CN117319076A - Network request interception method and device and electronic equipment - Google Patents

Abstract

The embodiments of the present application disclose network request interception methods, devices and electronic devices. A specific implementation of the method includes: in response to receiving a network request, obtaining the target address of the network request, where the target address includes an Internet protocol address and/or a gateway address, and the network request originates from a publisher in a publish-subscribe model. The subscription model includes publishers and subscribers. The publisher sends messages to the topic, and the subscriber consumes the messages in the subscribed topic; performs a preset operation on the target address to obtain the index value to determine whether the target topic exists, where, The target topic is the topic corresponding to the index value; if it exists, the request information of the network request is sent to the target topic so that the target subscriber can obtain the request information and determine whether to intercept the network request, where the target subscriber is the subscription Subscribers to the target topic. This implementation decouples the production and consumption of network requests to improve system performance.

Description

Network request interception method, device and electronic device

Technical field

The embodiments of the present disclosure relate to the field of computer technology, and specifically to network request interception methods, devices and electronic devices.

Background technique

With the development of Internet technology, servers will receive a large number of network requests every day. Some abnormal or illegal requests will threaten the security of the server, causing the server to paralyze or illegally obtain user information. At this time, these abnormal or illegal network requests need to be processed. Interception.

Existing interception of network requests is mostly focused on Nginx's IP list settings and network identity information verification within the system. The above two restrictions on network requests mainly use IP address information judgment at the technical implementation level, as well as the network address information of the server business system and network request header information for specific counterfeiting judgment.

Contents of the invention

This Disclosure is provided to introduce in simplified form the concepts that are later described in detail in the Detailed Description. This disclosure section is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to be used to limit the scope of the claimed technical solution.

In a first aspect, embodiments of the present disclosure provide a method for intercepting network requests, including: in response to receiving a network request, obtaining a target address of the network request, where the target address includes an Internet protocol address and/or a gateway address, and the source of the network request. For publishers in the publish-subscribe model, the publish-subscribe model includes publishers and subscribers. The publisher sends messages to topics, and subscribers consume messages in the subscribed topics; preset operations are performed on the target address to obtain the index. value to determine whether there is a target topic, where the target topic is the topic corresponding to the index value; if it exists, the request information of the network request is sent to the target topic so that the target subscriber can obtain the request information and determine whether to make the network request. Perform interception, where the target subscriber is the subscriber who subscribes to the target topic.

In a second aspect, embodiments of the present disclosure provide a network request interception device, including: an acquisition unit, configured to obtain the target address of the network request in response to receiving the network request, wherein the target address includes an Internet protocol address and/or a gateway Address, the network request comes from the publisher in the publish-subscribe model. The publish-subscribe model includes publishers and subscribers. The publisher sends messages to the topic, and the subscriber consumes the messages in the subscribed topic; determine the unit with Perform a preset operation on the target address to obtain the index value to determine whether there is a target topic, where the target topic is the topic corresponding to the index value; the interception unit is used to send the request information of the network request to the target topic if it exists , for the target subscriber to obtain the request information and determine whether to intercept the network request, where the target subscriber is the subscriber that subscribes to the target topic.

In a third aspect, embodiments of the present disclosure provide an electronic device, including: one or more processors; a storage device configured to store one or more programs. When the one or more programs are processed by the one or more Execution by multiple processors causes the one or more processors to implement the network request interception method described in the first aspect.

In a fourth aspect, embodiments of the present disclosure provide a computer-readable medium on which a computer program is stored. When the program is executed by a processor, the steps of the network request interception method as described in the first aspect are implemented.

The network request interception method, device and electronic device provided by the embodiments of the present disclosure obtain the target address of the above-mentioned network request by responding to the network request sent by the publisher in the publish-subscribe model; and then preset the above-mentioned target address. The operation obtains the index value and determines whether there is a target topic corresponding to the index value; if it exists, the request information of the above network request is sent to the above target topic so that subscribers who subscribe to the above target topic can obtain the above request information and determine whether Intercept the above network requests. By using the publish-subscribe model to process network requests, after the producer side generates the network request, the subscriber side determines whether to intercept the network request, thereby decoupling the production and consumption of network requests and improving system performance.

Description of drawings

The above and other features, advantages, and aspects of various embodiments of the present disclosure will become more apparent with reference to the following detailed description taken in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numbers refer to the same or similar elements. It is to be understood that the drawings are schematic and that elements and elements are not necessarily drawn to scale.

Figure 1 is a flow chart of an embodiment of a network request interception method according to the present disclosure;

Figure 2 is a flow chart of one embodiment of interception of network requests by a target subscriber in the network request interception method according to the present disclosure;

Figure 3 is a schematic structural diagram of an embodiment of a network request interception device according to the present disclosure;

Figure 4 is an exemplary system architecture diagram in which various embodiments of the present disclosure may be applied;

FIG. 5 is a schematic structural diagram of a computer system suitable for implementing an electronic device according to an embodiment of the present disclosure.

Detailed ways

Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the disclosure are shown in the drawings, it should be understood that the disclosure may be embodied in various forms and should not be construed as limited to the embodiments set forth herein, which rather are provided for A more thorough and complete understanding of this disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of the present disclosure.

It should be understood that various steps described in the method implementations of the present disclosure may be executed in different orders and/or in parallel. Furthermore, method embodiments may include additional steps and/or omit performance of illustrated steps. The scope of the present disclosure is not limited in this regard.

As used herein, the term "include" and its variations are open-ended, ie, "including but not limited to." The term "based on" means "based at least in part on." The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; and the term "some embodiments" means "at least some embodiments". Relevant definitions of other terms will be given in the description below.

It should be noted that concepts such as “first” and “second” mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units. Or interdependence.

It should be noted that the modifications of "one" and "plurality" mentioned in this disclosure are illustrative and not restrictive. Those skilled in the art will understand that unless the context clearly indicates otherwise, it should be understood as "one or Multiple”.

The names of messages or information exchanged between multiple devices in the embodiments of the present disclosure are for illustrative purposes only and are not used to limit the scope of these messages or information.

Please refer to FIG. 1 , which shows a process 100 of one embodiment of a network request interception method according to the present disclosure. This network request interception method includes the following steps:

Step 101: In response to receiving the network request, obtain the target address of the network request.

In this embodiment, the execution subject of the network request interception method can determine whether a network request is received. The above network requests usually originate from the publisher in the publish-subscribe model. The publish-subscribe model includes publishers and subscribers. The publisher sends messages to the topic, and the subscriber consumes the messages in the subscribed topic. A topic can be understood as a container for storing messages.

In software architecture, publish-subscribe is a messaging paradigm in which the sender of a message (called a publisher) does not send the message directly to a specific receiver (called a subscriber). Instead, published messages are grouped into different categories without knowing which subscribers (if any) might exist. Likewise, subscribers can express interest in one or more categories and receive only messages of interest without knowing which publishers (if any) exist.

If a network request is received, the above execution subject can obtain the target address of the above network request. Here, the above-mentioned target address usually includes an Internet Protocol Address (IP) address and/or a gateway address.

Step 102: Perform a preset operation on the target address to obtain the index value, and determine whether the target topic exists.

In this embodiment, the execution subject may perform a preset operation on the target address to obtain an index value. Here, the above execution subject can use the RSA algorithm to calculate the above target address to obtain the index value. RSA is an asymmetric encryption algorithm. The so-called asymmetry means that the algorithm requires a pair of keys. If you use one of them to encrypt, you need to use the other to decrypt. Indexes provide pointers to data values stored in specified columns of a table, and then sort these pointers according to a sort order that you specify. The database uses indexes to find a specific value and then points forward to find the row containing that value. This allows SQL statements corresponding to the table to execute faster and allows quick access to specific information in the database table.

Afterwards, the above-mentioned execution subject can determine whether there is a target topic, and the above-mentioned target topic usually refers to the topic corresponding to the above-mentioned index value. The above-mentioned execution subject may store a correspondence table containing the correspondence between the index value and the topic. The above-mentioned execution subject may use the above-mentioned index value as a key and query whether there is a topic (i.e. value) corresponding to the key in the above-mentioned correspondence table. .

It should be noted that the index values corresponding to target addresses from the same area usually point to the same topic.

If the target topic exists, the above execution subject can execute step 103.

Step 103, if it exists, send the request information of the network request to the target topic so that the target subscriber can obtain the request information and determine whether to intercept the network request.

In this embodiment, if it is determined that the target topic exists in step 102, the execution subject may send the request information of the network request to the target topic, so that the target subscriber can obtain the request information and determine whether to perform the network request. Interception. The above target subscribers are usually subscribers who subscribe to the above target topic. The above request information may include but is not limited to: IP address, gateway address, content type, character set, request time, content length and operation.

As an example, the above request information can be: "IP": "128.12.11.244", "gateway": "HTTP/1.1200OK; Jerry-Response-data: response-jerry; Content-Type: text/html; charset=UTF -8; Date: Fri, 30Sep 2022 09:35:22GMT; content-length: "2", "operate": "query".

Specifically, after the above execution subject sends the request information of the above network request to the target topic, the target subscriber who subscribes to the target topic will receive the notification and obtain the above request information from the target topic; after that, the target subscriber can determine Whether to intercept the above network requests.

As an example, the above-mentioned target subscriber can determine whether the above-mentioned network request complies with the preset interception rules, and if it meets the above-mentioned interception rules, the above-mentioned network request can be intercepted. The above interception rule may be that the number of executions of the same type of operation from a network request originating from the same IP address exceeds the preset first count threshold (for example, 20 times) within a preset first period of time (for example, 1 minute), or It can be that the number of executions of any operation from a network request originating from the same IP address exceeds the preset number of times (for example, 60 times) within a preset second period of time (for example, 2 minutes), and there is no specific limit here.

The method provided by the above-mentioned embodiments of the present disclosure obtains the target address of the above-mentioned network request by responding to the network request sent by the publisher in the publish-subscribe model; then, performs a preset operation on the above-mentioned target address to obtain the index value, and determines whether There is a target topic corresponding to the index value; if it exists, the request information of the above-mentioned network request is sent to the above-mentioned target topic, so that subscribers who subscribe to the above-mentioned target topic can obtain the above-mentioned request information and determine whether to intercept the above-mentioned network request. By using the publish-subscribe model to process network requests, after the producer side generates the network request, the subscriber side determines whether to intercept the network request, thereby decoupling the production and consumption of network requests and improving system performance.

In some optional implementations, the target subscriber can determine whether to intercept the network request through the following steps: the target subscriber can determine whether the target address exists in a preset set of addresses to be intercepted. The above set of addresses to be intercepted is usually stored in Nginx, and network requests usually go through Nginx first. Nginx is a web server that can also be used for load balancing and reverse proxy. Currently, load balancing is the most commonly used.

If it does not exist in the above set of addresses to be intercepted, the above target subscriber can determine whether the above network request complies with the preset interception rules. The above interception rule may be that the number of executions of the same type of operation by an IP address originating from the same user or the same area (for example, the same computer room) within a preset third period of time (for example, 1 minute) exceeds the preset third threshold ( For example, 40 times), or the number of executions of any operation by an IP address originating from the same user or the same region within a preset fourth period of time (for example, 2 minutes) exceeds the preset fourth threshold (for example, 80 times). times), there are no specific restrictions here.

If the above network request complies with the above interception rule, the above target subscriber can determine whether the above target address exists in the preset suspicious address set. The addresses in the above suspicious address collection are usually addresses that have been previously confirmed to comply with the above blocking rules.

If it exists in the above set of suspicious addresses, the above target address can be added to the above set of addresses to be intercepted. In other words, if the above target address is determined to be a suspicious address again, it will be added to the above set of addresses to be intercepted.

In this way, suspicious network requests can be verified twice, preventing misuse of suspicious IP addresses, and intercepting network requests more accurately.

In some optional implementations, the above-mentioned target subscriber can add the above-mentioned target address to the above-mentioned set of addresses to be intercepted in the following manner: the above-mentioned target subscriber can determine whether the target field corresponding to the above-mentioned target address in the above-mentioned suspicious address set is is the first value. The above target field usually indicates whether the address has been added to the set of addresses to be intercepted, and the above first value usually indicates that the address is a suspicious address.

If it is determined that the target field is the first value, the value of the target field can be modified to a second value. The second value usually indicates that the address has not been added to the set of addresses to be intercepted.

In response to detecting that the value of the target field is the second value, the target subscriber may add the target address to the set of addresses to be intercepted. That is to say, after it is determined that the above target address is a suspicious address and has not been added to the above set of addresses to be intercepted, it can be added to the set of addresses to be intercepted.

It should be noted that after the above target address is added to the above set of addresses to be intercepted, the value of the target field corresponding to the above target address will be modified to a third value. The above third value usually indicates that it has been added to the set of addresses to be intercepted. middle.

This method of judging whether the IP address and gateway address violates the rules is implemented by judging the target field corresponding to the target address.

In some optional implementations, the above-mentioned target subscriber can respond to detecting that the value of the above-mentioned target field is the second value in the following manner, adding the above-mentioned target address to the above-mentioned set of addresses to be intercepted: the above-mentioned target subscriber can set For scheduled tasks, after the scheduled task is triggered, the above-mentioned target subscriber will receive the scheduled task execution instruction. After that, the address whose target field is the above-mentioned second value in the above-mentioned suspicious address set can be retrieved. Then, the retrieved address can be added to the above set of addresses to be intercepted, and the value of the target field corresponding to the above retrieved address can be modified to a third value. The above third value usually indicates that the address has been added to the set of addresses to be intercepted. middle.

It should be noted that after adding the retrieved address to the above set of addresses to be intercepted, Nginx needs to be restarted. After restarting, Nginx will use the updated set of addresses to be intercepted to intercept subsequent addresses received.

Here, the above-mentioned target field may be a "whether it has been added to Nginx" field. As an example, the above-mentioned first value may be 2, the above-mentioned second value may be 1, and the above-mentioned third value may be 0.

This method decouples the two tasks of determining address violations and adding them to the set to be intercepted through scheduled task execution, further improving system performance.

In some optional implementations, after determining whether the above-mentioned target address exists in the preset suspicious address set, if it is determined that it does not exist in the above-mentioned suspicious address set, the above-mentioned target subscriber can store the above-mentioned target address in In the above set of suspicious addresses, the field information may be an auto-incremented ID field, an IP address field, a gateway information field and the above-mentioned target field. Usually, the above-mentioned target field is set to the above-mentioned first value, that is, the above-mentioned target address is a suspicious address by default. In this way, the target address of the first violating network request can be added to the set of suspicious addresses. Compared with directly intercepting network requests, this method can prevent mistaken interception of network requests.

In some optional implementations, after determining whether the above-mentioned target address exists in the preset set of addresses to be intercepted, if it is determined to exist in the above set of addresses to be intercepted, the above-mentioned target subscriber can make the above-mentioned network request. Interception, that is to say, when the above network request passes through the Nginx server, it is directly intercepted by the Nginx server.

In some optional implementations, the correspondence between the index value and the topic can be determined in the following way: a preset address library can be obtained, and the address library can store known target addresses, for example, received The IP address and gateway address of the network request. Afterwards, for each address in the above address library, a preset operation can be performed on the address to obtain an index value. As an example, you can perform a hash operation on the IP address and the gateway address respectively to obtain the hash code as the index value, or you can perform an RSA operation on the IP address and the gateway address respectively to obtain the index value. Then, the index value can be matched with a topic in the above publish-subscribe model to generate a corresponding relationship between the index value and the topic. It should be noted that the index values corresponding to addresses originating from the same area usually match the same topic. A topic can only correspond to the index value of the address of one area, or it can correspond to the index value of the addresses of multiple areas.

In some optional implementations, the above-mentioned execution subject can perform a preset operation on the above-mentioned target address to obtain the index value in the following manner: the above-mentioned execution subject can perform a hash operation on the above-mentioned target address to obtain a hash code. ) as the index value. Hashing converts input of any length (also called pre-mapping pre-image) into a fixed-length output through a hash algorithm, and the output is the hash value. This transformation is a compressed mapping, that is, the space of hash values is usually much smaller than the space of inputs, and different inputs may hash to the same output, so it is impossible to determine a unique input value from the hash value. Simply put, it is a function that compresses a message of any length into a message digest of a fixed length.

In some optional implementations, the above publish-subscribe model can be a Kafka system. Kafka is a distributed streaming media platform and a high-throughput, durable, distributed publish-subscribe message queue system. Using the Kafka system to intercept network requests can improve the request interception effect.

Continuing to refer to FIG. 2 , it shows a process 200 of one embodiment in which a target subscriber intercepts a network request in the network request interception method. The process 200 of the network request interception method includes the following steps:

Step 201: Determine whether the target address exists in a preset set of addresses to be intercepted.

In this embodiment, the target subscriber can determine whether the above target address exists in a preset set of addresses to be intercepted. The above set of addresses to be intercepted is usually stored in Nginx, and network requests usually go through Nginx first. Nginx is a web server that can also be used for load balancing and reverse proxy. Currently, load balancing is the most commonly used.

If it is determined that the address does not exist in the set of addresses to be intercepted, the target subscriber may perform step 202.

If it is determined that the address exists in the set of addresses to be intercepted, the target subscriber may perform step 209.

Step 202: If the address does not exist in the set of addresses to be intercepted, determine whether the network request complies with the preset interception rules.

In this embodiment, if it is determined in step 201 that the address does not exist in the set of addresses to be intercepted, the target subscriber can determine whether the network request complies with the preset interception rules.

The above interception rule may be that the number of executions of the same type of operation by an IP address originating from the same user or the same area (for example, the same computer room) within a preset third period of time (for example, 1 minute) exceeds the preset third threshold ( For example, 40 times), or the number of executions of any operation by an IP address originating from the same user or the same region within a preset fourth period of time (for example, 2 minutes) exceeds the preset fourth threshold (for example, 80 times). times), there are no specific restrictions here.

If it is determined that the above interception rules are met, the above target subscriber can perform step 203.

Step 203: If the interception rules are met, determine whether the target address exists in a preset suspicious address set.

In this embodiment, if it is determined in step 202 that the interception rule is met, the target subscriber can determine whether the target address exists in a preset suspicious address set. The addresses in the above suspicious address collection are usually addresses that have been previously confirmed to comply with the above blocking rules.

If it exists in the above suspicious address set, the above target subscriber can perform step 204.

If it does not exist in the above suspicious address set, the above target subscriber can perform step 208.

Step 204: If it exists in the suspicious address set, determine whether the target field corresponding to the target address in the suspicious address set is the first value.

In this embodiment, if it is determined in step 203 that the target address exists in the suspicious address set, the target subscriber can determine whether the target field corresponding to the target address in the suspicious address set is the first value. The above target field usually indicates whether the address has been added to the set of addresses to be intercepted, and the above first value usually indicates that the address is a suspicious address.

If the target field is the first value, the above target subscriber can perform step 205.

Step 205: If the target field is the first value, modify the value of the target field to the second value.

In this embodiment, if it is determined in step 204 that the target field is the first value, the target subscriber can modify the value of the target field to a second value. The second value usually indicates that the target field has not been added to In the above set of addresses to be intercepted.

Step 206: In response to receiving the scheduled task execution instruction, retrieve the address whose target field is the second value in the suspicious address set.

In this embodiment, the above-mentioned target subscriber can set a scheduled task. After the scheduled task is triggered, the above-mentioned target subscriber will receive the scheduled task execution instruction. After that, it can be retrieved that the target field in the above-mentioned suspicious address set is the above-mentioned second The address of the value.

Step 207: Add the retrieved address to the set of addresses to be intercepted, and modify the value of the target field corresponding to the retrieved address to a third value.

In this embodiment, the target subscriber can add the retrieved address to the set of addresses to be intercepted, and modify the value of the target field corresponding to the retrieved address to a third value. The third value usually represents has been added to the set of addresses to be blocked.

It should be noted that after adding the retrieved address to the above set of addresses to be intercepted, Nginx needs to be restarted. After restarting, Nginx will use the updated set of addresses to be intercepted to intercept subsequent addresses received.

Here, the above-mentioned target field may be a "whether it has been added to Nginx" field. As an example, the above-mentioned first value may be 2, the above-mentioned second value may be 1, and the above-mentioned third value may be 0.

Step 208: If it does not exist in the suspicious address set, store the target address in the suspicious address set, and set the target field to the first value.

In this embodiment, if it is determined in step 203 that it does not exist in the above-mentioned suspicious address set, the above-mentioned target subscriber can store the above-mentioned target address in the above-mentioned suspicious address set. The field information can be an auto-increment ID field, In the IP address field, the gateway information field and the above-mentioned target field, the above-mentioned target field is usually set to the above-mentioned first value, that is, the above-mentioned target address is a suspicious address by default.

Step 209: If it exists in the set of addresses to be intercepted, intercept the network request.

In this embodiment, if it is determined in step 201 that the target subscriber exists in the set of addresses to be intercepted, the target subscriber can intercept the network request. That is to say, when the network request passes through the Nginx server, it is directly intercepted. Nginx server interception.

The method provided by the above embodiments of the present disclosure can perform secondary verification on suspicious network requests, prevent misuse of suspicious IP addresses, and intercept network requests more accurately. In addition, the two tasks of determining address violations and adding to the set to be intercepted are decoupled through scheduled task execution to further improve system performance.

With further reference to Figure 3, as an implementation of the methods shown in the above figures, this application provides an embodiment of a network request interception device. The device embodiment corresponds to the method embodiment shown in Figure 1. The device is specifically Can be used in various electronic devices.

As shown in FIG. 3 , the network request interception device 300 in this embodiment includes: an acquisition unit 301 , a determination unit 302 and an interception unit 303 . Wherein, the obtaining unit 301 is used to obtain the target address of the network request in response to receiving the network request, where the target address includes an Internet protocol address and/or a gateway address, and the network request originates from the publisher in the publish-subscribe model. The publish-subscribe model Including publishers and subscribers, publishers send messages to topics, and subscribers consume messages in the subscribed topics; the determination unit 302 is used to perform a preset operation on the target address to obtain the index value, and determine whether the target topic exists , where the target topic is the topic corresponding to the index value; the interception unit 303 is used to send the request information of the network request to the target topic if it exists, so that the target subscriber can obtain the request information and determine whether to intercept the network request. , where the target subscriber is the subscriber who subscribes to the target topic.

In this embodiment, the specific processing of the acquisition unit 301, the determination unit 302 and the interception unit 303 of the network request interception device 300 can refer to step 101, step 102 and step 103 in the corresponding embodiment of Figure 1.

In some optional implementations, the target subscriber determines whether to intercept the network request through the following steps: determine whether the target address exists in the preset set of addresses to be intercepted; if it does not exist in the set of addresses to be intercepted, determine Whether the network request meets the preset interception rules; if it meets the interception rules, it is determined whether the target address exists in the preset suspicious address set; if it exists in the suspicious address set, the target address is added to the set of addresses to be intercepted.

In some optional implementations, the target subscriber adds the target address to the set of addresses to be intercepted through the following steps: determine whether the target field corresponding to the target address in the suspicious address set is the first value, where the target field indicates whether has been added to the set of addresses to be intercepted, and the first numerical value indicates that the address is a suspicious address; if the target field is the first numerical value, the value of the target field is modified to the second numerical value, wherein the second numerical value indicates that the address has not been added to the set of addresses to be intercepted. in the set of intercepted addresses; in response to detecting that the value of the target field is the second value, the target address is added to the set of addresses to be intercepted.

In some optional implementations, the target subscriber responds to detecting that the value of the target field is the second value through the following steps: adding the target address to the set of addresses to be intercepted: in response to receiving the scheduled task execution instruction, retrieving The target field in the suspicious address set is an address with the second value; the retrieved address is added to the set of addresses to be intercepted, and the value of the target field corresponding to the retrieved address is modified to a third value, where the third value represents has been added to the set of addresses to be blocked.

In some optional implementations, after determining whether the target address exists in a preset suspicious address set, the step further includes: if it does not exist in the suspicious address set, storing the target address in the suspicious address set, and Set the target field to the first value.

In some optional implementations, after determining whether the target address exists in a preset set of addresses to be intercepted, the step further includes: intercepting the network request if it exists in the set of addresses to be intercepted.

In some optional implementations, the correspondence between the index value and the topic is determined by: obtaining the preset address library; for each address in the address library, performing a preset operation on the address to obtain the index value , match the index value with a topic in the publish-subscribe model, and generate a correspondence between the index value and the topic, where the index value corresponding to the address originating from the same area matches the same topic.

In some optional implementations, the determining unit 302 further performs a preset operation on the target address to obtain the index value in the following manner: performs a hash operation on the target address to obtain a hash code as the index value.

In some optional implementations, the publish-subscribe model is Kafka system.

With further reference to FIG. 4 , FIG. 4 illustrates an exemplary system architecture 400 to which embodiments of the network request interception method of the present disclosure may be applied.

As shown in Figure 4, the system architecture 400 may include publishers 4011, 4012, 4013, networks 4021, 4022, servers 403 and subscribers 4041, 4042, 4043. Network 4021 is used to provide a medium for communication links between publishers 4011, 4012, 4013 and server 403, and network 4022 is used to provide a medium for communication links between server 403 and subscribers 4041, 4042, 4043. Networks 4021, 4022 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.

Users can use publishers 4011, 4012, 4013 to interact with the server 403 through the network 4021, and use subscribers 4041, 4042, 4043 to interact with the server 403 through the network 4022 to send or receive messages, etc., for example, the server 403 can interact with the server 403 from the publisher 4011 , 4012, 4013 received network requests are stored in the topic, and the network requests can be sent to the corresponding subscribers 4041, 4042, 4043. Various communication client applications can be installed on the publishers 4011, 4012, 4013 and the subscribers 4041, 4042, 4043, such as shopping applications, instant messaging software, etc.

Publishers 4011, 4012, and 4013 can be hardware or software. When the publishers 4011, 4012, and 4013 are hardware, they can be various electronic devices with display screens and supporting information interaction, including but not limited to smart phones, tablet computers, laptop computers, etc. When the publishers 4011, 4012, and 4013 are software, they can be installed in the electronic devices listed above. It can be implemented as multiple software or software modules (for example, multiple software or software modules used to provide distributed services), or as a single software or software module. There are no specific limitations here.

Subscribers 4041, 4042, and 4043 can be hardware or software. When the subscribers 4041, 4042, and 4043 are hardware, they may be various electronic devices with display screens and supporting information interaction, including but not limited to smart phones, tablet computers, laptop computers, etc. When the subscribers 4041, 4042, and 4043 are software, they can be installed in the electronic devices listed above. It can be implemented as multiple software or software modules (for example, multiple software or software modules used to provide distributed services), or as a single software or software module. There are no specific limitations here.

Server 403 may be a server that provides various services. For example, it can be a backend server that analyzes network requests. The server 103 can first receive the network request sent by the publishers 4011, 4012, and 4013, and obtain the target address of the network request; then, perform a preset operation on the target address to obtain the index value, and determine whether there is a target topic corresponding to the index value; if If exists, the request information of the network request is sent to the target topic, so that the subscribers 4041, 4042, and 4043 who subscribe to the target topic can obtain the request information and determine whether to intercept the network request.

It should be noted that the server 403 may be hardware or software. When the server 403 is hardware, it can be implemented as a distributed server cluster composed of multiple servers, or it can be implemented as a single server. When the server 403 is software, it may be implemented as multiple software or software modules (for example, used to provide distributed services), or it may be implemented as a single software or software module. There are no specific limitations here.

It should also be noted that the network request interception method provided by the embodiment of the present disclosure is usually executed by the server 403, and the network request interception device is usually provided in the server 403.

It should be understood that the numbers of publishers, networks, servers and subscribers in Figure 4 are only illustrative. You can have any number of publishers, networks, servers, and subscribers depending on your implementation needs.

Referring now to FIG. 5 , a schematic structural diagram of an electronic device (eg, the server in FIG. 4 ) 500 suitable for implementing embodiments of the present disclosure is shown. The electronic device shown in FIG. 5 is only an example and should not bring any limitations to the functions and usage scope of the embodiments of the present disclosure.

As shown in FIG. 5 , the electronic device 500 may include a processing device (eg, central processing unit, graphics processor, etc.) 501 that may be loaded into a random access device according to a program stored in a read-only memory (ROM) 502 or from a storage device 508 . The program in the memory (RAM) 503 executes various appropriate actions and processes. In the RAM 503, various programs and data required for the operation of the electronic device 500 are also stored. The processing device 501, the ROM 502 and the RAM 503 are connected to each other via a bus 504. An input/output (I/O) interface 505 is also connected to bus 504.

Generally, the following devices may be connected to the I/O interface 505: input devices 506 including, for example, a touch screen, touch pad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; including, for example, a liquid crystal display (LCD), speakers, vibration An output device 507 such as a computer; a storage device 508 including a magnetic tape, a hard disk, etc.; and a communication device 509. Communication device 509 may allow electronic device 500 to communicate wirelessly or wiredly with other devices to exchange data. Although FIG. 5 illustrates electronic device 500 with various means, it should be understood that implementation or availability of all illustrated means is not required. More or fewer means may alternatively be implemented or provided. Each block shown in Figure 5 may represent one device, or may represent multiple devices as needed.

In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product including a computer program carried on a computer-readable medium, the computer program containing program code for performing the method illustrated in the flowchart. In such embodiments, the computer program may be downloaded and installed from the network via communication device 509, or from storage device 508, or from ROM 502. When the computer program is executed by the processing device 501, the above-described functions defined in the method of the embodiment of the present disclosure are performed. It should be noted that the computer-readable medium described in the embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of computer readable storage media may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard drive, random access memory (RAM), read only memory (ROM), removable Programmed read-only memory (EPROM or flash memory), fiber optics, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above. In embodiments of the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. In embodiments of the present disclosure, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, in which computer-readable program code is carried. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device . Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to: wire, optical cable, RF (radio frequency), etc., or any suitable combination of the above.

The above-mentioned computer-readable medium may be included in the above-mentioned electronic device; it may also exist independently without being assembled into the electronic device. The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: in response to receiving the network request, obtains the target address of the network request, where the target address Including Internet protocol address and/or gateway address, the network request originates from the publisher in the publish-subscribe model. The publish-subscribe model includes publishers and subscribers. The publisher sends messages to the topic, and the subscriber responds to the subscribed topic. The message is consumed; perform a preset operation on the target address to obtain the index value, and determine whether the target topic exists, where the target topic is the topic corresponding to the index value; if it exists, the request information of the network request is sent to the target topic to For the target subscriber to obtain the request information and determine whether to intercept the network request, where the target subscriber is the subscriber who subscribes to the target topic.

Computer program code for performing operations of embodiments of the present disclosure may be written in one or more programming languages, including object-oriented programming languages—such as Java, Smalltalk, C++, or a combination thereof, Also included are conventional procedural programming languages—such as the "C" language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In situations involving remote computers, the remote computer can be connected to the user's computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (such as an Internet service provider). connected via the Internet).

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagram may represent a module, segment, or portion of code that contains one or more logic functions that implement the specified executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown one after another may actually execute substantially in parallel, or they may sometimes execute in the reverse order, depending on the functionality involved. It will also be noted that each block of the block diagram and/or flowchart illustration, and combinations of blocks in the block diagram and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or operations. , or can be implemented using a combination of specialized hardware and computer instructions.

The units involved in the embodiments of the present disclosure may be implemented in software or hardware. The described unit may also be provided in a processor. For example, it may be described as follows: a processor includes an acquisition unit, a determination unit and an interception unit. The names of these units do not constitute a limitation on the unit itself under certain circumstances. For example, the receiving unit can also be described as "a unit that obtains the target address of the network request in response to receiving the network request."

The above description is only a description of the preferred embodiments of the present disclosure and the technical principles applied. Persons skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to technical solutions composed of specific combinations of the above technical features, and should also cover the above-mentioned technical solutions without departing from the above-mentioned inventive concept. Other technical solutions formed by any combination of technical features or their equivalent features. For example, a technical solution is formed by replacing the above features with technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to).

Claims (12)

1. A network request interception method, comprising:

in response to receiving a network request, acquiring a target address of the network request, wherein the target address comprises an Internet protocol address and/or a gateway address, the network request is sourced from a publisher in a publish-subscribe model, the publish-subscribe model comprises the publisher and a subscriber, the publisher sends a message to a topic, and the subscriber consumes the message in the subscribed topic;

performing preset operation on the target address to obtain an index value, and determining whether a target theme exists, wherein the target theme is a theme corresponding to the index value;

If so, sending the request information of the network request to the target topic so as to enable a target subscriber to acquire the request information and determine whether to intercept the network request, wherein the target subscriber is a subscriber subscribed to the target topic.

2. The method of claim 1, wherein the target subscriber determines whether to intercept the network request by:

determining whether the target address exists in a preset address set to be intercepted;

if the network request does not exist in the address set to be intercepted, determining whether the network request accords with a preset interception rule;

if the interception rule is met, determining whether the target address exists in a preset suspicious address set;

if the target address exists in the suspicious address set, the target address is added into the address set to be intercepted.

3. The method of claim 2, wherein the adding the target address to the set of addresses to be intercepted comprises:

determining whether a target field corresponding to the target address in the suspicious address set is a first numerical value, wherein the target field represents whether the target address is added to the address set to be intercepted or not, and the first numerical value represents that the address is the suspicious address;

If the target field is the first value, modifying the value of the target field to a second value, wherein the second value representation is not added to the address set to be intercepted;

and in response to detecting that the value of the target field is a second value, adding the target address to the set of addresses to be intercepted.

4. A method according to claim 3, wherein said adding the target address to the set of addresses to be intercepted in response to detecting that the value of the target field is a second value comprises:

in response to receiving a timed task execution instruction, retrieving an address of which the target field is the second numerical value in the suspicious address set;

and adding the retrieved address to the address set to be intercepted, and modifying the value of the target field corresponding to the retrieved address to be a third value, wherein the third value represents that the third value is added to the address set to be intercepted.

5. The method of claim 2, wherein after said determining whether said target address is present in a preset set of suspicious addresses, said steps further comprise:

If not present in the set of suspicious addresses, storing the target address into the set of suspicious addresses, and setting the target field to the first value.

6. The method of claim 2, wherein after said determining whether the target address is in a preset set of addresses to be intercepted, said steps further comprise:

and if the network request exists in the address set to be intercepted, intercepting the network request.

7. The method of claim 2, wherein the correspondence between index values and topics is determined by:

acquiring a preset address library;

and aiming at each address in the address library, carrying out preset operation on the address to obtain an index value, and matching the index value with one topic in the publish-subscribe model to generate a corresponding relation between the index value and the topic, wherein the index value corresponding to the address from the same area is matched with the same topic.

8. The method of claim 1, wherein the performing a preset operation on the target address to obtain an index value includes:

and carrying out hash operation on the target address to obtain a hash code as an index value.

9. The method according to one of claims 1 to 8, wherein the publish-subscribe model is a kaff card system.

10. A network request intercepting apparatus, comprising:

the acquisition unit is used for responding to a received network request and acquiring a target address of the network request, wherein the target address comprises an Internet protocol address and/or a gateway address, the network request is sourced from a publisher in a publish-subscribe model, the publish-subscribe model comprises the publisher and a subscriber, the publisher sends a message to a topic, and the subscriber consumes the message in the subscribed topic;

the determining unit is used for carrying out preset operation on the target address to obtain an index value and determining whether a target theme exists, wherein the target theme is a theme corresponding to the index value;

the interception unit is used for sending the request information of the network request to the target topic if the request information exists, so that a target subscriber can acquire the request information and determine whether to intercept the network request, wherein the target subscriber is a subscriber subscribed to the target topic.

11. An electronic device, comprising:

One or more processors;

a storage device having one or more programs stored thereon,

when executed by the one or more processors, causes the one or more processors to implement the method of any of claims 1-9.

12. A computer readable medium, on which a computer program is stored, characterized in that the program, when being executed by a processor, implements the method according to any one of claims 1-9.