Agent-free illegal external-connection monitoring method and system

Abstract

The invention provides an agent-free illegal external-connection monitoring method. The agent-free illegal external-connection monitoring method comprises the steps that: when an intranet terminal host accesses a service website page, a JS code together with the page is downloaded to the terminal host through a browser; the JS code accesses an extranet monitoring server from the terminal host; once the extranet monitoring server receives access data from the JS code, an illegal external-connection alarm is given instantly; simultaneously, the extranet IP address in the access data is returnedto the JS code; the JS code sends the extranet IP address of the terminal host together with the internet IP address to an internet monitoring server; and, once the internet monitoring server receivesthe data sent by the JS code, an illegal external-connection alarm is given instantly. The invention further provides an agent-free illegal external-connection monitoring system. The agent-free illegal external-connection monitoring system comprises an internet monitoring module, an extranet monitoring module and the JS code. By means of the method and the system provided by the invention, illegal external-connection behaviour monitoring can be realized on the terminal host without an agent client side.

Description

technical field [0001] The invention belongs to the field of information security, and relates to a monitoring technology for illegal outreach of an intranet terminal host, in particular to an agentless monitoring method and system for illegal outreach. Background technique [0002] With the continuous development and popularization of Internet technology, various terminal devices emerge in an endless stream, and it has become an inevitable trend for future development that more and more desktop terminals and diversified private terminals are connected to the enterprise intranet. In the network environment of some enterprises or units, they are often directly connected to the network, and computers in the network are not allowed to connect to the intranet and the Internet at the same time. However, some employees privately build subnets in the intranet and connect to the Internet in the subnets, and employees violate the rules and external connections, which will bring great...

AI Technical Summary

Problems solved by technology

However, in an intranet without a proxy client, it is often difficult to detect illegal outreach behaviors in the subnet

In the past, there was an agentless outreach monitoring method using source address spoofing, but due to some network attack attributes, it was intercepted by the terminal host security software, resulting in a high possibility of monitoring failure and inaccurate monitoring results

Images