VoIP gateway identification method, device, equipment and storage medium

Abstract

The present application provides a VoIP gateway identification method, device, equipment and storage medium, the method comprising: receiving an identification instruction, the identification instruction carrying the IP address of a target host; sending a detection message to the target host according to the IP address of the target host, receiving a detection response message returned by the target host to the detection message; and determining whether the target host belongs to a VoIP gateway according to the detection response message. The present application identifies whether the target host is a VoIP gateway by actively detecting the target host and analyzing the target host, thereby improving the initiative and pertinence of identifying the VoIP gateway.

Description

Technical Field

[0001] The present application relates to the field of information processing technology, and in particular to a VoIP gateway identification method, device, equipment and storage medium. Background Art

[0002] VoIP (Voice over Internet Protocol) is an application of the Internet to traditional industries. It is widely used by users in the telecommunications industry for its developable and flexible features. However, it also brings security risks of the Internet into the telecommunications business field.

[0003] In recent years, there have been more and more advertisements and fraudulent calls originating from the Internet and entering the telecommunications network through illegal and covertly operated VoIP gateways, causing a lot of interference and harm to people's daily lives. Therefore, it is particularly important to identify VoIP gateways from many network nodes.

[0004] VoIP gateway node identification is mainly to identify VoIP gateway nodes existing in the Internet and distinguish the types of VoIP voice communication nodes. This technology classifies the nodes involved in VoIP voice packet communication into two major types of nodes: PC users and VoIP gateways, and provides important support for the subsequent management and control of VoIP traffic passing through the node. In the existing VoIP gateway identification technology, the address belonging to the VoIP gateway is generally identified from the IP addresses involved in many VoIP media data packets. The overall method of passive analysis of VoIP traffic is adopted, which strictly relies on the accuracy and comprehensiveness of passive traffic, so there are certain limitations. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a VoIP gateway identification method, apparatus, device and storage medium, which can identify whether a target host is a VoIP gateway by actively detecting the target host and improving the initiative and pertinence of identifying the VoIP gateway.

[0006] A first aspect of an embodiment of the present application provides a VoIP gateway identification method, comprising: receiving an identification instruction, the identification instruction carrying the IP address of a target host; sending a probe message to the target host according to the IP address of the target host, and receiving a probe response message returned by the target host in response to the probe message; and determining whether the target host belongs to a VoIP gateway according to the probe response message.

[0007] In one embodiment, the method of sending a probe message to the target host based on the IP address of the target host and receiving a probe response message returned by the target host for the probe message includes: sending a host survival probe message to the IP address of the target host; if a reply message from the target host to the host survival probe message is received, sending a port probe message to the IP address of the target host, and determining the port status information of the target host based on the response message of the target host to the port probe message; and sending a service probe message based on the port status information, and receiving a response message from the target host to the service probe message.

[0008] In one embodiment, determining whether the target host belongs to a VoIP gateway based on the detection response message includes: identifying the enabled services of the target host based on the response message of the target host to the service detection message; comparing the enabled services with a preset service library, wherein the preset service library includes multiple session services based on a VoIP gateway; if the enabled services exist in the preset service library, determining that the target host is a VoIP gateway.

[0009] In one embodiment, sending a service detection message according to the port status information and receiving a response message from the target host to the service detection message include: sending a service detection message to an open port and a closed port of the target host according to the port status information, and receiving return data from the open port and the closed port as a response message from the target host to the service detection message.

[0010] In one embodiment, the method of identifying the enabled service of the target host based on the response message of the target host to the service detection message includes: generating a system fingerprint of the target host based on the return data of the open port and the closed port of the target host for the service detection message; comparing the system fingerprint with a preset fingerprint library, searching for a target service matching the system fingerprint from the preset fingerprint library, and using the target service as the enabled service of the target host, wherein the preset fingerprint library includes fingerprint features of multiple known systems.

[0011] In one embodiment, determining whether the target host belongs to a VoIP gateway based on the detection response message also includes: constructing a protocol detection message based on the enabled service; sending the protocol detection message to the IP address of the target host, and receiving return data from the target host in response to the protocol detection message; comparing a specified field of the return data of the target host in response to the protocol detection message with a preset field library, and if the content of the specified field exists in the field library, determining that the target host belongs to a VoIP gateway, and determining the attribute information of the target host as a VoIP gateway based on the content of the specified field, wherein the preset field library includes: identification information of the VoIP gateway.

[0012] In one embodiment, after determining that the target host is a VoIP gateway, it also includes: constructing a target network address according to the content of the specified field, accessing the target network address, and receiving return data from the target network address, wherein the return data of the target network address includes the VoIP traffic record on the target host.

[0013] In one embodiment, there are multiple target hosts; sending a detection message to the target host according to the IP address of the target host includes: generating a detection task for each target host according to the identification instruction; assigning the multiple detection tasks to different sub-processes, and the multiple sub-processes execute the multiple detection tasks in parallel, and respectively send detection messages to the corresponding IP addresses of the target hosts.

[0014] The second aspect of an embodiment of the present application provides a VoIP gateway identification device, including: a receiving module, used to receive an identification instruction, the identification instruction carrying the IP address of a target host; a detection module, used to send a detection message to the target host according to the IP address of the target host, and receive a detection response message returned by the target host for the detection message; a determination module, used to determine whether the target host belongs to a VoIP gateway according to the detection response message.

[0015] In one embodiment, the detection module is used to: send a host survival detection message to the IP address of the target host; if a reply message from the target host to the host survival detection message is received, send a port detection message to the IP address of the target host, and determine the port status information of the target host based on the response message of the target host to the port detection message; according to the port status information, send a service detection message, and receive a response message from the target host to the service detection message.

[0016] In one embodiment, the determination module is used to: identify the enabled services of the target host based on the response message of the target host to the service detection message; compare the enabled services with a preset service library, wherein the preset service library includes multiple session services based on a VoIP gateway; if the enabled services exist in the preset service library, determine that the target host is a VoIP gateway.

[0017] In one embodiment, sending a service detection message according to the port status information and receiving a response message from the target host to the service detection message include: sending a service detection message to an open port and a closed port of the target host according to the port status information, and receiving return data from the open port and the closed port as a response message from the target host to the service detection message.

[0018] In one embodiment, the method of identifying the enabled service of the target host based on the response message of the target host to the service detection message includes: generating a system fingerprint of the target host based on the return data of the open port and the closed port of the target host for the service detection message; comparing the system fingerprint with a preset fingerprint library, searching for a target service matching the system fingerprint from the preset fingerprint library, and using the target service as the enabled service of the target host, wherein the preset fingerprint library includes fingerprint features of multiple known systems.

[0019] In one embodiment, the determination module is also used to: construct a protocol detection message according to the enabled service; send the protocol detection message to the IP address of the target host, and receive the return data of the target host in response to the protocol detection message; compare the specified field of the return data of the target host in response to the protocol detection message with a preset field library, and if the content of the specified field exists in the field library, determine that the target host belongs to a VoIP gateway, and determine the attribute information of the target host as a VoIP gateway according to the content of the specified field, wherein the preset field library includes: identification information of the VoIP gateway.

[0020] In one embodiment, it also includes: an access module, which is used to construct a target network address according to the content of the specified field after determining that the target host is a VoIP gateway, and access the target network address, and receive return data from the target network address, wherein the return data of the target network address includes the VoIP traffic record on the target host.

[0021] In one embodiment, the number of the target hosts is multiple; the detection module is also used to: generate a detection task for each of the target hosts according to the identification instruction; assign the multiple detection tasks to different sub-processes, and the multiple sub-processes execute the multiple detection tasks in parallel, and send detection messages to the corresponding IP addresses of the target hosts respectively.

[0022] A third aspect of an embodiment of the present application provides an electronic device, comprising: a memory for storing a computer program; a processor for executing the computer program to implement the method of the first aspect of the embodiment of the present application and any embodiment thereof.

[0023] The fourth aspect of the embodiments of the present application provides a non-transitory electronic device readable storage medium, including: a program, which, when executed by an electronic device, enables the electronic device to execute the method of the first aspect of the embodiments of the present application and any one of its embodiments.

[0024] The VoIP gateway identification method, apparatus, device and storage medium provided in the present application actively detects the target host of the specified IP address and actively determines whether the target host is a VoIP gateway based on the detection response message returned by the target host to the detection message. In this way, an analysis method of actively detecting the target host is implemented to identify whether the target host is a VoIP gateway. Compared with the passive analysis of the prior art, the initiative and pertinence of identifying the VoIP gateway are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0026] Figure 1 A schematic diagram of the structure of an electronic device according to an embodiment of the present application;

[0027] Figure 2 A schematic diagram of a scenario of a VoIP gateway detection system according to an embodiment of the present application;

[0028] Figure 3A A flowchart of a VoIP gateway identification method according to an embodiment of the present application;

[0029] Figure 3B A schematic diagram of a VoIP gateway detection process node according to an embodiment of the present application;

[0030] Figure 4A flowchart of a VoIP gateway identification method according to an embodiment of the present application;

[0031] Figure 5 A flowchart of a VoIP gateway identification method according to an embodiment of the present application;

[0032] Figure 6 A flowchart of a VoIP gateway identification method according to an embodiment of the present application;

[0033] Figure 7 Schematic diagram of the structure of a VoIP gateway identification device according to an embodiment of the present application. DETAILED DESCRIPTION

[0034] The technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings in the embodiments of the present application. In the description of the present application, the terms "first", "second" and the like are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0035] like Figure 1 As shown, this embodiment provides an electronic device 1, including: at least one processor 11 and a memory 12, Figure 1 A processor is taken as an example. The processor 11 and the memory 12 are connected via a bus 10. The memory 12 stores instructions that can be executed by the processor 11, and the instructions are executed by the processor 11 so that the electronic device 1 can execute all or part of the process of the method in the following embodiment to determine whether the target host with a specified IP address belongs to a VoIP gateway.

[0036] In one embodiment, the electronic device 1 may be a mobile phone, a tablet computer, a laptop computer, a desktop computer, or a large computing system composed of multiple computers.

[0037] Please see Figure 2 , which is a scenario diagram of a VoIP gateway detection system according to an embodiment of the present application, which may mainly include: a web interface server, a detection host, a routing device, the Internet, and a target host, wherein:

[0038] The web interface server can provide a human-computer interaction interface so that the staff can enter the specified IP address through the human-computer interaction interface, that is, send the IP address of the target host to be detected through the web interface server to generate the corresponding detection task file. Among them, the detection task can include but is not limited to: the IP address of the target machine, the ID of the detection task, the type of service to be detected and other information. Then the detection task file is sent to the configuration folder of the detection host by writing a file in the specified format and path. In other words, first set up a web interface server to send the IP address of the target host to be detected.

[0039] Detect the host and start the corresponding detection process to perform the detection task. The detection host can access the Internet through the routing device, and then access the target host on the external network.

[0040] In one embodiment, the detection host can be implemented by the above-mentioned electronic device 1, for example, the user's mobile phone and computer can both serve as the detection host.

[0041] Please see Figure 3A , which is a VoIP gateway identification method according to an embodiment of the present application, the method can be Figure 1 The electronic device 1 shown is implemented as a detection host and can be applied to the above Figure 2 In the scenario of the detection system in the present invention, it is to determine whether the target host with the specified IP address belongs to the VoIP gateway. The method comprises the following steps:

[0042] Step 301: Receive an identification instruction, which carries the IP address of the target host.

[0043] In this step, in actual scenarios, there are often some illegal VoIP gateway hosts, which pose a risk of defrauding ordinary users. If the device type is identified based on traffic through traditional passive methods, it is often not identified until fraud and other illegal acts have already occurred. In order to increase the initiative, some suspicious target hosts can be counted in advance, and the IP addresses of the hosts suspected of being VoIP gateways can be pre-counted based on historical records or the experience of professionals who identify VoIP gateways. These suspicious hosts can be actively detected as target hosts, and further actively determined whether they are really VoIP gateways, which can greatly reduce the losses caused by the lag of passive identification. It can be done by staff through Figure 2 The identification instruction is entered into the web interface server in the system, and the identification instruction carries the IP address of the target host that needs to be actively detected.

[0044] In one embodiment, before entering the recognition command, some preparatory work needs to be done, as follows:

[0045] Step 1: Build a web interface server to send the target IP to be detected.

[0046] Step 2: Set up a detection host to start the detection process for VoIP gateway detection.

[0047] Step 3: According to Figure 2 The detection host is connected to the Web interface server, the detection host is connected to the network environment, and the detection host is configured so that the detection host can access Internet services through the Internet to ensure that it can access the target host on the external network.

[0048] In one embodiment, after the detection system is built, assuming that the designated IP address of the target host is: 173.82.90.36, step 301 may specifically include: issuing an identification instruction on the Web server, the identification instruction including the designated IP address of the target host: 173.82.90.36.

[0049] Step 302: Send a detection message to the target host according to the IP address of the target host, and receive a detection response message returned by the target host in response to the detection message.

[0050] In this step, a targeted detection message is first constructed. The specific type of the detection message can be determined based on the purpose of the detection, for example, Figure 3B As shown in the figure, the specific process nodes of the entire detection can include host survival detection, port detection, protocol detection, OS and service detection, vulnerability detection, etc. Each detection can construct a different detection message, and then send the detection message to the IP address of the target host. After the detection message of each detection node is sent, the detection response message returned by the target host to the detection message can be received in real time, and the detection response message can be recorded and stored for subsequent gateway identification reference application.

[0051] In one embodiment, after receiving the identification instruction, a task detection task file of the target host is generated on the detection host, wherein the task file may include: task ID, IP address information. The detection host scans the task file under the specified path where the configuration file is located, and executes the detection scanning task.

[0052] In one embodiment, the number of target hosts is multiple. Step 302 may specifically include: generating a detection task for each target host according to the identification instruction. The multiple detection tasks are assigned to different sub-processes, and the multiple sub-processes execute the multiple detection tasks in parallel, and send detection messages to the IP addresses of the corresponding target hosts respectively.

[0053] In actual scenarios, for multiple target hosts, a detection task is generated for each target host. Multiple detection tasks are placed in the configuration file. The detection host can be composed of multiple device nodes, and each sub-node can start a sub-process. The main detection process is used to traverse the detection task files in the configuration folder, obtain the corresponding task parameters, and perform sub-processing according to the ID in the task and the IP address of the target host, and send them to the sub-processes of each sub-node respectively. This sub-processing can adopt a load balancing method to ensure that each sub-node can obtain different detection tasks, increase processing performance and concurrency. After receiving the specific detection task, the sub-node performs detection according to the task parameters (IP address of the target host, ID of the detection task).

[0054] Step 303: Determine whether the target host belongs to a VoIP gateway according to the detection response message.

[0055] In this step, each time a detection message is sent to the target host, the target host will return data or no response, but no matter what the target host is, it can be judged based on historical experience data and the current response status of the target host to determine certain states of the target host at this time. For example, some commonly used session service protocols for VoIP gateways: SIP (Session Initiation Protocol), SIPS (encrypted SIP protocol), H323 protocol (H.323 Audio Video protocol), etc. Each session service protocol has its own detection message characteristics, and the target host will also have specific response status for different protocol detections. Therefore, it can be determined based on the target host's response status to the detection message whether the target host has opened the relevant session service. If so, it means that the target host is a VoIP gateway. Then the IP address of the target host can be marked and a prompt can be given for reference and inquiry by information security investigators to prevent possible fraud incidents in time.

[0056] The above-mentioned VoIP gateway identification method actively detects the target host of the specified IP address, and actively determines whether the target host is a VoIP gateway based on the detection response message returned by the target host to the detection message. In this way, it realizes the analysis method of actively detecting the target host to identify whether the target host is a VoIP gateway. Compared with the passive analysis of the prior art, the initiative and pertinence of identifying the VoIP gateway are improved.

[0057] Please see Figure 4 , which is a VoIP gateway identification method according to an embodiment of the present application, the method can be Figure 1 The electronic device 1 shown is implemented as a detection host and can be applied to the above Figure 2 In the scenario of the detection system in the present invention, it is to determine whether the target host with the specified IP address belongs to the VoIP gateway. The method comprises the following steps:

[0058] Step 401: Receive an identification instruction, which carries the IP address of the target host. For details, refer to the description of step 301 in the above embodiment.

[0059] Step 402: Send a host survival detection message to the IP address of the target host.

[0060] In this step, you can first perform a host survival detection on the target host to determine whether the host is online. You can use Nmap (Network Mapper, a network scanning and sniffing toolkit) to implement the host survival detection. Nmap will send four different types of data packets to detect whether the target host is online. That is, the host survival detection message can have at least the following four types:

[0061] 1. ICMP echo request

[0062] 2. a TCP SYN packet to port 443

[0063] 3. a TCP ACK packet to port 80

[0064] 4. an ICMP timestamp request

[0065] Specifically, Figure 5 As shown, the above four messages can be sent in sequence to detect whether the target host is turned on. As long as the target host receives a reply to one of the messages, it proves that the target host is turned on and can continue to detect. If the target host does not receive a reply to any of the messages, it means that the target host may not be turned on, and there is no security risk, so no subsequent detection is required. The above detection process uses four different types of data packets to avoid misjudgment caused by firewalls or packet loss.

[0066] Step 403: If a reply message to the host survival detection message is received from the target host, a port detection message is sent to the IP address of the target host, and the port status information of the target host is determined based on the response message of the target host to the port detection message.

[0067] In this step, if a reply response is received from the target host to any of the detection messages in step 402, it proves that the target host is turned on, and the port detection of the target host can continue. Port detection can also be implemented using Nmap. Port detection can be performed based on the input parameter results. You can specify a port for detection, and only the specified port is detected at this time. If no port is specified, the scanning detection is performed by detecting well-known ports (well-known port numbers, reserved by the Internet Corporation for Assigned Names and Numbers (ICANN) for use by the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP)). If after port detection, none of the ports of the target host are open, subsequent detection can be omitted. If one port is open, subsequent detection can be continued.

[0068] Specifically, there are at least five available detection port modes:

[0069] The first method uses TCP SYN scanning request message as the port detection message, and sends TCP SYNscanning request message to the target host. This method will send SYN (Synchronize Sequence Numbers) to the detected port of the target host. If a SYN / ACK reply is received from the target host, it proves that the detected port is open. If an RST packet (reset message) is received from the target host, it means that the detected port is closed. If no reply is received, it means that the detected port is blocked.

[0070] The second method is to use the TCP connect method to use the system network API connect to initiate a connection to the detected port of the target host. If the connection fails, it means that the detected port is closed. This method has a relatively slow scanning speed, and because the establishment of a complete TCP connection will leave record information on the target host, it is not stealthy enough.

[0071] The third method uses TCP ACK scanning to send an ACK (Acknowledge character) packet to the detected port of the target host. If an RST packet is received, it means that the detected port is not blocked by the firewall. If no RST packet is received, it means that the detected port is blocked.

[0072] The fourth method uses TCP FIN packets, Xmas tree packets, or Null packets as port detection packets. TCP FIN packets, Xmas tree packets, or Null packets can be sent to the detected port of the target host. If an RST reply packet is received from the other party, it means that the detected port is closed. If no RST packet is received, it means that the detected port may be open or blocked. TCP FIN / Xmas / NULL scanning is relatively hidden.

[0073] The fifth method uses UDP scanning packets as port detection packets to detect the UDP port of the target host. You can send a detection packet to the UDP port of the target host. If you receive a reply "ICMP port unreachable", it means that the UDP port of the target host is closed. If you do not receive a reply, it means that the UDP port of the target host may be open or blocked.

[0074] In one embodiment, if Figure 5 As shown, the detection host constructs a port detection message and sends it to the target host. Assuming that no port to be detected is specified, the port detection process in step 403 may include the following steps:

[0075] Step 4031: The detection host will automatically generate a table of ports to be detected (1-10000). By default, Nmap will scan the 1000 most likely open TCP ports. The initial port is 1 and increases by 1 each time.

[0076] Step 4032: Determine whether there are any remaining ports. If so, proceed to step 4033, otherwise end.

[0077] Step 4033: Then construct and send TCP SYN scanning, TCP connect, TCP ACK scanning, TCP FIN / Xmas / NULL scanning, and UDP scanning messages to each port.

[0078] Step 4034: Determine whether the port is open based on the response result. If a reply or response is received from the target host to any of the detection messages, the port status is analyzed and determined based on the reply and response data. Then return to step 4031 to detect the next port, and finally complete the detection of each port.

[0079] Assume that the port detection result shows that the port status information of the target host is: its well-known port 5060 and port 80 are both open, and port 5060 is a commonly used open port for SIP, and port 80 is a commonly used port for HTTP (Hyper Text Transfer Protocol), then subsequent detection can be continued.

[0080] Step 404: Send a service detection message according to the port status information, and receive a response message from the target host to the service detection message.

[0081] In this step, according to the port status information of the target host, Nmap can be used to detect the OS operating system (operating system, referred to as "OS") and services of the target host. The detection host constructs relevant OS detection packets to perform OS detection, such as constructing TCP / UDP / ICMP data packets as service detection packets, and sending them to the target host, and receiving data packets returned by the target host.

[0082] In one embodiment, step 404 may include: sending a service detection message to an open port and a closed port of the target host according to the port status information, and receiving return data from the open port and the closed port as a response message of the target host to the service detection message.

[0083] In actual scenarios, you can select an open port and a closed port from the target host's ports based on the port status information, send carefully designed TCP / UDP / ICMP data packets to the above ports, and receive data packets returned by the above ports.

[0084] Step 405: According to the response message of the target host to the service detection message, the enabled services of the target host are identified.

[0085] In this step, a system fingerprint of the target host may be generated according to a response message of the target host to the service detection message, and then the enabled services of the target host may be identified based on the system fingerprint of the target host.

[0086] In one embodiment, step 405 may include: generating a system fingerprint of the target host according to the return data of the service detection message for the open port and the closed port of the target host, comparing the system fingerprint with a preset fingerprint library, searching for a target service matching the system fingerprint from the preset fingerprint library, and using the target service as an enabled service of the target host.

[0087] In actual scenarios, the preset fingerprint library can be collected and set in advance, which can also include a fingerprint library for service activation. For example, Nmap contains fingerprint features of more than 2,600 known systems (in the file nmap-os-db). The above fingerprint library can be used as a sample library for fingerprint comparison, drawing on the fingerprint features and methods of Nmap. Use TCP / IP protocol stack fingerprints to identify different operating systems and devices. In the RFC (Request For Comments, a series of files arranged by numbers) specifications, there are some places that do not have mandatory regulations on the implementation of TCP / IP, so different TCP / IP schemes may have their own specific methods. This embodiment mainly judges the type of operating system based on the differences in these details. Compare the system fingerprint of the target host generated by the detection with the features in the fingerprint library to find the matching target system and related service activation information. If there is no match, the possible target system and enabled services can be listed in a probabilistic form. For example, through the above detection, the target host with a specified IP: 173.82.90.36 has an operating system of Linux2.6.18, the SIP service is enabled, and the VOS service is deployed.

[0088] Step 406: Compare the enabled service with the preset service library. If the enabled service exists in the preset service library, determine that the target host is a VoIP gateway.

[0089] In this step, the preset service library is obtained based on the actual service data statistics of the VoIP gateway. For example, the preset service library may include some commonly used session services of the VoIP gateway: SIP service, SIPS service or H323 service, etc. Then, the above-mentioned commonly used session services of the VoIP gateway can be added to the preset service library. If the target host with the specified IP: 173.82.90.36 has one or more of the SIP service, SIPS service, and H323 service enabled, it can be directly proved that the target host is the VoIP gateway.

[0090] In order to further determine the relevant communication behavior of the target host as a VoIP gateway to determine whether it has unsafe information behavior, further, this embodiment may also include:

[0091] Step 407: Construct a protocol detection message according to the enabled service, send the protocol detection message to the IP address of the target host, and receive the return data of the target host in response to the protocol detection message.

[0092] In this step, in order to further determine the target host's relevant communication behavior as a VoIP gateway, the target host is subjected to protocol detection. Nmap can also be used to implement protocol detection. Usually, the protocols of the enabled services can at least include one or more of the SIP protocol, H323 protocol, and HTTP protocol. Targeted detection of the service protocols enabled by the target host can reduce the resource cost of blind detection and improve detection efficiency.

[0093] In one embodiment, if Figure 6 As shown, for the case where the enabled service protocols include SIP protocol, H323 protocol, and HTTP protocol at the same time, step 407 may specifically include:

[0094] Step 4071: First, perform SIP protocol detection. When detecting the SIP protocol, TCP and UDP sockets are established, OPTIONS (selection), INVITE (invitation), and REGISTER (registration) requests are constructed respectively, and packets are sent to the designated port of the target host.

[0095] Step 4072: Receive a response message from the target host.

[0096] Step 4073: Determine whether the target host has enabled the SIP protocol service based on the response message. If so, proceed to step 4076; otherwise, proceed to step 4074.

[0097] Step 4074: construct an H323 protocol detection message to detect the H323 protocol. The H323 call signaling channel can be established in TCP or UDP, and the port used for call signaling is 1720. When detecting the H323 protocol, TCP and UDP sockets are established, a STATUS INQUIRY message is constructed, and a packet is sent to port 1720 of the target host.

[0098] Step 4075: Waiting to receive a response message from the target host to the STATUS INQUIRY message. Determine whether the target host has enabled the H323 protocol service based on the response message. Regardless of whether the target host has enabled the H323 protocol service, the process proceeds to step 4076.

[0099] Step 4076: construct an HTTP detection message. The HTTP protocol communicates based on TCP and uses port 80 / 8080. When detecting the HTTP protocol, a TCP socket is established, a GET request is constructed and sent to port 80 / 8080 of the target host, and a response to the GET request is waited for. The HTTP protocol activation status is obtained based on the response result.

[0100] Step 4077: Output the protocol detection results.

[0101] In one embodiment, assuming that the target host with the specified IP: 173.82.90.36 has enabled the SIP service and the HTTP service, step 407 may include: constructing the OPTIONS, REGEISTER, and INVITE detection messages of the SIP protocol, and the detection message of the HTTP protocol, respectively, and the content of the application layer protocol can be filled in according to the protocol specification. After sending the detection message, receive the response of the target host.

[0102] Step 408: Compare the specified field of the target host's return data for the protocol detection message with the preset field library. If the content of the specified field exists in the field library, it is determined that the target host belongs to a VoIP gateway, and the attribute information of the target host as a VoIP gateway is determined based on the content of the specified field.

[0103] In this step, by receiving the return data of the target host for the protocol detection message, it is determined whether the target host is a VoIP gateway. The specified field can be the server field or some fields in the agent such as Gateway, Pbx, Switch, Router, Server, and Proxy. According to the results returned in the protocol detection, feature matching is performed. The preset field library includes: identification information of the VoIP gateway, which is used to characterize the unique attributes of the VoIP gateway. If the content of the server field in the returned data or some fields such as Gateway, Pbx, Switch, Router, Server, and Proxy in the agent exists in the field library, it means that the returned data carries the identification information of the VoIP gateway, then it can be determined that the target host is a VoIP gateway, and the relevant attribute information of the target host as a VoIP gateway can also be obtained based on this. For example, for the target host with a specified IP: 173.82.90.36, for HTTP protocol detection, its corresponding response message can be used to identify the HTTP protocol. At the same time, the content in the return data corresponding to the HTTP protocol detection message can be matched. Assuming that its operating platform (agent) field is VOS3000-2.1.2.4 (identification information of the VoIP gateway), it can be determined that the target host is a VoIP gateway, and the operating platform is VOS (attribute information).

[0104] In one embodiment, in order to further determine the specific traffic service information of the target host with IP: 173.82.90.36 as the VoIP gateway, after step 408, the following may also be included:

[0105] Step 409: construct the target network address according to the content of the designated field, access the target network address, and receive the return data of the target network address, wherein the return data of the target network address includes the VoIP traffic record on the target host.

[0106] In this step, the target host is detected for vulnerabilities, and the detection host constructs a vulnerability detection message to obtain more detailed information. In step 409, the target host with IP: 173.82.90.36 has been identified as the VOS gateway, and the determined operation platform (agent) field is: VOS3000-2.1.2.4, that is, the version number is Version 2.1.2. According to the vulnerabilities existing in this version, the target network address URL = / chs / login.jsp can be constructed, and an HTTP request can be sent to access the target network address. The return data can be received, and the corresponding crawled content and information can be stored and saved.

[0107] For example, the returned data includes the response data of 200OK. Through the specified field of 200OK, the user-related information can be obtained, such as the call records of the user through the target host, which further verifies that the target host of this IP is a VOIP gateway. Through the above VoIP gateway identification method, the identification result of the target host of IP: 173.82.90.36 is shown in Table 1:

[0108] Table 1 Identification results of the target host IP: 173.82.90.36

[0109]

[0110] The above VoIP gateway identification method can detect, analyze and identify various suspected IP addresses by actively detecting the target host of the specified IP address and actively judge whether the target host is a VoIP gateway based on the detection response message returned by the target host to the detection message. From the perspective of active detection, it can determine whether the detected IP is a VoIP gateway. The identification result is more accurate, which greatly promotes the standardization and rationalization of telecommunications network management.

[0111] Please see Figure 7 , which is a VoIP gateway identification device 700 of an embodiment of the present application, which can be applied to Figure 1 The electronic device 1 shown can be applied to the above Figure 2 In the scenario of the detection system in the embodiment, it is to determine whether the target host with the specified IP address belongs to the VoIP gateway. The device includes: a receiving device, a detection module 702 and a determination module 703. The principle relationship of each module is as follows:

[0112] The receiving module 701 is used to receive an identification instruction, wherein the identification instruction carries the IP address of the target host.

[0113] The detection module 702 is used to send a detection message to the target host according to the IP address of the target host, and receive a detection response message returned by the target host in response to the detection message.

[0114] The determination module 703 is used to determine whether the target host belongs to a VoIP gateway according to the detection response message.

[0115] In one embodiment, the detection module 702 is used to: send a host survival detection message to the IP address of the target host. If a reply message to the host survival detection message is received from the target host, send a port detection message to the IP address of the target host, and determine the port status information of the target host based on the response message of the target host to the port detection message. According to the port status information, send a service detection message, and receive a response message to the service detection message from the target host.

[0116] In one embodiment, the determination module 703 is used to: identify the enabled services of the target host according to the response message of the target host to the service detection message, compare the enabled services with a preset service library, wherein the preset service library includes multiple session services based on a VoIP gateway; if the enabled services exist in the preset service library, determine that the target host is a VoIP gateway.

[0117] In one embodiment, a service detection message is sent according to the port status information, and a response message of the target host to the service detection message is received, including: according to the port status information, a service detection message is sent to an open port and a closed port of the target host, and return data of the open port and the closed port are received as a response message of the target host to the service detection message.

[0118] In one embodiment, according to the response message of the target host to the service detection message, the enabled service of the target host is identified, including: generating a system fingerprint of the target host according to the return data of the service detection message for the open port and the closed port of the target host. The system fingerprint is compared with a preset fingerprint library, and the target service matching the system fingerprint is found from the preset fingerprint library, and the target service is used as the enabled service of the target host, wherein the preset fingerprint library includes fingerprint features of multiple known systems.

[0119] In one embodiment, the determination module 703 is further used to: construct a protocol detection message according to the enabled service. Send the protocol detection message to the IP address of the target host, and receive the return data of the target host for the protocol detection message. Compare the specified field of the return data of the target host for the protocol detection message with the preset field library. If the content of the specified field exists in the field library, it is determined that the target host is a VoIP gateway, and the attribute information of the target host as a VoIP gateway is determined according to the content of the specified field, wherein the preset field library includes: identification information of the VoIP gateway.

[0120] In one embodiment, it also includes: an access module 704, which is used to construct a target network address according to the content of a specified field after determining that the target host is a VoIP gateway, access the target network address, and receive return data from the target network address, wherein the return data of the target network address includes VoIP traffic records on the target host.

[0121] In one embodiment, the number of target hosts is multiple. The detection module 702 is further used to: generate a detection task for each target host according to the identification instruction. The multiple detection tasks are assigned to different sub-processes, and the multiple sub-processes execute the multiple detection tasks in parallel, and send detection messages to the IP addresses of the corresponding target hosts respectively.

[0122] For a detailed description of the above-mentioned VoIP gateway identification device 700, please refer to the description of the relevant method steps in the above-mentioned embodiment.

[0123] The embodiment of the present invention also provides a non-transitory electronic device readable storage medium, including: a program, when it is run on an electronic device, the electronic device can execute all or part of the process of the method in the above embodiment. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk (Hard Disk Drive, abbreviated: HDD) or a solid-state drive (SSD), etc. The storage medium can also include a combination of the above types of memory.

[0124] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A VoIP gateway identification method, characterized in that: include: Receiving an identification instruction, wherein the identification instruction carries an IP address of a target host; Send a detection message to the target host according to the IP address of the target host, and receive a detection response message returned by the target host in response to the detection message; Determining whether the target host belongs to a VoIP gateway according to the detection response message; The step of sending a detection message to the target host according to the IP address of the target host and receiving a detection response message returned by the target host in response to the detection message includes: Send a host survival detection message to the IP address of the target host; If a reply message from the target host to the host survival detection message is received, a port detection message is sent to the IP address of the target host, and based on the response message from the target host to the port detection message, the port status information of the target host is determined; Sending a service detection message according to the port status information, and receiving a response message from the target host to the service detection message; Wherein, determining whether the target host belongs to a VoIP gateway according to the detection response message includes: Identifying the enabled services of the target host according to a response message of the target host to the service detection message; Comparing the enabled service with a preset service library, wherein the preset service library includes a plurality of session services based on a VoIP gateway; if the enabled service exists in the preset service library, determining that the target host is a VoIP gateway; The step of identifying the enabled service of the target host according to a response message of the target host to the service detection message includes: Generate a system fingerprint of the target host according to the return data of the service detection message of the open port and the closed port of the target host; The system fingerprint is compared with a preset fingerprint library, a target service matching the system fingerprint is found from the preset fingerprint library, and the target service is used as an enabled service of the target host, wherein the preset fingerprint library includes fingerprint features of multiple known systems.

2. The method according to claim 1, characterized in that The determining, according to the detection response message, whether the target host belongs to a VoIP gateway further includes: Constructing a protocol detection message according to the enabled service; Sending the protocol detection message to the IP address of the target host, and receiving return data of the target host in response to the protocol detection message; The specified field of the return data of the protocol detection message of the target host is compared with the preset field library. If the content of the specified field exists in the field library, it is determined that the target host belongs to the VoIP gateway, and the attribute information of the target host as a VoIP gateway is determined according to the content of the specified field, wherein the preset field library includes: identification information of the VoIP gateway.

3. The method according to claim 2, characterized in that After determining that the target host is a VoIP gateway, the method further includes: According to the content of the designated field, a target network address is constructed, the target network address is accessed, and return data of the target network address is received, wherein the return data of the target network address includes the VoIP traffic record on the target host.

4. The method according to claim 1, characterized in that: The number of the target hosts is multiple; and sending a detection message to the target host according to the IP address of the target host includes: According to the identification instruction, a detection task is generated for each of the target hosts; The plurality of detection tasks are assigned to different sub-processes, and the plurality of sub-processes execute the plurality of detection tasks in parallel, and respectively send detection messages to the corresponding IP addresses of the target hosts.

5. A VoIP gateway identification device, characterized in that: include: A receiving module, used for receiving an identification instruction, wherein the identification instruction carries an IP address of a target host; A detection module, used for sending a detection message to the target host according to the IP address of the target host, and receiving a detection response message returned by the target host in response to the detection message; A determination module, used to determine whether the target host belongs to a VoIP gateway according to the detection response message; The step of sending a detection message to the target host according to the IP address of the target host and receiving a detection response message returned by the target host in response to the detection message includes: Send a host survival detection message to the IP address of the target host; If a reply message from the target host to the host survival detection message is received, a port detection message is sent to the IP address of the target host, and based on the response message from the target host to the port detection message, the port status information of the target host is determined; Sending a service detection message according to the port status information, and receiving a response message from the target host to the service detection message; Wherein, determining whether the target host belongs to a VoIP gateway according to the detection response message includes: Identifying the enabled services of the target host according to a response message of the target host to the service detection message; Comparing the enabled service with a preset service library, wherein the preset service library includes a plurality of session services based on a VoIP gateway; if the enabled service exists in the preset service library, determining that the target host is a VoIP gateway; The step of identifying the enabled service of the target host according to a response message of the target host to the service detection message includes: Generate a system fingerprint of the target host according to the return data of the service detection message of the open port and the closed port of the target host; The system fingerprint is compared with a preset fingerprint library, a target service matching the system fingerprint is found from the preset fingerprint library, and the target service is used as an enabled service of the target host, wherein the preset fingerprint library includes fingerprint features of multiple known systems.

6. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to execute the computer program to implement the method according to any one of claims 1 to 4.

7. A non-transitory electronic device readable storage medium, characterized in that: The invention comprises: a program, which, when executed by an electronic device, causes the electronic device to execute the method according to any one of claims 1 to 4.

Images