Violation outreach monitoring method, device, system and storage medium

Abstract

The invention discloses a method, device, system and storage medium for monitoring illegal outreach, wherein the method for monitoring illegal outreach includes: acquiring HTTP traffic information between a terminal in the first network and a first server in the first network, HTTP The traffic information includes the interaction information of the first WEB service; the redirection message and the RST reset message are respectively constructed through the original socket, and the redirection message includes the terminal pointing to the connection configuration of the second server in the second network. Redirection information and asynchronous request information to make the terminal asynchronously request the first WEB service to the first server; send an RST reset message to the first server, so that the first server resets the TCP address of the first WEB service originally requested by the terminal connecting; and sending a redirection message to the terminal, so that when the second server receives the request message sent by the terminal, it determines that the terminal has illegal outreach. The outreach monitoring of violations of the present invention is flexible in deployment, and the user has no perception.

Description

technical field [0001] The present invention relates to the field of information security, in particular to a method, device, system and storage medium for outreach monitoring of violations. Background technique [0002] With the development of computer network technology, computer and network leakage cases are increasing year by year, and the current situation of information security is very severe. In order to improve the security of the intranet or private network, enterprises and institutions generally prohibit the connection between the internal network and the Internet, or prohibit the connection between the private network and other networks, and adopt physical isolation or logical isolation to control, thereby reducing security threats from the Internet . However, there are often employees who lack security awareness and connect their terminals to the Internet through other channels without disconnecting from the internal network, resulting in illegal outreach. In ...

AI Technical Summary

Problems solved by technology

[0003] One of the existing monitoring methods for illegal outreach is to install a client monitoring program on each monitored terminal. The disadvantage of this method is that it needs to install a monitoring program on each intranet terminal, and technical measures need to be taken To prevent it from being uninstalled; the other is to embed the monitoring code on the intranet business website. When the intranet terminal accesses the intranet business website, the monitoring code will be downloaded to the terminal and run to monitor the terminal’s illegal outreach. The disadvantage of the method is that some changes need to be made to the existing network to deploy and embed the monitoring code on the intranet business website, so some business service resources will be occupied

Images