A data back-injection method and system
By identifying the degree of malice in user requests through reverse data injection, and processing response data with different data processing rules to generate different processed data, the problem of fragmented protection chains in existing technologies is solved, and the malicious crawlers are effectively contained and traced.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SUZHOU YUNHULU INFORMATION TECH CO LTD
- Filing Date
- 2026-04-07
- Publication Date
- 2026-07-10
AI Technical Summary
Existing technologies cannot effectively prevent malicious data scraping using artificial intelligence, resulting in a fragmented protection chain, making it difficult to curb the continuous mutation and long-term infiltration of malicious crawlers, and making subsequent rights protection difficult.
By using reverse data injection, the maliciousness of user requests can be identified. Different data processing rules are used to process the response data, generating different processed data, and relevant information is recorded to form a complete protection chain.
It effectively curbs the continuous mutation and long-term penetration of malicious web crawlers. By identifying the degree of malice in user requests, it adopts different data modification strategies to form a complete protection chain, supporting subsequent data verification and legal tracing.
Smart Images
Figure CN122372255A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a data reverse injection method and system. Background Technology
[0002] Malicious data scraping refers to the high-frequency, large-scale, and purposeful scraping of data from target websites using automated programs (such as web crawlers). This behavior can overload servers and severely impact normal data services. In particular, when high-quality, heavily processed data is scraped and used for commercial purposes, it seriously undermines the enthusiasm and commercial interests of data holders.
[0003] To combat malicious data scraping, common measures currently include: Anti-scraping based on identity verification: Filtering out requests with obvious non-browser behavior by verifying the legitimacy of the request source, such as User-Agent detection, Referer verification, IP address restriction and blocking, account access control, and CAPTCHA protection; Anti-scraping based on behavioral characteristics: Analyzing user operation patterns to identify differences between machine and human behavior, such as monitoring request frequency and rhythm, analyzing mouse trajectory and click patterns, page dwell time and scrolling behavior; Anti-scraping based on data encryption and rendering: Changing the data transmission method to prevent traditional crawlers from directly parsing valid information, such as dynamic page rendering (JS encryption), font anti-scraping and SVG mapping, API parameter encryption and token verification.
[0004] The aforementioned measures only address the initial stage of anti-scraping. With the development of AI technology, traditional anti-scraping strategies are no longer sufficient to prevent data scraping using artificial intelligence. Furthermore, they fail to effectively coordinate with subsequent data verification, behavioral analysis, and legal recourse measures. This results in a fragmented system defense, making it difficult to form a complete protection chain and systematically curb the continuous mutation and long-term infiltration of malicious crawlers, making subsequent rights protection extremely difficult. Summary of the Invention
[0005] To address the aforementioned technical issues, this invention proposes a data reverse injection method and system that can identify the degree of malice in user requests and take timely preventative measures without affecting normal data services.
[0006] To achieve the above objectives, the technical solution of the present invention is as follows:
[0007] A data reverse injection method includes the following steps:
[0008] Obtain the user's data access request;
[0009] Extract user information, which includes markers for normal users, abnormal users, or dangerous users;
[0010] If the current user is a normal user, the response data corresponding to the data access request will be fed back to the user; if the current user is an abnormal user, the response data will be processed according to the pre-configured first processing rule to generate first processed data, and the first processed data will be fed back to the user and relevant information will be recorded; if the current user is a dangerous user, the response data will be processed according to the pre-configured second processing rule to generate second processed data, and the second processed data will be fed back to the user and relevant information will be recorded.
[0011] Preferably, the process of marking normal users, abnormal users, or dangerous users includes the following steps:
[0012] The system includes preset dynamic abnormal conditions and dynamic dangerous conditions. Both dynamic abnormal conditions and dynamic dangerous conditions include one or more of the following limiting boundaries: high frequency access within a preset time period, mechanical access rhythm, IP / device abnormality, parameter regular traversal, and no normal human-machine behavior. The limiting boundary range of the dynamic dangerous conditions includes the limiting boundary range of the dynamic abnormal conditions.
[0013] Obtain historical data access records, and identify information such as high-frequency access, mechanical access rhythm, abnormal IP / device, regular parameter traversal, and no normal human-machine behavior within a preset time period from the historical data access records;
[0014] If a user's historical data access records trigger dynamic abnormal conditions, the user is marked as an abnormal user; otherwise, the user is marked as a normal user.
[0015] When a user's historical data access records trigger dynamic danger conditions, the user is marked as a dangerous user.
[0016] Preferably, the first processing rule is to randomly add data markers; the second processing rule is one or more of the following: deletion, modification, or calculation and adjustment of numerical data.
[0017] Preferably, the data markers include one or more of the following: patterns, numbers, symbols, or text.
[0018] Preferably, the relevant information includes request time, feedback data, and IP address, wherein the feedback data is first processed data or second processed data.
[0019] Preferably, the method further includes the following steps:
[0020] Construct a first database to store data information; if the user is a normal user, send the response data corresponding to the data access request in the first database to the user.
[0021] A second database is constructed to store data information; if the user is an abnormal or dangerous user, the feedback data corresponding to the data access request in the second database is sent to the user, and the relevant information is stored in the second database.
[0022] Preferably, the first database and the second database are deployed on one server, or the first database and the second database are deployed on different servers.
[0023] Based on the above, the present invention also discloses a data reverse injection system, comprising: a user terminal and a server, wherein,
[0024] The user terminal is used to send data access requests to the server and to receive response data, first processed data, or second processed data from the server.
[0025] The server is configured to: acquire user data access requests; extract user information, including markers for normal users, abnormal users, or dangerous users; if the current user is a normal user, provide the response data corresponding to the data access request to the user; if the current user is an abnormal user, process the response data according to a pre-configured first processing rule to generate first processed data, provide the first processed data to the user, and record relevant information; if the current user is a dangerous user, process the response data according to a pre-configured second processing rule to generate second processed data, provide the second processed data to the user, and record relevant information.
[0026] Based on the above technical solution, the beneficial effects of this invention are as follows: This invention discloses a data reverse injection method and system. The method involves: acquiring a user's data access request; extracting user information, which includes markers for normal users, abnormal users, or dangerous users; if the current user is a normal user, then the response data corresponding to the data access request is fed back to the user; if the current user is an abnormal user, then the response data is processed according to a pre-configured first processing rule to generate first processed data, which is fed back to the user along with relevant information; if the current user is a dangerous user, then the response data is processed according to a pre-configured second processing rule to generate second processed data, which is fed back to the user along with relevant information. This invention can identify the degree of malice in user requests, adopt different data modification strategies according to different degrees of malice, and effectively coordinate subsequent data verification, behavior analysis, and legal tracing, forming a complete protection chain that can effectively curb the continuous mutation and long-term penetration of malicious crawlers. Attached Figure Description
[0027] Figure 1This is a schematic diagram of a data reverse injection method in one embodiment. Detailed Implementation
[0028] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.
[0029] like Figure 1 As shown, this embodiment provides a data reverse injection method, including the following steps:
[0030] Step 1: Obtain the user's data access request;
[0031] Step 2: Extract user information, which includes markers for normal users, abnormal users, or dangerous users;
[0032] Step 3: If the current user is a normal user, the response data corresponding to the data access request is fed back to the user; if the current user is an abnormal user, the response data is processed according to the pre-configured first processing rule to generate first processed data, the first processed data is fed back to the user and relevant information is recorded; if the current user is a dangerous user, the response data is processed according to the pre-configured second processing rule to generate second processed data, the second processed data is fed back to the user and relevant information is recorded.
[0033] In this embodiment, the user's status as a normal user, abnormal user, or dangerous user is determined by reviewing historical data access records. The malicious intent of the current data access request is inferred based on the user's abnormal or dangerous user flag. Different data modification strategies are employed according to the degree of malice, and relevant information is saved as evidence in subsequent accountability processes.
[0034] Specifically, if the current user is a normal user, no processing is required on the response data; the response data corresponding to the data access request is directly fed back to the user without affecting the normal data service. If the current user is an abnormal user, the response data is processed according to the pre-configured first processing rule to generate first processed data, which is then fed back to the user along with relevant information. If the current user is a dangerous user, the response data is processed according to the pre-configured second processing rule to generate second processed data, which is then fed back to the user along with relevant information.
[0035] The first processing rule is to randomly add data markers, which include one or more combinations of patterns, numbers, symbols, or text; the second processing rule is to perform one or more combinations of deletion, modification, or calculation and adjustment on the numerical data.
[0036] The first processing rule involves randomly adding data markers to abnormal users exhibiting minor malicious behavior (e.g., randomly appending meaningless information such as patterns, numbers, symbols, or text to usernames, addresses, etc.; patterns include logos; symbols include -, *, etc.; text includes cloud gourd, cloud, gourd, etc.). This useless information will not affect the user's use, but the relevant information for this data access request is saved. If there are subsequent actions that constitute a crime, the retained record can be used as evidence for prosecution. For dangerous users exhibiting serious malicious behavior such as high-frequency access within a short period, the second processing rule directly involves deleting, modifying, or adjusting one or more of the following methods: data provided will affect normal use, and the relevant information for this data access request is saved. If the behavior is determined to constitute a crime, the retained record will be used as evidence for prosecution.
[0037] The relevant information includes the request time, feedback data, and IP address. The feedback data is either the first processed data or the second processed data.
[0038] One embodiment of a data reverse injection method also provides a process for marking normal users, abnormal users, or dangerous users, which includes the following steps:
[0039] The system includes preset dynamic abnormal conditions and dynamic dangerous conditions. Both dynamic abnormal conditions and dynamic dangerous conditions include one or more of the following limiting boundaries: high frequency access within a preset time period, mechanical access rhythm, IP / device abnormality, parameter regular traversal, and no normal human-machine behavior. The limiting boundary range of the dynamic dangerous conditions includes the limiting boundary range of the dynamic abnormal conditions.
[0040] Obtain historical data access records, and identify information such as high-frequency access, mechanical access rhythm, abnormal IP / device, regular parameter traversal, and no normal human-machine behavior within a preset time period from the historical data access records;
[0041] If a user's historical data access records trigger dynamic abnormal conditions, the user is marked as an abnormal user; otherwise, the user is marked as a normal user.
[0042] When a user's historical data access records trigger dynamic danger conditions, the user is marked as a dangerous user.
[0043] In this embodiment, by screening historical data access records, information such as high-frequency access within a preset time period, mechanical access rhythm, abnormal IP / device, regular parameter traversal, and lack of normal human-machine behavior is identified, including:
[0044] 1) High-frequency access within a preset time period refers to a single IP address or device making a large number of requests within a preset time period, exceeding the normal frequency of user behavior. For example, accessing the same page hundreds of times within 10 minutes.
[0045] 2) Mechanical access rhythm, characterized by highly regular request intervals, such as a fixed access every 5 seconds, lacking the randomness of human operation. This type of behavior can be identified by detecting the entropy value of the time series.
[0046] 3) IP / device anomalies, such as accessing the site using a large number of proxy IPs, virtual machines, or uncommon devices.
[0047] 4) Parameter pattern traversal: Data is crawled by programmatically traversing parameters (e.g., crawling data from patent application numbers from 201700000000.0, 201700000000.1, 201700000000.2...201899999999.9, 201900000000.0).
[0048] 5) There is no normal human-computer interaction. There are no interactive actions such as page dwell, scrolling, or clicking. Only API calls or page loading are performed, which does not conform to the real user behavior path.
[0049] To handle users with different risk levels differently, dynamic anomaly conditions and dynamic danger conditions are set. The limitation range of dynamic danger conditions includes that of dynamic anomaly conditions, but dynamic danger conditions have more requirements for fulfillment. For example, if a user's access frequency within a preset time period of historical data access records exceeds A, or if an IP / device anomaly occurs, the user is considered an abnormal user; otherwise, they are considered a normal user. If a user's access frequency within a preset time period of historical data access records exceeds B, and if an IP / device anomaly occurs or the parameters exhibit a pattern of repetitive traversal, the user is considered a dangerous user, where B > A. However, this is not the only limitation; implementers can adjust the dynamic anomaly conditions and dynamic danger conditions according to actual circumstances.
[0050] The data reverse injection method in this embodiment further includes the following steps:
[0051] Construct a first database to store data information; if the user is a normal user, send the response data corresponding to the data access request in the first database to the user.
[0052] A second database is constructed to store data information; if the user is an abnormal or dangerous user, the feedback data corresponding to the data access request in the second database is sent to the user, and the relevant information is stored in the second database.
[0053] In this embodiment, the feedback data differs from normal data because it has been modified using either the first or second processing rule. The second database serves as a backup database for subsequent data verification and does not affect the updating, maintenance, or service of normal data in the first database. If the verification confirms that the other party's data matches the feedback data, it can be used as evidence for accountability.
[0054] The first and second databases are deployed on different servers to achieve load isolation, improve response speed, and facilitate independent expansion and maintenance.
[0055] It should be understood that although the steps in the flowchart above are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart above may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.
[0056] Based on the same inventive concept, this application also provides a system for implementing the data reverse injection method described above. The solution provided by this system is similar to the solution described in the above method, and therefore will not be repeated here.
[0057] In one embodiment, a data reverse injection system is also provided, comprising: a client and a server, wherein,
[0058] The user terminal is used to send data access requests to the server and to receive response data, first processed data, or second processed data from the server.
[0059] The server is configured to: acquire user data access requests; extract user information, including markers for normal users, abnormal users, or dangerous users; if the current user is a normal user, provide the response data corresponding to the data access request to the user; if the current user is an abnormal user, process the response data according to a pre-configured first processing rule to generate first processed data, provide the first processed data to the user, and record relevant information; if the current user is a dangerous user, process the response data according to a pre-configured second processing rule to generate second processed data, provide the second processed data to the user, and record relevant information.
[0060] In the above embodiments, each module of the data reverse injection system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of the computer device as software, so that the processor can call and execute the operations corresponding to each module.
[0061] The above are merely preferred embodiments of the present application and are not intended to limit the embodiments of the present application. For those skilled in the art, the embodiments of the present application can have various modifications and variations. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of the present application should be included within the protection scope of the embodiments of the present application.
Claims
1. A data reverse injection method, characterized in that, Includes the following steps: Obtain the user's data access request; Extract user information, which includes markers for normal users, abnormal users, or dangerous users; If the current user is a normal user, the response data corresponding to the data access request will be fed back to the user; if the current user is an abnormal user, the response data will be processed according to the pre-configured first processing rule to generate first processed data, and the first processed data will be fed back to the user and relevant information will be recorded; if the current user is a dangerous user, the response data will be processed according to the pre-configured second processing rule to generate second processed data, and the second processed data will be fed back to the user and relevant information will be recorded.
2. The data reverse injection method according to claim 1, characterized in that, The process of marking normal users, abnormal users, or dangerous users includes the following steps: The system includes preset dynamic abnormal conditions and dynamic dangerous conditions. Both dynamic abnormal conditions and dynamic dangerous conditions include one or more of the following limiting boundaries: high frequency access within a preset time period, mechanical access rhythm, IP / device abnormality, parameter regular traversal, and no normal human-machine behavior. The limiting boundary range of the dynamic dangerous conditions includes the limiting boundary range of the dynamic abnormal conditions. Obtain historical data access records, and identify information such as high-frequency access, mechanical access rhythm, abnormal IP / device, regular parameter traversal, and no normal human-machine behavior within a preset time period from the historical data access records; If a user's historical data access records trigger dynamic abnormal conditions, the user is marked as an abnormal user; otherwise, the user is marked as a normal user. When a user's historical data access records trigger dynamic danger conditions, the user is marked as a dangerous user.
3. The data reverse injection method according to claim 1, characterized in that, The first processing rule is to randomly add data markers; the second processing rule is one or more of the following: deletion, modification, or calculation and adjustment of numerical data.
4. The data reverse injection method according to claim 3, characterized in that, The data markers include one or more of the following: patterns, numbers, symbols, or text.
5. The data reverse injection method according to claim 1, characterized in that, The relevant information includes the request time, feedback data, and IP address, wherein the feedback data is either first processed data or second processed data.
6. A data reverse injection method according to claim 5, characterized in that, It also includes the following steps: Construct a first database to store data information; if the user is a normal user, send the response data corresponding to the data access request in the first database to the user. Construct a second database, which is used to store data information; If the user is an abnormal or dangerous user, the feedback data corresponding to the data access request in the second database will be sent to the user, and the relevant information will be stored in the second database.
7. A data reverse injection method according to claim 6, characterized in that, The first database and the second database are deployed on the same server, or the first database and the second database are deployed on different servers.
8. A data reverse injection system, characterized in that, Includes: client and server, among which, The user terminal is used to send data access requests to the server and to receive response data, first processed data, or second processed data from the server. The server is configured to: acquire user data access requests; extract user information, including markers for normal users, abnormal users, or dangerous users; if the current user is a normal user, provide the response data corresponding to the data access request to the user; if the current user is an abnormal user, process the response data according to a pre-configured first processing rule to generate first processed data, provide the first processed data to the user, and record relevant information; if the current user is a dangerous user, process the response data according to a pre-configured second processing rule to generate second processed data, provide the second processed data to the user, and record relevant information.