Abnormal network access connection identification and blocking method, system, medium and equipment
A network access and network connection technology, applied in the field of network connection identification and blocking, abnormal network access connection identification and blocking, can solve the problems of difficult configuration blocking strategy, network stability impact, long time period, etc. The effect of applying access control
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
Embodiment 1
[0059] Such as figure 1As shown, the abnormal network access connection identification and blocking method of this embodiment includes the following steps:
[0060] S101. Identification of abnormal network access connections.
[0061] (1) Identification of abnormal network access connections based on behavior;
[0062] Based on the real-time statistics and analysis of access sessions per unit time based on source IP and destination IP, source IP addresses with high frequency and wide range are determined. If the number of sessions related to these IPs is greater than a certain threshold, it is considered to be an abnormal network access connection.
[0063] (2) Abnormal network access connection definition based on multi-dimensional policy rule matching;
[0064] Support policy rules based on the following dimensions: source address, source port, destination address, destination port, transport layer protocol (TCP / UDP), application layer protocol (HTTP, etc.), source / destina...
Embodiment 2
[0085] Such as image 3 As shown, the present embodiment provides a system for identifying and blocking abnormal network access connections. The system includes an abnormal network identification module 1 and an access connection blocking module 2. The specific functions of each module are as follows:
[0086] The abnormal network identification module 1 is used for accessing the connected network and identifying whether it belongs to an abnormal network access connection;
[0087] The access connection blocking module 2 is used to block the network access connection in a bypass mode, that is, to collect the real-time communication traffic of the network connection communication, obtain the communication control information of the two parties in communication, and construct a specific data packet, and at the same time, both parties in the communication Send a control packet for connection interruption, thereby blocking the communication connection;
[0088] The access connect...
Embodiment 3
[0095] This embodiment provides a storage medium, the storage medium stores one or more programs, and when the programs are executed by the processor, the abnormal network access connection identification and blocking method of the above-mentioned embodiment 1 is implemented, as follows:
[0096] For the accessed network access, identify whether it is an abnormal network access connection;
[0097] The bypass method is used to block the network access connection, that is, to collect the real-time communication traffic of the network connection communication, obtain the communication control information of the two parties in communication, and construct a specific data packet, and at the same time send a control packet of connection interruption to the two parties in communication, thereby blocking Disconnect the communication connection; specifically:
[0098] Establish a matching rule strategy and generate a matching rule tree;
[0099] Capture the data packet and store the ...
PUM
Login to View More Abstract
Description
Claims
Application Information
Login to View More