Method for detecting broadband private connection based on open system interconnection (OSI) transmission layer timestamp

Abstract

The invention discloses a method for detecting broadband private connection based on an open system interconnection (OSI) transmission layer timestamp. The method comprises the following steps of: 1) when a client requests a server for establishing a transmission control protocol (TCP) connection, returning synchronous confirmation message by the server, and intercepting the synchronous confirmation message, adding the timestamp and then sending the synchronous confirmation message to the client by telecom access routing equipment; 2) setting a first constant and a second constant in the telecom access routing equipment; 3) marking the system time of each received TCP message and acquiring the timestamp of each received TCP message by the telecom access routing equipment; and 4) acquiring the system time difference and the timestamp difference between the two adjacent TCP messages sent by the client of the same IP address in real time, acquiring the difference between the system time difference and the timestamp difference, and judging that the client corresponding to the IP address has broadband private connection phenomenon if the difference exceeds the first constant or the non-0 number of the difference in the preset time exceeds the second constant. The method has the advantages of high detection accuracy, low system resource occupancy, simple detection process and wide application range.

Description

technical field [0001] The invention relates to the field of broadband user detection, in particular to a broadband private connection detection method for illegal Internet sharing. Background technique [0002] At present, broadband access services are basically carried out in the form of monthly or yearly subscriptions. Therefore, there are often cases where people apply for broadband in the name of individuals and allow black Internet cafes and enterprises to use it, or several households share broadband and share the cost, causing operators a lot of trouble. Huge economic loss, currently the most effective detection methods for this illegal shared Internet access are IP_ID detection method and TCP fingerprint detection method. [0003] The principle of the IP_ID detection method is as follows: the ID field carried in the IP message sent by the same Windows host changes continuously and shows an increasing trend, and its initial value varies with different Windows hosts. ...

AI Technical Summary

Problems solved by technology

[0004] 1) Misjudgment may be caused when the message is out of order;

[0005] 2) In most LINUX versions or UNIX systems, the IP_ID in each TCP increases continuously, but for different TCP connections, the IP_ID has nothing to do with it;

[0006] 3) It is invalid for proxy mode and time-sharing Internet access;

[0009] 1) Since the window size is determined through negotiation between the client and the server, there may be several window sizes for the same IP address that is not privately connected, which will lead to misjudgment;

[0010] 2) The detection speed is slow, and it is possible to determine whether there are several serial numbers, confirmation numbers, and window sizes under a certain IP address based on the collection of many continuous message segment samples;

[0012] To sum up, the IP_ID detection method and the TCP fingerprint detection method have the problems of low detection accuracy, high system resource occupation, cumbersome detection process and narrow scope of application in addition to their own shortcomings.

Images