CN107046544B - Method and device for identifying illegal access request to website - Google Patents

Abstract

The embodiment of the present invention discloses a method and a device for identifying an illegal access request to a website. Wherein, the method for identifying an illegal access request to a website is characterized in that the method includes: obtaining the access request initiated by the client to the website, matching the link of the obtained access request with the legality rules of the whitelist, and identifying according to the matching result. Whether the obtained access request is legal. The whitelist defines the legality rules of the access request. When the website server obtains the access request, it loads the legality rules defined by the whitelist, and matches the obtained access request with the legality rules defined by the whitelist. According to the matching result To preliminarily identify whether the obtained access request is legal, so as to determine whether to load the interceptor for further verification according to the preliminary identification result, which can efficiently and accurately identify the legitimacy of the access request, and realize the on-demand loading of the interceptor, saving server resource occupation and improving The accuracy of blocking CSRF attacks.

Description

A method and apparatus for identifying an illegal access request to a website

technical field

The present invention relates to the technical field of network security, and in particular, to a method and device for identifying an illegal access request to a website.

Background technique

At present, the security problems of websites are becoming more and more serious, and it is very difficult for website administrators to find signs of suspicious activities from a large number of access requests.

In the prior art, a solution for identifying illegal http (hyper text transfer protocol, hypertext transfer protocol) access requests is to formulate a corresponding matching policy (judging access requests) according to known attack strategies (eg CSRF attack, sql injection attack). Illegal characters and illegal keywords) to intercept illegal access requests. The way to implement this solution is to use a special hardware firewall to load corresponding rules for filtering; the protection method based on CSRF attacks can be implemented by verifying the http referer field, where, According to the http protocol, there is a field called referer in the http header, and the httpreferer field records the source address of the http access request. Another method is to hide an input check value in each page form as a detection field, which is used to verify whether it is consistent with the server.

In the method of the prior art, illegal access requests are intercepted according to a predetermined matching strategy. This protection method has low security, poor protection against CSRF attacks, low detection efficiency, and http requests that do not require detection will also occupy Check resources. By adding an input check value to each page form, the development process is cumbersome and inefficient.

SUMMARY OF THE INVENTION

In order to solve the related technical problems, the present invention provides a method and device for identifying an illegal access request to a website, so as to efficiently and accurately identify the illegal access request to a website.

To achieve the above purpose, the embodiment of the present invention adopts the following technical solutions:

In a first aspect, an embodiment of the present invention provides a method for identifying an illegal access request to a website, the method comprising:

Obtain the access request initiated by the client to the website;

The obtained link of the access request is matched with the legality rule of the whitelist, and whether the obtained access request is legal is identified according to the matching result.

In a second aspect, an embodiment of the present invention also provides a device for identifying an illegal access request to a website, the device comprising:

an access request acquisition module, used to acquire the access request initiated by the client to the website;

The identification module is configured to match the obtained link of the access request with the legality rule of the whitelist, and identify whether the obtained access request is legal according to the matching result.

The beneficial effects brought by the technical solutions provided in the embodiments of the present invention:

In this technical solution, the whitelist defines the legitimacy rules of the access request link. When the website server obtains the access request initiated by the client to the website, it loads the legitimacy rules defined by the whitelist, and the link of the obtained access request is loaded. Match with the legality rules defined by the whitelist, and initially identify whether the obtained access request is legal according to the matching result. It is legal, so as to determine whether to load the interceptor for further verification according to the preliminary identification results. When the access request is legal, it is not necessary to load the interceptor. When the initial identification of the illegal access request is loaded with the interceptor for further verification, the legality of the access request can be accurately identified, and on-demand Loading an interceptor saves server resource usage and improves the accuracy of intercepting CSRF attacks.

Description of drawings

In order to illustrate the technical solutions in the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments of the present invention. Obviously, the drawings in the following description are only some embodiments of the present invention. , for those of ordinary skill in the art, other drawings can also be obtained according to the contents of the embodiments of the present invention and these drawings without creative efforts.

1 is a schematic flowchart of a method for identifying an illegal access request to a website provided by Embodiment 1 of the present invention;

2 is a schematic flowchart of a method for identifying an illegal access request to a website provided by Embodiment 2 of the present invention;

3 is a schematic flowchart of a method for identifying an illegal access request to a website provided by Embodiment 3 of the present invention;

4A is a schematic structural diagram of a device for identifying an illegal access request to a website according to Embodiment 4 of the present invention;

FIG. 4B is a schematic structural diagram of an optional implementation manner of the access request obtaining module 410 in FIG. 4A;

FIG. 4C is a schematic structural diagram of an optional implementation manner of the identification module 420 in FIG. 4A .

Detailed ways

In order to make the technical problems solved by the present invention, the technical solutions adopted and the technical effects achieved more clearly, the technical solutions of the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings. Obviously, the described embodiments are only the present invention. Some examples, but not all examples. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative efforts shall fall within the protection scope of the present invention.

Example 1

Please refer to FIG. 1 , which is a schematic flowchart of a method for identifying an illegal access request to a website provided by Embodiment 1 of the present invention. A method for identifying an illegal access request to a website provided by this embodiment is suitable for a scenario in which an access request initiated by a client to a website is legal. A method for identifying an illegal access request to a website provided by this embodiment may be executed by a device for identifying an illegal access request to a website. The device may be implemented by software and/or hardware and integrated in a corresponding website server.

As shown in FIG. 1 , a method for identifying an illegal access request to a website provided by this embodiment may include the following steps:

S110: Acquire an access request initiated by the client to the website.

Exemplarily, the client may be a terminal device held by the client, such as a desktop computer, a notebook computer, a tablet computer, a mobile phone, and the like. A website can refer to a collection of web pages that are used to display specific content and related web pages produced by tools such as HTML (Hyper Text Markup Language) according to certain rules on the Internet. Simply put, a website is a communication tool. Producers can publish the information they want to make public through the website, or use the website to provide related network services. A website server refers to a server that stores websites in an Internet data center. It is mainly used for the publication and application of websites on the Internet. It is the infrastructure of network applications. Each website server can receive website requests from at least one client to the website. . Access requests may include browsing requests for users to browse the web content of the website, registration requests for users to register an account on the website, login requests for users to log in to an existing account on the website, and abnormal access requests initiated by criminals maliciously attacking the website, etc. In this embodiment, access requests can be divided into regular access requests, specific access requests, and abnormal access requests. Regular access requests include browsing requests and other access requests that do not involve website security, and specific access requests include registration requests, login requests and Access requests that may affect the security of the website, such as requests to access website directory files, etc., abnormal access requests include requests to tamper with website directory files and other access requests to maliciously attack websites.

For example, the user can enter the website address information in the web browser on the client, open the website page, the client initiates an access request to the website according to the user's operation, and the website server obtains the access request. The specific manner in which the client initiates the access request and the specific manner in which the website server obtains the access request may be set according to the actual situation, which is not limited here.

S120. Match the obtained link of the access request with the validity rules of the whitelist, and identify whether the obtained access request is legal according to the matching result.

Exemplarily, the link of the access request is also called a hyperlink, which refers to a connection relationship from a webpage to a target, and the pointed target can be another webpage, or a different location on the same webpage, or a picture, E-mail addresses, files, and even applications, etc., the specific target depends on the access request obtained by the website server. The whitelist in this embodiment is configured based on the PHP (PHP: Hypertext Preprocessor, hypertext preprocessor) framework Kohana, and the whitelist defines the legality rules for accessing the request link, and the legality rules of the whitelist are preliminary to the website server. The basis for judging whether the obtained access request is legitimate.

For example, website server administrators can set identifiers for links that do not conform to a specific link form in the links to each target of the website in advance, to indicate that the access request corresponding to the link is initially judged to be an illegal access request, and an interceptor needs to be loaded. Intercept the access request to further verify whether the access request is an illegal access request, and the identifier is not set for links that conform to a specific link form. By default, the access request corresponding to this type of link is legal, and there is no need to load an interceptor to intercept. The website server administrator can specifically decide whether to set an identifier for a link according to the URL (Uniform ResourceLocator) in each link. Each target file on the website corresponds to a unique URL information. The URL information of the link can determine the type of the access request corresponding to the link. For example, according to the URL information in the link, it can be determined that the access request corresponding to the link is a general access request, a specific access request or an abnormal access request. The identifier is not set, and the identifier is set for the link of a specific access request and the link of an abnormal access request.

Preferably, identifying whether the obtained access request is legal according to the matching result includes: when the link of the access request does not conform to the set form rule, intercepting the access request; when the link of the access request conforms to the set form rule, Access requests are not intercepted. That is, the legality rule of the whitelist is defined as: for an access request corresponding to a link without an identifier set, it is determined as a legal access request, and an interceptor does not need to be loaded to intercept the access request. For the access request corresponding to the link with the set identifier, it is considered that it does not meet the legality rules of the whitelist, and it is initially determined to be an illegal access request. It is necessary to load an interceptor to intercept the access request to further verify whether it is an illegal request.

It should be noted that this embodiment uses the legality rule of the whitelist to preliminarily determine whether the obtained access request is legal, and no further verification is required for the access request that is preliminarily determined to be legal, but the access request that is preliminarily determined to be illegal needs to be verified. The loading interceptor further verifies whether it is an illegal access request. The operation flow of the further verification is an optional implementation manner given in the third embodiment, which will not be repeated here.

To sum up, in the method for identifying an illegal access request to a website provided by the first embodiment of the present invention, the whitelist defines the legitimacy rules of the access request link. When the server obtains the access request initiated by the client to the website, it loads the whitelist defined It matches the obtained access request link with the legality rule defined by the whitelist, and preliminarily identifies whether the obtained access request is legal according to the matching result. The scheme is simple to implement and can efficiently identify the legality of the access request. When the access request is legitimate, there is no need to load the interceptor. When the access request is initially identified as illegal, the interceptor is loaded for further verification, which can accurately identify the legitimacy of the access request, and realize the on-demand loading of the interceptor, which saves the occupation of server resources and improves the response to CSRF. The accuracy with which the attack is intercepted.

Embodiment 2

Please refer to FIG. 2 , which is a schematic flowchart of a method for identifying an illegal access request to a website according to Embodiment 2 of the present invention. The main difference between this embodiment and the first embodiment is that, on the basis of the embodiment, this embodiment further provides an optional implementation manner for S120 in the first embodiment.

As shown in FIG. 2, a method for identifying an illegal access request to a website provided by this embodiment may include the following steps:

S210: Acquire an access request initiated by the client to the website.

Optionally, on the basis of Embodiment 1, S120 in FIG. 1 may include two steps of S221 and S222, wherein:

S221. Analyze the obtained access request to obtain a link of the access request.

Exemplarily, the parsing of the acquired access request in this embodiment means that the website server parses the acquired request message of the access request, and obtains the link part of the access request in the request message.

S222. Match the link of the access request with the legality rule of the whitelist. If the matching is successful, it is determined that the acquired access request is legal, and if the matching is unsuccessful, it is determined that the acquired access request is illegal.

Exemplarily, the successful matching described in this embodiment means that the link of the access request obtained by the website server does not have an identifier set, which is consistent with the legality rules specified in the whitelist; If the match is unsuccessful, it means that the link of the access request obtained by the website server has a set identifier, which is inconsistent with the legality rules specified in the whitelist.

It should also be noted that the legality rule of the whitelist in this embodiment is to preliminarily determine whether the acquired access request is legal, and no further verification is required for the access request that is preliminarily determined to be legal, but the access request that is preliminarily determined to be illegal does not need to be further verified. An interceptor needs to be loaded to further verify whether it is an illegal access request, and the operation flow of further verification is given in the third embodiment as an optional implementation, which will not be repeated here.

To sum up, in the method for identifying an illegal access request to a website provided by the second embodiment of the present invention, the whitelist defines the legitimacy rules of the access request link. When the server obtains the access request initiated by the client to the website, it loads the whitelist defined It matches the obtained link of the access request with the legality rules defined by the whitelist, and preliminarily identifies whether the obtained access request is legal according to the matching result. The solution is simple and efficient. It can accurately identify the legitimacy of the access request. When the access request is legitimate, there is no need to load the interceptor. When the access request is initially identified as illegal, the interceptor is loaded for further verification. occupancy, which improves the accuracy of intercepting CSRF attacks.

Embodiment 3

Please refer to FIG. 3 , which is a schematic flowchart of a method for identifying an illegal access request to a website provided by Embodiment 3 of the present invention. On the basis of any of the above-mentioned embodiments, this embodiment supplements the operation process after initially identifying whether the access request is legal through the legality of the whitelist, and further provides an optional implementation manner in which the client initiates an access request to the website .

As shown in FIG. 3 , a method for identifying an illegal access request to a website provided by this embodiment may include the following steps:

S311. Receive a first resource request initiated by the client to the website, where the first resource request carries a user identifier, a first IP address, and a first initiation time.

S312. Generate a first check code according to the user identifier, the first IP address, and the first initiation time.

S313: Encrypt the first check code to obtain a second check code, and send the second check code to the client.

S314. After the client decrypts the second check code, a second resource request initiated by the website is received, and the second resource request carries the user ID, the first check code, the second IP address, and the second initiation time.

Exemplarily, when a client initiates an access request to a website through a browser, it usually initiates two resource requests successively, that is, a first resource request and a second resource request. The user identification may be digital code information such as the account number registered by the user on the website, the machine code of the client terminal, and the like. The first IP address refers to the IP address of the client when the website server receives the first resource request, the first initiation time refers to the time when the website server receives the first resource request, and the second IP address refers to the time when the website server receives the first resource request. The IP address of the client when the second resource is requested, and the second initiation time refers to the time point when the website server receives the second resource request.

The website server generates a first check code by setting an arithmetic rule according to the user ID, the first IP address and the first initiation time. The user ID, the first IP address and the first initiation time can form a digital code. The code is generally located behind the digital code, and is used to verify the accuracy of the digital code. Preferably, the first check code is encrypted by the md5 encryption algorithm. When the website server transmits the first verification code to the client, in order to prevent the user from directly obtaining the first verification code and initiating a request to the server without going through the client, and to improve information security, preferably, the website server first uses the XOR encryption algorithm. Encrypt the first check code to obtain the second check code, and indirectly transmit the first check code to the client by transmitting the second check code, and the client decrypts the second check code according to the corresponding decryption rule to obtain the second check code. The first check code is decrypted, and the encrypted first check code is decrypted.

It should be noted that the specific encryption algorithm and decryption algorithm mentioned in this embodiment do not constitute a limitation on the technical solution of the present invention. It should be clear to those skilled in the art that there are many specific encryption algorithms and decryption algorithms. Not to give examples one by one.

S320. Match the obtained link of the access request with the validity rules of the whitelist, and identify whether the obtained access request is legal according to the matching result.

Exemplarily, when the website server preliminarily identifies that the obtained access request is legal, it is not necessary to load the interceptor to intercept the access request and re-verify, and execute the following S330; The interceptor intercepts the access request, further verifies the access request, and executes the following S340.

S330. In response to the access request, send response data to the client.

Exemplarily, when the website server initially identifies that the access request is legal according to the legality rules of the whitelist, it means that the access request is a regular access request, which does not affect the security of the website. Therefore, the access request is normally responded to and response data is sent to the client. That's it, the process ends.

S340. Parse the first check code to obtain the first IP address and the first initiation time.

Exemplarily, parsing the first check code refers to calculating a digital code preceding the check code by using the above-mentioned set transportation rules, where the digital code is composed of a user ID, a first IP address, and a first origination time.

S350. Determine whether the first IP address is legal, whether the first initiation time is legal, whether the time difference between the first initiation time and the second initiation time is not greater than a preset duration, and whether the first IP address and the second IP address are the same.

Exemplarily, judging whether the first IP address is legal and whether the first initiation time is legal, the judgment is mainly based on whether the form of the IP address is garbled, and whether the form of the initiation time is garbled, wherein the IP address in the form of garbled and the initiation time are garbled. time is considered illegal. The preset duration in this embodiment is 2 minutes, and other values may also be set in other embodiments, which is not limited herein.

It should be noted that this step includes four judgment operations, and the above S330 is executed only when the judgment results of the four judgment operations are all "Yes", otherwise, the judgment result of any one or more judgment operations is "No". ”, then execute the following S360. Therefore, when the website server initially identifies that the access request is illegal through the legality rules of the whitelist, it does not mean that the access request must be an illegal access request, and an interceptor needs to be loaded to intercept the access request for further verification. The result finally determines whether the access request is a legal access request or an illegal access request.

S360. Do not respond to the access request, and prompt the client that the obtained access request is illegal.

Exemplarily, when an illegal access request is initially identified as an illegal access request after further verification by the interceptor, it is finally determined to be an illegal access request, the website server does not respond to the access request, and prompts the client that the obtained access request is illegal, and the process ends.

To sum up, in the method for identifying an illegal access request to a website provided by the third embodiment of the present invention, the whitelist defines the legitimacy rules of the access request link. When the server obtains the access request initiated by the client to the website, the whitelist defines the It matches the obtained access request link with the legality rule defined by the whitelist, and preliminarily identifies whether the obtained access request is legal according to the matching result. The scheme is simple to implement and can efficiently identify the legality of the access request. There is no need to load an interceptor for a preliminary identification of legitimate access requests. For an access request that is initially identified as illegal, an interceptor is loaded to further verify it. The illegal access request can accurately identify the legitimacy of the access request, and load the interceptor on demand, which saves the occupation of server resources and improves the accuracy of intercepting CSRF attacks.

The following is an example of a device for identifying an illegal access request to a website provided by an embodiment of the present invention. The device for identifying an illegal access request to a website and the above-mentioned method for identifying an illegal access request to a website belong to the same inventive concept. For details that are not described in detail in the examples, reference may be made to the embodiments of any of the above methods.

Embodiment 4

Please refer to FIG. 4A, FIG. 4B and FIG. 4C, wherein, FIG. 4A is a schematic diagram of the architecture of a device for identifying an illegal access request to a website provided by Embodiment 4 of the present invention; FIG. 4B is a block diagram of the access request obtaining module 410 in FIG. 4A FIG. 4C is a schematic structural diagram of an optional implementation manner of the identification module 420 in FIG. 4A .

As shown in FIG. 4A , an apparatus 400 for identifying an illegal access request to a website provided in this embodiment may include the following content:

The access request obtaining module 410 is configured to obtain the access request initiated by the client to the website.

Optionally, as shown in FIG. 4B , the access request obtaining module 410 may include a first resource request receiving unit 411, a first check code generating unit 412, an encryption unit 413 and a second resource request receiving unit 414, wherein:

The first resource request receiving unit 411 is configured to receive a first resource request initiated by the client to the website, where the first resource request carries a user identifier, a first IP address and a first initiation time.

The first check code generating unit 412 is configured to generate a first check code according to the user identifier, the first IP address and the first initiation time.

The encryption unit 413 is configured to encrypt the first check code, obtain the second check code, and send the second check code to the client.

The second resource request receiving unit 414 is configured to receive a second resource request initiated by the client to the website after decrypting the second check code, where the second resource request carries the user ID, the first check code, the second IP address and the Second launch time.

The identification module 420 is configured to match the obtained link of the access request with the legality rule of the whitelist, and identify whether the obtained access request is legal according to the matching result.

Preferably, identifying whether the acquired access request is legal according to the matching result includes: when the link of the access request does not conform to the set form rules, intercepting the access request; when the link of the access request conforms to the set form rules, then not Intercept the access request.

Optionally, as shown in FIG. 4C, the identification module 420 may include a link acquisition unit 421 and a matching unit 422, wherein:

The link obtaining unit 421 is configured to parse the obtained access request to obtain a link of the access request.

The matching unit 422 is configured to match the link of the access request with the validity rules of the whitelist. If the matching is successful, it is determined that the obtained access request is valid, and if the matching is unsuccessful, it is determined that the obtained access request is invalid.

The response data sending module 430 is configured to send response data to the client in response to the access request if it is identified that the obtained access request is legitimate.

The verification module 440 is configured to parse the first check code and obtain the first IP address and the first initiation time if it is identified that the obtained access request is illegal; if it is determined that the first IP address is legal, the first initiation time is legal, and the first If the time difference between the initiation time and the second initiation time is not greater than the preset time length, and the first IP address and the second IP address are the same, respond to the access request and return response data to the client; otherwise, do not respond to the access request and send the client The terminal prompts that the obtained access request is illegal.

To sum up, in the device for identifying an illegal access request to a website provided by the fourth embodiment of the present invention, the whitelist defines the legitimacy rules of the access request link. When the server obtains the access request initiated by the client to the website, it loads the whitelist defined It matches the obtained access request link with the legality rule defined by the whitelist, and preliminarily identifies whether the obtained access request is legal according to the matching result. The scheme is simple to implement and can efficiently identify the legality of the access request. When the access request is legitimate, there is no need to load the interceptor. When the access request is initially identified as illegal, the interceptor is loaded for further verification, which can accurately identify the legitimacy of the access request, and realize the on-demand loading of the interceptor, which saves the occupation of server resources and improves the response to CSRF. The accuracy with which the attack is intercepted.

Note that the above are only preferred embodiments of the present invention and applied technical principles. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the protection scope of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and can also include more other equivalent embodiments without departing from the concept of the present invention. The scope is determined by the scope of the appended claims.

Claims (8)

1. A method of identifying illegitimate access requests to a web site, the method comprising:

acquiring an access request initiated by a client to the website;

matching the link of the obtained access request with the legality rule of a white list, and identifying whether the obtained access request is legal or not according to a matching result;

the step of obtaining the access request initiated by the client to the website includes:

receiving a first resource request initiated by the client to the website, wherein the first resource request carries a user identifier, a first IP address and first initiation time;

generating a first check code according to the user identifier, the first IP address and the first initiation time;

encrypting the first check code to obtain a second check code, and sending the second check code to the client;

receiving a second resource request initiated by the client to the website after decrypting the second check code, wherein the second resource request carries the user identifier, the first check code, a second IP address and second initiation time;

after the step of matching the link of the obtained access request with the validity rule of the white list and identifying whether the obtained access request is valid according to the matching result, the method further comprises the following steps:

if the obtained access request is identified to be illegal, analyzing the first check code to obtain the first IP address and first initiation time;

and if the first IP address is determined to be legal, the first initiating time is legal, the time difference between the first initiating time and the second initiating time is not more than the preset time, and the first IP address and the second IP address are the same, responding to the access request and returning response data to the client, otherwise, not responding to the access request and prompting the client that the obtained access request is illegal.

2. The method of claim 1, wherein said identifying whether the obtained access request is legitimate based on the matching result comprises:

intercepting the access request when the link of the access request does not accord with a set form rule;

and when the link of the access request conforms to a set form rule, the access request is not intercepted.

3. The method of claim 1, wherein the step of matching the link of the obtained access request with the validity rule of the whitelist and identifying whether the obtained access request is valid according to the matching result comprises:

analyzing the obtained access request to obtain a link of the access request;

matching the link of the access request with the validity rule of the white list, if the matching is successful, determining that the obtained access request is legal, and if the matching is unsuccessful, determining that the obtained access request is illegal;

the validity rule is as follows:

and judging the access request corresponding to the link without the identifier as a legal access request without loading an interceptor to intercept the access request.

4. The method according to any of claims 1-3, wherein after the step of matching the link of the obtained access request with the validity rule of the whitelist and identifying whether the obtained access request is valid according to the matching result, further comprising:

and if the obtained access request is identified to be legal, responding to the access request and sending response data to the client.

5. An apparatus for identifying an illegitimate access request to a website, the apparatus comprising:

the access request acquisition module is used for acquiring an access request initiated by a client to the website;

the identification module is used for matching the link of the obtained access request with the legality rule of the white list and identifying whether the obtained access request is legal or not according to the matching result;

the access request acquisition module comprises:

a first resource request receiving unit, configured to receive a first resource request initiated by the client to the website, where the first resource request carries a user identifier, a first IP address, and a first initiation time;

the first check code generating unit is used for generating a first check code according to the user identifier, the first IP address and the first initiation time;

the encryption unit is used for encrypting the first check code to obtain a second check code and sending the second check code to the client;

a second resource request receiving unit, configured to receive a second resource request initiated by the client to the website after decrypting the second check code, where the second resource request carries the user identifier, the first check code, a second IP address, and a second initiation time;

the device further comprises:

the verification module is used for analyzing the first check code to obtain the first IP address and the first initiation time if the obtained access request is identified to be illegal; and if the first IP address is determined to be legal, the first initiating time is legal, the time difference between the first initiating time and the second initiating time is not more than the preset time, and the first IP address and the second IP address are the same, responding to the access request and returning response data to the client, otherwise, not responding to the access request and prompting the client that the obtained access request is illegal.

6. The apparatus of claim 5, wherein the identifying whether the obtained access request is legitimate according to the matching result comprises:

intercepting the access request when the link of the access request does not accord with a set form rule;

and when the link of the access request conforms to a set form rule, the access request is not intercepted.

7. The apparatus of claim 5, wherein the identification module comprises:

the link acquisition unit is used for analyzing the acquired access request to acquire a link of the access request;

the matching unit is used for matching the link of the access request with the legality rule of the white list, if the matching is successful, the obtained access request is determined to be legal, and if the matching is unsuccessful, the obtained access request is determined to be illegal;

the validity rule is as follows:

and judging the access request corresponding to the link without the identifier as a legal access request without loading an interceptor to intercept the access request.

8. The apparatus of any of claims 5-7, wherein the apparatus further comprises:

and the response data sending module is used for responding to the access request and sending response data to the client if the obtained access request is identified to be legal.

Images