PCDN equipment detection method and device, computer equipment and storage medium

Abstract

The invention relates to a PCDN equipment detection method and device, computer equipment and a storage medium. The method comprises the following steps: acquiring terminal information data; according to a preset analysis threshold value, the historical query data and the terminal information data, carrying out equipment confirmation on the to-be-identified equipment to obtain an equipment confirmation result; when the device confirmation result is that the to-be-identified device is confirmed to belong to the PCDN device, updating a feature library of the management platform based on the terminal information data to obtain an updated feature library, and generating an isolation blocking instruction; and transmitting the isolation blocking instruction and the updated feature library to the gateway terminal. By adopting the method, the security and management capability of the home network can be effectively improved, the PCDN equipment is accurately detected by collecting and analyzing the equipment flow information through the local plug-in and combining the characteristics and the cloud secondary identification, the false alarm and the missing alarm are reduced, the damage of malicious equipment to the home network is prevented, suspicious equipment is isolated or blocked in real time, and the safety of the home network is improved. And timely updating of the feature library is ensured.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a PCDN device detection method, apparatus, computer equipment and storage medium. Background Art

[0002] With the popularity of smart home devices and the richness of Internet applications, the home network environment has become increasingly complex. As the core device of the home network, the home gateway is responsible for connecting different types of devices such as personal computers, mobile phones, tablets, smart home devices, etc. to the Internet. At the same time, the popularity of content distribution network (CDN) technology enables users to quickly obtain Internet content. In order to further improve the access speed of the home network, some users have begun to deploy PCDN (Private Content Delivery Network) devices, which can accelerate home network access traffic and increase data transmission speed. However, with the use of PCDN devices, home networks are also facing new security challenges: the emergence of malicious PCDN devices may affect network security, causing network bandwidth waste, information leakage or other potential security threats.

[0003] In the related art, a common method for identifying malicious PCDN devices is based on broadband traffic feature recognition technology, which monitors broadband traffic in the user's home network in real time and analyzes traffic features, such as traffic size, duration, and data packet transmission mode, to identify whether there are suspicious PCDN devices. Generally speaking, this method relies on efficient collection and analysis of traffic, and determines whether there are malicious PCDN devices connected to the network by extracting traffic features.

[0004] However, the above-mentioned related technologies may not be able to fully and effectively identify all malicious devices, resulting in false positives and false negatives. In addition, when the system detects a suspicious PCDN device, there is a lack of further analysis and processing mechanisms, and it is impossible to take corresponding countermeasures according to the severity of the threat, which may also affect the overall protection effect of network security. Summary of the invention

[0005] Based on this, it is necessary to provide a PCDN device detection method, device, computer equipment, computer-readable storage medium and computer program product that can improve home network security protection capabilities, optimize home network resource management, and enhance system flexibility and scalability to address the above technical problems.

[0006] In a first aspect, the present application provides a PCDN device detection method, which is applied to a management platform. The method comprises:

[0007] Get terminal information data;

[0008] Perform device confirmation on the device to be identified based on the preset analysis threshold, historical query data and terminal information data, and obtain the device confirmation result;

[0009] If the device confirmation result shows that the device to be identified is a PCDN device, the feature library of the management platform is updated based on the terminal information data, an updated feature library is obtained, and an isolation and blocking instruction is generated;

[0010] The isolation and blocking instructions and the updated signature database are transmitted to the gateway terminal.

[0011] In one embodiment, device confirmation is performed on the device to be identified according to the preset analysis threshold, historical query data and terminal information data to obtain a device confirmation result, including:

[0012] When analyzing each downstream device, data processing is performed on the device information data to obtain processed device data;

[0013] Performing device analysis on the processed device data according to a preset analysis threshold to obtain a device analysis result;

[0014] When the device analysis result is a preliminary confirmation of the PCND device, the device is confirmed based on the device information data, processed device data and historical query data to obtain the device confirmation result.

[0015] In one embodiment, performing device analysis on the processed device data according to a preset analysis threshold to obtain a device analysis result includes:

[0016] Perform address analysis on multiple device addresses to obtain the proportion of home broadband addresses;

[0017] Determine the number of home broadband addresses based on the proportion of home broadband addresses and the number of addresses;

[0018] Device analysis is performed according to the home broadband address ratio, the number of home broadband addresses, the preset home broadband address threshold, and the preset address ratio threshold to obtain a device analysis result.

[0019] In a second aspect, the present application also provides a PCDN device detection method, which is applied to a gateway terminal. The method comprises:

[0020] Obtain device information data transmitted by multiple downstream devices;

[0021] Perform device identification on multiple device information data based on the current local feature library to obtain device identification results;

[0022] Based on the device identification result, multiple device information data are screened to obtain terminal information data;

[0023] Upload terminal information data to the management platform.

[0024] In one embodiment, the method further comprises:

[0025] Obtain isolation and blocking instructions and updated feature libraries;

[0026] Determine the target downstream device based on the isolation and blocking instructions;

[0027] Perform network settings on the target downstream device according to the isolation and blocking instructions, and then connect the device after obtaining the settings.

[0028] In one embodiment, after obtaining the isolation blocking instruction and the updated feature library, the method further includes:

[0029] The local feature library is updated based on the updated feature library to obtain an updated local feature library.

[0030] In a third aspect, the present application also provides a PCDN device detection device, which is applied to a management platform. The device includes:

[0031] The first communication module is used to obtain terminal information data;

[0032] The device analysis module is used to confirm the device to be identified based on the preset analysis threshold, historical query data and terminal information data, and obtain the device confirmation result;

[0033] A processing update module, used for updating the feature library of the management platform based on the terminal information data, obtaining the updated feature library, and generating an isolation and blocking instruction when the device confirmation result shows that the device to be identified is a PCDN device;

[0034] The first communication module is also used to transmit the isolation and blocking instruction and the updated feature library to the gateway terminal.

[0035] In a fourth aspect, the present application further provides a PCDN device detection device, which is applied to a gateway terminal. The device comprises:

[0036] The second communication module is used to obtain device information data transmitted by multiple downstream devices;

[0037] The device identification module is used to perform device identification on multiple device information data based on the current local feature library to obtain device identification results;

[0038] A data screening module is used to screen multiple device information data based on the device identification result to obtain terminal information data;

[0039] The second communication module is also used to upload the terminal information data to the management platform.

[0040] In a fifth aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0041] Get terminal information data;

[0042] Perform device confirmation on the device to be identified based on the preset analysis threshold, historical query data and terminal information data, and obtain the device confirmation result;

[0043] If the device confirmation result shows that the device to be identified is a PCDN device, the feature library of the management platform is updated based on the terminal information data, an updated feature library is obtained, and an isolation and blocking instruction is generated;

[0044] Transmitting the isolation blocking instruction and the updated signature database to the gateway terminal; or

[0045] Obtain device information data transmitted by multiple downstream devices;

[0046] Perform device identification on multiple device information data based on the current local feature library to obtain device identification results;

[0047] Based on the device identification result, multiple device information data are screened to obtain terminal information data;

[0048] Upload terminal information data to the management platform.

[0049] In a sixth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0050] Get terminal information data;

[0051] Perform device confirmation on the device to be identified based on the preset analysis threshold, historical query data and terminal information data, and obtain the device confirmation result;

[0052] If the device confirmation result shows that the device to be identified is a PCDN device, the feature library of the management platform is updated based on the terminal information data, an updated feature library is obtained, and an isolation and blocking instruction is generated;

[0053] Transmitting the isolation blocking instruction and the updated signature database to the gateway terminal; or

[0054] Obtain device information data transmitted by multiple downstream devices;

[0055] Perform device identification on multiple device information data based on the current local feature library to obtain device identification results;

[0056] Based on the device identification result, multiple device information data are screened to obtain terminal information data;

[0057] Upload terminal information data to the management platform.

[0058] In a seventh aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0059] Get terminal information data;

[0060] Perform device confirmation on the device to be identified based on the preset analysis threshold, historical query data and terminal information data, and obtain the device confirmation result;

[0061] If the device confirmation result shows that the device to be identified is a PCDN device, the feature library of the management platform is updated based on the terminal information data, an updated feature library is obtained, and an isolation and blocking instruction is generated;

[0062] Transmitting the isolation blocking instruction and the updated signature database to the gateway terminal; or

[0063] Obtain device information data transmitted by multiple downstream devices;

[0064] Perform device identification on multiple device information data based on the current local feature library to obtain device identification results;

[0065] Based on the device identification result, multiple device information data are screened to obtain terminal information data;

[0066] Upload terminal information data to the management platform.

[0067] The PCDN device detection method, apparatus, computer device, storage medium and computer program product, after obtaining the terminal information data uploaded by the gateway terminal, processes the device information data corresponding to each downstream device in the terminal information data and analyzes and judges it with the preset analysis threshold to preliminarily judge whether the downstream device belongs to the PCDN device, and then performs secondary confirmation on the device information data corresponding to the preliminarily judged downstream device and the historical data of the query device and the data of other devices to finally determine whether the downstream device belongs to the PCDN device, and then updates the feature library of the platform based on the device information data confirmed as the PCDN device, and generates isolation and blocking instructions for the downstream devices confirmed as the PCDN devices and transmits them to the gateway terminal together with the updated feature library, effectively improving the security and resource management capabilities of the home network, collecting and analyzing device traffic information through local plug-ins, combining features and cloud secondary identification, can accurately detect PCDN devices, reduce false positives and false negatives, prevent malicious devices from infringing on the home network, and support real-time isolation or blocking of suspicious devices, optimize bandwidth allocation, ensure that the use of normal devices is not affected, and ensure that the feature library is updated in time, thereby enhancing the flexibility and scalability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 A diagram showing an application environment of a PCDN device detection method in an embodiment;

[0069] Figure 2 A schematic diagram of a flow chart of a PCDN device detection method applied to a management platform in an embodiment;

[0070] Figure 3 A schematic diagram of a process flow of a device confirmation step in an embodiment;

[0071] Figure 4 A schematic diagram of a flow chart of a PCDN device detection method applied to a gateway terminal in an embodiment;

[0072] Figure 5 is a structural block diagram of a PCDN device detection device applied to a management platform in an embodiment;

[0073] Figure 6 is a structural block diagram of a PCDN device detection apparatus applied to a gateway terminal in one embodiment;

[0074] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0075] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0076] The PCDN device detection method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the gateway terminal 102 communicates with the management platform 104 through the network. The data storage system can store the data that the management platform 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. After obtaining the terminal information data uploaded by the gateway terminal, the device information data corresponding to each hanging device in the terminal information data is processed and analyzed and judged with the preset analysis threshold to preliminarily determine whether the hanging device belongs to the PCDN device, and then the device information data corresponding to the preliminarily judged hanging device is double-confirmed with the historical data of the query device and the data of other devices to finally determine whether the hanging device belongs to the PCDN device, and then the feature library of the platform is updated based on the device information data confirmed as the PCDN device, and the isolation blocking instruction of the hanging device confirmed as the PCDN device is generated and transmitted to the gateway terminal together with the updated feature library. Among them, the gateway terminal 102 can be but not limited to an ADSL / VDSL gateway, a fiber gateway, an LTE / 5G gateway and a smart home gateway. The management platform 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0077] In one embodiment, Figure 2 As shown, a PCDN device detection method is provided, and the method is applied to Figure 1 The management platform in the example is used to illustrate, including the following steps:

[0078] Step 202, obtaining terminal information data.

[0079] The terminal information data includes device information data of multiple downstream devices.

[0080] Exemplarily, the gateway terminal performs a preliminary analysis on all downstream devices connected thereto, and uploads device information data of downstream devices suspected to be PCDN devices to the management platform. After receiving the terminal information data, the management platform stores it in a database.

[0081] Step 204 , performing device confirmation on the device to be identified according to the preset analysis threshold, historical query data and terminal information data, and obtaining a device confirmation result.

[0082] Among them, the preset analysis threshold includes a preset home broadband address threshold and a preset address ratio threshold, and the processed device data includes multiple device addresses and address quantities.

[0083] Exemplarily, when analyzing and identifying each downstream device, statistics are collected on the target addresses of the uplink traffic in the device information data to determine the number of home broadband addresses in the target addresses and the overall proportion of the target addresses.

[0084] Then, the number of home broadband addresses in the target address and the overall proportion of the target address are compared with the preset home broadband address threshold and the preset home broadband proportion threshold, and it is preliminarily determined whether each downstream device belongs to a PCDN device through comparison.

[0085] Afterwards, the traffic patterns of each downstream device of the preliminarily confirmed PCDN device are compared with those of other devices, and the historical records of the device are queried, so as to finally confirm whether each downstream device of the preliminarily confirmed PCDN device is a PCDN device.

[0086] Step 206: When the device confirmation result shows that the device to be identified is a PCDN device, the feature library of the management platform is updated based on the terminal information data, an updated feature library is obtained, and an isolation and blocking instruction is generated.

[0087] The terminal information data includes device information data corresponding to all downstream devices that are finally confirmed as PCDN devices.

[0088] For example, when the device confirmation result is that the device to be identified is confirmed to be a PCDN device, feature extraction is performed on the device information data corresponding to all the downstream devices finally confirmed as PCDN devices, and the cloud feature library is updated using the extracted features to obtain an updated feature library. The feature information includes the MAC address prefix and uplink traffic pattern of a specific known PCDN device.

[0089] At the same time, an instruction for isolating or blocking all downstream devices finally confirmed as PCDN devices, namely, an isolation and blocking instruction, is generated.

[0090] Step 208: Transmit the isolation and blocking instruction and the updated feature library to the gateway terminal.

[0091] Exemplarily, when the identification of the downstream devices corresponding to all uploaded device information data is completed, the management platform transmits the isolation blocking instruction and the updated feature library to the gateway terminal.

[0092] In the above PCDN device detection method, after obtaining the terminal information data uploaded by the gateway terminal, the device information data corresponding to each downstream device in the terminal information data is processed and analyzed and judged with the preset analysis threshold to preliminarily judge whether the downstream device belongs to the PCDN device, and then the device information data corresponding to the preliminarily judged downstream device is reconfirmed with the historical data of the query device and the data of other devices to finally determine whether the downstream device belongs to the PCDN device, and then the feature library of the platform is updated based on the device information data confirmed as the PCDN device, and at the same time, an isolation and blocking instruction for the downstream device confirmed as the PCDN device is generated and transmitted to the gateway terminal together with the updated feature library, so as to effectively improve the security and resource management capabilities of the home network, collect and analyze device traffic information through local plug-ins, and combine features with cloud secondary identification, so as to accurately detect PCDN devices, reduce false positives and false negatives, and prevent malicious devices from infringing on the home network, and at the same time support real-time isolation or blocking of suspicious devices, optimize bandwidth allocation, ensure that the use of normal devices is not affected, and ensure that the feature library is updated in time, thereby enhancing the flexibility and scalability of the system.

[0093] In an exemplary embodiment, Figure 3 As shown, the device to be identified is confirmed according to the preset analysis threshold, historical query data and terminal information data, and the device confirmation result is obtained, including:

[0094] Step 302: After analyzing each downstream device, perform data processing on the device information data to obtain processed device data.

[0095] The terminal information data includes device information data of multiple downstream devices.

[0096] For example, when analyzing and identifying each downstream device, it is necessary to count and analyze the upstream traffic target addresses in the device information data. Through detailed statistics of the target addresses, it is possible to identify which addresses belong to home broadband addresses. The number of these home broadband addresses is further analyzed, and their proportion in all target addresses is calculated.

[0097] Step 304: Perform device analysis on the processed device data according to a preset analysis threshold to obtain a device analysis result.

[0098] The preset analysis threshold includes a preset home broadband address threshold and a preset address ratio threshold.

[0099] Exemplarily, the number of home broadband addresses in the target address and the overall proportion of the target address are compared with a preset home broadband address threshold and a preset home broadband proportion threshold, respectively, and whether each downstream device belongs to a PCDN device is preliminarily determined by comparison.

[0100] By analyzing the number of home broadband addresses in the target address and the overall proportion of the target address, it is possible to preliminarily determine whether each downstream device is a PCDN device. The number of broadband addresses and their proportion in all target addresses are compared with the preset home broadband address threshold and home broadband proportion threshold. If the number of home broadband addresses exceeds the preset threshold, or the home broadband proportion exceeds the preset proportion threshold, it can be preliminarily determined that the downstream device may be a PCDN device.

[0101] For example, the judgment rules are pre-set, specifically:

[0102] If, in the past day, the total number of home broadband IP addresses in the upstream traffic of a downstream device exceeds 100 and accounts for more than 80%, then the downstream device is suspected to be a PCDN device.

[0103] Therefore, after counting the data within one day in the device information data, if the number of home broadband addresses and their proportion in all target addresses exceed 100 and 80% respectively, the corresponding downstream device is suspected to be a PCDN device; otherwise, the corresponding downstream device is not a PCDN device.

[0104] Step 306: When the device analysis result is a preliminary confirmation of the PCND device, device confirmation is performed according to the device information data, the processed device data and the historical query data to obtain a device confirmation result.

[0105] For example, when confirming the device of each downstream device that is preliminarily determined as a PCDN device, the traffic characteristics of the device are checked to see if they are consistent with the typical PCDN device pattern by comparing and analyzing the traffic patterns of other devices. For example, PCDN devices usually have a high content distribution density and a stable traffic distribution. Therefore, the platform will use the traffic monitoring system to evaluate whether the traffic characteristics of the device meet these typical characteristics. Then query the historical records of the device to analyze its long-term usage and behavior patterns. By tracing back the historical traffic data of the device, it can be further determined whether the device has maintained operating characteristics consistent with PCDN devices for a long time. If the behavior of the device is highly consistent with a typical PCDN device, it can be confirmed to be a PCDN device.

[0106] In an exemplary embodiment, performing device analysis on the processed device data according to a preset analysis threshold to obtain a device analysis result includes:

[0107] Perform address analysis on multiple device addresses to obtain a proportion of home broadband addresses; determine the number of home broadband addresses based on the proportion of home broadband addresses and the number of addresses; perform device analysis based on the proportion of home broadband addresses, the number of home broadband addresses, a preset home broadband address threshold, and a preset address proportion threshold to obtain a device analysis result.

[0108] Among them, the preset analysis threshold includes a preset home broadband address threshold and a preset address ratio threshold, and the processed device data includes multiple device addresses and address quantities.

[0109] Exemplarily, by analyzing the number of home broadband addresses in the target address and their overall proportion in the target address, it is preliminarily determined whether each downstream device belongs to a PCDN device. Specifically, the number of home broadband addresses and their proportion of the overall target address are compared with a preset home broadband address threshold and a home broadband proportion threshold. If the number of home broadband addresses exceeds the preset threshold, or the proportion of home broadband addresses exceeds the preset proportion threshold, it can be preliminarily determined that the downstream device may be a PCDN device.

[0110] In an exemplary embodiment, a PCDN device detection method is provided, wherein the method is applied to Figure 1 The management platform in the example is used to illustrate, including the following steps:

[0111] Get terminal information data.

[0112] When analyzing each downstream device, data processing is performed on the device information data to obtain processed device data.

[0113] Perform address analysis on multiple device addresses to obtain the proportion of home broadband addresses.

[0114] Determine the number of home broadband addresses based on the proportion of home broadband addresses and the number of addresses.

[0115] Device analysis is performed according to the home broadband address ratio, the number of home broadband addresses, the preset home broadband address threshold, and the preset address ratio threshold to obtain a device analysis result.

[0116] When the device analysis result is a preliminary confirmation of the PCND device, the device is confirmed based on the device information data, processed device data and historical query data to obtain the device confirmation result.

[0117] When the device confirmation result is that the device to be identified is confirmed to be a PCDN device, the feature library of the management platform is updated based on the terminal information data, an updated feature library is obtained, and an isolation and blocking instruction is generated.

[0118] The isolation and blocking instructions and the updated signature database are transmitted to the gateway terminal.

[0119] In one embodiment, Figure 4 As shown, a PCDN device detection method is provided, and the method is applied to Figure 1 The gateway terminal in the example is used as an example to illustrate, including the following steps:

[0120] Step 402: Acquire device information data transmitted by multiple downstream devices.

[0121] Exemplarily, a plug-in capable of capturing the connection information and flow information of each downstream device is pre-installed in the gateway terminal, and the operating parameters of the plug-in are configured. The operating parameters include log storage path, data reporting cycle, etc. After the configuration is completed, the gateway terminal monitors the network activities of the downstream devices in real time through the plug-in, and collects key information, such as online time, MAC address, destination IP address of upstream traffic, etc.

[0122] Step 404: perform device identification on multiple device information data based on the current local feature library to obtain a device identification result.

[0123] Exemplarily, a local feature library is also provided in the plug-in, and the feature library contains feature information of known PCDN devices, such as a specific MAC address prefix, an uplink traffic pattern, and the like.

[0124] After the device information data of the downstream device is completed, the device information data is compared with the information data in the local feature database to preliminarily determine whether the device is a PCDN device.

[0125] Step 406: Screen multiple device information data based on the device identification result to obtain terminal information data.

[0126] Exemplarily, after the comparison is completed, the device information data of the downstream device preliminarily determined to be the PCDN device is uniformly set as the terminal information data.

[0127] Step 408: Upload the terminal information data to the management platform.

[0128] Exemplarily, after completing the data screening, the gateway terminal uploads the terminal information data to the management platform via the network.

[0129] In an exemplary embodiment, the method further includes:

[0130] Obtain an isolation and blocking instruction and an updated feature library; determine a target downstream device based on the isolation and blocking instruction; perform network settings on the target downstream device according to the isolation and blocking instruction, and obtain the downstream device after the settings.

[0131] For example, after receiving the isolation or blocking instruction, the home gateway will perform corresponding network security measures, such as disconnecting the device from the network or adding it to the blacklist, to prevent potential security threats. The platform will record these operations in real time, generate security reports regularly, and send reminders to users to help them pay attention to the security status of the home network in a timely manner. The specific process includes: the home gateway first obtains the isolation or blocking instruction. Then, according to the instruction, the affected target hanging device is determined, and the corresponding network settings are executed, such as disconnecting or restricting the device's network access. Next, the network status of the target device is confirmed to ensure that the security measures are effectively implemented.

[0132] In an exemplary embodiment, after obtaining the isolation blocking instruction and the updated feature library, the method further includes:

[0133] The local feature library is updated based on the updated feature library to obtain an updated local feature library.

[0134] Exemplarily, after updating the cloud feature library, the management platform synchronizes the updated feature library to the gateway terminal, and the gateway terminal updates the local feature library using the updated feature library to obtain the updated local feature library.

[0135] In an exemplary embodiment, a PCDN device detection method is provided, wherein the method is applied to Figure 1 The gateway terminal in the example is used as an example to illustrate, including the following steps:

[0136] Get device information data transmitted by multiple downstream devices.

[0137] Based on the current local feature library, multiple device information data are identified to obtain device identification results.

[0138] Based on the device identification result, multiple device information data are screened to obtain terminal information data.

[0139] Upload terminal information data to the management platform.

[0140] Obtain isolation and blocking instructions and updated signature database.

[0141] The local feature library is updated based on the updated feature library to obtain an updated local feature library.

[0142] Determine the target downstream device based on the isolation and blocking instructions.

[0143] Perform network settings on the target downstream device according to the isolation and blocking instructions, and then connect the device after obtaining the settings.

[0144] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0145] Based on the same inventive concept, the embodiment of the present application further provides a PCDN device detection apparatus for implementing the PCDN device detection method involved above. The implementation scheme for solving the problem provided by the apparatus is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more PCDN device detection apparatus embodiments provided below can refer to the limitations on the PCDN device detection method above, and will not be repeated here.

[0146] In one embodiment, Figure 5 As shown, a PCDN device detection device is provided, which is applied to a management platform, including: a first communication module 502, a device analysis module 504 and a processing update module 506, wherein:

[0147] The first communication module 502 is used to obtain terminal information data;

[0148] The device analysis module 504 is used to perform device confirmation on the device to be identified according to the preset analysis threshold, historical query data and terminal information data, and obtain a device confirmation result;

[0149] The processing update module 506 is used to update the feature library of the management platform based on the terminal information data, obtain the updated feature library, and generate an isolation and blocking instruction when the device confirmation result is that the device to be identified is confirmed to be a PCDN device;

[0150] The first communication module 502 is also used to transmit the isolation and blocking instruction and the updated feature library to the gateway terminal.

[0151] In an exemplary embodiment, the device analysis module 504 is also used to perform data processing on the device information data to obtain processed device data when analyzing each downstream device; perform device analysis on the processed device data according to a preset analysis threshold to obtain a device analysis result; when the device analysis result is a preliminary confirmation of a PCND device, perform device confirmation based on the device information data, the processed device data and the historical query data to obtain a device confirmation result.

[0152] In an exemplary embodiment, the device analysis module 504 is also used to perform address analysis on multiple device addresses to obtain the home-broadband address ratio; determine the number of home-broadband addresses based on the home-broadband address ratio and the number of addresses; perform device analysis based on the home-broadband address ratio, the number of home-broadband addresses, a preset home-broadband address threshold and a preset address ratio threshold to obtain a device analysis result.

[0153] In one embodiment, Figure 6 As shown, a PCDN device detection device is provided, which is applied to a gateway terminal, including: a second communication module 602, a device identification module 604 and a data screening module 606, wherein:

[0154] The second communication module 602 is used to obtain device information data transmitted by multiple downstream devices;

[0155] The device identification module 604 is used to perform device identification on multiple device information data based on the current local feature library to obtain a device identification result;

[0156] The data screening module 606 is used to screen the multiple device information data based on the device identification result to obtain the terminal information data;

[0157] The second communication module 602 is also used to upload the terminal information data to the management platform.

[0158] In an exemplary embodiment, the PCDN device detection apparatus is further used to obtain an isolation and blocking instruction and an updated feature library; determine a target downstream device based on the isolation and blocking instruction; perform network settings on the target downstream device according to the isolation and blocking instruction to obtain a downstream device after the settings.

[0159] In an exemplary embodiment, the PCDN device detection apparatus is further configured to update data in the local feature library based on the updated feature library to obtain an updated local feature library.

[0160] Each module in the above PCDN device detection device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0161] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store device information data and feature library data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a PCDN device detection method is implemented.

[0162] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0163] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0164] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0165] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0166] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0167] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0168] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0169] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A PCDN device detection method, characterized in that: Applied on a management platform, the method includes: Get terminal information data; Performing device confirmation on the device to be identified according to the preset analysis threshold, the historical query data and the terminal information data, and obtaining a device confirmation result; If the device confirmation result is that the device to be identified is confirmed to be a PCDN device, updating the feature library of the management platform based on the terminal information data, obtaining an updated feature library, and generating an isolation and blocking instruction; The isolation and blocking instruction and the updated feature library are transmitted to the gateway terminal.

2. The PCDN device detection method according to claim 1, characterized in that: The terminal information data includes device information data of multiple downstream devices; performing device confirmation on the device to be identified according to the preset analysis threshold, historical query data and the terminal information data to obtain the device confirmation result includes: When analyzing each downstream device, data processing is performed on the device information data to obtain processed device data; Performing device analysis on the processed device data according to a preset analysis threshold to obtain a device analysis result; In the case where the device analysis result is a preliminary confirmation of the PCND device, device confirmation is performed according to the device information data, the processed device data and the historical query data to obtain a device confirmation result.

3. The PCDN device detection method according to claim 2, characterized in that: The preset analysis threshold includes a preset home broadband address threshold and a preset address ratio threshold; the processed device data includes multiple device addresses and address quantities; The performing device analysis on the processed device data according to a preset analysis threshold to obtain a device analysis result includes: Perform address analysis on multiple device addresses to obtain the proportion of home broadband addresses; Determine the number of home broadband addresses based on the proportion of home broadband addresses and the number of addresses; Device analysis is performed according to the home broadband address ratio, the number of home broadband addresses, a preset home broadband address threshold, and a preset address ratio threshold to obtain a device analysis result.

4. A PCDN device detection method, characterized in that: Applied in a gateway terminal, the method comprises: Obtain device information data transmitted by multiple downstream devices; Performing device identification on the plurality of device information data based on the current local feature library to obtain a device identification result; Screening the plurality of device information data based on the device identification result to obtain terminal information data; The terminal information data is uploaded to the management platform.

5. The PCDN device detection method according to claim 4, characterized in that: The method further comprises: Obtain isolation and blocking instructions and updated feature libraries; Determine the target downstream device based on the isolation and blocking instruction; According to the isolation and blocking instruction, network settings are performed on the target downstream device to obtain the downstream device after the settings.

6. The PCDN device detection method according to claim 5, characterized in that: After obtaining the isolation and blocking instruction and the updated feature library, the method further includes: The local feature library is updated based on the updated feature library to obtain an updated local feature library.

7. A PCDN device detection device, characterized in that: Applied in a management platform, the device includes: The first communication module is used to obtain terminal information data; A device analysis module, used to perform device confirmation on the device to be identified according to a preset analysis threshold, historical query data and the terminal information data, and obtain a device confirmation result; A processing and updating module, configured to update a feature library of a management platform based on the terminal information data, obtain an updated feature library, and generate an isolation and blocking instruction when the device confirmation result indicates that the device to be identified is a PCDN device; The first communication module is also used to transmit the isolation and blocking instruction and the updated feature library to the gateway terminal.

8. A PCDN device detection device, characterized in that: Applied in a gateway terminal, the device comprises: The second communication module is used to obtain device information data transmitted by multiple downstream devices; A device identification module, used to perform device identification on the plurality of device information data based on the current local feature library to obtain a device identification result; A data screening module, used for screening the plurality of device information data based on the device identification result to obtain terminal information data; The second communication module is also used to upload the terminal information data to the management platform.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images