Method to realize monitoring connection states of closed network by using a computer on intranet

Abstract

This invention discloses a method for monitoring closed network connection state with an internet work computer, utilizing at internet-work computer as a monitor connected into an internetwork exchanger with a router connected. The monitor computer sends detection packet to other internetwork computers to make judgement the computer's network connection state according to the returned result, suitable for the environments with strictly isolated inner and outer network and strict multilayer protected internetwork, realizing overall and quick monitor to the network state of internetwork finidng out behaviors of connecting to internet and special network by variou s methods.

Description

technical field [0001] The invention relates to a computer application technology, in particular to a method for monitoring the connection state of a closed network by utilizing an intranet computer. Background technique [0002] Perimeter security is one of the elements of network security. In computer system applications, border security technologies represented by firewalls are often used to construct security boundaries at the connection between the intranet and the Internet to form a relatively closed security domain. With the deepening of social informatization, there are more and more wired and wireless Internet access methods, and the access methods are becoming more and more flexible. Internal employees can easily connect to the Internet and overcome the security barriers of the firewall, thereby breaking the The closed nature of the security domain poses a great threat to the security of the intranet. Therefore, it is extremely important to monitor and analyze th...

AI Technical Summary

Problems solved by technology

Although this method is relatively easy to implement, there are several main problems in this method: 1. It is complicated to deploy and maintain on multiple computers, and it is easy to cause employees to resist monitoring software; 2. It is difficult to adapt to diversified network access methods; 3. It can only detect three connection states: dial-up / non-dial-up / disconnection, and it is difficult to analyze other external connection states; 4. Need to purchase more licenses, which requires a large investment

This method has several main problems as follows because the detection packet sent is an IP spoofing packet (Fake IP Packet), and the technical compatibility is poor: 1. It is required that the internal network firewall and the gateway cannot be set to block the IP spoofing packet, thereby seriously affecting the internal network. 2. Some Internet service providers have adopted IP spoofing packet blocking technology in firewalls and gateways, which will cause the above-mentioned spoofing packets to fail to pass through, resulting in false positives; 3. When a typical Microsoft Windows operating system dials up, if Setting sharing will also cause the above-mentioned spoofing packets to fail to pass through, resulting in false positives; 4, because the extranet server that is set on the Internet cannot receive network data packets from other closed private networks, it cannot detect that it is connected to a private network (such as a spy network) ), resulting in missed reports; 5. It can only monitor whether it is illegally outreached, but it is difficult to analyze other states, and it is impossible to detect the situation that the monitoring target machine unplugs the network cable and then connects out, resulting in missed reports

However, monitoring method 3 requires computers to be able to access the Internet, and cannot be used in application environments that require strict physical isolation of internal and external networks.

Images