Verification method, device and apparatus of GoIP device, and storage medium

Abstract

The application discloses a kind of GoIP equipment verification method, equipment, device and storage medium.The application discloses: each IP address in the region to be scanned is sent SIP protocol request, each IP address is screened according to the response result of each IP address, determine the IP address to be verified in each IP address, obtain the response message sent based on SIP protocol request of IP address to be verified, whether the device corresponding to IP address to be verified is GoIP equipment according to response message verification IP address to be verified;Since the application sends SIP protocol request to each IP address in the region to be scanned, since GoIP equipment is communicated between SIP protocol and SIP server, so it can be screened according to the response result of each IP address IP address to be verified, according to the response message sent by IP address to be verified, IP address to be verified is verified, compared with prior art verification method, the application can effectively and accurately identify GoIP equipment, and can accurately track and locate GoIP equipment based on IP address.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a verification method, device, apparatus, and storage medium for GoIP devices. Background Technology

[0002] GoIP devices (GSM over IP, GSM communication based on IP) are hardware devices for network communication that support SIM card access and convert traditional telephone signals into network signals. A single device can operate hundreds of SIM cards simultaneously and can remotely control SIM cards in different locations to make calls and send / receive text messages, achieving separation between the person and the SIM card to conceal identity and evade detection. Furthermore, it can perform virtual dialing, arbitrarily switching phone numbers to call victims, making it extremely difficult for law enforcement to intercept and trace the signal. Therefore, it has gradually become a new tactic for fraudsters. Currently, there is no precise detection capability for GoIP devices, making effective monitoring of them impossible.

[0003] The above content is only used to help understand the technical solution of the present invention and does not represent an admission that the above content is prior art. Summary of the Invention

[0004] The main objective of this invention is to provide a verification method, device, apparatus, and storage medium for GoIP devices, aiming to solve the technical problem that existing technologies cannot accurately detect GoIP devices, resulting in the inability to effectively monitor GoIP devices.

[0005] To achieve the above objectives, the present invention provides a verification method for GoIP devices, the method comprising the following steps:

[0006] Send SIP protocol requests to each IP address in the area to be scanned;

[0007] Based on the response results of each IP address, filter the IP addresses to be verified.

[0008] Obtain the response message sent by the IP address to be verified based on the SIP protocol request;

[0009] Verify whether the device corresponding to the IP address to be verified is a GoIP device based on the response message.

[0010] Optionally, verifying whether the device corresponding to the IP address to be verified is a GoIP device based on the response message includes:

[0011] The response message is parsed to obtain the feature information in the response message;

[0012] Query the preset message feature table based on the aforementioned feature information;

[0013] Verify, based on the query results, whether the device corresponding to the IP address to be verified is a GoIP device.

[0014] Optionally, querying a preset message feature table based on the feature information includes:

[0015] Extract each field from the feature information;

[0016] According to the SIP protocol, each field is traversed, and the traversed fields are used as keyword fields;

[0017] The preset message feature table is queried based on the keyword field.

[0018] Optionally, before sending SIP protocol requests to each IP address in the area to be scanned, the process includes:

[0019] Upon receiving a scan request, the scan parameters are obtained based on the scan request;

[0020] The scanning parameters are input into a pre-built profile analysis model to determine the profile analysis result corresponding to the scanning parameters;

[0021] The area to be scanned is determined based on the image analysis results.

[0022] Optionally, before inputting the scanning parameters into a pre-built image analysis model and determining the image analysis result corresponding to the scanning parameters, the method further includes:

[0023] Acquire historical scanning information and extract historical abnormal behavior information from the historical scanning information;

[0024] Based on the aforementioned historical abnormal behavior information, each historical abnormal behavior and the corresponding feature information of each historical abnormal behavior are determined.

[0025] A profile analysis model is constructed based on the correspondence between each historical abnormal behavior and the aforementioned feature information.

[0026] Optionally, sending SIP protocol requests to each IP address in the area to be scanned includes:

[0027] Upon receiving a scan request, a scan strategy is obtained based on the scan request;

[0028] When the scanning strategy is an IP segmentation scanning strategy, the IP addresses in the scanning area are segmented and sorted according to a preset segmentation and sorting strategy.

[0029] Based on the segmentation and sorting results, SIP protocol requests are sent to each IP address in the area to be scanned.

[0030] Optionally, after obtaining the scanning strategy based on the scanning request upon receiving the scanning request, the method further includes:

[0031] When the scanning strategy is a regional scanning strategy, the scanning weight of each region in the area to be scanned is determined according to the regional scanning strategy;

[0032] The scanning order of each region is determined based on the scanning weights and the scanning order of each region is determined based on the scanning order results.

[0033] Based on the scanning order, SIP protocol requests are sent to each IP address in each region of the area to be scanned.

[0034] Furthermore, to achieve the above objectives, the present invention also proposes a verification device for a GoIP device, the verification device for a GoIP device comprising:

[0035] The request sending module is used to send SIP protocol requests to each IP address in the area to be scanned.

[0036] The IP address filtering module is used to filter IP addresses based on their response results and determine the IP addresses to be verified.

[0037] The message acquisition module is used to acquire the response message sent by the IP address to be verified based on the SIP protocol request;

[0038] The device verification module is used to verify whether the device corresponding to the IP address to be verified is a GoIP device based on the response message.

[0039] Furthermore, to achieve the above objectives, the present invention also proposes a verification device for a GoIP device, the verification device for a GoIP device comprising: a memory, a processor, and a verification program for a GoIP device stored in the memory and executable on the processor, the verification program for a GoIP device being configured to implement the steps of the verification method for a GoIP device as described above.

[0040] In addition, to achieve the above objectives, the present invention also proposes a storage medium storing a verification program for a GoIP device, wherein the verification program for the GoIP device, when executed by a processor, implements the steps of the verification method for the GoIP device as described above.

[0041] This invention sends SIP protocol requests to each IP address in the area to be scanned, filters the IP addresses based on their response results, determines the IP addresses to be verified, obtains the response messages sent by the IP addresses to be verified based on the SIP protocol requests, and verifies whether the device corresponding to the IP address to be verified is a GoIP device based on the response messages. Because this invention sends SIP protocol requests to each IP address in the area to be scanned, and because GoIP devices communicate with SIP servers via the SIP protocol, it can filter the IP addresses to be verified based on their response results and verify them based on the response messages sent by those IP addresses. Compared to existing verification methods, this invention can effectively and accurately identify GoIP devices and accurately track and locate them based on their IP addresses. Attached Figure Description

[0042] Figure 1 This is a schematic diagram of the structure of the verification device for the GoIP device in the hardware operating environment involved in the embodiments of the present invention;

[0043] Figure 2 This is a flowchart illustrating the first embodiment of the verification method for the GoIP device of the present invention;

[0044] Figure 3 This is a schematic diagram of the GoIP device discovery process in the first embodiment of the GoIP device verification method of the present invention;

[0045] Figure 4 This is a flowchart illustrating the second embodiment of the verification method for the GoIP device of the present invention;

[0046] Figure 5 This is a flowchart illustrating the third embodiment of the verification method for the GoIP device of the present invention;

[0047] Figure 6 This is a schematic diagram of the GoIP device scanning process in the third embodiment of the GoIP device verification method of the present invention;

[0048] Figure 7 This is a structural block diagram of the first embodiment of the verification device for the GoIP device of the present invention.

[0049] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0050] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention.

[0051] Reference Figure 1 , Figure 1 This is a schematic diagram of the verification device structure of the GoIP device in the hardware operating environment involved in the embodiments of the present invention.

[0052] like Figure 1 As shown, the verification device of the GoIP device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to implement communication between these components. The user interface 1003 may include a display screen or an input unit such as a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wireless-Fidelity (Wi-Fi) interface). The memory 1005 may be high-speed random access memory (RAM) or stable non-volatile memory (NVM), such as a disk storage device. The memory 1005 may also optionally be a storage device independent of the aforementioned processor 1001.

[0053] Those skilled in the art will understand that Figure 1 The structure shown does not constitute a limitation on the verification device of the GoIP device, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0054] like Figure 1 As shown, the memory 1005, which serves as a storage medium, may include an operating system, a network communication module, a user interface module, and a verification program for GoIP devices.

[0055] exist Figure 1 In the verification device of the GoIP device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the verification device of the GoIP device of the present invention can be set in the verification device of the GoIP device. The verification device of the GoIP device calls the verification program of the GoIP device stored in the memory 1005 through the processor 1001 and executes the verification method of the GoIP device provided in the embodiment of the present invention.

[0056] This invention provides a verification method for GoIP devices, referring to... Figure 2 , Figure 2This is a flowchart illustrating the first embodiment of a verification method for a GoIP device according to the present invention.

[0057] In this embodiment, the verification method for the GoIP device includes the following steps:

[0058] Step S10: Send SIP protocol requests to each IP address in the area to be scanned.

[0059] It should be noted that because GoIP devices and control servers (i.e., SIP servers) are deployed in a distributed manner, malicious actors can control GoIP devices to make outbound calls through the SIP server. To address this characteristic, this embodiment utilizes network scanning to actively detect GoIP devices within the network. When scanning for GoIP addresses in a region, a SIP protocol request is sent to each IP address in the region. Based on the response results, the IP addresses are filtered to identify those awaiting verification. The response message sent by the IP address awaiting verification based on the SIP protocol request is obtained. The device corresponding to the IP address awaiting verification is then verified based on the response message to determine whether it is a GoIP device. This allows for accurate location of GoIP devices in the region being scanned, effectively tracking and monitoring them.

[0060] It should be understood that the execution subject of the method in this embodiment can be a verification device of a GoIP device with data processing, network communication and program running functions, such as a computer, or other devices or equipment that can achieve the same or similar functions. Here, the verification device of the GoIP device (hereinafter referred to as the verification device) is used as an example for explanation.

[0061] It should be noted that the area to be scanned can be the area of ​​the GoIP device determined by the verification device based on the scanning parameters pre-input by the user. The aforementioned SIP protocol request can be a request containing SIP protocol probe instructions. The SIP protocol can be the Session Initiation Protocol (SIP), a multimedia communication protocol developed by the Internet Engineering Task Force (IETF).

[0062] It should be understood that GoIP devices communicate with SIP servers via the SIP protocol. Therefore, in this embodiment, the verification device sends SIP protocol requests to each IP address in the area to be scanned, thereby determining the suspicious IP addresses based on the responses to the SIP protocol requests from each IP address.

[0063] Step S20: Filter each IP address based on the response results of each IP address to determine the IP address to be verified.

[0064] It should be noted that the response result can be the response information returned by the device corresponding to each IP address when it receives the SIP protocol request. The response result may include no response from the IP address based on the SIP protocol request, a relevant response from the IP address based on the SIP protocol request, or an irrelevant response from the IP address based on the SIP protocol request. The IP address to be verified mentioned above can be the IP address that responded to the SIP protocol request among all IP addresses.

[0065] It should be understood that, in order to further verify suspicious IP addresses from each IP address, the verification device in this embodiment determines the IP addresses that respond to SIP protocol requests based on the response results of each IP address, and filters out the IP addresses that generate responses from each IP address as suspicious IP addresses to be verified.

[0066] Step S30: Obtain the response message sent by the IP address to be verified based on the SIP protocol request.

[0067] It should be noted that the response message can be the message information requested by the IP address to be verified based on the SIP protocol.

[0068] It should be understood that, in order to accurately determine whether the device corresponding to the IP address to be verified is a GoIP address, the verification device in this embodiment obtains the response message sent by the IP address to be verified based on the SIP protocol request, parses the response message, determines the specific message information returned by the device corresponding to the IP address to be verified based on the parsing result, and then verifies the message information.

[0069] Step S40: Verify whether the device corresponding to the IP address to be verified is a GoIP device based on the response message.

[0070] It should be understood that in this embodiment, the verification device parses the received response message to obtain the message information, queries the pre-built SIP protocol message feature table based on the message information, and determines whether the message information contains the message features in the SIP protocol message feature table based on the query results. If it does, the device corresponding to the IP address to be verified is determined to be a GoIP device.

[0071] In the specific implementation, if the verification device verifies that the device corresponding to the IP address to be verified is a GoIP device according to the response message, it determines the geographical location information of the GoIP device based on the IP address corresponding to the GoIP device, monitors the GoIP address based on the geographical location information, and uploads the geographical location information and IP address of the GoIP device to the alarm system.

[0072] It should be understood that, with reference Figure 3 , Figure 3 The flowchart illustrates the process of GoIP device discovery. It involves verifying the creation of a scan task, setting scan parameters, selecting a scan strategy, determining the area to be scanned based on the scan parameters and strategy, scanning the area by sending SIP protocol requests to each IP address in the area, filtering the IP addresses based on their responses, identifying the IP addresses to be verified, obtaining the response messages sent by the IP addresses to be verified based on the SIP protocol requests, and verifying whether the device corresponding to the IP address to be verified is a GoIP device based on the response messages.

[0073] Furthermore, in order to accurately verify the device corresponding to the IP address to be verified, step S40 above may include:

[0074] The response message is parsed to obtain the feature information in the response message;

[0075] Query the preset message feature table based on the aforementioned feature information;

[0076] Verify, based on the query results, whether the device corresponding to the IP address to be verified is a GoIP device.

[0077] It should be noted that the feature information can be key features in the response message, such as key fields of the SIP protocol. The preset message feature table can be a lookup table built by the verification device based on relevant information of GoIP devices acquired historically.

[0078] It should be understood that the verification device analyzes multiple GoIP devices in advance, summarizes the SIP protocol message characteristic table of GoIP devices based on the analysis results, parses the response message returned by the IP address to be verified, obtains the request line, message header and body of the response message based on the parsing results, obtains the characteristic information in the response message based on the parsing results, and queries the preset message characteristic table based on the characteristic information. If the characteristic information in the preset message characteristic table exists in the response message, it is determined that the device corresponding to the IP address to be verified is a GoIP device.

[0079] Furthermore, in order to accurately determine whether information exists in the preset message feature table in the response message, the above-mentioned querying of the preset message feature table based on the feature information may include:

[0080] Extract each field from the feature information;

[0081] According to the SIP protocol, each field is traversed, and the traversed fields are used as keyword fields;

[0082] The preset message feature table is queried based on the keyword field.

[0083] It should be noted that the fields can be message fields from the feature information, which consists of multiple sets of fields. Keyword fields can be fields related to the SIP protocol. The default message feature table contains key field information for SIP protocol parsing.

[0084] This embodiment sends SIP protocol requests to each IP address in the area to be scanned, filters the IP addresses based on their response results, determines the IP addresses to be verified, obtains the response messages sent by the IP addresses to be verified based on the SIP protocol requests, and verifies whether the device corresponding to the IP address to be verified is a GoIP device based on the response messages. Because this invention sends SIP protocol requests to each IP address in the area to be scanned, and because GoIP devices communicate with SIP servers via the SIP protocol, it can filter the IP addresses to be verified based on their response results and verify them based on the response messages sent by those IP addresses. Compared to existing verification methods, this invention can effectively and accurately identify GoIP devices and accurately track and locate them based on their IP addresses.

[0085] refer to Figure 4 , Figure 4 This is a flowchart illustrating a second embodiment of a verification method for a GoIP device according to the present invention.

[0086] Based on the first embodiment described above, in this embodiment, before step S10, the following is included:

[0087] Step S11: Upon receiving a scan request, obtain scan parameters according to the scan request.

[0088] It should be noted that the scan parameters can be the settings parameters for this GoIP device scan extracted from the scan request when the verification device receives the scan request.

[0089] Step S12: Input the scanning parameters into the pre-built portrait analysis model to determine the portrait analysis result corresponding to the scanning parameters.

[0090] It should be noted that the profile analysis model can be a profile feature analysis model for GoIP devices, and the profile analysis results can be the profile feature information of the GoIP devices to be scanned during the GoIP device scan. Alternatively, the profile analysis results can be the profile feature information of abnormal users corresponding to the GoIP devices.

[0091] It should be understood that, in order to search for abnormal users of the target, the verification device in this embodiment inputs the scanning parameters into a pre-built profile analysis model to determine the profile analysis result corresponding to the scanning parameters, that is, to determine the profile feature information of the target abnormal user in this scan. Based on the profile feature information of the target abnormal user, the area to be scanned, as well as the GoIP device's usual IP address and SIM card number information of the target abnormal user, can be determined.

[0092] Furthermore, in order to accurately construct an accurate profile analysis model, the following may be included before step S102:

[0093] Step S121: Obtain historical scanning information and extract historical abnormal behavior information from the historical scanning information;

[0094] Step S122: Determine each historical abnormal behavior and the corresponding feature information based on the historical abnormal behavior information;

[0095] Step S123: Construct a profile analysis model based on the correspondence between each historical abnormal behavior and the feature information.

[0096] It should be noted that historical scan information can include scanning parameters and strategies from historically scanned GoIP devices, as well as scan results. Historical abnormal behavior information can be related to abnormal users corresponding to the scanned GoIP devices during the historical scanning process. This information can include the operating time of the abnormal user controlling the GoIP device, SIM card number database information, call patterns, and targeting information. Call patterns can include the call dialing patterns commonly used by the abnormal user with GoIP devices, such as sequential dialing, parallel dialing, and interval dialing. The targeting can be the abnormal user's commonly used dialing targeting patterns with GoIP devices, such as geographic targeting or number targeting.

[0097] Step S13: Determine the area to be scanned based on the image analysis results.

[0098] It should be noted that the profile analysis results may include information such as the GoIP device's usual operating time, SIM card information, SIM card pool information, call patterns, or target information of the target abnormal user.

[0099] It should be understood that, in order to determine the area to be scanned and thus accurately locate the GoIP devices of the target abnormal user, the verification device in this embodiment determines the area to be scanned based on the profile analysis results, such as the SIM card pool's common home location, call direction region information, and the location of the commonly used devices of the target abnormal user's GoIP device, thereby effectively improving scanning efficiency.

[0100] This embodiment obtains scanning parameters based on the received scanning request, inputs the scanning parameters into a pre-built profile analysis model, determines the profile analysis result corresponding to the scanning parameters, and determines the area to be scanned based on the profile analysis result. Because this invention obtains scanning parameters based on the received scanning request and inputs the scanning parameters into a pre-built profile analysis model, it achieves the analysis of the profile features of abnormal users in the target scan, and thus determines the area to be scanned based on the profile analysis result, effectively improving scanning efficiency and avoiding the problem of scanning invalid areas.

[0101] refer to Figure 5 , Figure 5 This is a flowchart illustrating a third embodiment of a verification method for a GoIP device according to the present invention.

[0102] Based on the first embodiment described above, in this embodiment, step S10 includes:

[0103] Step S101: Upon receiving a scan request, obtain a scan strategy based on the scan request.

[0104] It should be understood that the verification device in this embodiment has the characteristics of large-scale concurrency and stepped sequence scanning, referring to... Figure 6 , Figure 6This diagram illustrates the GoIP device scanning process. Unlike the relatively inefficient single-threaded / sequential GoIP device detection methods, the high-concurrency sequential detection algorithm can achieve the most efficient parallel processing (including non-standard SIP protocol detection) within our dedicated processing cluster, maximizing resource utilization. Based on the basic interaction flow of the SIP protocol, each uplink and downlink message exchange inevitably experiences a delay of 0.8 to 3 seconds in reality. During large-scale detection, the accumulated waiting time is the main cause of inefficiency. Therefore, further, based on each concurrent processing flow, this method uniquely adds a "ladder sequence scanning characteristic" judgment mechanism and an efficient algorithm to the parallel dimension. This means reserving a small portion of computing power in the system to monitor the implementation and feedback status of each concurrent process in real time. When the probe detects a target IP and encounters a delay exceeding the threshold at different time points (including network congestion and network outages, etc.), the system monitoring probe will call the breakpoint caching mechanism to record the current breakpoint in a special way. Subsequently, it will respond to the follow-up work in the fastest possible way in a three-dimensional manner at this time sequence (time dimension) or at the newly ended thread (space dimension).

[0105] It should be noted that when the verification device adopts the "GoIP high concurrency and ladder sequence probing" method, it can use "non-response breakpoint caching" and "discrimination timeout caching" techniques within the timeout waiting timeline of each probing thread to efficiently reclaim idle threads. It can perform step-by-step foolproof probing on the timeline, and the method is very efficient.

[0106] Furthermore, to improve the efficiency of IP address scanning, the following steps can be included after step S101:

[0107] When the scanning strategy is a regional scanning strategy, the scanning weight of each region in the area to be scanned is determined according to the regional scanning strategy;

[0108] The scanning order of each region is determined based on the scanning weights and the scanning order of each region is determined based on the scanning order results.

[0109] Based on the scanning order, SIP protocol requests are sent to each IP address in each region of the area to be scanned.

[0110] It should be noted that the scan weight can be the proportion of importance of different regions in the area to be scanned. The higher the frequency of GoIP devices appearing in a region in the past, the higher the scan weight.

[0111] It should be understood that, in order to sort the regions in the area to be scanned and thus ensure the orderliness of the scan, the verification device in this embodiment obtains the historical scan information of the area to be scanned when the scanning strategy is a region scanning strategy, determines the scan results of each region based on the historical scan information, determines the scan weight of each region in the area to be scanned based on the scan results and the region scanning strategy, sorts the regions based on the scan weights, determines the scan order of each region based on the scan sorting results, and sends SIP protocol requests to each IP address in each region in the area to be scanned based on the scan order.

[0112] Step S102: When the scanning strategy is an IP segmentation scanning strategy, the IP addresses in the scanning area are segmented and sorted according to a preset segmentation sorting strategy.

[0113] It should be noted that the scanning strategy may include a region scanning strategy and an IP segmentation scanning strategy. The region scanning strategy may be a strategy in which the verification device divides the IP addresses to be scanned into segments and sorts them according to the division results, and then scans the IP addresses according to the sorting results.

[0114] Step S103: Send SIP protocol requests to each IP address in the area to be scanned based on the segmentation and sorting results.

[0115] It should be understood that the GoIP device segments and sorts the IP addresses in the scanned area to ensure the orderly progress of the scan. It communicates with the SIP server via the SIP protocol. Therefore, in this embodiment, the verification device sends SIP protocol requests to each IP address in the scanned area, and thus can determine the suspicious IP addresses based on the responses of each IP address to the SIP protocol requests.

[0116] This embodiment obtains a scanning strategy based on a scanning request upon receipt. When the scanning strategy is an IP segmentation scanning strategy, it segments and sorts the IP addresses in the scanning area according to a preset segmentation sorting strategy. Based on the segmentation sorting results, it sends SIP protocol requests to each IP address in the area to be scanned. Because this invention obtains the scanning strategy by extracting the scanning request, and when the scanning strategy is an IP segmentation scanning strategy, it segments and sorts the IP addresses in the scanning area according to a preset segmentation sorting strategy, and sends SIP protocol requests to each IP address in the area to be scanned based on the segmentation sorting results, thereby ensuring the orderly progress of the scan and effectively improving the efficiency of IP address scanning.

[0117] Furthermore, this embodiment of the invention also proposes a storage medium storing a verification program for a GoIP device, wherein when the verification program for the GoIP device is executed by a processor, it implements the steps of the verification method for the GoIP device as described above.

[0118] Since this storage medium adopts all the technical solutions of all the above embodiments, it has at least all the beneficial effects brought about by the technical solutions of the above embodiments, which will not be repeated here.

[0119] Reference Figure 7 , Figure 7 This is a structural block diagram of the first embodiment of the verification device for the GoIP device of the present invention.

[0120] like Figure 7 As shown, the verification device for GoIP devices proposed in this embodiment of the invention includes:

[0121] Request sending module 10 is used to send SIP protocol requests to each IP address in the area to be scanned;

[0122] IP address filtering module 20 is used to filter each IP address based on the response result of each IP address and determine the IP address to be verified among each IP address;

[0123] The message acquisition module 30 is used to acquire the response message sent by the IP address to be verified based on the SIP protocol request;

[0124] The device verification module 40 is used to verify whether the device corresponding to the IP address to be verified is a GoIP device based on the response message.

[0125] Furthermore, the device verification module 40 is also used to parse the response message to obtain the feature information in the response message; query a preset message feature table based on the feature information; and verify whether the device corresponding to the IP address to be verified is a GoIP device based on the query result.

[0126] Furthermore, the device verification module 40 is also used to extract each field from the feature information; traverse each field according to the SIP protocol, and use the traversed fields as keyword fields; and query the preset message feature table according to the keyword fields.

[0127] Furthermore, the request sending module 10 is also configured to, upon receiving a scanning request, obtain scanning parameters according to the scanning request; input the scanning parameters into a pre-built profile analysis model to determine the profile analysis result corresponding to the scanning parameters; and determine the area to be scanned based on the profile analysis result.

[0128] Furthermore, the request sending module 10 is also used to acquire historical scanning information and extract historical abnormal behavior information from the historical scanning information; determine each historical abnormal behavior and the feature information corresponding to each historical abnormal behavior based on the historical abnormal behavior information; and construct a profile analysis model based on the correspondence between each historical abnormal behavior and the feature information.

[0129] Furthermore, the request sending module 10 is also configured to, upon receiving a scan request, obtain a scan strategy based on the scan request; when the scan strategy is an IP segmentation scan strategy, segment and sort each IP address in the scan area according to a preset segmentation and sorting strategy; and send a SIP protocol request to each IP address in the area to be scanned based on the segmentation and sorting results.

[0130] Furthermore, the request sending module 10 is also configured to, when the scanning strategy is a regional scanning strategy, determine the scanning weight of each region in the region to be scanned according to the regional scanning strategy; sort the regions according to the scanning weight, and determine the scanning order of each region according to the scanning sorting result; and send SIP protocol requests to each IP address in each region in the region to be scanned based on the scanning order.

[0131] This embodiment sends SIP protocol requests to each IP address in the area to be scanned, filters the IP addresses based on their response results, determines the IP addresses to be verified, obtains the response messages sent by the IP addresses to be verified based on the SIP protocol requests, and verifies whether the device corresponding to the IP address to be verified is a GoIP device based on the response messages. Because this invention sends SIP protocol requests to each IP address in the area to be scanned, and because GoIP devices communicate with SIP servers via the SIP protocol, it can filter the IP addresses to be verified based on their response results and verify them based on the response messages sent by those IP addresses. Compared to existing verification methods, this invention can effectively and accurately identify GoIP devices and accurately track and locate them based on their IP addresses.

[0132] It should be understood that the above are merely illustrative examples and do not constitute any limitation on the technical solutions of the present invention. In specific applications, those skilled in the art can make settings as needed, and the present invention does not impose any restrictions on this.

[0133] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of this invention. In practical applications, those skilled in the art can select some or all of the workflow to achieve the purpose of this embodiment according to actual needs, and no restrictions are imposed here.

[0134] In addition, for technical details not described in detail in this embodiment, please refer to the verification method of GoIP device provided in any embodiment of the present invention, which will not be repeated here.

[0135] Furthermore, it should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0136] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0137] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory (ROM) / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0138] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A verification method for GoIP devices, characterized in that, The verification method for the GoIP device includes: Send SIP protocol requests to each IP address in the area to be scanned; Based on the response results of each IP address, filter the IP addresses to be verified. Obtain the response message sent by the IP address to be verified based on the SIP protocol request; The response message is parsed to obtain the feature information in the response message; Query the preset message feature table based on the aforementioned feature information; Verify, based on the query results, whether the device corresponding to the IP address to be verified is a GoIP device.

2. The verification method for GoIP devices as described in claim 1, characterized in that, The step of querying the preset message feature table based on the feature information includes: Extract each field from the feature information; According to the SIP protocol, each field is traversed, and the traversed fields are used as keyword fields; The preset message feature table is queried based on the keyword field.

3. The verification method for GoIP devices as described in claim 1, characterized in that, Before sending SIP protocol requests to each IP address in the area to be scanned, the process includes: Upon receiving a scan request, the scan parameters are obtained based on the scan request; The scanning parameters are input into a pre-built profile analysis model to determine the profile analysis result corresponding to the scanning parameters; The area to be scanned is determined based on the image analysis results.

4. The verification method for GoIP devices as described in claim 3, characterized in that, Before inputting the scanning parameters into the pre-built portrait analysis model and determining the portrait analysis result corresponding to the scanning parameters, the method further includes: Acquire historical scanning information and extract historical abnormal behavior information from the historical scanning information; Based on the aforementioned historical abnormal behavior information, each historical abnormal behavior and the corresponding feature information of each historical abnormal behavior are determined. A profile analysis model is constructed based on the correspondence between each historical abnormal behavior and the aforementioned feature information.

5. The verification method for the GoIP device as described in any one of claims 1 to 4, characterized in that, Sending SIP protocol requests to each IP address in the area to be scanned includes: Upon receiving a scan request, a scan strategy is obtained based on the scan request; When the scanning strategy is an IP segmentation scanning strategy, the IP addresses in the scanning area are segmented and sorted according to a preset segmentation and sorting strategy. Based on the segmentation and sorting results, SIP protocol requests are sent to each IP address in the area to be scanned.

6. The verification method for GoIP devices as described in claim 5, characterized in that, Upon receiving a scan request, after obtaining the scan strategy based on the scan request, the method further includes: When the scanning strategy is a regional scanning strategy, the scanning weight of each region in the area to be scanned is determined according to the regional scanning strategy; The scanning order of each region is determined based on the scanning weights and the scanning order of each region is determined based on the scanning order results. Based on the scanning order, SIP protocol requests are sent to each IP address in each region of the area to be scanned.

7. A verification device for GoIP equipment, characterized in that, The verification device for the GoIP device includes: The request sending module is used to send SIP protocol requests to each IP address in the area to be scanned. The IP address filtering module is used to filter IP addresses based on their response results and determine the IP addresses to be verified. The message acquisition module is used to acquire the response message sent by the IP address to be verified based on the SIP protocol request; The device verification module is used to verify whether the device corresponding to the IP address to be verified is a GoIP device based on the response message. The device verification module is also used to parse the response message to obtain the feature information in the response message; query a preset message feature table based on the feature information; and verify whether the device corresponding to the IP address to be verified is a GoIP device based on the query result.

8. A verification device for GoIP devices, characterized in that, The verification device for the GoIP device includes: a memory, a processor, and a verification program for the GoIP device stored in the memory and capable of running on the processor, wherein the verification program for the GoIP device is configured to implement the verification method for the GoIP device as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium stores a verification program for the GoIP device, which, when executed by a processor, implements the verification method for the GoIP device as described in any one of claims 1 to 6.

Images