Method and device for detecting intranet external connection of terminal and related equipment

Abstract

The invention relates to the technical field of network security, in particular to a method and device for detecting intranet external connection of a terminal and related equipment. The method is applied to scanning equipment in an intranet, and comprises the following steps: sending a first message of which a source address is a scanning equipment address and a destination address is a target terminal address and a second message of which a source address is a preset extranet address and a destination address is the target terminal address to a to-be-detected target terminal; and if it is judged that a first response of the target terminal based on the first message response is received within a preset message timeout duration, and a second response of the second message response is not received, determining that the target terminal is an intranet external connection terminal, the default route configured on the target terminal is a route forwarded to a core router in the intranet, and the core router mirrors the received traffic message to the scanning device.

Description

Technical Field

[0001] This application relates to the field of network security technologies, and particularly to a method, device, and related equipment for detecting internal network external connection of a terminal. Background Art

[0002] Network security is becoming increasingly important for enterprises. Each enterprise and institution attaches more and more importance to the security prevention of its internal network, and various firewall devices are built in the internal network to ensure the security of the enterprise internal network. However, it is also possible that some users privately build an external network environment and use enterprise internal network terminals to access Internet resources. In order to prevent the terminals in the internal network from accessing the Internet, prevent external networks from accessing the terminals in the internal network, and prevent the data of the internal network terminals from leaking to the external network. A system is needed to timely detect whether the terminals in the internal network are externally connected to the Internet. Summary of the Invention

[0003] This application provides a method, device, and related equipment for detecting internal network external connection of a terminal.

[0004] In a first aspect, this application provides a method for detecting internal network external connection of a terminal, which is applied to a scanning device in an internal network. The method includes:

[0005] Sending a first packet with the source address being the address of the scanning device and the destination address being the address of the target terminal, and a second packet with the source address being a preset external network address and the destination address being the address of the target terminal to the target terminal to be detected;

[0006] Determining whether a first response based on the first packet and a second response based on the second packet are received from the target terminal within a preset packet timeout duration, where the default route configured on the target terminal is a route forwarded to a core router in the internal network, and the core router mirrors the received traffic packets to the scanning device;

[0007] If it is determined that the first response based on the first packet is received from the target terminal within the preset packet timeout duration, but the second response based on the second packet is not received, then it is determined that the target terminal is an internal network external connection terminal.

[0008] Optionally, the method further includes:

[0009] Receiving a detection policy issued by a server, where the detection policy includes: the internal network IP address segment of the terminal to be detected, the preset external network IP address range, the policy detection interval duration, and the preset packet timeout duration.

[0010] Optionally, the step of sending a first message with the source address being the address of the scanning device and the destination address being the address of the target terminal, and a second message with the source address being a preset external network address and the destination address being the address of the target terminal to the target terminal to be detected includes:

[0011] Based on the policy detection interval duration, periodically send a first message with the source address being the IP address of the scanning device and the destination address being the IP address of each internal network terminal to be detected, and a second message with the source address being each preset external network IP address and the destination address being the IP address of each internal network terminal.

[0012] Optionally, the method further includes:

[0013] If it is determined that the first response from the target terminal based on the first message is not received within the preset message timeout duration, it is determined that the target terminal is offline.

[0014] In a second aspect, the present application provides a device for detecting internal network external connection of a terminal, which is applied to a scanning device in an internal network. The device includes:

[0015] A sending unit, configured to send a first message with the source address being the address of the scanning device and the destination address being the address of the target terminal, and a second message with the source address being a preset external network address and the destination address being the address of the target terminal to the target terminal to be detected;

[0016] A judging unit, configured to judge whether a first response from the target terminal based on the first message and a second response from the target terminal based on the second message are received within the preset message timeout duration, where the default route configured on the target terminal is a route forwarded to the core router in the internal network, and the core router mirrors the received traffic message to the scanning device;

[0017] A determining unit, if the judging unit determines that the first response from the target terminal based on the first message is received within the preset message timeout duration, but the second response from the second message is not received, then the determining unit is configured to determine that the target terminal is an internal network external connection terminal.

[0018] Optionally, the device further includes:

[0019] A receiving unit, configured to receive a detection policy issued by a server, where the detection policy includes: the internal network IP address segment of the terminal to be detected, the preset external network IP address range, the policy detection interval duration, and the preset message timeout duration.

[0020] Optionally, when sending a first message with the source address being the scanning device address and the destination address being the target terminal address, and a second message with the source address being a preset external network address and the destination address being the target terminal address to the target terminal to be detected, the sending unit is specifically configured to:

[0021] Based on the policy detection interval duration, periodically send a first message with the source address being the IP address of the scanning device and the destination address being the IP address of each internal network terminal to be detected, and a second message with the source address being each preset external network IP address and the destination address being the IP address of each internal network terminal.

[0022] Optionally, if the judging unit determines that the first response based on the first message from the target terminal is not received within the preset message timeout duration, the determining unit is further configured to determine that the target terminal is offline.

[0023] In a third aspect, an embodiment of the present application provides a device for detecting internal network external connection of a terminal. The device for detecting internal network external connection of the terminal includes:

[0024] A memory for storing program instructions;

[0025] A processor for calling the program instructions stored in the memory and executing the steps of the method according to any one of the above first aspects according to the obtained program instructions.

[0026] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium. The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to cause the computer to execute the steps of the method according to any one of the above first aspects.

[0027] In summary, the method for detecting internal network external connection of a terminal provided by the embodiment of the present application is applied to a scanning device in the internal network. The method includes: sending a first message with the source address being the scanning device address and the destination address being the target terminal address, and a second message with the source address being a preset external network address and the destination address being the target terminal address to the target terminal to be detected; judging whether a first response based on the first message and a second response based on the second message from the target terminal are received within the preset message timeout duration, where the default route configured on the target terminal is a route forwarded to the core router in the internal network, and the core router mirrors the received traffic message to the scanning device; if it is determined that the first response based on the first message from the target terminal is received within the preset message timeout duration, but the second response based on the second message is not received, then determining that the target terminal is an internal network external connection terminal.

[0028] By using the method for detecting internal network external connection of a detection terminal provided in the embodiments of the present application, a default route to a core router is configured on an internal network terminal, and a mechanism for the core router to mirror traffic to a scanning device is provided. The scanning device forges a packet with the source IP address being an external network IP and sends it to the internal network terminal to be detected. By determining whether a response to the packet is received, it is determined whether the internal network terminal externally connects to the corresponding external network IP. The detection of whether the internal network terminal externally connects can be achieved without deploying an external network forensics server. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for the description of the embodiments of the present application or the prior art. Obviously, the drawings in the following description are only some embodiments recorded in the present application. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings in the embodiments of the present application.

[0030] Figure 1 It is a detailed flowchart of a method for detecting internal network external connection of a detection terminal provided in the embodiments of the present application;

[0031] Figure 2 It is a schematic diagram of a networking relationship provided in the embodiments of the present application;

[0032] Figure 3 It is a schematic structural diagram of a device for detecting internal network external connection of a detection terminal provided in the embodiments of the present application;

[0033] Figure 4 It is a schematic hardware architecture diagram of a device for detecting internal network external connection of a detection terminal provided in the embodiments of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0034] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments and do not limit the present application. The singular forms of "a", "the", and "said" used in the present application and the claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to any or all possible combinations including one or more of the associated listed items.

[0035] It should be understood that although the terms first, second, third, etc. may be used in the embodiments of the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, in addition, the word "if" may be interpreted as "when" or "while" or "in response to a determination".

[0036] At present, the first method for detecting external connection of internal network terminals is to install client software on the terminals to detect external connection to the internal network. The server distributes ACL rules to the client, and the client controls network access rights by executing ACL, which can prohibit the terminal from accessing the external network. However, it is necessary to install client software, and clientless detection cannot be achieved.

[0037] The second method for detecting external connection of network terminals is to detect through the ICMP reflection principle. The scanner in the internal network sends an ICMP request message (the source IP is configured as the forensics server on the public network, and the message content carries the IP address of the internal network terminal) to the internal network terminal to be detected. After the internal network terminal receives the ICMP request message, it sends an ICMP response message to the forensics server on the public network. After the forensics server receives the ICMP response message from the internal network, it obtains the IP address of the internal network terminal from the ICMP response message, so as to obtain the list of IP addresses of the terminals privately connected to the external network.

[0038] However, in the case where the internal network terminal is privately connected to the Internet through the NAT method, it is impossible to detect that the terminal is externally connected.

[0039] The embodiment of the present application provides a method for actively detecting whether there is an external connection behavior of the internal network by the terminal. By actively sending a message to the terminal and judging whether the terminal has an external connection to the internal network through traffic monitoring.

[0040] Exemplarily, refer to Figure 1 As shown, it is a detailed flowchart of a method for detecting external connection of the internal network by the terminal provided by the embodiment of the present application. This method is applied to a scanning device in the internal network, and this method includes the following steps:

[0041] Step 100: Send a first message with the source address being the address of the scanning device and the destination address being the address of the target terminal, and a second message with the source address being a preset external network address and the destination address being the address of the target terminal to the target terminal to be detected.

[0042] In the embodiment of the present application, a core router, a server, and a scanning device (which can be integrated on the server or an independent third-party scanning device) need to be deployed in the internal local area network (internal network). All traffic in the internal network needs to pass through the core router, and the core router can mirror the traffic to the scanner. The internal network terminal accesses the Internet through the privately connected NAT or dual-network card method.

[0043] In the embodiment of the present application, detection policies are configured on the internal network server, including: (1) the IP address segment of the internal network to be detected; (2) the IP address range of the external network; (3) the policy detection interval duration; (4) the message timeout duration.

[0044] Then, in the embodiments of the present application, before performing step 100, the method for detecting the external connection of the terminal intranet may further include the following steps:

[0045] Receive the detection policy sent by the server, where the detection policy includes: the intranet IP address segment of the terminal to be detected, the preset external network IP address range, the policy detection interval duration, and the preset message timeout duration.

[0046] That is, the user / administrator can configure a custom detection policy on the user interface provided by the server, define the IP address segment of the intranet terminal to be detected, customize the external network IP address that the intranet terminal may access, the interval duration of policy detection (i.e., the detection period), and the message timeout duration parameter.

[0047] Start the function of listening to the traffic messages of the core router on the scanning device, start the internal network external connection detection task, and the scanning device generates a detection task based on the detection policy.

[0048] Specifically, when sending the first message with the source address being the address of the scanning device and the destination address being the address of the target terminal to be detected and the second message with the source address being the preset external network address and the destination address being the address of the target terminal, a preferred implementation method is:

[0049] Based on the policy detection interval duration, periodically send the first message with the source address being the IP address of the scanning device and the destination address being the IP address of each internal network terminal to be detected and the second message with the source address being each preset external network IP address and the destination address being the IP address of each internal network terminal.

[0050] For example, assume that the intranet IP addresses of the terminals to be detected included in the detection policy include Intranet IP 1 (the IP of internal network terminal 1), Intranet IP 2 (the IP of internal network terminal 2), and Intranet IP 3 (the IP of internal network terminal 3), and the preset external network IP address range is External network IP 1 and External network IP 2. Then, for internal network terminal 1, send the first message with the source address being the IP address of the scanning device and the destination address being Intranet IP 1 and the second message with the source address being External network IP 1 and the destination address being Intranet IP 1. In this detection, it can be obtained whether internal network terminal 1 is externally connected to External network IP 1.

[0051] Further, for internal network terminal 1, send the first message with the source address being the IP address of the scanning device and the destination address being Intranet IP 1 and the second message with the source address being External network IP 2 and the destination address being Intranet IP 1. In this detection, it can be obtained whether internal network terminal 1 is externally connected to External network IP 2.

[0052] Similarly, the detection processes for the intranet terminals 2 and 3 are the same as that for the intranet terminal 1, which will not be elaborated here.

[0053] That is to say, for each combination of an intranet IP and an extranet IP, a detection task is executed to determine whether the terminal with the intranet IP has accessed the service of the extranet IP.

[0054] Step 110: Determine whether the first response replied by the target terminal based on the first message and the second response replied by the target terminal based on the second message are received within a preset message timeout duration.

[0055] In the embodiment of the present application, the default route configured on the target terminal is a route forwarded to the core router in the intranet, and the core router mirrors the received traffic message to the scanning device.

[0056] As can be seen from the above, the source IP address of the first message is the IP address of the scanning device, and the destination IP address is the IP address of the intranet terminal to be detected (target terminal). If the intranet terminal exists and is online, after receiving the first message, a first response with the source IP address being the IP address of the target terminal and the destination IP address being the IP address of the scanning device is fed back to the scanning device.

[0057] The source IP address of the second message is the extranet IP, and the destination IP address is the IP address of the target terminal. If the target terminal has internal and external connections and configures an external network route corresponding to the external network IP, then after the target terminal receives the second message, since the source IP address of the second message is the external network IP, when generating a second response with the source IP address being the IP address of the target terminal and the destination address being the external network IP address, during routing and forwarding, based on the configured external network route, the second response will be routed and forwarded to the external network, so that the core router cannot receive the second response, and further the core router cannot mirror the second response to the scanning device, and the scanning device cannot receive the second response either.

[0058] If the target terminal does not have internal and external connections and does not configure an external network route corresponding to the external network IP, at this time, after generating a second response with the source IP address being the IP address of the target terminal and the destination address being the external network IP address, during routing and forwarding, since the route corresponding to the external network IP cannot be matched, at this time, it is forwarded based on the default route, and the default route is a route forwarded to the core router, then the core router can receive the second response, and further mirror the second response to the scanning device, and the scanning device can receive the second response.

[0059] Step 120: If it is determined that the first response replied by the target terminal based on the first message is received within the preset message timeout duration, but the second response replied by the second message is not received, then determine that the target terminal is an internally and externally connected terminal.

[0060] In summary, if the scanning device determines that a first response indicating the existence and online status of the target terminal is received within the preset message timeout duration, but the second response is not received, it is determined that the route corresponding to the external network is configured on the target terminal, that is, it is determined that the target terminal is an internal network terminal with external network connection.

[0061] Further, in the embodiment of the present application, if it is determined that the first response from the target terminal based on the first message is not received within the preset message timeout duration, it is determined that the target terminal is not online.

[0062] Or, it is determined that the target terminal does not exist in the internal network.

[0063] Next, the internal network terminal external connection detection process provided by the embodiment of the present application will be described in detail in combination with a specific application scenario. Exemplarily, refer to Figure 2 As shown, it is a schematic diagram of a networking relationship provided by the embodiment of the present application. A core router, a server, and a scanner need to be deployed in the internal local area network. The traffic in the internal network needs to pass through the core router, and the core router can mirror the traffic to the scanner. The internal network terminal can access the Internet through a privately connected NAT or a dual-network card method.

[0064] 1. Configure detection policies on the internal network server, including: (1) the internal network IP address segment to be detected; (2) the IP address range of the external network; (3) the policy detection interval duration; (4) the message timeout duration;

[0065] 2. Start listening for traffic messages of the core router on the scanner;

[0066] 3. Start the internal network terminal external connection detection task;

[0067] 4. The server distributes the detection policy to the scanner;

[0068] 5. The scanner initiates internal network terminal external connection detection at regular intervals according to the policy detection interval duration;

[0069] 6. During the internal network terminal external connection detection, the scanner alternately sends an ICMP request message (the first message for detecting the existence and online status of the internal network terminal) and n TCP SYN messages (the second message) to each internal network terminal to be detected. The content of the ICMP request message is as follows: source address = the internal network IP address of the scanner, destination IP = the IP address of the terminal; the content of each TCP SYN message is as follows: source address = randomly select an IP address from the external network IP address range (assumed to be external network IP 1), source port = randomly generate a port from 0 - 65535; destination IP = the IP address of the terminal, destination port = select a port from the common TCP ports;

[0070] 7. After receiving the ICMP request message, the intranet terminal privately connected to the external network will respond with an ICMP response message to the scanner;

[0071] 8. After the intranet terminal privately connected to the external network receives the TCP SYN message, since the terminal needs to connect to the external network, a route to the external network will be configured (for example, if it needs to access the external network IP 1, a route to access the external network IP 1 will be configured). Therefore, if the intranet terminal is configured with a route to the external network IP 1, the TCP SYN+ACK message will be sent to the external network through the external network route, and the core router will not be able to intercept the TCP SYN+ACK message;

[0072] 9. After receiving the ICMP request message, the intranet terminal that is not privately connected to the external network will respond with an ICMP response message to the scanner;

[0073] 10. After the intranet terminal that is not privately connected to the external network receives the TCP SYN message, since the route of the terminal is to the intranet, since there is no matching route to the external network IP 1, the default route is used to route the TCP SYN+ACK message to the core router, and the core router will intercept the TCP SYN+ACK message;

[0074] 11. After the scanner times out, it uses the following rules to determine whether a terminal is connected to the intranet or the external network:

[0075] 12. If the ICMP response message and TCP SYN+ACK message / TCP RESET message / ICMP port unreachable message are received from the terminal, it cannot be determined whether the terminal is a non-intranet external terminal (it can only be determined that the terminal is not externally connected to the external network IP 1, and it may still be an intranet external terminal, such as the external network IP 2);

[0076] 13. If the ICMP response message of the terminal is received but the TCP SYN+ACK message / TCP RESET message / ICMP port unreachable message is not received (sent to the external network through the configured external network route), the terminal is judged to be an intranet external terminal;

[0077] 14. If no ICMP response message is received from the terminal, the terminal is judged to be offline (or does not exist), and is therefore judged to be a non-intranet external terminal;

[0078] 15. The scanner reports the intranet external terminal to the intranet server.

[0079] Based on the same inventive concept as the above-mentioned embodiment of the invention, for example, refer to Figure 3 FIG. 1 is a schematic diagram of a structure of a device for detecting an intranet external connection of a terminal provided in an embodiment of the present application. The device is applied to a scanning device in an intranet, and the device includes:

[0080] A sending unit 30, configured to send a first message with a source address being the address of the scanning device and a destination address being the address of the target terminal to be detected, and a second message with a source address being a preset external network address and a destination address being the address of the target terminal;

[0081] A determining unit 31, configured to determine whether a first response in response to the first message and a second response in response to the second message are received from the target terminal within a preset message timeout duration, where a default route configured on the target terminal is a route forwarded to a core router in the internal network, and the core router mirrors received traffic messages to the scanning device;

[0082] A determining unit 32, if the determining unit 31 determines that the first response in response to the first message is received from the target terminal within the preset message timeout duration, but the second response in response to the second message is not received, then the determining unit 32 is configured to determine that the target terminal is an internal network external connection terminal.

[0083] Optionally, the apparatus further includes:

[0084] A receiving unit, configured to receive a detection policy issued by a server, where the detection policy includes: an internal network IP address segment of a terminal to be detected, a preset external network IP address range, a policy detection interval duration, and a preset message timeout duration.

[0085] Optionally, when sending the first message with a source address being the address of the scanning device and a destination address being the address of the target terminal, and the second message with a source address being a preset external network address and a destination address being the address of the target terminal, the sending unit 30 is specifically configured to:

[0086] Based on the policy detection interval duration, periodically send the first message with a source address being the IP address of the scanning device and a destination address being the IP address of each internal network terminal to be detected, and the second message with a source address being each preset external network IP address and a destination address being the IP address of each internal network terminal.

[0087] Optionally, if the determining unit 31 determines that the first response in response to the first message is not received from the target terminal within the preset message timeout duration, then the determining unit 32 is further configured to determine that the target terminal is offline.

[0088] The above units may be one or more integrated circuits configured to implement the above methods. For example: one or more Application Specific Integrated Circuits (ASICs), or, one or more digital signal processors (DSPs), or, one or more Field Programmable Gate Arrays (FPGAs), etc. Again, when a certain unit above is implemented in the form of a processing element scheduling program code, the processing element may be a general-purpose processor, such as a Central Processing Unit (CPU) or other processors that can call program code. Again, these units may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0089] Further, for the device for detecting internal network and external network connection of a detection terminal provided in the embodiments of the present application, from a hardware level, the schematic diagram of the hardware architecture of the device for detecting internal network and external network connection of the detection terminal can be seen Figure 4 as shown. The device for detecting internal network and external network connection of the detection terminal may include: a memory 40 and a processor 41,

[0090] The memory 40 is used to store program instructions; the processor 41 calls the program instructions stored in the memory 40 and executes the above method embodiments according to the obtained program instructions. The specific implementation manners and technical effects are similar and will not be elaborated here.

[0091] Optionally, the present application further provides a scanning device, including at least one processing element (or chip) for executing the above method embodiments.

[0092] Optionally, the present application further provides a program product, such as a computer-readable storage medium. The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to cause the computer to execute the above method embodiments.

[0093] Here, the machine-readable storage medium may be any electronic, magnetic, optical or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium may be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or a combination thereof.

[0094] The systems, devices, modules, or units illustrated in the above embodiments may be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, and the specific form of the computer may be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver device, a game console, a tablet computer, a wearable device, or a combination of any several of these devices.

[0095] For convenience of description, when describing the above devices, they are divided into various units according to functions and described separately. Of course, when implementing the present application, the functions of each unit may be implemented in one or more software and / or hardware.

[0096] Those skilled in the art should understand that the embodiments of the present application may be provided as a method, a system, or a computer program product. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the embodiments of the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0097] The present application is described with reference to the flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowchart and / or block diagram, and the combination of flows and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate a device for implementing the functions specified in Figure 1 one or more of the flows Figure 1 or multiple flows and / or blocks

[0098] Moreover, these computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory generate a manufactured article including an instruction device, and the instruction device implements the functions specified in Figure 1 one or more of the flows Figure 1 or multiple flows and / or blocks

[0099] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus, so that a series of operation steps are performed on the computer or other programmable apparatus to generate a computer-implemented process, thereby providing instructions for implementing the steps of the process Figure 1 in one process or a plurality of processes and / or boxes Figure 1 or steps of functions specified in a plurality of boxes.

[0100] The foregoing are only preferred embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present application shall be included within the scope of protection of the present application.

Claims

1. A method for detecting terminal intranet external connection, characterized in that: Applied to a scanning device in an intranet, the method comprises: Sending a first message whose source address is the scanning device address and whose destination address is the target terminal address, and a second message whose source address is a preset external network address and whose destination address is the target terminal address to the target terminal to be detected; Determine whether a first response based on the first message response and a second response based on the second message response are received from the target terminal within a preset message timeout period, wherein the default route configured on the target terminal is a route forwarded to a core router in the intranet, and the core router mirrors the received traffic message to the scanning device; If it is determined that a first response of the target terminal based on the first message response is received within a preset message timeout period, but a second response of the second message response is not received, then the target terminal is determined to be an intranet extranet terminal.

2. The method according to claim 1, characterized in that The method further comprises: Receive the detection strategy sent by the server, the detection strategy includes: the intranet IP address segment of the terminal to be detected, the preset extranet IP address range, the strategy detection interval duration, and the preset message timeout duration.

3. The method according to claim 2, characterized in that The step of sending a first message having a source address of the scanning device address and a destination address of the target terminal address and a second message having a source address of a preset external network address and a destination address of the target terminal address to a target terminal to be detected comprises: Based on the strategy detection interval, a first message with a source address as the scanning device IP address and a destination address as the IP address of each intranet terminal and a second message with a source address as the preset external network IP address and a destination address as the IP address of each intranet terminal are periodically sent to each intranet terminal to be detected.

4. The method according to claim 1, characterized in that The method further comprises: If it is determined that a first response from the target terminal based on the first message is not received within a preset message timeout period, it is determined that the target terminal is offline.

5. A device for detecting terminal intranet external connection, characterized in that: A scanning device applied to an intranet, the device comprising: A sending unit, configured to send a first message whose source address is the scanning device address and whose destination address is the target terminal address, and a second message whose source address is a preset external network address and whose destination address is the target terminal address to a target terminal to be detected; a judgment unit, configured to judge whether a first response based on the first message response and a second response based on the second message response from the target terminal are received within a preset message timeout period, wherein the default route configured on the target terminal is a route forwarded to a core router in the intranet, and the core router mirrors the received traffic message to the scanning device; The determination unit is used to determine that the target terminal is an intranet external terminal if the judgment unit determines that a first response based on the first message response is received from the target terminal within a preset message timeout period, but a second response based on the second message response is not received.

6. The device according to claim 5, characterized in that The device also includes: The receiving unit is used to receive the detection strategy sent by the server, wherein the detection strategy includes: the intranet IP address segment of the terminal to be detected, the preset extranet IP address range, the strategy detection interval duration, and the preset message timeout duration.

7. The device according to claim 6, characterized in that When sending a first message whose source address is the scanning device address and whose destination address is the target terminal address and a second message whose source address is a preset external network address and whose destination address is the target terminal address to the target terminal to be detected, the sending unit is specifically used to: Based on the strategy detection interval, a first message with a source address as the scanning device IP address and a destination address as the IP address of each intranet terminal and a second message with a source address as the preset external network IP address and a destination address as the IP address of each intranet terminal are periodically sent to each intranet terminal to be detected.

8. The device according to claim 5, characterized in that If the judging unit determines that the first response of the target terminal based on the first message is not received within the preset message timeout period, the determining unit is further configured to determine that the target terminal is offline.

9. A device for detecting terminal intranet external connection, characterized in that: The device for detecting terminal intranet external connection includes: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps of the method according to any one of claims 1 to 4 according to the obtained program instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the steps of the method according to any one of claims 1 to 4.

Images