preset multiple of the average. If a preset proportion of traffic is concentrated on the second proportion of IP network segments, a protection policy is generated that instructs edge nodes to implement rate limiting on IP network segments whose traffic exceeds a preset multiple of the average.

[0125] In an alternative implementation, the generation module 603 is further configured to: Generate a version control policy and distribute it to edge nodes; the version control policy is used to instruct edge nodes to perform version control; version control includes: Extract the client version number identifier from the access request targeting the business resource; The client version number identifier is matched with a list of preset version policies to determine the version category to which the client version number identifier belongs; If the client version number indicates that it belongs to a preset old version or an expired version, then the access request will be blocked or the access request will be rate-limited. If the client version number belongs to the preset online version, the access request will be verified.

[0126] The abnormal access protection device provided in this disclosure can execute the abnormal access protection method provided in any embodiment of this disclosure, and has the corresponding functional modules and beneficial effects for executing the method. Further functional descriptions of the various modules and units described above are the same as in the corresponding embodiments described above, and will not be repeated here.

[0127] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure.

[0128] The following is a detailed reference. Figure 7 The diagram illustrates a structural schematic suitable for implementing an electronic device according to embodiments of the present disclosure. The electronic device may include a processor (e.g., a central processing unit, graphics processor, etc.) 701, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 702 or a program loaded from memory 708 into random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the electronic device. The processor 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0129] Typically, the following devices can be connected to I / O interface 705: input devices 706 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 707 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; memory devices 708 including, for example, magnetic tapes, hard disks, etc.; and communication devices 709. Communication device 709 allows electronic devices to exchange data via wireless or wired communication with other devices. Although Figure 7 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown, and more or fewer devices may be implemented or have instead.

[0130] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 709, or installed from a memory 708, or installed from a ROM 702. When the computer program is executed by the processor 701, it performs the functions defined in the abnormal access protection method of embodiments of this disclosure.

[0131] Figure 7The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0132] This disclosure also provides a computer-readable storage medium in which the methods described in this disclosure can be implemented in hardware or firmware, or implemented as recordable on a storage medium, or implemented as computer code originally stored on a remote storage medium or a non-transitory machine-readable storage medium and subsequently stored on a local storage medium after being downloaded over a network. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium may also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, implementing the abnormal access protection methods shown in the above embodiments when the software or computer code is accessed and executed by the computer, processor, or hardware.

[0133] A portion of this disclosure can be applied to computer program products, such as computer program instructions, which, when executed by a computer, can invoke or provide methods and / or technical solutions according to this disclosure through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, and installation package files. Accordingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions; the computer compiling the instructions and then executing the corresponding compiled program; the computer reading and executing the instructions; or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0134] Although embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for protecting against abnormal access, characterized in that, The method includes: Obtain access logs uploaded by edge nodes; the access logs are collected by the edge nodes after they have verified the access request initiated by the client for the target business resource. Extract various types of access attributes from the access logs to construct an access feature vector, and identify abnormal access patterns based on the access feature vector to determine the target abnormal access object; Generate a target protection policy for the target abnormal access object, and instruct the edge node to execute the target protection policy.

2. The method according to claim 1, characterized in that, Before the step of obtaining the access logs uploaded by the edge node, the method further includes: A verification interaction strategy is generated and sent to the edge node; the verification interaction strategy is used to instruct the edge node to send a verification script to the client when it receives an access request from the client for the target business resource; the verification script is used to instruct the client to execute a preset computing task; If the verification information returned by the client based on the verification script meets the preset legality conditions, then the access request initiated by the client for the target business resource is deemed to have passed verification.

3. The method according to claim 2, characterized in that, The verification information includes: a timestamp generated by the client executing a preset computing task, a one-time token, browser fingerprint information, and a digital signature; The preset legality conditions include: the consistency verification of the digital signature is passed, the one-time token is not reused and the timestamp is within the preset valid time window, and the browser fingerprint information conforms to the preset real browser environment characteristics.

4. The method according to claim 1, characterized in that, The various types of access attributes include: the client's IP address, the Uniform Resource Locator (URL) of the accessed resource, the user agent, and the source page information; The construction of the access feature vector includes: The client's IP address, the Uniform Resource Locator (URL) of the accessed resource, the user agent, and the source page information extracted from the access logs are standardized to construct the access feature vector.

5. The method according to claim 4, characterized in that, The identification of abnormal access patterns based on the access feature vector includes: A density-based clustering algorithm is used to perform cluster analysis on the access feature vectors; If an access cluster that meets the preset clustering conditions is identified, it is determined to be an abnormal access pattern; The preset aggregation conditions include: the client's IP address comes from a centralized IP address range, the single access resource uses a Uniform Resource Locator (URL), the user agent has non-business characteristics, and the source page information is empty.

6. A protection system for abnormal access, characterized in that, The system includes edge nodes and a server that communicates with the edge nodes. The edge node is used to receive access requests from clients for target business resources, send verification scripts to clients, receive and verify the verification information returned by clients, allow access requests after verification, and collect access logs during the client's access process. The server is configured to execute the abnormal access protection method as described in any one of claims 1 to 5, to determine the target abnormal access object based on the access logs uploaded by the edge node, and to generate a target protection policy for the target abnormal access object. The edge node is also used to receive and execute the target protection policy to intercept or rate-limit the target abnormal access object.

7. A protective device for abnormal access, characterized in that, The device includes: The acquisition module is used to acquire access logs uploaded by edge nodes; the access logs are collected by the edge nodes after they have verified the access request initiated by the client for the target business resource. The determination module is used to extract multiple types of access attributes from the access log to construct an access feature vector, and to identify abnormal access patterns based on the access feature vector in order to determine the target abnormal access object. The generation module is used to generate a target protection policy for the target abnormal access object, so as to instruct the edge node to execute the target protection policy.

8. An electronic device, characterized in that, include: A memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, the processor executing the computer instructions to perform the abnormal access protection method according to any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the protection method against abnormal access as described in any one of claims 1 to 5.

10. A computer program product, characterized in that, Includes computer instructions for causing a computer to execute the protection method against abnormal access as described in any one of claims 1 to 5.

Images