# US 2021/0344706 A1 · Method and apparatus for implementing server anti-attack > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344706 A1 - Document ID: US20210344706A1 - Status: Published application - Kind: A1 - Application number: 16/473,095 - Filed: 2018-09-28 - Published: 2021-11-04 - Earliest claimed: 2018-08-22 - Assignees: Wangsu Science & Technology Co., Ltd. - Applicants: Wangsu Science & Technology Co., Ltd. - Inventors: Xiaochuan ZHUANG; Maolin LIU; Zhiming ZHANG - Web page: https://patentgrep.com/patent/US20210344706A1 ## CPC - H04L 63/0254: {Stateful filtering} - H04L 63/1458: {Denial of Service} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for implementing a server anti-attack includes that: after receiving a first link request, the server may determine a target request type of the first link request based on feature information of the first link request; determine, based on the target request type of the first link request, a number of requests that are initiated by a source IP address within a first preset period and have a request type consistent with the target request type; and, in the condition that the number of requests is greater than a preset threshold, determine a target attack type of the first link request, reject the first link request, and add the source IP address to the first collection. ## Claims ### Claim 1 A method for implementing a server anti-attack, comprising: receiving, by a server, a first link request, wherein the first link request includes a source IP address that initiates the first link request; determining, by the server, a target request type of the first link request based on feature information of the first link request, wherein the feature information of the first link request includes at least one of request data, a requesting rule, and requested content; determining, by the server, the number of requests that are initiated by the source IP address within a first preset period and have a request type consistent with the target request type based on the target request type of the first link request; and if it is determined that the number of requests, that are initiated by the source IP address and have a request type consistent with the target request type, is greater than a preset threshold, determining, by the server, a target attack type of the first link request based on the target request type, rejecting the first link request, and adding the source IP address to a first collection, wherein the first collection is configured to store IP addresses that the server denies access. ### Claim 2 (depends on 1) The method according to claim 1, wherein: determining, by the server, the target request type of the first link request based on the feature information of the first link request further includes: if it is determined, based on the request data of the first link request, that the request data cannot be assembled into a request format that can be recognized by the server, determining, by the server, that the target request type of the first link request is an SYN flood request; determining, by the server, the number of requests that are initiated by the source IP address within the first preset period and have a request type consistent with the target request type further includes: determining, by the server, the number of requests that are initiated by the source IP address within the first preset period and have a request type of an SYN flood request; and if it is determined that the number of requests, that are initiated by the source IP address and have a request type consistent with the target request type, is greater than the preset threshold, determining, by the server, the target attack type of the first link request based on the target request type further includes: if it is determined that the number of SYN flood requests initiated by the source IP address is greater than a first preset threshold, determining, by the server, that the target attack type of the first link request is an SYN flood attack. ### Claim 3 (depends on 1) The method according to claim 1, wherein: determining, by the server, the target request type of the first link request based on the feature information of the first link request further includes: if it is determined, based on the request data and the requesting rule of the first link request, that the request data can be assembled into a request format that can be recognized by the server but the requesting rule does not satisfy a preset rule, determining, by the server, that the target request type of the first link request is an illegal URL request; determining, by the server, the number of requests that are initiated by the source IP address within the first preset period and have a request type consistent with the target request type further includes: determining, by the server, the number of requests that are initiated by the source IP address within the first preset period and have a request type of an illegal URL request; and if it is determined that the number of requests, that are initiated by the source IP address and have a request type consistent with the target request type, is greater than the preset threshold, determining, by the server, the target attack type of the first link request based on the target request type further includes: if it is determined that the number of illegal URL requests initiated by the source IP address is greater than a second preset threshold, determining, by the server, that the target attack type of the first link request is an illegal URL attack. ### Claim 4 (depends on 1) The method according to claim 1, wherein determining, by the server, the target request type of the first link request based on the feature information of the first link request further includes: if it is determined, based on the request data and the requesting rule of the first link request, that the request data can be assembled into a request format that can be recognized by the server and the requesting rule satisfies a preset rule, determining, by the server, that the target request type of the first link request is a candidate legal URL request, and if it is determined, based on the requested content of the first link request, that the requested content is inconsistent with content of services provided by the server, determining, by the server, that the candidate legal URL request is a first type of legal URL request; determining, by the server, the number of requests that are initiated by the source IP address within the first preset period and have a request type consistent with the target request type further includes: determining, by the server, the number of requests that are initiated by the source IP address within the first preset period and have a request type of a first type of legal URL request; and if it is determined that the number of requests, that are initiated by the source IP address and have a request type consistent with the target request type, is greater than the preset threshold, determining, by the server, the target attack type of the first link request based on the target request type further includes: if it is determined that the number of first type of legal URL requests is greater than a third preset threshold, determining, by the server, that the target attack type of the first link request is a legal URL attack. ### Claim 5 (depends on 4) The method according to claim 4, further comprising: if it is determined that the requested content is consistent with the content of services provided by the server, determining, by the server, that the candidate legal URL request is a second type of legal URL request; if it is determined that the source IP address is included in a second collection, determining, by the server, the number of second type of legal URL requests initiated by the source IP address within a second preset period, wherein the second collection is configured to store IP addresses restricted by the server and corresponding numbers of requests received after restrictions; and if it is determined that the number of second type of legal URL requests initiated by the source IP address within the second preset period is greater than the number of requests received after a restriction, determining, by the server, that the target attack type of the first link request is a legal URL attack, rejecting the first link request, and adding the source IP address to the first collection. ### Claim 6 (depends on 5) The method according to claim 5, further comprising: if it is determined that the number of second type of legal URL requests initiated by the source IP address within the second preset period is less than or equal to the number of requests received after the restriction, determining, by the server, that the first link request is a legal request. ### Claim 7 (depends on 5) The method according to claim 5, further comprising: if it is determined that the source IP address is not included in the second collection, determining, by the server, the number of second type of legal URL requests initiated by the source IP address within a third preset period; if it is determined that the number of second type of legal URL requests initiated by the source IP address within the third preset period is greater than a fourth preset threshold, restricting, by the server, the number of requests from the source IP address and adding the source IP address to the second collection, wherein the third preset period is earlier than the second preset period; and if it is determined that the number of second type of legal URL requests initiated by the source IP address within the third preset period is less than or equal to the fourth preset threshold, determining, by the server, that the first link request is a legal request. ### Claim 8 (depends on 1) The method according to claim 1, wherein, after receiving the first link request and before determining the target request type of the first link request, the method further includes: determining, by the server, that the source IP address is not included in the first collection. ### Claim 9 An apparatus for implementing a server anti-attack, comprising: a receiving unit that is configured to receive a first link request, wherein the first link request includes a source IP address that initiates the first link request; and a processing unit that is configured to: determine a target request type of the first link request based on feature information of the first link request, wherein the feature information of the first link request includes at least one of request data, a requesting rule, and requested content, determine the number of requests that are initiated by the source IP address within a first preset period and have a request type consistent with the target request type based on the target request type of the first link request, and if it is determined that the number of requests, that are initiated by the source IP address and have a request type consistent with the target request type, is greater than a preset threshold, determine a target attack type of the first link request based on the target request type, reject the first link request, and add the source IP address to a first collection, wherein the first collection is configured to store IP addresses that the server denies access. ### Claim 10 (depends on 9) The apparatus according to claim 9, wherein the processing unit is further configured to: if it is determined, based on the request data of the first link request, that the request data cannot be assembled into a request format that can be recognized by the server, determine that the target request type of the first link request is an SYN flood request; determine the number of requests that are initiated by the source IP address within the first preset period and have a request type of an SYN flood request; and if it is determined that the number of SYN flood requests initiated by the source IP address is greater than a first preset threshold, determine that the target attack type of the first link request is an SYN flood attack. ### Claim 11 (depends on 9) The apparatus according to claim 9, wherein the processing unit is further configured to: if it is determined, based on the request data and the requesting rule of the first link request, that the request data can be assembled into a request format that can be recognized by the server but the requesting rule does not satisfy a preset rule, determine that the target request type of the first link request is an illegal URL request; determine the number of requests that are initiated by the source IP address within the first preset period and have a request type of an illegal URL request; and if it is determined that the number of illegal URL requests initiated by the source IP address is greater than a second preset threshold, determine that the target attack type of the first link request is an illegal URL attack. ### Claim 12 (depends on 9) The apparatus according to claim 9, wherein the processing unit is further configured to: if it is determined, based on the request data and the requesting rule of the first link request, that the request data can be assembled into a request format that can be recognized by the server and the requesting rule satisfies a preset rule, determine that the target request type of the first link request is a candidate legal URL request; if it is determined, based on the requested content of the first link request, that the requested content is inconsistent with content of services provided by the server, determine that the candidate legal URL request is a first type of legal URL request; determine the number of requests that are initiated by the source IP address within the first preset period and that have a request type of a first type of legal URL request; and if it is determined that the number of first type of legal URL requests initiated by the source address is greater than a third preset threshold, determine that the target attack type of the first link request is a legal URL attack. ### Claim 13 (depends on 12) The apparatus according to claim 12, wherein the processing unit is further configured to: if it is determined that the requested content is consistent with the content of services provided by the server, determine that the candidate legal URL request is a second type of legal URL request; if it is determined that the source IP address is included in a second collection, determine the number of second type of legal URL requests initiated by the source IP address within a second preset period, wherein the second collection is to store IP addresses restricted by the server and corresponding numbers of requests after restrictions; and if it is determined that the number of second type of legal URL requests initiated by the source IP address within the second preset period is greater than the number of requests received after a restriction, determine that the target attack type of the first link request is a legal URL attack, reject the first link request, and add the source IP address to the first collection. ### Claim 14 (depends on 13) The apparatus according to claim 13, wherein the processing unit is further configured to: if it is determined that the number of second type of legal URL requests initiated by the source IP address within the second preset period is less than or equal to the number of requests received after the restriction, determine that the first link request is a legal request. ### Claim 15 (depends on 13) The apparatus according to claim 13, wherein the processing unit is further configured to: if it is determined that the source IP address is not included in the second collection, determine the number of second type of legal URL requests initiated by the source IP address within a third preset period; if it is determined that the number of second type of legal URL requests initiated by the source IP address within the third preset period is greater than a fourth preset threshold, restrict the number of requests from the source IP address and add the source IP address to the second collection, wherein the third preset period is earlier than the second preset period; and if it is determined that the number of second type of legal URL requests initiated by the source IP address within the third preset period is less than or equal to the fourth preset threshold, determine that the first link request is a legal request. ### Claim 16 (depends on 9) The apparatus according to claim 9, wherein, after receiving the first link request and before determining the target request type of the first link request, the processing unit is further configured to: determine that the source IP address is not included in the first collection. ### Claim 17 (canceled) ### Claim 18 A computer device, comprising: a memory configured to store program instructions; and a processor configured to call the program instructions stored in the memory, and implement, based on an obtained program, a method for implementing a server anti-attack that includes: receiving, by a server, a first link request, wherein the first link request includes a source IP address that initiates the first link request; determining, by the server, a target request type of the first link request based on feature information of the first link request, wherein the feature information of the first link request includes at least one of request data, a requesting rule, and requested content; determining, by the server, the number of requests that are initiated by the source IP address within a first preset period and have a request type consistent with the target request type based on the target request type of the first link request; and if it is determined that the number of requests, that are initiated by the source IP address and have a request type consistent with the target request type, is greater than a preset threshold, determining, by the server, a target attack type of the first link request based on the target request type, rejecting the first link request, and adding the source IP address to a first collection, wherein the first collection is configured to store IP addresses that the server denies access.