A method and device for detecting agent surfing the Internet

Abstract

The embodiment of the invention provides a method for detecting proxy network access. The method comprises the following steps: establishing a proxy device identifier table in advance; receiving a Web webpage request message sent by a first user terminal after establishing a TCP connection with a Web server; feeding back a message used for detecting identification information of the user terminal to the first user terminal according to terminal type information in the Web webpage request message; receiving a message containing the identification information of the first user terminal sent by the first user terminal; when the source IP address of the message containing the identification information of the first user terminal is in the proxy device identifier table, determining whether the user terminal is a user terminal that surf the Internet through a proxy device according to the identification information of the first user terminal and the proxy device identifier table. Meanwhile, the invention further provides an apparatus for detecting proxy network access. According to the method and apparatus provided by the embodiment of the invention, the false alarm rate is low, and the network access experience of users is good.

Description

technical field [0001] The invention belongs to the technical field of data communication, and in particular relates to a method and a device for detecting an agent surfing the Internet. Background technique [0002] Proxy Internet access refers to the technology of using a router or proxy software to enable multiple people to share one IP address to access the Internet, commonly known as "one drag N". The most common is that multiple terminals use a router to proxy the Internet, or install a proxy server or network address translation software on a host. In this case, multiple users can share the same account to access the Internet, thereby bypassing the operator's account billing model, causing damage to the operator's interests, and ultimately affecting the normal construction of the network. In addition, when cyber violence, publishing illegal speeches, uploading pornographic videos and other violations of laws and regulations occur, the network supervision department c...

AI Technical Summary

Problems solved by technology

[0008] 1. The client program needs to be installed. It is very difficult to promote the installation of the client, and it has to face compatibility issues with different desktop systems, mobile terminals and various anti-virus software, and the maintenance cost is high;

[0009] 2. Using flash cookie technology, you will face the problem of multiple browsers and browser compatibility modes on the same host, which will cause one host to be recognized as more than two hosts, but now on the same host, It is too common to install several browsers, so the misjudgment rate is high; 3. There are other techniques for collecting fingerprint data of packets, such as the number of TCP connections, the number of DNS requests, and the ID loopback time of IP packets. Problems with large individual differences, high false alarm rate, difficult management and maintenance, etc.

[0010] 4. The requirements for network administrators are high. In the method of statistical message characteristics, it is necessary to set a judgment threshold, and the selection of this threshold requires very rich experience in network maintenance;

[0011] Therefore, in the prior art, the method for identifying the proxy to access the Internet is either inaccurate, or the client needs to be installed. It is necessary to provide a method for detecting the proxy to access the Internet that can improve accuracy and is easy to deploy and implement.

Images