Management and control method, device, equipment and system for intranet malicious reverse connection behavior

Abstract

The invention relates to a management and control method, device, equipment and system for an intranet malicious reverse connection behavior. Based on policy-based routing, the method comprises the steps of: obtaining an external network access request forwarded from a core switch, if the external network access request is an http access request, analyzing a host field at the head of the http datapacket in the http access request to take as a target domain name,if the external network access request is an https access request, analyzing a Server Name field of a Server Name Indication extension at the head of the SSL negotiation data packet, taking the Server Name field as a target domain name, and if the target domain name is detected to be in a preset white list, allowing the terminal equipment to access an IP corresponding to the target domain name. According to the invention, security management and control are carried out through the target domain name, error interception caused by IP resolution errors is avoided, the target domain name is obtained without adding a certificate to decrypt the https data packet, all application systems can be covered, and management and controlof malicious reverse connection behaviors of an intranet are realized.

Description

technical field [0001] The present invention relates to the technical field of network security, in particular to a method, device, device and system for managing and controlling malicious reverse connection behavior in an intranet. Background technique [0002] With the development of Internet technology, more and more industries have begun to use the Internet as a platform to carry out business. At the same time, the form of network security is becoming more and more severe. Various forms of network attacks occur more and more frequently in people's lives, and what emerges at the historic moment is the emergence of various network security technologies. With the development of network security, the focus of enterprise security construction has gradually expanded from the early border security to intranet security, and the management and control of malicious reverse connections on the intranet has become a security technology that enterprises focus on. At present, the comm...

AI Technical Summary

Problems solved by technology

[0005] In view of this, the purpose of the present invention is to provide a method, device, device and system for controlling malicious reverse connection behaviors in the intranet, so as to overcome the current intranet protection The problem of low security protection efficiency

Images