Illegal external connection detection method, device and system and electronic equipment

Abstract

The invention provides an illegal external connection detection method, apparatus and system, and an electronic device. The method comprises the steps of obtaining a target URL request in a to-be-detected network; taking an initiating terminal of the target URL request as a tested terminal, and sending first packet return response data to the tested terminal; receiving a resource traversal request initiated by the tested terminal, and sending second packet return response data to the tested terminal; and the tested terminal is used for executing an illegal external connection detection task according to the first return packet response data. The first return packet response data is sent to the tested terminal, the second return packet response data is sent to the tested terminal according to the resource traversal request initiated by the tested terminal, and after the tested terminal caches the first return packet response data and executes the second return packet response data, illegal external connection detection can be carried out by directly utilizing the cached data when a target URL is accessed. The detection pressure of the detection equipment is reduced, and the comprehensiveness and real-time performance of illegal external connection detection are ensured.

Description

technical field [0001] The invention relates to the technical field of network information security, and in particular, to a method, device, system and electronic equipment for detecting violations of external links. Background technique [0002] For a network environment with strict requirements for information and data security and confidentiality, in order to avoid the existence of unsafe communication paths caused by the simultaneous connection of terminals to internal and external networks, and to ensure the security of network information in the area, it is generally required to isolate specific internal networks from external networks. Communication is not allowed. [0003] In order to detect whether such illegal outreach behavior exists, in the prior art, real-time traffic mirroring is often performed by bypassing, and the HTTP requests in the terminal traffic within the monitoring range are hijacked in real time by the middleman, so that the tested terminal can acce...

AI Technical Summary

Problems solved by technology

[0006] The present invention provides a method, device, system and electronic equipment for detecting illegal outreach, which are used to solve the defect that the detection method for illegal outreach in the prior art cannot guarantee the comprehensiveness and real-time performance of terminal illegal outreach detection, and realize more comprehensive, More real-time detection of terminal violations and outreach

Images