Goip device positioning method and device, electronic device and computer readable storage medium

Abstract

The application discloses a GOIP device positioning method and device, electronic equipment and a computer readable storage medium, and relates to the technical field of network and security. The method comprises the following steps: collecting network flow data in a target area; determining whether the network flow data has a preset heartbeat packet feature; in the case that it is determined that the network flow data has the preset heartbeat packet feature, determining that a corresponding device of the network flow data is a GOIP device, determining the installation address of a broadband account corresponding to the network flow data, and taking the installation address as the address of the GOIP device. The embodiment can quickly locate the GOIP device without a complicated analysis process, can provide an accurate installation address, has a simple process and low cost, and can improve the efficiency of fighting fraud.

Description

Technical Field

[0001] This invention relates to the field of network technology and security, and in particular to a GOIP device location method, apparatus, electronic device, and computer-readable storage medium. Background Technology

[0002] With the rapid development of mobile internet, fraudsters have begun using VoIP to carry out illegal activities. They use GOIP devices to make fraudulent calls, converting traditional telephone signals into network signals. This allows them to switch phone numbers from anywhere and call victims, separating the caller from the SIM card. This enables unattended operation, two-way calling, and avoids the drawbacks of typical number spoofing software that prevents callbacks, thus achieving the goal of concealing identity and evading investigation. To prevent users from being scammed and improve user security, current technologies analyze the voice traffic generated when fraudsters begin making fraudulent calls to combat fraud. However, this method still requires complex and tedious analysis after identifying a fraudulent call to determine the fraudster's location, resulting in low efficiency in identifying and combating fraud. Summary of the Invention

[0003] To address the aforementioned technical problems, embodiments of the present invention provide a GOIP device positioning method, apparatus, electronic device, and computer-readable storage medium.

[0004] In a first aspect of the present invention, a GOIP device location method is provided, comprising: collecting network traffic data within a target area; determining whether the network traffic data has a preset heartbeat packet characteristic; if the network traffic data has the preset heartbeat packet characteristic, determining that the device corresponding to the network traffic data is a GOIP device, and determining the installation address of the broadband account corresponding to the network traffic data, wherein the installation address is used as the address of the GOIP device.

[0005] Optionally, collecting network traffic data within the target area includes: collecting netflow traffic data within the target area using the netflow flow detection method.

[0006] Optionally, determining whether the network traffic data possesses the preset heartbeat packet characteristics includes: determining whether the network traffic data contains heartbeat packet traffic data; if so, counting the number of times the heartbeat packet traffic data appears within a preset time period; and if the number of times the heartbeat packet traffic data appears within the preset time period is greater than a preset threshold, determining that the network traffic data possesses the preset heartbeat packet characteristics.

[0007] Optionally, determining whether the network traffic data contains heartbeat packet traffic data includes: parsing the network traffic data to determine the destination port number and packet size corresponding to the network traffic data; determining whether the destination port number and packet size meet preset conditions; if so, determining that the network traffic data contains heartbeat packet traffic data.

[0008] Optionally, the method further includes: determining whether the area information indicated by the installation address meets a preset rule; if so, determining that the GOIP device is an abnormal GOIP device.

[0009] Optionally, the method further includes: determining the installation time corresponding to the broadband account; determining whether the installation time meets a preset requirement; if so, determining that the GOIP device is an abnormal GOIP device.

[0010] Optionally, the method further includes: obtaining the identity information of the user corresponding to the broadband account; determining whether the user corresponding to the broadband account is from the target region based on the identity information; if so, determining that the GOIP device is an abnormal GOIP device.

[0011] According to a second aspect of the present invention, a GOIP device positioning device is provided, comprising: a collection module for collecting network traffic data within a target area; an analysis module for determining whether the network traffic data possesses preset heartbeat packet characteristics; and a positioning module for determining, when the network traffic data possesses the preset heartbeat packet characteristics, that the device corresponding to the network traffic data is a GOIP device, and determining the installation address of the broadband account corresponding to the network traffic data, wherein the installation address is used as the address of the GOIP device.

[0012] Optionally, the acquisition module is further configured to: acquire netflow traffic data within the target area using the netflow flow detection method.

[0013] Optionally, the analysis module is further configured to: determine whether the network traffic data contains heartbeat packet traffic data; if so, count the number of times the heartbeat packet traffic data appears within a preset time period; and if the number of times the heartbeat packet traffic data appears within the preset time period is greater than a preset threshold, determine that the network traffic data possesses the preset heartbeat packet characteristics.

[0014] Optionally, the analysis module is further configured to: parse the network traffic data, determine the destination port number and packet size corresponding to the network traffic data; determine whether the destination port number and the packet size meet preset conditions; if so, determine that the network traffic data contains heartbeat packet traffic data.

[0015] Optionally, the device further includes an anomaly identification module, used to: determine whether the area information indicated by the installation address meets a preset rule; if so, determine that the GOIP device is an abnormal GOIP device.

[0016] Optionally, the anomaly identification module is further configured to: determine the installation time corresponding to the broadband account; determine whether the installation time meets preset requirements; if so, determine that the GOIP device is an abnormal GOIP device.

[0017] Optionally, the anomaly identification module is further configured to: obtain the identity information of the user corresponding to the broadband account; determine whether the user corresponding to the broadband account is from the target region based on the identity information; if so, determine that the GOIP device is an abnormal GOIP device.

[0018] According to a third aspect of the present invention, an electronic device is provided, comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the GOIP device positioning method of the present invention.

[0019] According to a fourth aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the GOIP device positioning method of the present invention.

[0020] One embodiment of the above invention has the following advantages or beneficial effects:

[0021] By collecting network traffic data within a target area, determining whether the network traffic data possesses preset heartbeat packet characteristics, and if the network traffic data is found to possess the preset heartbeat packet characteristics, the device corresponding to the network traffic data is identified as a GOIP device. The installation address of the broadband account corresponding to the network traffic data is then determined, and the installation address is used as the address of the GOIP device. This technical means can quickly locate the installation address of the GOIP device without a cumbersome analysis process. The process is simple, low-cost, and can quickly combat fraudulent activities.

[0022] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0023] The accompanying drawings are provided to better understand the invention and are not intended to unduly limit the scope of the invention. Wherein:

[0024] Figure 1 This diagram illustrates the use of GOIP devices to carry out illegal activities.

[0025] Figure 2 This is a schematic flowchart illustrating the GOIP device positioning method according to an embodiment of the present invention;

[0026] Figure 3 This is a schematic flowchart illustrating another embodiment of the GOIP device positioning method of the present invention;

[0027] Figure 4 This is a schematic diagram illustrating the structure of the GOIP device positioning device according to an embodiment of the present invention;

[0028] Figure 5 A schematic diagram of an electronic device according to an embodiment of the present invention is shown. Detailed Implementation

[0029] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0030] To facilitate understanding of the technical solutions of the embodiments of the present invention, the technical terms involved in the embodiments of the present invention will be explained below.

[0031] GOIP (GSM Over Internet Protocol) is an IP-based signal transmission technology that essentially digitizes the signal from a SIM card. A GOIP device is a hardware device for network communication that supports SIM card access and converts traditional telephone signals into network signals. A single GOIP device can operate hundreds of SIM cards simultaneously and can remotely control SIM cards in different locations to make calls and send / receive text messages, achieving separation between the user and the SIM card. Due to the mass-messaging capabilities of GOIP devices, individuals such as fraudsters may use them to carry out illegal activities, such as... Figure 1As shown, individuals rent a room in a certain location to set up GOIP equipment. After the equipment is installed, they transmit SIM card data to the GOIP device via the network. The GOIP device then connects to a local communication base station to conduct voice calls and carry out fraudulent activities. This method allows calls to victims from anywhere, separating the person from the SIM card, thus concealing their identity and evading detection. Existing technologies primarily analyze the voice traffic generated by fraudulent calls for identification. However, this method requires a certain volume of calls to be effective, and the identification process is cumbersome. After identifying a fraudulent call, further tedious analysis is needed to determine the approximate location of the GOIP device, failing to provide precise installation location and thus being inefficient in combating fraud.

[0032] To address the aforementioned technical issues, the inventors studied the communication traffic between GOIP devices and remote control servers. They discovered that the network communication traffic between GOIP devices and remote control servers generally includes heartbeat packets (a heartbeat is a user-defined command message sent periodically between a client and server to communicate their status, similar to a heartbeat). Therefore, heartbeat traffic is generated between GOIP devices and remote control servers at fixed intervals. Heartbeat traffic is characterized by small data packets, fixed sending intervals, and consistent content and size. Therefore, the heartbeat packet characteristics of GOIP devices can be used to analyze the network traffic data of GOIP devices.

[0033] Based on the above technical concept, this invention provides a method for locating GOIP devices. This method uses heartbeat packet feature analysis to analyze network traffic data within a target area. When the number of times a traffic packet of the same size appears within a certain period exceeds a preset threshold, it is determined that the broadband account corresponding to the network traffic data uses a GOIP device. The installation address of this broadband account is the installation address of the GOIP device, thus enabling rapid location of the GOIP device and obtaining its precise installation address. This invention's method for identifying abnormal GOIP devices analyzes the communication traffic between the GOIP device and the remote control terminal. It does not rely on specific IPs or ports; it only needs to determine the size and frequency of traffic packets. The process is simple, low-cost, and highly accurate.

[0034] Figure 2 A flowchart illustrating the GOIP device positioning method according to an embodiment of the present invention is shown. Figure 2 As shown, the GOIP device positioning method includes:

[0035] Step 201: Collect network traffic data within the target area.

[0036] The target area can be any region that needs to be monitored and can be flexibly set according to requirements; this invention does not impose any limitations on it. For example, the target area can be a city, a province, or even the entire country. When the target area is a city, network traffic data within that city can be collected through its metropolitan area network (MAN). A metropolitan area network (MAN) is a computer communication network established within a city, and is a type of broadband local area network. An important use of a MAN is as a backbone network, connecting hosts, databases, and LANs located in different locations within the same city.

[0037] In an optional embodiment, collecting network traffic data within the target area includes: collecting netflow traffic data within the target area using the netflow flow detection method.

[0038] NetFlow is a flow-based traffic analysis technology. Each flow mainly includes the following fields: source IP address, destination IP address, source port number, destination port number, IP protocol number, service type, TCP flag (Transmission Control Protocol), packet size (in bytes), and interface number. A NetFlow flow is defined as a unidirectional stream of data packets transmitted between a source IP address and a destination IP address, and all data packets share common transport layer source and destination port numbers. NetFlow flow detection methods can collect network traffic data flowing through a metropolitan area network and determine the source IP address, destination IP address, source port number, destination port number, and packet size of that network traffic data.

[0039] It's worth noting that NetFlow collects raw user internet traffic at a ratio of many to one, for example, 1000:1. It only analyzes the five-tuple (source IP address, destination IP address, source port number, destination port number, and IP protocol number) and packet size. Therefore, NetFlow is a lightweight analysis method; it only reads some important fields from the packet and does not include the raw data, and it is not a full traffic analysis. Both the traffic volume and packet size of NetFlow streams are relatively small, saving significant resources and reducing costs.

[0040] Step 202: Determine whether the network traffic data has preset heartbeat packet characteristics.

[0041] As mentioned above, based on the communication traffic study between GOIP devices and remote control servers, heartbeat packets are exchanged between the GOIP devices and remote control servers. Therefore, heartbeat traffic is generated between the GOIP devices and remote control servers at fixed intervals. Heartbeat traffic is characterized by small data packets, fixed transmission intervals, and consistent data packet content and size. Therefore, determining whether the network traffic data possesses the preset heartbeat packet characteristics refers to determining whether the network traffic data contains heartbeat packet traffic that appears multiple times and has the same packet size. Specifically, the process of determining whether the network traffic data possesses the preset heartbeat packet characteristics includes:

[0042] Identify the heartbeat packet traffic data within the network traffic data;

[0043] Count the number of times the heartbeat packet flow data appears within a preset time period;

[0044] If the number of times the heartbeat packet traffic data appears within a preset time period is greater than a preset threshold, it is determined that the network traffic data possesses the heartbeat packet characteristic.

[0045] Each piece of network traffic data contains the following fields: source IP address, destination IP address, source port number, destination port number, IP protocol number, and packet size. The destination port number and packet size of a heartbeat packet are fixed. Therefore, it can be determined whether the network traffic data contains heartbeat packet data based on the destination port number and packet size. Specifically, the process of determining whether network traffic data contains heartbeat packet data includes: parsing the network traffic data to determine the corresponding destination port number and packet size; determining whether the destination port number and packet size meet preset conditions; if so, then the network traffic data is determined to contain heartbeat packet data. The preset conditions can be that the destination port number is fixed and the packet size is within a preset range, classifying network traffic data as heartbeat packet data.

[0046] Both the preset time period and the preset threshold can be flexibly set according to needs, and this invention does not impose any limitations on them. As an example, the preset time period can be one day, and the preset threshold can be 10,000.

[0047] If the number of times heartbeat packet traffic data appears within a preset time period exceeds a preset threshold, then it can be determined that the network traffic data has heartbeat packet characteristics.

[0048] Step 203: If it is determined that the network traffic data has the preset heartbeat packet characteristics, determine that the device corresponding to the network traffic data is a GOIP device, determine the installation address of the broadband account corresponding to the network traffic data, and use the installation address as the address of the GOIP device.

[0049] If the network traffic data has heartbeat packet characteristics, it can be determined that a GOIP device is used under the broadband account corresponding to the network traffic data, and then the installation address corresponding to the broadband account can be used as the address of the GOIP device.

[0050] The GOIP device location method of this invention collects network traffic data within a target area, determines whether the network traffic data possesses preset heartbeat packet characteristics, and identifies the device corresponding to the network traffic data as a GOIP device if the network traffic data possesses the preset heartbeat packet characteristics. It also determines the installation address of the broadband account corresponding to the network traffic data and uses the installation address as the address of the GOIP device. This technical means can quickly locate the installation address of the GOIP device without a cumbersome analysis process, enabling rapid and accurate crackdown on fraudulent activities. Moreover, this method does not rely on specific IPs and ports; it only requires analyzing packet size and frequency of occurrence. The process is simple, efficient, low-cost, and resource-saving.

[0051] Figure 3 A flowchart illustrating another embodiment of the GOIP device positioning method of the present invention is shown, such as... Figure 3 As shown, the method includes:

[0052] Step 301: Collect network traffic data within the target area;

[0053] Step 302: Determine whether the network traffic data possesses preset heartbeat packet characteristics;

[0054] Step 303: If it is determined that the network traffic data has the preset heartbeat packet characteristics, determine that the device corresponding to the network traffic data is a GOIP device, determine the installation address of the broadband account corresponding to the network traffic data, and use the installation address as the address of the GOIP device;

[0055] Step 304: Determine whether the area information indicated by the installation address meets the preset rules;

[0056] Step 305: If yes, then determine that the GOIP device is an abnormal GOIP device.

[0057] Among them, steps 301-303 and Figure 2 The embodiments shown are the same, and the present invention will not be described again here.

[0058] For steps 304-305, based on the analysis of historical fraudulent activities, it is known that fraudulent users typically install GOIP devices in areas with high population mobility, such as rented rooms in rental houses, apartments, or subdivided flats. Therefore, the installation address can be used to determine whether the GOIP device is an abnormal GOIP device, i.e., whether the GOIP device is being used for illegal activities. Thus, in step 304, it can be determined whether the area indicated by the installation address is a rental house, apartment, or subdivided flat with high population mobility. If so, the GOIP device can be determined to be an abnormal GOIP device.

[0059] refer to Figure 1 Existing technology utilizes call detail records (CDRs) between operators and victims (i.e., Figure 1 The data shown in “②” in the figure is used to analyze and identify fraudulent activities, while the method of this embodiment of the invention utilizes network traffic data between the remote controller and the GOIP device (i.e., Figure 1 The data shown in "①" is used to analyze and identify fraudulent activities. In this embodiment of the invention, network traffic data in the target area is collected to determine whether the network traffic data has preset heartbeat characteristics. If the network traffic data has the preset heartbeat characteristics, the device corresponding to the network traffic data is determined to be a GOIP device. The installation address of the broadband account corresponding to the network traffic data is determined. Furthermore, based on the installation address of the GOIP device, it is identified whether the GOIP device is an abnormal GOIP device. Abnormal GOIP devices can be quickly and accurately identified, and the precise address of the abnormal GOIP device can be obtained, thereby improving the efficiency of combating fraud.

[0060] In an optional embodiment, the GOIP device location method may further include: determining the installation time corresponding to the broadband account; determining whether the installation time meets a preset requirement; and if so, determining that the GOIP device is an abnormal GOIP device. Here, the installation time refers to the time when the broadband was installed. Determining whether the installation time meets the preset requirement is used to determine whether the GOIP device was recently installed, for example, whether it was installed within the last three months. If the GOIP device was recently installed, it can be determined that the GOIP device is an abnormal GOIP device.

[0061] In an optional embodiment, the GOIP device location method may further include: obtaining the identity information of the user corresponding to the broadband account; determining, based on the identity information, whether the user corresponding to the broadband account is from a target region; if so, determining that the GOIP device is an abnormal GOIP device. The identity information of the user corresponding to the broadband account can be obtained from the information filled out by the user when applying for broadband, such as information obtained from the user's ID card, which may include the user's name, gender, ID number, and address (registered residence). Based on the address, it can be determined whether the user is from a target region. The target region may be a high-incidence area for fraud determined based on past experience, such as a district in a certain city. If the user's identity information determines that the user is from a target region, then the GOIP device can be determined to be an abnormal GOIP device.

[0062] In an optional embodiment, a GOIP device can be identified as an abnormal GOIP device when one or more of the installation address, installation time, and identity information meet the above rules. In a preferred embodiment, to improve the accuracy of identifying abnormal GOIP devices, a GOIP device can only be identified as an abnormal GOIP device when all of the above installation address, installation time, and identity information meet the above rules.

[0063] Figure 4 The schematic diagram illustrates the structure of the GOIP device positioning device 400 according to an embodiment of the present invention, as shown below. Figure 4 As shown, the GOIP device positioning device 400 includes:

[0064] The acquisition module 401 is used to acquire network traffic data within the target area;

[0065] Analysis module 402 is used to determine whether the network traffic data has preset heartbeat packet characteristics;

[0066] The positioning module 403 is used to determine, when the network traffic data has the preset heartbeat packet characteristics, that the device corresponding to the network traffic data is a GOIP device, and to determine the installation address of the broadband account corresponding to the network traffic data, wherein the installation address is used as the address of the GOIP device.

[0067] Optionally, the acquisition module is further configured to: acquire netflow traffic data within the target area using the netflow flow detection method.

[0068] Optionally, the analysis module is further configured to: determine whether the network traffic data contains heartbeat packet traffic data; if so, count the number of times the heartbeat packet traffic data appears within a preset time period; and if the number of times the heartbeat packet traffic data appears within the preset time period is greater than a preset threshold, determine that the network traffic data possesses the preset heartbeat packet characteristics.

[0069] Optionally, the analysis module is further configured to: parse the network traffic data, determine the destination port number and packet size corresponding to the network traffic data; determine whether the destination port number and the packet size meet preset conditions; if so, determine that the network traffic data contains heartbeat packet traffic data.

[0070] Optionally, the device further includes an anomaly identification module, used to: determine whether the area information indicated by the installation address meets a preset rule; if so, determine that the GOIP device is an abnormal GOIP device.

[0071] Optionally, the anomaly identification module is further configured to: determine the installation time corresponding to the broadband account; determine whether the installation time meets preset requirements; if so, determine that the GOIP device is an abnormal GOIP device.

[0072] Optionally, the anomaly identification module is further configured to: obtain the identity information of the user corresponding to the broadband account; determine whether the user corresponding to the broadband account is from the target region based on the identity information; if so, determine that the GOIP device is an abnormal GOIP device.

[0073] The above-described apparatus can execute the method provided in the embodiments of the present invention, and has the corresponding functional modules and beneficial effects for executing the method. Technical details not described in detail in this embodiment can be found in the method provided in the embodiments of the present invention.

[0074] This invention also provides an electronic device, such as... Figure 5 As shown, it includes a processor 501, a communication interface 502, a memory 503, and a communication bus 504, wherein the processor 501, the communication interface 502, and the memory 503 communicate with each other through the communication bus 504.

[0075] Memory 503 is used to store computer programs;

[0076] When processor 501 executes the program stored in memory 503, it performs the following steps:

[0077] The system collects network traffic data within the target area; determines whether the network traffic data possesses preset heartbeat packet characteristics; if the network traffic data possesses the preset heartbeat packet characteristics, it determines that the device corresponding to the network traffic data is a GOIP device, and determines the installation address of the broadband account corresponding to the network traffic data, with the installation address serving as the address of the GOIP device. The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of representation, only one thick line is used in the figure, but this does not indicate that there is only one bus or one type of bus.

[0078] The communication interface is used for communication between the aforementioned terminal and other devices.

[0079] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0080] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0081] In another embodiment of the present invention, a computer-readable storage medium is also provided, which stores instructions that, when executed on a computer, cause the computer to perform the GOIP device positioning method of any embodiment of the present invention. It should be noted that the computer-readable medium shown in the present invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. The computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the present invention, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wireline, optical fiber, RF, etc., or any suitable combination thereof.

[0082] In another embodiment of the present invention, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute the GOIP device positioning method of any embodiment of the present invention.

[0083] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0084] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. It should be understood that such data used can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and do not limit the number of objects; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following related objects are in an "or" relationship. Moreover, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0085] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0086] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A GOIP device positioning method, characterized in that, include: Collect network traffic data within the target area; Determine whether the network traffic data possesses preset heartbeat packet characteristics; If the network traffic data is determined to have the preset heartbeat packet characteristics, the device corresponding to the network traffic data is determined to be a GOIP device, and the installation address of the broadband account corresponding to the network traffic data is determined, and the installation address is used as the address of the GOIP device. Determining whether the network traffic data possesses the preset heartbeat packet characteristics includes: Determine whether the network traffic data contains heartbeat packet traffic data; If so, count the number of times the heartbeat packet traffic data appears within a preset time period; If the number of times the heartbeat packet traffic data appears within a preset time period is greater than a preset threshold, it is determined that the network traffic data possesses the preset heartbeat packet characteristics; The method further includes: Determine whether the area information indicated by the installation address meets the preset rules; If so, then the GOIP device is determined to be an abnormal GOIP device; The method further includes: Determine the installation time corresponding to the broadband account; Determine whether the installation time meets the preset requirements; If so, then the GOIP device is determined to be an abnormal GOIP device; The method further includes: Obtain the identity information of the user corresponding to the broadband account; Based on the identity information, determine whether the user corresponding to the broadband account is from the target region; If so, then the GOIP device is determined to be an abnormal GOIP device; Determining whether the network traffic data contains heartbeat packet traffic data includes: Parse the network traffic data to determine the destination port number and packet size corresponding to the network traffic data; Determine whether the destination port number and the message size meet preset conditions; the preset conditions are that the destination port number remains unchanged and the message size is within a preset range. If so, then it is determined that the network traffic data contains heartbeat packet traffic data.

2. The method according to claim 1, characterized in that, The network traffic data collected within the target area includes: The netflow flow detection method is used to collect netflow traffic data within the target area.

3. A GOIP device positioning device, characterized in that, include: The acquisition module is used to collect network traffic data within the target area; The analysis module is used to determine whether the network traffic data has preset heartbeat packet characteristics; The positioning module is used to determine, when the network traffic data has the preset heartbeat packet characteristics, that the device corresponding to the network traffic data is a GOIP device, and to determine the installation address of the broadband account corresponding to the network traffic data, wherein the installation address is used as the address of the GOIP device; The analysis module is also used to: determine whether the network traffic data contains heartbeat packet traffic data; if so, count the number of times the heartbeat packet traffic data appears within a preset time period; If the number of times the heartbeat packet traffic data appears within a preset time period is greater than a preset threshold, it is determined that the network traffic data possesses the preset heartbeat packet characteristics; The device also includes an anomaly identification module, used to: determine whether the area information indicated by the installation address meets preset rules; if so, determine that the GOIP device is an abnormal GOIP device; The anomaly identification module is also used to: determine the installation time corresponding to the broadband account; determine whether the installation time meets the preset requirements; if so, determine that the GOIP device is an abnormal GOIP device; The anomaly detection module is further configured to: obtain the identity information of the user corresponding to the broadband account; determine whether the user corresponding to the broadband account is from the target region based on the identity information; if so, determine that the GOIP device is an abnormal GOIP device; The device is also used for: Parse the network traffic data to determine the destination port number and packet size corresponding to the network traffic data; Determine whether the destination port number and the message size meet preset conditions; the preset conditions are that the destination port number remains unchanged and the message size is within a preset range. If so, then it is determined that the network traffic data contains heartbeat packet traffic data.

4. An electronic device, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-2.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-2.

Images