A network sharing behavior detection method and device

Abstract

The embodiments of the present application provide a network sharing behavior detection method and device, which relate to the field of network technology. The network sharing behavior detection method may include: receiving a network access request sent by a terminal device; obtaining a first IP address of the terminal device in the network access request; determining whether the first IP address is an IP address that has undergone network address translation; and determining that the terminal device has network sharing behavior when the first IP address is an IP address that has undergone network address translation. The technical solution provided by the embodiments of the present application can solve the problems of high hardware requirements, low detection efficiency, short validity duration, and low detection reliability in the prior art network sharing behavior detection method.

Description

Technical Field

[0001] The present application belongs to the field of network technology, and specifically relates to a network sharing behavior detection method and device. Background Art

[0002] In the prior art, a user-agent field, UA for short, is defined in the Hyper Text Transfer Protocol (HTTP), which identifies the terminal operating system and version, central processing unit (CPU) type, browser and version, browser rendering engine, browser language, browser plug-in, etc. Since the UA field carries individual characteristics of the terminal, the current mainstream network sharing behavior detection method is based on UA.

[0003] The UA-based detection method requires the collection of all business traffic for disassembly and detection. The detection, collection and analysis equipment requires high performance, takes a long time, and has low detection efficiency. In addition, it is necessary to occupy additional mirror physical port resources or splitter equipment equivalent to the network exit level to guide all business data packets to the collection server, which has high hardware requirements. Furthermore, for the UA-based detection method, its detection effect changes with the changes and development of the business. In the future, it is necessary to continue to invest a lot of manpower to analyze business behaviors and business change trends in order to continuously update the detection rules, and the effectiveness is short-lived. In addition, the attack and defense confrontation between sharing and anti-sharing has developed to this day, and shared black routers have also developed corresponding targeted anti-detection mechanisms, such as tampering with UA to achieve the purpose of deceiving detection. The reliability of this detection method needs to be improved. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a network sharing behavior detection method and device to solve the problems of poor detection effect such as high hardware requirements, low detection efficiency, short validity duration and low detection reliability in the network sharing behavior detection method in the prior art.

[0005] In a first aspect, an embodiment of the present application provides a network sharing behavior detection method, which is applied to a server side in a network access system without network address translation requirements, and the method includes:

[0006] Receiving a network access request sent by a terminal device;

[0007] In the network access request, obtaining a first IP address of the terminal device;

[0008] Determining whether the first IP address is an IP address that has undergone network address translation;

[0009] When the first IP address is an IP address that has undergone network address translation, it is determined that the terminal device has a network sharing behavior.

[0010] In a second aspect, an embodiment of the present application provides a network sharing behavior detection method, which is applied to a terminal device in a network access system without network address translation requirements, and the method includes:

[0011] In the case of sending a network access request to the server in the network access system, under the action of a preset plug-in, triggering an operation of obtaining a second IP address of the terminal device; wherein the second IP address is a real IP address of the terminal device;

[0012] Under the action of the preset plug-in, the second IP address is sent to the server.

[0013] In a third aspect, an embodiment of the present application provides a network sharing behavior detection device, which is applied to a server side in a network access system without network address translation requirements, and the device includes:

[0014] A receiving module, used for receiving a network access request sent by a terminal device;

[0015] A first acquisition module, used to acquire a first IP address of the terminal device in the network access request;

[0016] A first determination module, used to determine whether the first IP address is an IP address that has undergone network address translation;

[0017] The second determination module is used to determine whether the terminal device has network sharing behavior when the first IP address is an IP address that has undergone network address translation.

[0018] In a fourth aspect, an embodiment of the present application provides a network sharing behavior detection device, which is applied to a terminal device in a network access system without network address translation requirements, and the device includes:

[0019] A trigger module, configured to trigger, under the action of a preset plug-in, an operation of obtaining a second IP address of the terminal device when a network access request is sent to a server in the network access system; wherein the second IP address is a real IP address of the terminal device;

[0020] A sending module is used to send the second IP address to the server under the action of the preset plug-in.

[0021] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps in the network sharing behavior detection method described in the first aspect or the second aspect are implemented.

[0022] In a sixth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps in the network sharing behavior detection method described in the first aspect or the second aspect are implemented.

[0023] In the embodiment of the present application, in a network access environment without network address translation requirements, based on the NAT detection mechanism, it is determined whether the terminal device has network sharing behavior. This detection method can be carried out by collecting IP address data. Compared with the UA detection mechanism in the prior art that first collects and disassembles the full amount of business data and then performs detection, it can reduce the detection time and improve the detection efficiency. Moreover, since the data required for detection is small and the analysis and processing operation is simple, the hardware performance requirements are lower than those of the UA detection mechanism. In addition, in order to ensure normal communication, it is difficult for users to tamper with IP layer data. Therefore, detection is performed based on mature IP network protocols, which can improve the reliability of detection and increase the difficulty of cracking and anti-detection compared to the UA detection mechanism. Furthermore, the detection rules in the embodiment of the present application are stable and do not change with business changes. Compared with the UA detection mechanism, the effectiveness lasts longer. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 One of the flow charts of the network sharing behavior detection method provided in the embodiment of the present application;

[0025] Figure 2 A schematic diagram of a warning page provided in an embodiment of the present application;

[0026] Figure 3 A schematic diagram of a login page provided in an embodiment of the present application;

[0027] Figure 4 One of the network architecture diagrams of the network access system provided in the embodiment of the present application;

[0028] Figure 5 A schematic diagram of a network access interaction process provided in an embodiment of the present application;

[0029] Figure 6 A second schematic diagram of a network architecture of a network access system provided in an embodiment of the present application;

[0030] Figure 7 A second flowchart of a network sharing behavior detection method provided in an embodiment of the present application;

[0031] Figure 8 One of the schematic block diagrams of the network sharing behavior detection device provided in the embodiment of the present application;

[0032] Fig. 9 This is a second schematic block diagram of the network sharing behavior detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the embodiments described below are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0034] It should be understood that "one embodiment" or "an embodiment" mentioned in the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner.

[0035] In the various embodiments of the present application, it should be understood that the serial numbers of the steps do not mean an absolute order of execution, and the execution order of each step should be determined by its function and internal logic. Therefore, the serial numbers of each step should not constitute an absolute limitation on the implementation process of the embodiments of the present application.

[0036] The network sharing behavior detection method provided in the embodiment of the present application is described in detail below through specific embodiments and application scenarios in conjunction with the accompanying drawings.

[0037] An embodiment of the present application provides a network sharing behavior detection method, which is applied to a server side in a network access system without network address translation requirements. The network access system may also include a terminal device requesting to access the network.

[0038] like Figure 1 As shown, the network sharing behavior detection method may include:

[0039] Step 101: Receive a network access request sent by a terminal device.

[0040] The network access request mentioned here may be a request to access a network that requires a user name and a user password to be entered for identity authentication, such as a local area network within a company, a campus network within a campus, etc. The network access request may also be referred to as a network access request.

[0041] Step 102: Obtain the first IP address of the terminal device in the network access request.

[0042] After receiving the network access request sent by the terminal device, the server obtains the Internet Protocol (IP) address of the terminal device included in the network access request, that is, the first IP address.

[0043] Step 103: Determine whether the first IP address is an IP address that has undergone network address translation.

[0044] After obtaining the first IP address included in the network access request, the server determines whether the first IP address has undergone network address translation (NAT), that is, determines whether the first IP address is an IP address that has undergone network address translation.

[0045] Step 104: When the first IP address is an IP address that has undergone network address translation, it is determined that the terminal device has a network sharing behavior.

[0046] In a network access environment without network address translation requirements, if the IP address of a terminal device requesting network access has undergone network address translation, it indicates that the terminal device has network sharing behavior. At the same time, the occurrence time of the network sharing behavior, the first IP address and other information can be recorded.

[0047] In the embodiment of the present application, in a network access environment without network address translation requirements, based on the NAT detection mechanism, it is determined whether the terminal device has network sharing behavior. This detection method can be carried out by collecting IP address data. Compared with the UA detection mechanism that first collects and disassembles the full amount of business data and then detects, it can shorten the detection time and improve the detection efficiency. Moreover, since the data required for detection is small and the analysis and processing operation is simple, the hardware performance requirements are lower than those of the UA detection mechanism. In addition, in order to ensure normal communication, it is difficult for users to tamper with IP layer data. Therefore, detection is performed based on mature IP network protocols, which can improve the reliability of detection and increase the difficulty of cracking and anti-detection compared to the UA detection mechanism. Furthermore, the detection rules in the embodiment of the present application are stable and do not change with business changes. Compared with the UA detection mechanism, the effectiveness lasts for a long time. Finally, the technical solution provided in the embodiment of the present application can block terminal devices with NAT behavior from accessing the network in application scenarios such as local area networks and campus networks in non-NAT environments, and has universal applicability.

[0048] As an optional embodiment, after step 104 of “determining that the terminal device has network sharing behavior”, the network sharing behavior detection method may further include:

[0049] Block the network access request of the terminal device, and send a first warning message to the terminal device.

[0050] In the embodiment of the present application, when the server determines that the terminal device has network sharing behavior, it can block the network access request of the terminal device, prohibit the terminal device from accessing the network, prevent network sharing behavior, and thus improve network security. In addition, a warning message (i.e., a first warning message) can also be sent to the terminal device to warn the user of the terminal device. Furthermore, since the UA-based detection method requires full collection and disassembly of business data before detection, the detection process is likely to occur after the terminal device accesses the network, which has affected network security at this time. The embodiment of the present application can block before network access, which improves blocking efficiency and improves network security.

[0051] Optionally, the first warning information may be sent to the terminal device by pushing a warning page. The warning page includes the first warning information, such as Figure 2 Diagram of the warning page shown.

[0052] As an optional embodiment, after step 103 of "determining whether the first IP address is an IP address that has undergone network address translation", the network sharing behavior detection method may further include:

[0053] In the case that the first IP address is not an IP address that has undergone network address translation, it is determined that the terminal device does not have any network sharing behavior, and an identity authentication page is sent to the terminal device.

[0054] In the embodiment of the present application, when the server determines that the first IP address has not been translated, and determines that the terminal device does not have network sharing behavior, the server can continue the network access process and send an identity authentication page (i.e., a login page) to the terminal device. Figure 3 The schematic diagram of the identity authentication page is shown. On the identity authentication page, the terminal device user can enter the user name and password for identity authentication.

[0055] As an optional embodiment, the network sharing behavior detection method provided in the embodiment of the present application can be applied to the portal access authentication process for identity authentication during network access, that is, inserting a NAT detection mechanism in the portal access authentication process to execute the network sharing behavior detection method provided in the embodiment of the present application. Figure 4 and Figure 5 Take the following as an example to explain the network access process based on portal access authentication.

[0056] Figure 4The network architecture diagram corresponding to the network access process is illustrated, including: NAT detection server 401, portal authentication server 402, RADIUS server 403, core switch 404, aggregation layer switch 405, access layer switch 406, and terminal device 407.

[0057] Figure 5 The illustrated interaction process is mainly described with the NAT detection server 401 , the portal authentication server 402 , the RADIUS server 403 and the terminal device 407 as objects.

[0058] The network access process may include the following steps:

[0059] (1) The terminal device 407 sends a network access request to a broadband access server, wherein the broadband access server is arranged on the core switch 404, which is not shown in the figure.

[0060] (2) The broadband access server sends a portal redirection instruction to the terminal device 407 according to the received network access request.

[0061] (3) The terminal device 407 sends a portal redirection request to the NAT detection server 401 according to the received portal redirection instruction, that is, sends a network access request to the NAT detection server 401 .

[0062] (4) NAT detection server 401 receives the network access request sent by terminal device 407 (corresponding to step 101), and performs NAT detection on the IP address in the request according to the received network access request to determine whether the IP address has undergone network address translation (corresponding to steps 102 and 03).

[0063] (5) If the NAT detection server 401 determines that the IP address has undergone network address translation and determines that the terminal device 407 has network sharing behavior (corresponding to step 104), the detection fails and a warning page is pushed to the terminal device 407.

[0064] (6) If the NAT detection server 401 determines that the IP address has not been translated and that the terminal device 407 does not have any network sharing behavior, the detection passes and a redirection page is requested from the portal authentication server 402 .

[0065] (7) The portal authentication server 402 performs portal redirection push according to the request sent by the NAT detection server 401 and pushes the login page to the terminal device 407 .

[0066] (8) After the terminal device user enters the identity authentication information such as account number and password on the login page, the terminal device 407 sends the identity authentication information to the portal authentication server 402.

[0067] (9) The portal authentication server 402 pushes the received identity authentication information to the broadband access server.

[0068] (10) The broadband access server sends the received identity authentication information to the RADIUS server 403 for dial-up authentication. If the authentication is successful, the RADIUS server 403 sends an authentication success notification message to the broadband access server, so that the terminal device 407 can access the network under the action of the broadband access server.

[0069] It should be noted that:

[0070] 1. The aforementioned broadband access server is the Chinese translation of Broadband Access Server or Broadband Remote Access Server, and its English abbreviation is BAS.

[0071] 2. The aforementioned RADIUS is the abbreviation of Remote Authentication Dial In User Service, and its Chinese name is Remote User Dial-In Authentication Service.

[0072] 3. The server side that executes the aforementioned steps 101 to 104 may specifically refer to a NAT detection server 401.

[0073] 4. The NAT detection server 401 and the portal authentication server 402 can be the same server, which can reduce the deployment of network devices. Of course, the NAT detection server 401 and the portal authentication server 402 can also be different servers. In this way, the two servers are independent of each other and perform different functions respectively. After one device fails, it does not affect the function to be performed by the other device.

[0074] 5. The NAT detection server 401 may be an AMP (Apache-MySQL-PHP) website architecture.

[0075] The embodiment of the present application inserts a NAT detection mechanism into the portal access authentication process and adopts an active detection method to collect only necessary data for detection. Compared with the business method of first collecting and disassembling the full amount of business data and then detecting and blocking the business, it is beneficial to improve the efficiency of the detection and blocking mechanism.

[0076] In addition, the embodiment of the present application uses NAT detection results as the basis for judging network sharing behavior to block portal login. This detection mechanism based on mature IP network protocols makes it difficult for sharers to tamper with IP layer data to ensure normal communication needs, thereby improving the reliability of detection.

[0077] Finally, the technical solution provided in the embodiment of the present application can block the access of terminals with NAT behavior in application scenarios such as local area networks and campus networks that use Portal access authentication in non-NAT environments, and is universal.

[0078] As an optional embodiment, step 103: determining whether the first IP address is an IP address that has undergone network address translation may specifically include:

[0079] Step A1: Receive the second IP address sent by the terminal device.

[0080] The second IP address mentioned here is the real IP address of the terminal device, and the second IP address may be obtained and sent by the terminal device under the action of a preset plug-in. Specifically, when the preset plug-in detects that the terminal device sends a network access request, the terminal device obtains the second IP address under the action of the preset plug-in and sends the second IP address to the server.

[0081] Optionally, in the embodiment of the present application, when the network access request sent by the terminal device is authenticated through the portal access authentication process, it is generally performed based on the browser. Therefore, the terminal device can use the RTCPeerConnection protocol to self-request connection to obtain the local IP address in the interactive data; or call the system plug-in (Windows Management Instrumentation, WMI) interface through the browser ActiveX control to obtain the local IP address; or perform network connection sniffing through a preset plug-in to analyze the actual exit of the user's network behavior, determine the exit IP address, and thus obtain the local IP address.

[0082] Step A2: Compare the first IP address with the second IP address.

[0083] Step A3: When the first IP address is different from the second IP address, determine that the first IP address is an IP address that has undergone network address translation.

[0084] In the embodiment of the present application, by comparing whether the first IP address is the same as the second IP address, it can be determined whether the first IP address has been translated by the network address. If the first IP address is the same as the second IP address, it means that the first IP address is the real address of the terminal device, that is, the first IP address has not been translated by the network address. If the first IP address is different from the second IP address, it means that the first IP address is not the real address of the terminal device, that is, the first IP address has been translated by the network address.

[0085] In the embodiment of the present application, the terminal device can actively send its real IP address to the server under the action of the preset plug-in. The server can save the real IP address of the terminal device to determine whether the IP address in the network access request sent by the terminal device has been converted by the network address.

[0086] Wherein, when the network access request sent by the terminal device is authenticated through the portal access authentication process, the preset plug-in may be installed in the terminal device along with the browser application, or may be installed in the terminal device through other means.

[0087] Optionally, before sending the second IP address, the terminal device may encrypt the second IP address to improve information security and detection reliability.

[0088] In the case where the second IP address is encrypted, the network sharing behavior detection method may further include:

[0089] Decrypt the second IP address; if the decryption fails, block the network access request of the terminal device and send a second warning message to the terminal device.

[0090] In the embodiment of the present application, the server and the terminal device may pre-negotiate and agree on encryption and decryption rules, the terminal device encrypts the second IP address according to the preset encryption rules, and the server decrypts the second IP address according to the corresponding preset decryption rules. If the server fails to decrypt, it means that the second IP address may be tampered with, and the network access request of the terminal device is judged as an invalid access request, and in order to ensure network security, the network access request of the terminal device may be blocked, and a second warning message is sent to the terminal device to warn the user of the terminal device.

[0091] Optionally, the embodiment of the present application may preset several encryption and decryption rules, and form a rule group set through permutations and combinations. The rule order, rule content, and rule quantity in the rule group set may be dynamically adjusted.

[0092] The terminal device may determine the encryption rule serial number in a specific manner, and use the corresponding encryption rule to encrypt the second IP address, and the encryption rule may be encrypted and transmitted between the terminal device and the server in a specific manner. The server decrypts according to the encryption rule transmitted between the terminal device and the server, thereby obtaining the decrypted second IP address. Specifically, the preset plug-in in the terminal device may determine the encryption rule serial number in a specific manner, and encrypt the encryption rule used this time and send it to the server in a specific manner.

[0093] As an optional embodiment, in the embodiment of the present application, when it is detected that the terminal device has network sharing behavior, a preset program can be used to simulate the maintenance personnel to log in to the network device, recursively level by level, trace the first IP address, locate the access location of the network sharing behavior, and determine which physical device and which physical port the first IP address comes from. The specific implementation method is as follows:

[0094] After step 104 of “determining that the terminal device has network sharing behavior”, the network sharing behavior detection method may further include:

[0095] Step B1: From the server to the terminal, log in to the switch between the server and the terminal step by step.

[0096] In the embodiment of the present application, the switch between the server and the terminal device can be logged in step by step in the order from the upper level to the lower level to trace the source of the first IP address.

[0097] Step B2: Determine the source port of the target MAC address recorded in the switch for each login.

[0098] Each level of switch records the source port of the target MAC address, and the source port is the port of the lower-level device of the current switch.

[0099] Among them, you can use the method of viewing the device MAC address table to obtain the source port of the target MAC address.

[0100] Step B3: Based on the preset network architecture information, determine whether the source port of the target MAC address is a physical port of the terminal device.

[0101] After obtaining the source port information of the target MAC address recorded in the current switch, it can be determined whether the source port is an end port based on the preset network architecture information, that is, whether the source port is a physical port of the terminal device.

[0102] The preset network architecture information mentioned here includes network equipment information in the network access system and port information of the network equipment. The preset network architecture information can be network equipment maintenance data, which is generated in the process of building a network.

[0103] Step B4: When the source port of the target MAC address is a physical port of the terminal device, the source port and the currently logged-in switch information are recorded.

[0104] When the source port of the target MAC address is determined to be the physical port of the terminal device, the source tracing is completed, and the source port information and the currently logged-in switch information are recorded and displayed for the administrator to view. The currently logged-in switch described here is the end access switch, which is the switch connected to the terminal device.

[0105] In addition, the time when the traceability result is obtained can also be recorded to distinguish the time when the network sharing behavior occurs, and provide a basis for tracing back for invalid records that may occur due to the reallocation of IP addresses. For example, terminal device A uses its own real first IP address to request access to the network, and terminal device B converts its own IP address to the first IP address through network address translation to perform network sharing. The server side finds that the network sharing behavior time of terminal device B is 10:00, and traces the source of terminal device B to obtain the traceability result at 10:10. During the period from 10:00 to 10:10, the first IP address may be reallocated to terminal device C, so that terminal device C uses the first IP address to request network access, which may result in the traceability result being the physical port of terminal device C, causing the server side to send a first warning message to terminal device C. At this time, the recorded time of obtaining the traceability result can become the basis for tracing back to terminal device C.

[0106] If it is determined that the source port of the target MAC address is not a physical port of the terminal device, the next level switch is logged in.

[0107] Among them, the server executing steps B1 to B4 can be the same server as the server executing steps 101 to 104, such as both are NAT detection servers, or they can be different servers, such as steps B1 to B4 are executed by a separate tracing server.

[0108] In order to better understand the above scheme, Figure 6 Take this as an example for further explanation.

[0109] Figure 6The diagram shows a network architecture of a network access system, which may include: a tracing server 408, a NAT detection server 401, a database server 409, a core switch 404, a convergence layer switch 405, an access layer switch 406 and a terminal device 407.

[0110] The NAT detection server 401 will record the time when the network sharing behavior is detected, the first IP address corresponding to the network sharing behavior, and other information to form a network sharing behavior record.

[0111] The tracing server 408 can periodically obtain network sharing behavior records from the NAT detection server 401 to determine whether there is any new network sharing behavior. After discovering the new network sharing behavior, the corresponding first IP address is obtained. Among them, there is a warning page in the access.log of the NAT detection server 401 to push the access log (i.e., the network sharing behavior record). The tracing server 408 can read the first IP address corresponding to the new network sharing behavior by reading the information in the access.log.

[0112] After obtaining the first IP address, the tracing server 408 can use Visual Basic Script (VBScript) as a command execution script template, call SecureCRT as a command execution platform, and simulate manual login operations.

[0113] for Figure 6 The network architecture shown first simulates manual login to the core switch 404. On the core switch 404, the correspondence between the IP address and the MAC address in the Dynamic Host Configuration Protocol (DHCP) allocation log can be used to determine the target MAC address corresponding to the first IP address, and the source port of the target MAC address recorded in the core switch 404 can be determined through the device ARP (Address Resolution Protocol) table or the device MAC address table. The tracing server 408 can obtain network equipment maintenance information from the database server 409. Based on the network equipment maintenance information, it can be determined whether the source port of the target MAC address recorded in the core switch 404 is the end port of the target MAC address. The network equipment maintenance information obtained by the tracing server 408 is mainly MySQL database information stored in the standardized format. For the missing equipment information in the database, the tracing server 408 can obtain it by reading the original Excel table, and then add it to the database after standardized formatting.

[0114] for Figure 6In the network architecture shown, it is obvious that the source port of the target MAC address recorded in the core switch 404 is not the end port of the target MAC address, so continue to simulate manual login to the aggregation layer switch 405, and so on, by simulating manual login to the core switch 404 and the aggregation layer switch 405 step by step, until the artificial login to the access layer switch 406 is simulated, it is determined that the source port of the target MAC address recorded in the access layer switch 606 is the end port. After that, the information of the end access switch (i.e., the access layer switch 406) and the end port information of the target MAC address are written into the MySQL database, and the time of obtaining the tracing result is recorded. If necessary, a page display can be provided for the recorded information to provide accurate positioning for administrative law enforcement.

[0115] in, Figure 6 The 410 in the figure is a black router of a network sharing device, which can convert the IP address of the terminal device into a network address.

[0116] Among them, the login account and password of each level of switch can be obtained from the network equipment maintenance information.

[0117] The embodiment of the present application also provides a network sharing behavior detection method, which is applied to a terminal device in a network access system without network address translation requirements.

[0118] like Figure 7 As shown, the network sharing behavior detection method may include:

[0119] Step 701: When a network access request is sent to a server in a network access system, an operation of obtaining a second IP address of a terminal device is triggered under the action of a preset plug-in.

[0120] The second IP address is the real IP address of the terminal device.

[0121] Step 702: Under the action of the preset plug-in, the second IP address is sent to the server.

[0122] In an embodiment of the present application, a preset plug-in installed in the terminal device can trigger a processing operation of obtaining the real IP address of the terminal device (i.e., the second IP address) and a sending operation of sending the real IP address to the server side when it detects that the terminal device sends a network access request to the server side.

[0123] The preset plug-in described here can be a plug-in that comes with the terminal device system. If the network access request sent by the terminal device is authenticated through the portal access authentication process, the preset plug-in can also be installed in the terminal device with the browser application, of course, it can also be installed in the terminal device in other ways.

[0124] Through this preset plug-in, the terminal device can actively send its real IP address to the server, which is convenient for the server to perform NAT detection, and is also helpful to reduce the situation where the terminal device sends a false IP address as a real IP address.

[0125] As an optional embodiment, step 702 "sending the second IP address to the server under the action of the preset plug-in" may include:

[0126] Among multiple preset encryption rules, determine a target encryption rule; use the target encryption rule to encrypt the second IP address; under the action of a preset plug-in, send the encrypted second IP address to the server.

[0127] In an embodiment of the present application, the terminal device may encrypt the second IP address before sending the second IP address to improve information security and detection reliability.

[0128] In the embodiment of the present application, several encryption and decryption rules can be preset, and a rule group set can be formed through permutations and combinations. The rule order, rule content, and rule quantity in the rule group set can be dynamically adjusted.

[0129] Among them, the terminal device can use a specific method to determine the encryption rule sequence number, use the corresponding encryption rule to encrypt the second IP address, and the encryption rule can be encrypted and transmitted between the terminal device and the server in a specific way. The server decrypts according to the encryption rule transmitted between the terminal device and the server, thereby obtaining the decrypted second IP address. If the server-side decryption fails, it means that the second IP address may have been tampered with, then the network access request of the terminal device is judged as an invalid access request, and in order to ensure network security, the network access request of the terminal device can be blocked, and a second warning message is sent to the terminal device to warn the user of the terminal device.

[0130] Specifically, the preset plug-in in the terminal device may determine the encryption rule serial number in a specific manner, and encrypt the encryption rule used this time in a specific manner and send it to the server.

[0131] The above is a description of the network sharing behavior detection method provided in the embodiment of the present application.

[0132] In summary, in the embodiment of the present application, in a network access environment without network address translation requirements, based on the NAT detection mechanism, it is determined whether the terminal device has network sharing behavior. The detection method can be carried out by collecting IP address data. Compared with the UA detection mechanism that first collects and disassembles the full amount of business data and then detects, it can shorten the detection time and improve the detection efficiency. Moreover, since the data required for detection is small and the analysis and processing operation is simple, the hardware performance requirements are lower than those of the UA detection mechanism. In addition, in order to ensure normal communication, it is difficult for users to tamper with IP layer data. Therefore, detection is performed based on mature IP network protocols, which can improve the reliability of detection and the difficulty of cracking and anti-detection compared to the UA detection mechanism. Furthermore, the detection rules in the embodiment of the present application are stable and do not change with business changes. Compared with the UA detection mechanism, the effectiveness lasts for a long time. Finally, the technical solution provided in the embodiment of the present application can block terminal devices with NAT behavior from accessing the network in application scenarios such as local area networks and campus networks in non-NAT environments, and has universal applicability.

[0133] In addition, through the preset plug-in, the terminal device can actively send its own real IP address to the server, which is convenient for the server to perform NAT detection, and is also helpful to reduce the situation where the terminal device sends a false IP address as a real IP address.

[0134] The above describes the network sharing behavior detection method provided by the embodiment of the present application. The following will describe the network sharing behavior detection device provided by the embodiment of the present application in conjunction with the accompanying drawings.

[0135] like Figure 8 As shown, an embodiment of the present application also provides a network sharing behavior detection device, which is applied to a server side in a network access system without network address translation requirements.

[0136] Wherein, the network sharing behavior detection device may include:

[0137] The receiving module 801 is used to receive a network access request sent by a terminal device.

[0138] The first acquisition module 802 is used to obtain the first IP address of the terminal device in the network access request.

[0139] The first determination module 803 is used to determine whether the first IP address is an IP address that has undergone network address translation.

[0140] The second determination module 804 is used to determine whether the terminal device has network sharing behavior when the first IP address is an IP address that has undergone network address translation.

[0141] Optionally, the device may further include:

[0142] The first processing module is used to block the network access request and send a first warning message to the terminal device.

[0143] Optionally, the first determining module 803 may include:

[0144] A receiving unit is used to receive the second IP address sent by the terminal device.

[0145] The second IP address is a real IP address of the terminal device, and is obtained and sent by the terminal device under the action of a preset plug-in.

[0146] A comparing unit is used to compare the first IP address with the second IP address.

[0147] The first determining unit is used to determine that the first IP address is an IP address that has undergone network address translation when the first IP address is different from the second IP address.

[0148] Optionally, the second IP address sent by the terminal device is encrypted.

[0149] The device may also include:

[0150] A decryption module is used to decrypt the second IP address.

[0151] The second processing module is used to block the network access request and send a second warning message to the terminal device when the decryption fails.

[0152] Optionally, the device may further include:

[0153] The login module is used to log in to the switch between the server and the terminal device step by step in the direction from the server to the terminal device.

[0154] The second acquisition module is used to obtain the source port of the target MAC address recorded in the switch for each login.

[0155] The target MAC address corresponds to the first IP address.

[0156] The third determination module is used to determine whether the source port is a physical port of the terminal device based on preset network architecture information.

[0157] The preset network architecture information includes network device information and port information of network devices in the network access system.

[0158] The recording module is used to record the source port information and the currently logged-in switch information when the source port is a physical port of the terminal device.

[0159] The network sharing behavior detection device provided in the embodiment of the present application can achieve Figure 1 To avoid repetition, the various processes implemented by the network sharing behavior detection device in the illustrated method embodiment will not be described again here.

[0160] like Fig. 9 As shown, an embodiment of the present application also provides a network sharing behavior detection device, which is applied to a terminal device in a network access system without network address translation requirements.

[0161] Wherein, the network sharing behavior detection device may include:

[0162] The trigger module 901 is used to trigger the operation of obtaining the second IP address of the terminal device under the action of a preset plug-in when a network access request is sent to the server in the network access system.

[0163] The second IP address is the real IP address of the terminal device.

[0164] The sending module 902 is used to send the second IP address to the server under the action of the preset plug-in.

[0165] Optionally, the sending module 902 may include:

[0166] The second determining unit is used to determine a target encryption rule among a plurality of preset encryption rules.

[0167] An encryption unit is used to encrypt the second IP address using the target encryption rule.

[0168] The sending unit is used to send the encrypted second IP address to the server under the action of the preset plug-in.

[0169] The network sharing behavior detection device provided in the embodiment of the present application can achieve Figure 7 To avoid repetition, the various processes implemented by the network sharing behavior detection device in the illustrated method embodiment will not be described again here.

[0170] In the embodiment of the present application, in a network access environment without network address translation requirements, based on the NAT detection mechanism, it is determined whether the terminal device has network sharing behavior. This detection method can be carried out by collecting IP address data. Compared with the UA detection mechanism that first collects and disassembles the full amount of business data and then detects, it can shorten the detection time and improve the detection efficiency. Moreover, since the data required for detection is small and the analysis and processing operation is simple, the hardware performance requirements are lower than those of the UA detection mechanism. In addition, in order to ensure normal communication, it is difficult for users to tamper with IP layer data. Therefore, detection is performed based on mature IP network protocols, which can improve the reliability of detection and increase the difficulty of cracking and anti-detection compared to the UA detection mechanism. Furthermore, the detection rules in the embodiment of the present application are stable and do not change with business changes. Compared with the UA detection mechanism, the effectiveness lasts for a long time. Finally, the technical solution provided in the embodiment of the present application can block terminal devices with NAT behavior from accessing the network in application scenarios such as local area networks and campus networks in non-NAT environments, and has universal applicability.

[0171] An embodiment of the present application also provides an electronic device, including a processor and a memory, wherein the memory stores a program or instruction that can be executed on the processor. When the program or instruction is executed by the processor, the various steps of the above-mentioned network sharing behavior detection method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0172] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned network sharing behavior detection method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0173] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0174] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM, RAM, disk, CD, etc., including a number of instructions for a computer device (which can be a personal computer, server or network device, etc.) to execute the methods described in each embodiment or some parts of the embodiment.

[0175] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A network sharing behavior detection method, applied to a server side of a network access system without network address translation requirements, characterized in that: The method comprises: Receiving a network access request sent by a terminal device; In the network access request, obtaining a first IP address of the terminal device; Determining whether the first IP address is an IP address that has undergone network address translation; In the case where the first IP address is an IP address that has undergone network address translation, determining that the terminal device has a network sharing behavior; Wherein, determining whether the first IP address is an IP address that has undergone network address translation includes: Receiving a second IP address sent by the terminal device; wherein the second IP address is a real IP address of the terminal device, and is obtained and sent by the terminal device under the action of a preset plug-in; Comparing the first IP address with the second IP address; In the case where the first IP address is different from the second IP address, determining that the first IP address is an IP address that has undergone network address translation; Wherein, the second IP address sent by the terminal device is encrypted; After receiving the second IP address sent by the terminal device, the method further includes: Decrypting the second IP address; In case of decryption failure, the network access request is blocked and a second warning message is sent to the terminal device.

2. The network sharing behavior detection method according to claim 1, characterized in that: After determining that the terminal device has a network sharing behavior, the method further includes: The network access request is blocked, and a first warning message is sent to the terminal device.

3. The network sharing behavior detection method according to claim 1, characterized in that: After determining that the terminal device has a network sharing behavior, the method further includes: Logging into the switch between the server and the terminal device step by step in the direction from the server to the terminal device; Obtaining the source port of the target MAC address recorded in the switch for each login; wherein the target MAC address corresponds to the first IP address; Based on preset network architecture information, determining whether the source port is a physical port of the terminal device; wherein the preset network architecture information includes network device information and port information of the network device in the network access system; In the case where the source port is a physical port of the terminal device, the source port information and the currently logged-in switch information are recorded.

4. A network sharing behavior detection device, applied to the server side of a network access system without network address translation requirements, characterized in that: The device comprises: A receiving module, used for receiving a network access request sent by a terminal device; A first acquisition module, used to acquire a first IP address of the terminal device in the network access request; A first determination module, used to determine whether the first IP address is an IP address that has undergone network address translation; A second determination module is used to determine that the terminal device has a network sharing behavior when the first IP address is an IP address that has undergone network address translation; The first determination module further includes: A receiving unit, configured to receive a second IP address sent by the terminal device; wherein the second IP address is a real IP address of the terminal device, and is obtained and sent by the terminal device under the action of a preset plug-in; A comparing unit, configured to compare the first IP address with the second IP address; A first determining unit, configured to determine that the first IP address is an IP address that has undergone network address translation when the first IP address is different from the second IP address; The second IP address sent by the terminal device is encrypted, and the apparatus further includes: A decryption module, used for decrypting the second IP address; The second processing module is used to block the network access request and send a second warning message to the terminal device when the decryption fails.

5. The network sharing behavior detection device according to claim 4, characterized in that: The device also includes: The first processing module is used to block the network access request and send a first warning message to the terminal device.

6. The network sharing behavior detection device according to claim 4, characterized in that: The device also includes: A login module, used to log in to the switch between the server and the terminal device step by step in the direction from the server to the terminal device; A second acquisition module, used to obtain a source port of a target MAC address recorded in the switch for each login; wherein the target MAC address corresponds to the first IP address; A third determination module is used to determine whether the source port is a physical port of the terminal device based on preset network architecture information; wherein the preset network architecture information includes network device information and port information of the network device in the network access system; The recording module is used to record the source port information and the currently logged-in switch information when the source port is a physical port of the terminal device.

7. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps of the network sharing behavior detection method according to any one of claims 1 to 3 are implemented.

8. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by a processor, the steps of the network sharing behavior detection method according to any one of claims 1 to 3 are implemented.

Images