Judge black production based on CDN and client slow log characteristics

background

---

With the network popular anchor , More and more popular , Has produced a very large flow economic effect , Therefore, it has attracted the attention of a large number of third-party black production companies , In order to improve the popularity and ranking of anchors , There's a lot of “ Machine fans ”, Disrupt the operation of the live broadcasting platform , It has brought great economic losses to the anchor and the platform .

The live broadcast platforms involved include Tiktok , Well quickly , Fighting fish , Tiger tooth ,B Station and other live broadcast platforms , Where can I make money , Where there is black production , Through reverse analysis of business logic , Understand the meaning of indicators , Can formulate corresponding black production strategy .

Problem analysis

---

Client Caton log ：

Abnormal client logs ：

An average playback duration of 0 Caton's diary ：

Server side logs

The data reported in the above logs are abnormal , There are still a lot of reports , We can focus on cracking down on the playing behavior of these abnormal customers .

Weak network statistics based on client logs ip situation ：

Internal black product warehouse , To comprehensively locate the information of illegal production ：

adopt cdn Log , And other live broadcast platforms , The request characteristics of black production are as follows ：

1、 Requests are very frequent .

2、 In order to save the cost of black production , The request time is very short , Pull up in a short time qps.

3、 Once the connection is established , No data , Only increase the number of online people , No flow .

4、 The device is continuously charged .

5、 The device is in the process of live broadcasting , There is no displacement at all .

Solution

---

Scheme structure

Self built black product warehouse

The establishment of black production information is a long-term accumulation and optimization process , Rules can be complex , It can also be very simple , The focus is on the collection of information about illegal production , The information source of black production , It can be a client playback log , Customer operation behavior ,cdn Play log , And customer behavior analysis collected by other products .

Live broadcast client logs

Client log ：

1、 Judge by playing time

2、 Delay time

3、 Error rate

4、 abnormal ip Request frequency

Client user behavior data

You can collect customer usage data on the end app act , Analyze , It is judged to be a normal and legal customer , Or robots , Or simulator operated . General timing operation , All are operated by scripts or machines .

cdn Play log

Although the client can collect rich audience information , But there are some unusual requests , Not through a legal client , Or a request simulated by a script , This part of information needs to be supplemented by the server information . The server acts as the other end of the network connection , There is a lot of information that the client cannot get , Server side logs are required , Conduct supplementary analysis .

Through analysis cdn Log of exceptions , The following is the analysis strategy of other live broadcast platforms , Judge by the number of disconnection and sending timeout , Whether it is a black product .

The attack strategy of a live broadcast platform ：

1、ip Black and white list , The business party is responsible for ip List maintenance , The platform party is responsible for cracking down on .

2、ua and referer Information , Attack requests with special information .

3、 Area control , Restrict access to some areas .

Other businesses

You can analyze VOD , static state , And the reported data of other products , To collect information about illegal production .

A third-party black product repository

If you don't have your own black production base , You can use a third-party black product library .

Not IP The rules

Pass the assessment ua,referer etc. http Hit the head , You can also design complex authentication logic .

Risk point

The most critical point of the whole scheme , How to effectively improve the success rate of the strike , If the control is not good , It is easy to misjudge .

Conclusion

---

The whole idea is through cdn And the client's exception log , To build a black production feature library , Reject the request of black production in advance , Avoid economic losses .