Illegal external connection monitoring method, device and system and storage medium

Abstract

The invention discloses an illegal external connection monitoring method, device and system and a storage medium, and the method comprises the steps: obtaining HTTP flow information between a terminalin a first network and a first server in the first network, and the HTTP flow information comprising the interaction information of a first WEB service; respectively constructing a redirection message and an RST reset message through the original socket, wherein the redirection message comprises redirection information enabling the terminal to point to a second server configured in a second network and asynchronous request information enabling the terminal to asynchronously request a first WEB service for the first server; sending an RST reset message to the first server, so that the first server resets TCP connection of the first WEB service originally requested by the terminal; and sending the redirection message to the terminal, so that the second server determines that illegal external connection occurs to the terminal when receiving the request message sent by the terminal. Illegal external connection monitoring deployment is flexible, and users do not perceive the illegal external connection monitoring deployment.

Description

technical field [0001] The present invention relates to the field of information security, in particular to a method, device, system and storage medium for outreach monitoring of violations. Background technique [0002] With the development of computer network technology, computer and network leakage cases are increasing year by year, and the current situation of information security is very severe. In order to improve the security of the intranet or private network, enterprises and institutions generally prohibit the connection between the internal network and the Internet, or prohibit the connection between the private network and other networks, and adopt physical isolation or logical isolation to control, thereby reducing security threats from the Internet . However, there are often employees who lack security awareness and connect their terminals to the Internet through other channels without disconnecting from the internal network, resulting in illegal outreach. In ...

AI Technical Summary

Problems solved by technology

[0003] One of the existing monitoring methods for illegal outreach is to install a client monitoring program on each monitored terminal. The disadvantage of this method is that it needs to install a monitoring program on each intranet terminal, and technical measures need to be taken To prevent it from being uninstalled; the other is to embed the monitoring code on the intranet business website. When the intranet terminal accesses the intranet business website, the monitoring code will be downloaded to the terminal and run to monitor the terminal’s illegal outreach. The disadvantage of the method is that some changes need to be made to the existing network to deploy and embed the monitoring code on the intranet business website, so some business service resources will be occupied

Images