Method and device for identifying illegal broadband access

Abstract

The present disclosure relates to a method and apparatus for identifying illegal broadband access. A method for identifying illegal broadband access is provided, comprising: obtaining, by a computing terminal, an HTTP request message in a GET mode from a source IP address associated with a specific user from a core router; analyzing, by the computing terminal, the obtained HTTP request message to count the number of different destination IP addresses contained in the HTTP request message per unit time; comparing, by the computing terminal, the number of different destination IP addresses with a threshold; and in response to determining that the number of different destination IP addresses is greater than the threshold, the computing terminal identifies that the specific user has illegal broadband access behavior.

Description

Technical Field

[0001] The present disclosure generally relates to broadband access, and more particularly to a method, apparatus, and computer-readable storage medium for identifying illegal broadband access. Background Art

[0002] Since most of the content on the Internet is on the backbone network of first-tier operators (such as China Telecom and China Unicom) (i.e., in the computer rooms of first-tier operators and their partners), other second-tier operators (such as radio and television cable operators and other private operators) have the need to interconnect with first-tier operators and pay fees to first-tier operators. In the current Chinese Internet architecture, first-tier operators are backbone network operators, and they do not need to pay each other for interconnection, while other second-tier or third-tier operators need to pay relatively expensive interconnection fees when accessing the backbone network of first-tier operators. Many third-party companies purchase access bandwidth from first-tier operators, but do not use it themselves, but resell it to other operators to earn the difference.

[0003] Third-party companies purchase large bandwidth from first-tier operators and then resell it to other operators. This method violates the current communications industry regulations, causes unfair market competition to a certain extent, and disrupts the order of the communications market. Since the threshold for third-party companies to purchase bandwidth from first-tier operators is relatively low, and it is difficult to make judgments through prior data review, it is necessary to break through traditional detection technology.

[0004] At present, one idea of ​​the prior art is to identify the occurrence of broadband illegal access behavior by identifying the content of specific application messages. The identification may include, for example, counting the cumulative number of accounts used by a specific application, counting the cumulative number of account logins of a specific application, or counting the number of concurrent NAT sessions of a network address translation (NAT) system. Summary of the invention

[0005] A brief overview of the disclosure is given below in order to provide a basic understanding of some aspects of the disclosure. However, it should be understood that this overview is not an exhaustive overview of the disclosure. It is not intended to identify the key or important parts of the disclosure, nor is it intended to limit the scope of the disclosure. Its purpose is simply to give some concepts of the disclosure in a simplified form as a prelude to a more detailed description given later.

[0006] According to one aspect of the present disclosure, a method for identifying illegal broadband access is provided, comprising: obtaining, by a computing terminal, an HTTP request message in a GET mode from a source IP address associated with a specific user from a core router; analyzing, by the computing terminal, the obtained HTTP request message to count the number of different destination IP addresses contained in the HTTP request message per unit time; comparing, by the computing terminal, the number of different destination IP addresses with a threshold; and in response to determining that the number of different destination IP addresses is greater than the threshold, the computing terminal identifying that the specific user has illegal broadband access behavior.

[0007] According to another aspect of the present disclosure, a device for identifying illegal broadband access is provided, including a memory having instructions stored thereon and a processor. The processor is configured to execute the instructions stored on the memory to perform: the device obtains an HTTP request message in a GET mode from a source IP address associated with a specific user from a core router; the device analyzes the obtained HTTP request message to count the number of different destination IP addresses contained in the HTTP request message per unit time; the device compares the number of different destination IP addresses with a threshold; and in response to determining that the number of different destination IP addresses is greater than the threshold, the device identifies that the specific user has illegal broadband access behavior.

[0008] According to another aspect of the present disclosure, a computer-readable storage medium is provided, which includes computer-executable instructions. When the computer-executable instructions are executed by one or more processors, the one or more processors execute the method according to the above aspects of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0010] The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:

[0011] Figure 1 A flow chart of a method for identifying illegal broadband access according to an embodiment of the present invention is shown;

[0012] Figure 2 A schematic diagram showing a mirroring operation on user traffic according to an embodiment of the present disclosure is shown;

[0013] Figure 3 An example of a result obtained by detecting an access point of a single host according to an embodiment of the present disclosure is shown;

[0014] Figure 4 An example of a result obtained by detecting the access point of a large bandwidth user according to an embodiment of the present disclosure is shown;

[0015] Figure 5 An example of a result obtained by detecting an access point of another large bandwidth user according to an embodiment of the present disclosure is shown; and

[0016] Figure 6 An exemplary configuration of a computing device that can implement an embodiment according to the present disclosure is shown. DETAILED DESCRIPTION

[0017] The following detailed description is made with reference to the accompanying drawings, and the following detailed description is provided to assist in a comprehensive understanding of the various exemplary embodiments of the present disclosure. The following description includes various details to assist in understanding, but these details are considered to be examples only and not to limit the present disclosure, which is defined by the appended claims and their equivalents. The words and phrases used in the following description are only used to enable a clear and consistent understanding of the present disclosure. In addition, for the sake of clarity and brevity, descriptions of well-known structures, functions, and configurations may be omitted. Those of ordinary skill in the art will recognize that various changes and modifications may be made to the examples described herein without departing from the spirit and scope of the present disclosure.

[0018] The inventor of the present invention has found that the broadband illegal access identification technology used in the prior art has certain limitations. For example, when counting the number of accounts used for a specific application or the number of account logins and using this as a basis for judgment, due to the large number of Internet users, it is impossible to unify the specific applications to be counted, and even common applications may have statistical deviations. For example, users with broadband illegal access behavior may not use one or more applications that are counted at all. In addition, when counting the number of NAT sessions and using this as a basis for judgment, it is not easy to obtain the number of NAT sessions of the user, and specific fields can be modified by NAT equipment or third-party software to achieve the purpose of circumventing inspection. Therefore, how to solve the universality of detection and prevent tampering with fields to circumvent inspection is the subject of the present invention.

[0019] Based on this, the inventor proposed the present invention, which focuses on illegal private access to telecommunications bandwidth, automatically identifies illegal access behaviors based on big data analysis of user behaviors, and technically realizes effective monitoring of illegal broadband access.

[0020] View now Figure 1 , Figure 1 FIG. 1 is a flow chart of a method 100 for identifying illegal broadband access according to an embodiment of the present invention. The method 100 is, for example, Figure 6The computing device 1200 is executed. The method 100 may include an HTTP request message acquisition step 110, an IP address statistics step 120, a comparison step 130, and an illegal access identification step 140.

[0021] Method 100 starts with HTTP request message acquisition step 110. In HTTP request message acquisition step 110, a computing terminal acquires an HTTP request message of GET mode from a source IP address associated with a specific user from a core router. According to one embodiment of the present disclosure, the computing terminal can be connected to a core router of a metropolitan area network computer room via a network cable. The computing terminal can be deployed in a metropolitan area network computer room of a large bandwidth upper layer as a monitoring terminal, so that more user access points can be covered using a single terminal. Specifically, in one example, the network cable of the computing terminal can be connected to a gigabit network cable interface of a core exit router of a metropolitan area network computer room.

[0022] Here, what is obtained is an HTTP request message in GET mode. Such a request can be cached and used only to retrieve data. According to one embodiment of the present disclosure, the HTTP request message acquisition step 110 may include: implementing the mirroring of HTTP protocol traffic by command configuration of the core router, and mirroring the HTTP request message in GET mode to the computing terminal through a policy for the source IP address. According to one embodiment of the present disclosure, the HTTP request message under the HTTP protocol can be transmitted using port 80, for example.

[0023] Figure 2 FIG. 1 is a schematic diagram showing a mirroring operation of user traffic according to an embodiment of the present disclosure. Figure 2 In FIG. 2 , user 210 accesses its local router (user access router 220). The HTTP request sent by user 210 is sent to Internet 250 via local router 220 and core router 230 (see FIG. 2 ). Figure 2 According to an embodiment of the present disclosure, the present invention is implemented by executing the steps of the method 100 for identifying illegal broadband access at the monitoring terminal 240 (i.e., the computing terminal) in the operator's metropolitan area network room. Specifically, the core router 230 implements the mirroring of HTTP protocol traffic through command configuration, and for the source IP address of the user, the HTTP request message in the GET mode is mirrored to the monitoring terminal through a policy (see Figure 2 The data flow marked by the dotted arrow in FIG. 1 ). Since the mirroring mode is used, the user's network access operation will not be affected, and the user will not feel that the HTTP request message is obtained. According to an embodiment of the present disclosure, command configuration of the core router includes using a dual-thread real mirroring function.

[0024] Since the HTTP request message of the GET method is relatively small, the measured mirror traffic bandwidth of 100,000 online users is about 100M, so a computer room monitoring terminal with average performance can execute the method 100 according to the embodiment of the present invention, so that the overall investment of this solution is almost zero.

[0025] Now return to reference Figure 1 ,exist Figure 1 In the IP address counting step 120, the computing terminal analyzes the acquired HTTP request message to count the number of different destination IP addresses contained in the HTTP request message within a unit time.

[0026] Figure 3 FIG. 2 shows an example of the result of detecting the access point of a single host according to an embodiment of the present disclosure. Figure 3 It can be seen that the access point statistics of this single host are 0 most of the time, and occasionally there will be less than 100 IP addresses per minute. This situation also confirms the actual usage of users, that is, most of the time users do not browse the web, and when they occasionally browse the web, because most mainstream websites have many links, a single user visits dozens of different IP addresses per minute.

[0027] Figure 4 An example of the result obtained by detecting the access point of a large bandwidth user according to an embodiment of the present disclosure is shown. Figure 4 In the example, the high-bandwidth user has, for example, 80 hosts. The statistical result of the access point of the high-bandwidth user (e.g., with 80 hosts) is about 300 IP addresses per minute most of the time. Although the contribution value of a single host is about 30 IP addresses per minute based on experience, considering the time difference in browsing web pages and the repetitiveness of mainstream websites, the total number of IP addresses counted per minute is not a simple superposition of the data of 80 hosts, so the order of magnitude of 300 IP addresses per minute should be within a reasonable range.

[0028] Figure 5 An example of the result obtained by detecting the access point of another large bandwidth user according to an embodiment of the present disclosure is shown. In order to verify the feasibility of the identification method proposed in this article, a test was conducted before the access point of a newly discovered illegal large bandwidth user was shut down. The results showed that the number of destination IP addresses (i.e., website servers) accessed by a source IP address per minute was more than 1,200. Figure 5 The illegal high-bandwidth users in also have 80 hosts. Figure 5 It can be seen from the figure that compared with normal large bandwidth users of the same bandwidth and user order (for example, Figure 4Compared with the users detected in the survey, the number of visits is more than 4 times the normal number of visits. Taking into account the time discreteness of users browsing web pages and the repetitiveness of mainstream websites, it is conservatively estimated that the number of real users is at least 10,000.

[0029] According to an embodiment of the present disclosure, the IP address counting step 120 may include counting the number of different destination IP addresses contained in the HTTP request messages in multiple time periods, and obtaining the median of the number of different destination IP addresses contained in the HTTP request messages in the multiple time periods. Figure 4 In the example, the detection results of three consecutive detection periods are 282, 270, and 314 (per minute). At this time, the median number of IP addresses detected in multiple time periods is 282. Figure 5 In the example, the detection results of three consecutive detection time periods are 1240, 1254 and 1252 (per minute) respectively. At this time, the median of the number of IP addresses detected in multiple time periods is 1252. In another example, the average number of different destination IP addresses contained in the HTTP request messages in the multiple time periods can also be obtained as the judgment indicator.

[0030] Now return to reference Figure 1 ,exist Figure 1 In the comparison step 130, the computing terminal compares the number of different destination IP addresses with a threshold. According to an embodiment of the present disclosure, the threshold can be determined based on statistical data of other users with the same bandwidth and scale under the same node as the specific user. Figure 4 The detection result of a normal large bandwidth user shown in the example determines the threshold value, thereby judging Figure 5 The example shows whether the HTTP access behavior of the high-bandwidth user is abnormal.

[0031] According to an embodiment of the present disclosure, the threshold may be a multiple of the number of different destination IP addresses contained in HTTP request messages of other users with the same bandwidth and scale under the same node as the specific user within a unit time. Figure 4 The threshold is twice the detection result of a normal large bandwidth user shown in the example of Figure 4 The threshold is 282, 270, or twice 314 as shown in .

[0032] It should be noted that the two times here is only an example for explanation, and three times, four times or higher times of the detection result of a normal user may also be used as the threshold, depending on actual application experience. In addition, the threshold may not necessarily be an integer multiple of the detection result of a normal user.

[0033] Although only one normal user ( Figure 4 In other embodiments, the threshold value may be determined using the detection results of multiple normal users. For example, a multiple of the average value of the detection results of multiple normal users is used as the threshold value.

[0034] Now return to reference Figure 1 ,exist Figure 1 In the illegal access identification step 140, in response to determining that the number of different destination IP addresses is greater than a threshold, the computing terminal identifies that the specific user has illegal broadband access behavior. Figure 4 In the example, the detection result 282 is twice as high as the threshold. When 282*2=564 is used as the threshold, Figure 5 In the example of the user, the detection results 1240, 1254 and 1252 all exceed the threshold, so it can be determined that Figure 5 The user in the example is suspected of illegal broadband access. According to one embodiment, when any detection result of a user exceeds a threshold, it can be determined that the user may have illegal broadband access behavior.

[0035] According to an embodiment of the present disclosure, comparing the number of different destination IP addresses with a threshold value may include comparing the median with the threshold value. Figure 4 and Figure 5 In the example above, Figure 5 The median of the detection results of the user in the example is 1252, which exceeds the threshold value 564, so it can be determined that Figure 5 In the example, the user is suspected of illegal broadband access.

[0036] According to one embodiment of the present disclosure, method 100 may further include presenting the statistical data and analysis results associated with the specific user in the form of a list or a chart. The presentation may be implemented on the monitoring terminal 240. The statistical data and analysis results associated with the specific user may also be sent to other terminals or servers by the monitoring terminal 240 via a network for presentation, thereby providing a unified and intuitive result presentation for the management department. According to one embodiment of the present disclosure, the presentation may be implemented, for example, using an echart component, thereby facilitating the viewing and statistics of the regulatory department.

[0037] The present invention may be an apparatus, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present invention.

[0038] According to one embodiment of the present invention, a device for identifying illegal broadband access is provided, comprising a memory having instructions stored thereon and a processor. The processor is configured to execute the instructions stored on the memory to perform: the device obtains an HTTP request message in a GET mode from a source IP address associated with a specific user from a core router; the device analyzes the obtained HTTP request message to count the number of different destination IP addresses contained in the HTTP request message per unit time; the device compares the number of different destination IP addresses with a threshold; and in response to determining that the number of different destination IP addresses is greater than the threshold, the device identifies that the specific user has illegal broadband access behavior.

[0039] According to one embodiment of the present invention, a computer-readable storage medium is provided, comprising computer-executable instructions, which, when executed by one or more processors, cause the one or more processors to execute: obtaining, by a computing terminal, an HTTP request message in GET mode from a source IP address associated with a specific user from a core router; analyzing, by the computing terminal, the obtained HTTP request message to count the number of different destination IP addresses contained in the HTTP request message per unit time; comparing, by the computing terminal, the number of different destination IP addresses with a threshold; and in response to determining that the number of different destination IP addresses is greater than the threshold, identifying by the computing terminal that the specific user has illegal broadband access behavior.

[0040] The invention combines the behavioral characteristics that must exist in user network access, and has a high accuracy rate in identifying illegal behaviors through the method of analyzing user behavior, solving the problem of third-party technology modifying IP message header information to circumvent detection. At the same time, because the invention method adopts the client / server C / S architecture, it fully utilizes the computer room terminal and reduces the problem of large investment caused by deploying probes in different networks.

[0041] The present invention analyzes and counts the essential and unmodifiable information (destination IP address) in the HTTP messages of users surfing the Internet, avoiding the limitations of the prior art in counting specific applications or accounts, and also avoiding the risk of detection being circumvented by third-party devices or programs modifying the fields in the message header. Through practical verification, the present invention can accurately detect large-bandwidth users who illegally connect privately. In addition, the technical solution of the present invention is easy to deploy, fully utilizes the computing power of the monitoring room terminal, and can provide intuitive and efficient result display.

[0042] Figure 6 An exemplary configuration of a computing device 1200 capable of implementing embodiments according to the present disclosure is shown.

[0043] The computing device 1200 is an example of a hardware device to which the above aspects of the present disclosure can be applied. The computing device 1200 can be any machine configured to perform processing and / or computing. The computing device 1200 can be, but is not limited to, a workstation, a server, a desktop computer, a laptop computer, a tablet computer, a personal data assistant (PDA), a smart phone, a vehicle-mounted computer, or a combination thereof.

[0044] like Figure 6 As shown, the computing device 1200 may include one or more components that can be connected or communicated with the bus 1202 via one or more interfaces. The bus 2102 may include, but is not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus. The computing device 1200 may include, for example, one or more processors 1204, one or more input devices 1206, and one or more output devices 1208. The one or more processors 1204 may be any type of processor and may include, but is not limited to, one or more general-purpose processors or special-purpose processors (such as special-purpose processing chips). The computing device 1200 may correspond to, for example, Figure 2 The monitoring terminal 240 in the embodiment is configured to implement the method 100 for identifying illegal broadband access. The input device 1206 can be any type of input device capable of inputting information to the computing device, and can include but is not limited to a mouse, a keyboard, a touch screen, a microphone and / or a remote controller. The output device 1208 can be any type of device capable of presenting information, and can include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator and / or a printer.

[0045] The computing device 1200 may also include or be connected to a non-transitory storage device 1214, which may be any non-transitory storage device that can implement data storage, and may include, but is not limited to, a disk drive, an optical storage device, a solid-state memory, a floppy disk, a flexible disk, a hard disk, a tape, or any other magnetic medium, a compressed disk or any other optical medium, a cache memory, and / or any other storage chip or module, and / or any other medium from which a computer can read data, instructions, and / or code. The computing device 1200 may also include a random access memory (RAM) 1210 and a read-only memory (ROM) 1212. The ROM 1212 may store programs, utilities, or processes to be executed in a non-volatile manner. The RAM 1210 may provide volatile data storage and store instructions related to the operation of the computing device 1200. The computing device 1200 may also include a network / bus interface 1216 coupled to a data link 1218. The network / bus interface 1216 may be any type of device or system capable of enabling communication with an external device and / or a network, and may include but is not limited to a modem, a network card, an infrared communication device, a wireless communication device, and / or a chipset (such as a Bluetooth TM equipment, 802.11 equipment, WiFi equipment, WiMax equipment, cellular communication facilities, etc.).

[0046] The present disclosure may be implemented as any combination of an apparatus, a system, an integrated circuit, and a computer program on a non-transitory computer-readable medium. One or more processors may be implemented as an integrated circuit (IC), an application specific integrated circuit (ASIC), or a large scale integrated circuit (LSI), a system LSI, a super LSI, or a super LSI component that performs some or all of the functions described in the present disclosure.

[0047] The present disclosure includes the use of software, applications, computer programs, or algorithms. The software, applications, computer programs, or algorithms may be stored on a non-transitory computer-readable medium to enable a computer such as one or more processors to perform the above steps and the steps described in the accompanying drawings. For example, one or more memories store the software or algorithm in executable instructions, and one or more processors may associate a set of instructions to execute the software or algorithm to provide various functions according to the embodiments described in the present disclosure.

[0048] Software and computer programs (which may also be referred to as programs, software applications, applications, components or code) include machine instructions for a programmable processor and may be implemented in a high-level procedural language, an object-oriented programming language, a functional programming language, a logic programming language, or an assembly language or a machine language. The term "computer-readable medium" refers to any computer program product, apparatus or device for providing machine instructions or data to a programmable data processor, such as magnetic disks, optical disks, solid-state storage devices, memories and programmable logic devices (PLDs), including computer-readable media that receive machine instructions as computer-readable signals.

[0049] For example, computer readable media may include dynamic random access memory (DRAM), random access memory (RAM), read-only memory (ROM), electrically erasable read-only memory (EEPROM), compact disk read-only memory (CD-ROM) or other optical disk storage devices, magnetic disk storage devices or other magnetic storage devices, or any other medium that can be used to carry or store the desired computer readable program code in the form of instructions or data structures and can be accessed by a general or special purpose computer or a general or special purpose processor. As used herein, disk or disc includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray disc, where disks usually reproduce data magnetically, while discs reproduce data optically by laser. Combinations of the above are also included in the scope of computer readable media.

[0050] The subject matter of the present disclosure is provided as an example of devices, systems, methods and programs for performing the features described in the present disclosure. However, in addition to the above-mentioned features, other features or variations may also be expected. It is expected that the implementation of the components and functions of the present disclosure may be completed with any emerging technology that may replace any of the above-mentioned implementation technologies.

[0051] In addition, the above description provides examples without limiting the scope, applicability or configuration set forth in the claims. Without departing from the spirit and scope of the present disclosure, the functions and arrangements of the elements discussed may be changed. Various embodiments may appropriately omit, replace or add various processes or components. For example, features described with respect to certain embodiments may be combined in other embodiments.

[0052] In addition, in the description of the present disclosure, the terms “first”, “second”, “third”, etc. are used for descriptive purposes only and cannot be understood as indicating or implying relative importance and order.

[0053] Similarly, while operations are depicted in a particular order in the drawings, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed to achieve desired results. In certain circumstances, multitasking and parallel processing can be advantageous.

Claims

1. A method for identifying illegal broadband access, comprising: The computing terminal obtains, from the core router, an HTTP request message in a GET mode from a source IP address associated with a specific user; The computing terminal analyzes the acquired HTTP request message to count the number of different destination IP addresses contained in the HTTP request message within a unit time; The computing terminal compares the number of the different destination IP addresses with a threshold, wherein the threshold is determined based on statistical data of other users with the same bandwidth and scale under the same node as the specific user; as well as In response to determining that the number of the different destination IP addresses is greater than a threshold, the computing terminal identifies that the specific user has illegal broadband access behavior.

2. The method according to claim 1, wherein: The computing terminal is connected to the core router of the metropolitan area network room through a network cable.

3. The method according to claim 2, wherein: The HTTP GET request message for obtaining the source IP address associated with a specific user includes: The mirroring of HTTP protocol traffic is achieved by configuring the core router with commands, and the HTTP request message in GET mode is mirrored to the computing terminal according to the strategy for the source IP address.

4. The method according to claim 1, wherein: The number of different destination IP addresses contained in the HTTP request message within a unit time is counted as follows: Counting the number of different destination IP addresses contained in the HTTP request messages within multiple time periods; and Obtain a median of the number of different destination IP addresses contained in the HTTP request messages in the plurality of time periods counted.

5. The method according to claim 4, wherein: Comparing the number of different destination IP addresses with a threshold includes comparing the median with the threshold.

6. The method according to claim 1, wherein: The threshold is a multiple of the number of different destination IP addresses contained in HTTP request messages per unit time of other users with the same bandwidth and scale under the same node as the specific user.

7. The method according to claim 1, further comprising: The statistical data and analysis results associated with the specific user are presented in the form of a list or a chart. The method according to claim 7 , wherein the presenting is implemented using an echart component.

9. The method according to claim 3, wherein: The command configuration of the core router includes using a dual-thread real mirror function.

10. A device for identifying illegal broadband access, comprising: a memory having instructions stored therein; as well as A processor configured to execute instructions stored on the memory to perform the method according to any one of claims 1 to 9.

11. A computer-readable storage medium comprising computer-executable instructions, which, when executed by one or more processors, cause the one or more processors to perform the method according to any one of claims 1 to 9.

Images