Request processing method and system for gateway, medium, product, and electronic device

CN122933738APending Publication Date: 2026-10-16SHANGHAI HEIHU NETWORK TECHNOLOGY CO LTD +1
View PDF 0 Cites 0 Cited by

Patent Information

Application Number
CN202611139037.1
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2026-07-28
Publication Date
2026-10-16

AI Technical Summary

Technical Problem

但有些情况下,用户请求并非是因为恶意而发出的,只是其表现行为类似于恶意时发出的请求,对此类情况而言,封禁就属于误封,导致用户体验下降

Benefits of technology

本发明实施例中在检测到用户的访问请求为恶意请求时,获取该用户在设定时间间隔内的行为数据,对行为数据进行分析并根据分析结果判断是否属于误封,若属于误封,根据对应的预设方案生成调整建议并发送至用户端和/或网关。由此,用户被误封时,用户端和/或网关会收到调整建议,从而能根据该调整建议对用户端和/或网关进行调整,能够减少甚至避免网关的误封,改善了用户的使用体验。

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN122933738A_ABST
    Figure CN122933738A_ABST
Patent Text Reader

Abstract

A request processing method and system for a gateway, a medium, a product, and an electronic device, wherein the request processing method for the gateway comprises: in response to detecting that an access request of a user is a malicious request, obtaining behavior data of the user within a set time interval, wherein the access request is sent by the user to a gateway through a user terminal; analyzing the behavior data of the user within the set time interval, and determining whether it is a false block according to at least an analysis result; if the determination result is yes, obtaining a corresponding scheme from a preset scheme library according to the analysis result, generating an adjustment suggestion according to the analysis result and the corresponding scheme, and sending the adjustment suggestion to the user terminal and / or the gateway. Thus, the gateway automatically detects false blocks and gives adjustment suggestions.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and more specifically to a request processing method and system, medium, product, and electronic device for a gateway. Background Technology

[0002] Traditional gateways are primarily used for task routing, request forwarding, and basic security monitoring. When a traditional gateway determines a user request to be malicious, such as a request intended to attack a server, the usual practice is to block the user, preventing subsequent requests from being responded to. However, in some cases, user requests are not malicious in nature, but their behavior resembles that of a malicious request. In such cases, blocking is a false positive, leading to a degraded user experience.

[0003] Therefore, how to reduce or avoid false blocking of gateways is a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0004] The purpose of this invention is to provide at least one request processing method for a gateway, which can reduce or even avoid false blocking of gateways.

[0005] In a first aspect, embodiments of the present invention provide a request processing method for a gateway, comprising: In response to detecting that a user's access request is malicious, the system obtains the user's behavior data within a set time interval, wherein the access request is sent by the user to the gateway through the user terminal; The user's behavioral data within a set time interval is analyzed, and at least the analysis results are used to determine whether the account was mistakenly blocked. If the judgment result is yes, then the corresponding solution is obtained from the preset solution library according to the analysis result, and an adjustment suggestion is generated according to the analysis result and the corresponding solution, and the adjustment suggestion is sent to the user terminal and / or gateway; The process of analyzing the user's behavioral data within a set time interval and determining whether the account was mistakenly blocked based on the analysis results includes: If the analysis results show that the number of times the user triggers login requests within a set time interval exceeds a preset threshold, and the user's local token cache is not enabled, then it is determined to be a false ban.

[0006] Optionally, the step of obtaining a corresponding solution from a preset solution library based on the analysis results, generating adjustment suggestions based on the analysis results and the corresponding solution, and sending the adjustment suggestions to the user terminal and / or gateway includes: A message indicating that local token caching is not enabled is sent to the user's client, suggesting that the user enable local token caching.

[0007] Optionally, if the analysis result shows that the number of times the user triggers login requests within a set time interval exceeds a preset threshold, and the user's local token cache is not enabled, then the account is determined to be mistakenly blocked, including: If the analysis results indicate that the number of login requests triggered within a user-defined time interval exceeds a preset threshold, and the variance of the time interval between adjacent login requests is less than a preset variance threshold, then the user is prompted to upload a login configuration file. The system checks whether the local token cache on the user's client is enabled based on the login configuration file. If it is not enabled, the account is considered to have been mistakenly blocked.

[0008] Optionally, the step of analyzing the user's behavioral data within a set time interval and determining whether the account was mistakenly blocked based on the analysis results further includes: If the analysis results show that multiple adjacent user access requests carry the same request identifier and the sending interval between adjacent access requests is less than a preset time threshold, then it is determined to be a false blocking.

[0009] Optionally, the step of obtaining a corresponding solution from a preset solution library based on the analysis results, generating adjustment suggestions based on the analysis results and the corresponding solution, and sending the adjustment suggestions to the user terminal and / or gateway includes: A network instability alert is sent to the user terminal, and the gateway's filtering logic for access requests sent by the user is adjusted to identify and filter out duplicate requests sent by the user with an interval less than the preset time threshold.

[0010] Optionally, analyzing the user's behavioral data within a set time interval, and at least determining whether the account was mistakenly blocked based on the analysis results, further includes: If the analysis results show that the same user logs in concurrently through multiple user terminals within the set time interval, it is determined to be a false ban; The step of obtaining a corresponding solution from a preset solution library based on the analysis results, generating adjustment suggestions based on the analysis results and the corresponding solution, and sending the adjustment suggestions to the user terminal and / or gateway includes: The gateway sends a prompt to the user client indicating that multiple devices can log in simultaneously, and adjusts the filtering logic of the gateway for the access requests sent by the user, adding the multiple user clients to the whitelist and allowing the multiple user clients to log in concurrently.

[0011] Optionally, the behavioral data includes a basic information log and a complete task chain log. The basic information log records a task identifier and basic information about the task indicated by that task identifier. The complete task chain log records a tracking identifier and detailed information about each task. The tracking identifier is associated with the task identifier. The amount of data in the detailed information of the task is greater than that in the basic information log. Analyzing the user's behavioral data within a set time interval includes: Based on the analysis of the basic information logs, the tasks involved in the access requests that were determined to be malicious were located. The associated tracking identifier is determined based on the task identifier obtained from the location, and the complete task chain log pointed to by the tracking identifier is determined; Analyze the complete task chain log.

[0012] Optionally, the method further includes: Get the updated behavior data; If a false ban is detected again after an adjustment suggestion is generated, and the analysis result obtained after analyzing the updated behavioral data is the same as the analysis result when the false ban was detected before, it is determined that the matching degree of the adjustment suggestion is low. Based on the analysis results of the updated behavioral data, a new corresponding solution is generated, and the corresponding solution in the preset solution library is replaced.

[0013] Secondly, embodiments of the present invention also provide a request processing system for a gateway, comprising: The data acquisition module, in response to detecting that a user's access request is malicious, acquires the user's behavioral data within a set time interval, wherein the access request is sent by the user to the gateway through the user's client; the analysis module is used to analyze the user's behavioral data within the set time interval, and at least determine whether it is a wrongful blocking based on the analysis results, wherein if the analysis results show that the number of times the user triggers login requests within the set time interval exceeds a preset threshold, and the user's local token cache is not enabled, it is determined to be a wrongful blocking; the suggestion generation module, if the determination result is yes, retrieves the corresponding solution from a preset solution library based on the analysis results, generates adjustment suggestions based on the analysis results and the corresponding solution, and sends the adjustment suggestions to the user's client and / or the gateway.

[0014] Thirdly, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above-described request processing methods for a gateway.

[0015] Fourthly, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described request processing methods for a gateway.

[0016] Fifthly, the present invention also provides an electronic device including a memory and a processor, wherein the memory stores a computer program executable on the processor, and the processor executes the steps of any of the above-described request processing methods for a gateway when running the computer program.

[0017] Compared with the prior art, the technical solution of the embodiments of the present invention has the following beneficial effects: In this embodiment of the invention, when a user's access request is detected as malicious, the system acquires the user's behavioral data within a set time interval, analyzes the behavioral data, and determines whether the blocking is due to a mistake. If it is a mistake, an adjustment suggestion is generated according to a corresponding preset scheme and sent to the user terminal and / or the gateway. Therefore, when a user is mistakenly blocked, the user terminal and / or the gateway will receive the adjustment suggestion, allowing them to adjust accordingly. This reduces or even avoids mistaken blocking by the gateway, improving the user experience.

[0018] Furthermore, the behavioral data in this embodiment of the invention includes basic information logs and complete task chain logs. The complete task chain logs contain more detailed task information. First, problematic access requests are filtered out from all user access requests using the basic information logs, and then the corresponding complete task chain logs are obtained for further analysis. This improves analysis efficiency. Attached Figure Description

[0019] Figure 1 This is a flowchart of a request processing method for a gateway in an embodiment of the present invention; Figure 2 This is a schematic diagram of a request processing system structure for a gateway in an embodiment of the present invention. Detailed Implementation

[0020] As mentioned in the background section, traditional gateways used in the prior art often mistakenly identify legitimate requests as malicious requests and block them during task routing, request forwarding, and basic security checks, resulting in a poor user experience.

[0021] The inventors of this application discovered through research that the main reason is that, during the use of traditional gateways, when a user request is detected as a malicious request, there is a lack of an automatic mechanism to identify whether there is a false blocking, further analyze the reasons for the false blocking, and provide adjustment suggestions based on the reasons for the false blocking.

[0022] Therefore, in this embodiment of the invention, user behavior data is analyzed to determine whether there is a false blocking, and the cause of the false blocking is matched with a solution in a preset solution library. After obtaining the corresponding solution, adjustment suggestions are generated and sent to the user terminal and / or gateway. This realizes automatic detection of false blocking during user use and generation of adjustment suggestions to be sent to the user terminal and / or gateway. It can adaptively optimize both the user terminal and the gateway during user use, thereby improving the user experience.

[0023] In addition, when analyzing user behavior data within a set time period, problematic access requests are first filtered out from all user access requests within the set time interval using basic information logs. Then, the complete task chain logs corresponding to the problematic access requests are used to further analyze the reasons for wrongful blocking. Compared with directly analyzing the complete task chain logs corresponding to all access requests issued by users within the set time interval, this improves analysis efficiency.

[0024] To make the above-mentioned objectives, features and beneficial effects of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0025] Figure 1 This is a flowchart illustrating a request processing method for a gateway according to an embodiment of the present invention. This method can be applied to a cloud-based manufacturing collaboration system, which includes a server, a gateway, and a user client. User requests from the user client are transmitted to the gateway, which performs various appropriate operations (e.g., routing) before transmitting them to the server. Alternatively, if the user request is deemed malicious, it will not be transmitted to the server. This method can be executed by the gateway, by the server, or by both the gateway and the server. (See reference...) Figure 1 The process includes steps S101 to S103, which will be described in detail below.

[0026] Step S101: In response to detecting that the user's access request is a malicious request, obtain the user's behavior data within a set time interval, wherein the access request is sent by the user to the gateway through the user terminal.

[0027] Step S102 involves analyzing the user's behavioral data within a set time interval and determining, at least based on the analysis results, whether the account was mistakenly blocked, including: If the analysis results show that the number of times the user triggers login requests within a set time interval exceeds a preset threshold, and the user's local token cache is not enabled, then it is determined to be a false ban.

[0028] Step S103: If the judgment result is yes, then obtain the corresponding solution from the preset solution library according to the analysis result, generate adjustment suggestions according to the analysis result and the corresponding solution, and send the adjustment suggestions to the user terminal and / or gateway.

[0029] In the specific implementation of step S101, under normal circumstances, a user sends an access request from the user's end to the gateway and then to the server. If the gateway identifies the access request as a malicious request, the user is blocked, and the corresponding access request is no longer transmitted to the server. When the gateway detects that a user's access request is a malicious request, it obtains the user's behavior data within a set time interval.

[0030] The time interval can be customized as needed, for example, it can be set to five minutes. User behavior data can include basic information logs and complete task chain logs. Each access request corresponds to one basic information log and one complete task chain log. Each access request includes at least one task. The basic information log contains the task identifier and basic information about the task indicated by the task identifier. The basic information log can include the request interface identifier, task ID (i.e., task identifier), user ID, request source IP information or device information, request processing result, and status code, etc. The complete task chain log records the trace identifier and detailed information of each task. The trace identifier is associated with the task identifier and is used to characterize the processing node in the task chain and its corresponding task. The trace identifier is also known as the processing node ID. The complete task chain log can include the processing node ID, the call order of each node during the execution of the access request, the request parameters and return parameters of each processing node, the task execution time of the processing node, the context information during the task processing, and related error information, etc. The amount of data in the detailed task information is larger than that in the basic information. User behavior data can be recorded and stored by the gateway.

[0031] In the specific implementation of step S102, after obtaining the user's behavior data within a set time interval, the basic information log within the set time interval is first analyzed. Based on the basic information log, access requests judged to be malicious are located. The information contained in the basic information log is analyzed. If the reason for the wrongful blocking can be obtained, the process jumps to step S103. If the reason for the wrongful blocking cannot be obtained from the basic information log, the tasks involved in the access request are located based on the basic information log. The associated tracking identifier is determined based on the located task identifier, and the complete task chain log pointed to by the tracking identifier is determined. The complete task chain log is analyzed, and at least based on the analysis results, it is determined whether it is a wrongful blocking. In this embodiment of the invention, the basic information log is first used to filter out problematic access requests from all user access requests within a set time interval. Then, the complete task chain log corresponding to the problematic access requests is used to further analyze the reason for the wrongful blocking. Compared with directly analyzing the complete task chain log corresponding to all access requests issued by the user within a set time interval, the analysis efficiency is improved.

[0032] In the specific implementation of step S103, if the analysis of the complete task chain log yields a judgment result indicating a false blocking, then a corresponding solution is retrieved from a preset solution library based on the analysis result. This retrieval can be achieved by matching the analysis result with solutions in the preset solution library using keywords; a match score greater than a preset matching threshold is considered successful, and the solution is retrieved. Then, adjustment suggestions are generated based on the analysis result and the corresponding solution, and these suggestions are sent to the user terminal and / or the gateway.

[0033] In a non-restrictive example, if the analysis shows that the number of login requests triggered by a user within a set time interval exceeds a preset threshold, and the variance of the time interval between adjacent login requests is less than a preset variance threshold, the user is prompted to upload a login configuration file. This configuration file can be an automated script set up on the user's client. The system checks whether the user's local token cache is enabled based on the login configuration file; if it is not enabled, it is considered a false ban. Furthermore, a message indicating that the local token cache is not enabled is sent to the user's client, such as "Local token caching should be enabled on the client; login status information is cached" or "Login cache failure detected; it is recommended to enable local token caching to avoid duplicate verification," suggesting that the user enable local token caching. When a user logs in through the client, the server creates a corresponding token for user authentication. In some application scenarios, if the client needs to frequently access the server to obtain data, such as in a cloud-based manufacturing collaboration system used in a manufacturing plant, the client may frequently query data stored on the server, such as warehouse data or production line status data. If an automated script is used for data querying without enabling local token caching, the automated script will frequently initiate login requests to obtain tokens, causing the gateway to ban the client. The solution in this embodiment sends a suggestion to the user when the client is blocked, advising them to upload login configuration files such as scripts. The gateway then checks whether the user has enabled local token caching. If not, it further suggests enabling it. Afterward, the user is advised to upload the modified login configuration file again. If local token caching is detected as enabled, the gateway lifts the block on the user.

[0034] In a non-restrictive example, the fingerprints, IP information, and access times of various user-end devices from which access requests originate for the same user are analyzed. If the analysis results indicate that the same user concurrently logs in through multiple user-end devices within the set time interval, and if the login credentials of each user-end device are valid and valid, then it is determined to be a false blocking. Here, the login credentials are obtained after the user-end device sends a login request. Furthermore, a multi-device simultaneous login prompt is sent to the user-end device, for example, "Multiple devices have been detected logging in simultaneously; please confirm if this is your operation." The gateway's filtering logic for access requests from this user is adjusted to add the multiple user-end devices to a whitelist, allowing concurrent login from these multiple user-end devices.

[0035] In a non-limiting example, if the analysis results show that multiple adjacent user access requests carry the same request identifier and the sending interval between adjacent access requests is less than a preset time threshold (e.g., 300ms), it is determined to be a false block. Normally, each access request corresponds to a unique request identifier. When the user's network is unstable, the user may not receive a response after sending an access request due to network problems, triggering the network instability retransmission mechanism. This causes the gateway to receive multiple access requests carrying the same request identifier. Furthermore, a network instability alert is sent to the user, and the gateway's filtering logic for access requests from that user is adjusted to identify and filter out duplicate requests with a sending interval less than the preset time threshold.

[0036] In a non-restrictive example, if the analysis shows that the access request is accompanied by repeated token refreshes, it is determined to be a false ban. In this case, the token validity period may be set too short, the user may have mistakenly discarded a valid token, or the user may have incorrectly triggered the token refresh process every time they send an access request. Further, corresponding adjustment suggestions should be sent to the gateway and / or the user to adjust the relevant gateway configurations or modify the program logic.

[0037] In a non-restricted example, if the frequency of user requests increases abnormally within a short period, the system first analyzes whether the user requests originate from the same browser page or front-end component. If the analysis shows that the access requests within a set time interval originate from the same source, have the same parameters, and the sending interval between adjacent requests is less than a preset interval threshold, it is determined to be a mistaken blocking due to an anomaly in the front-end polling. Furthermore, a prompt is sent to the user stating "Please disable automatic page refresh in your browser" or "Please adjust the front-end polling interval to no more than 2 seconds," and feedback is sent to the gateway stating "Add request interval control logic to the front-end code." If such mistaken blocking occurs frequently, the request frequency threshold for the corresponding interface in the gateway is automatically increased, or the user is added to a whitelist, allowing the user to send multiple access requests within a short period through the same browser page or front-end component.

[0038] In a non-restricted example, if the analysis shows that the access request is accompanied by multiple failed CAPTCHA verifications, and the request is deemed a mistaken block, the gateway's CAPTCHA service may be misconfigured, resulting in an invalid CAPTCHA received by the user, an excessively short validity period set for the CAPTCHA, or a logic error in the gateway's program causing a discrepancy between the CAPTCHA stored by the gateway and the CAPTCHA sent to the user. Further, corresponding adjustment suggestions should be sent to the gateway to adjust its relevant configurations or modify its program logic.

[0039] In a non-limiting example, after generating adjustment suggestions and sending them to the user and / or gateway, updated behavioral data is obtained. If a false blocking is detected again after the adjustment suggestions are generated, and the analysis results of the updated behavioral data are the same as the analysis results of the previous false blocking, it is determined that the matching degree of the adjustment suggestions generated by the preset scheme is low, meaning that the corresponding scheme in the preset scheme library needs to be adjusted and updated. A new corresponding scheme is generated based on the analysis results of the updated behavioral data, and the corresponding scheme in the preset scheme library is replaced.

[0040] This invention also provides a request processing system 200 for a gateway, comprising: The data acquisition module 201, in response to detecting that a user's access request is malicious, acquires the user's behavior data within a set time interval, wherein the access request is sent by the user to the gateway through the user terminal; the analysis module 202 is used to analyze the user's behavior data within the set time interval, and at least determine whether it is a false blocking based on the analysis results, including: if the analysis results show that the number of times the user triggers login requests within the set time interval exceeds a preset threshold, and the user terminal's local token cache is not enabled, then it is determined to be a false blocking; the suggestion generation module 203, if the determination result is yes, obtains the corresponding solution from the preset solution library based on the analysis results, generates adjustment suggestions based on the analysis results and the corresponding solution, and sends the adjustment suggestions to the user terminal and / or the gateway.

[0041] This invention also provides a computer-readable storage medium, which is a non-volatile or non-transitory storage medium storing a computer program. When executed by a processor, the computer program performs the steps of the request processing method for a gateway provided in any of the above embodiments. Preferably, the storage medium may include a computer-readable storage medium such as non-volatile or non-transitory memory. The storage medium may include ROM, RAM, a magnetic disk, or an optical disk, etc.

[0042] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the request processing method for a gateway provided in any of the above embodiments.

[0043] This invention also provides a server, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor runs the computer program, it executes the steps of the request processing method for a gateway provided in any of the above embodiments.

[0044] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by a program instructing related hardware. The program can be stored in a computer-readable storage medium, which may include ROM, RAM, disk, or optical disk, etc.

[0045] While the present invention has been disclosed above, it is not limited thereto. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of the invention; therefore, the scope of protection of the present invention should be determined by the scope defined in the claims.

Claims

1. A request processing method for a gateway, characterized in that, include: In response to detecting that a user's access request is malicious, the system obtains the user's behavior data within a set time interval, wherein the access request is sent by the user to the gateway through the user terminal; The user's behavioral data within a set time interval is analyzed, and at least the analysis results are used to determine whether the account was mistakenly blocked. If the judgment result is yes, then the corresponding solution is obtained from the preset solution library according to the analysis result, and an adjustment suggestion is generated according to the analysis result and the corresponding solution, and the adjustment suggestion is sent to the user terminal and / or gateway; The process of analyzing the user's behavioral data within a set time interval and determining whether the account was mistakenly blocked based on the analysis results includes: If the analysis results show that the number of times the user triggers login requests within a set time interval exceeds a preset threshold, and the user's local token cache is not enabled, then it is determined to be a false ban.

2. The request processing method for a gateway according to claim 1, characterized in that, The step of obtaining a corresponding solution from a preset solution library based on the analysis results, generating adjustment suggestions based on the analysis results and the corresponding solution, and sending the adjustment suggestions to the user terminal and / or gateway includes: A message indicating that local token caching is not enabled is sent to the user's client, suggesting that the user enable local token caching.

3. The request processing method for a gateway according to claim 1, characterized in that, If the analysis results show that the number of times the user triggers login requests within a set time interval exceeds a preset threshold, and the user's local token cache is not enabled, then the account is determined to be falsely blocked, including: If the analysis results indicate that the number of login requests triggered within a user-defined time interval exceeds a preset threshold, and the variance of the time interval between adjacent login requests is less than a preset variance threshold, then the user is prompted to upload a login configuration file. The system checks whether the local token cache on the user's client is enabled based on the login configuration file. If it is not enabled, the account is considered to have been mistakenly blocked.

4. The request processing method for a gateway according to claim 1, characterized in that, The step of analyzing the user's behavioral data within a set time interval, and at least determining whether the account was mistakenly blocked based on the analysis results, also includes: If the analysis results show that multiple adjacent user access requests carry the same request identifier and the sending interval between adjacent access requests is less than a preset time threshold, then it is determined to be a false blocking.

5. The request processing method for a gateway according to claim 4, characterized in that, The step of obtaining a corresponding solution from a preset solution library based on the analysis results, generating adjustment suggestions based on the analysis results and the corresponding solution, and sending the adjustment suggestions to the user terminal and / or gateway includes: A network instability alert is sent to the user terminal, and the gateway's filtering logic for access requests sent by the user is adjusted to identify and filter out duplicate requests sent by the user with an interval less than the preset time threshold.

6. The request processing method for a gateway according to claim 1, characterized in that, Analyzing the user's behavioral data within a set time interval, and at least determining whether the account was mistakenly blocked based on the analysis results, also includes: If the analysis results show that the same user logs in concurrently through multiple user terminals within the set time interval, it is determined to be a false ban; The step of obtaining a corresponding solution from a preset solution library based on the analysis results, generating adjustment suggestions based on the analysis results and the corresponding solution, and sending the adjustment suggestions to the user terminal and / or gateway includes: The gateway sends a prompt to the user client indicating that multiple devices can log in simultaneously, and adjusts the filtering logic of the gateway for the access requests sent by the user, adding the multiple user clients to the whitelist and allowing the multiple user clients to log in concurrently.

7. The request processing method for a gateway according to claim 1, characterized in that, The behavioral data includes a basic information log and a complete task chain log. The basic information log records a task identifier and basic information about the task indicated by that task identifier. The complete task chain log records a tracking identifier and detailed information about each task. The tracking identifier is associated with the task identifier. The amount of data in the detailed task information is greater than that in the basic information log. Analyzing the user's behavioral data within a set time interval includes: Based on the analysis of the basic information logs, the tasks involved in the access requests that were determined to be malicious were located. The associated tracking identifier is determined based on the task identifier obtained from the location, and the complete task chain log pointed to by the tracking identifier is determined; Analyze the complete task chain log.

8. The request processing method for a gateway according to claim 1, characterized in that, The method further includes: Get the updated behavior data; If a false ban is detected again after an adjustment suggestion is generated, and the analysis result obtained after analyzing the updated behavioral data is the same as the analysis result when the false ban was detected before, it is determined that the matching degree of the adjustment suggestion is low. Based on the analysis results of the updated behavioral data, a new corresponding solution is generated, and the corresponding solution in the preset solution library is replaced.

9. A request processing system for a gateway, characterized in that, include: The data acquisition module, in response to detecting that a user's access request is a malicious request, acquires the user's behavior data within a set time interval, wherein the access request is sent by the user to the gateway through the user terminal; The analysis module is used to analyze the user's behavior data within a set time interval, and at least determine whether the account is wrongly blocked based on the analysis results. If the analysis results show that the number of times the user triggers login requests within the set time interval exceeds a preset threshold, and the user's local token cache is not enabled, then the account is determined to be wrongly blocked. The suggestion generation module, if the judgment result is yes, retrieves the corresponding solution from the preset solution library based on the analysis result, generates adjustment suggestions based on the analysis result and the corresponding solution, and sends the adjustment suggestions to the user terminal and / or gateway.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the request processing method for a gateway as described in any one of claims 1 to 8.

11. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the steps of the request processing method for a gateway as described in any one of claims 1 to 8.

12. An electronic device comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, characterized in that, When the processor runs the computer program, it performs the steps of the request processing method for a gateway as described in any one of claims 1 to 8.