Identification method, device, system and electronic equipment for Internet phone service end

Abstract

The present application provides a method and device, system, and electronic device for identifying an Internet phone service end, the method comprising: obtaining SIP traffic, analyzing the SIP traffic, and obtaining the destination IP information; scanning the communication port of the target service end according to the destination IP information, and finding the target port of the open service; establishing a connection with the target port of the open service, and sending an HTTP message to the target port of the open service; and determining whether the target service end is an Internet phone service end according to the response message of the HTTP message. In this way, most of the VoIP operating platform information in the network can be efficiently filtered out, which requires fewer resources and is more flexible than the traditional passive parsing method, and is more efficient and more purposeful than the traditional active method. While consuming a small amount of resources, directional analysis can be efficiently performed, greatly improving the efficiency of the overall analysis.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to an identification method, device, system, and electronic device for an Internet phone service end. Background Art

[0002] The filtering and acquisition of traditional voip (Voice over Internet Protocol, IP-based voice call technology) operating platforms mainly comes from the passive analysis of HTTP (Hyper Text Transfer Protocol, Hypertext Transfer Protocol) traffic, which has great limitations in resource consumption and directional analysis.

[0003] The traditional passive parsing system analyzes the HTTP traffic in the network and extracts the server information that meets the specified traffic characteristics. Due to the large network transmission traffic and the low performance of parsing HTTP text, it has high requirements for computing and processing resources. The traditional active method performs a full analysis of non-C network addresses in the entire network. It has poor targeting and the detection target group is too large, resulting in a long detection cycle and low detection efficiency. Summary of the invention

[0004] The embodiment of the present application provides an identification method for an Internet phone service end, which can improve detection efficiency.

[0005] The present application embodiment provides a method for identifying an Internet phone service end, including:

[0006] Acquire SIP traffic, analyze the SIP traffic, and obtain destination IP information;

[0007] Scan the communication port of the target server according to the target IP information to find the target port of the open service;

[0008] Establishing a connection with the target port of the open service and sending an HTTP message to the target port of the open service;

[0009] According to the response message of the HTTP message, it is determined whether the target server is an Internet phone service terminal.

[0010] In one embodiment, analyzing the SIP traffic to obtain destination IP information includes:

[0011] Search for a registration message in the SIP traffic, and extract destination IP information in the registration message.

[0012] In one embodiment, scanning the communication port of the target server according to the destination IP information to find the target port of the open service includes:

[0013] Deduplication of the destination IP information is performed and then stored in an intermediate database;

[0014] For each item of IP information in the intermediate database, determine the target server corresponding to each item of IP information;

[0015] Scan the communication port of the target server to find the target port of the open service.

[0016] In one embodiment, scanning the communication port of the target server to find the target port of the open service includes:

[0017] Perform a semi-open scan on the standard network port of the target server to determine whether the standard network port is open for service;

[0018] If the standard network port is an open service, use the standard network port of the open service as the target port;

[0019] If the standard network port has no open service, a semi-open scan is performed on the communication port of the target server whose port number is less than a specified value, and a communication port with an open service is found as the target port.

[0020] In one embodiment, scanning the communication port of the target server to find the target port of the open service includes:

[0021] According to the arrangement order of the multiple entries of IP information in the intermediate database, when the target server corresponding to the previous destination IP information does not have an open service communication port, the communication port of the target server corresponding to the next destination IP information is scanned to find the target port of the open service until the detection of all target servers is completed.

[0022] In one embodiment, if there are multiple target ports, establishing a connection with the target port of the open service and sending an HTTP message to the target port of the open service includes:

[0023] For one of the target ports, establishing a connection with the target port based on the transmission control protocol, and sending an HTTP message to the target port;

[0024] If no response message to the HTTP message is received or the response code of the response message is not a preset value, a connection with the next target port is established based on the transmission control protocol according to the port number of each target port and an HTTP message is sent to the next target port until the response code of the received response message is a preset value.

[0025] In one embodiment, determining whether the target server is an Internet phone server according to the response message of the HTTP message includes:

[0026] For a response message whose response code is a preset value, obtaining a title field of the response message;

[0027] According to the platform type indicated by the title field, it is determined whether the target server is the Internet phone server.

[0028] In one embodiment, the method further comprises:

[0029] The target port corresponding to the response message whose response code is a preset value is determined as the service port of the target server.

[0030] The embodiment of the present application also provides an identification device for an Internet phone service end, the device comprising:

[0031] An address acquisition module is used to acquire SIP traffic, analyze the SIP traffic, and acquire destination IP information;

[0032] A port scanning module is used to scan the communication port of the target server according to the target IP information to find the target port of the open service;

[0033] A request sending module, used to establish a connection with the target port of the open service and send an HTTP message to the target port of the open service;

[0034] The type determination module is used to determine the platform type of the target server according to the response message of the HTTP message.

[0035] The embodiment of the present application also provides an identification system for an Internet phone service end, the identification system comprising:

[0036] A big data analysis system is used to obtain SIP traffic, analyze the SIP traffic, and obtain destination IP information;

[0037] A database system, connected to the big data analysis system, for storing the destination IP information;

[0038] The active detection system is connected to the database system and is used to scan the communication port of the target server according to the destination IP information to find the target port of the open service; establish a connection with the target port of the open service and send an HTTP message to the target port of the open service; and determine whether the target server is an Internet phone service according to the response message of the HTTP message.

[0039] The present application also provides an electronic device, the electronic device comprising:

[0040] processor;

[0041] a memory for storing processor-executable instructions;

[0042] Wherein, the processor is configured to execute the above-mentioned identification method of the Internet phone service end.

[0043] The embodiment of the present application further provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program can be executed by a processor to complete the above-mentioned identification method of the Internet phone service end.

[0044] The above embodiment of the present application obtains SIP traffic, extracts the destination IP information from it, scans the port of the destination IP information, determines the port of the open service, and determines whether the platform type of the target server corresponding to the target IP information is an Internet phone service based on the platform type indicated by the response message of the port. In this way, most of the VoIP operating platform information in the network can be efficiently filtered out, which requires fewer resources and is more flexible than the traditional passive parsing method, and is more efficient and more purposeful than the traditional active method. With a small amount of resources consumed, directional analysis can be efficiently performed, greatly improving the efficiency of the overall analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solution of the embodiments of the present application, the drawings required for use in the embodiments of the present application are briefly introduced below.

[0046] Figure 1 A schematic diagram of the architecture of the identification system of the Internet phone service end provided in the embodiment of the present application;

[0047] Figure 2 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0048] Figure 3 It is a flowchart of a method for identifying a VOIP (Voice over Internet Protocol) server provided in an embodiment of the present application;

[0049] Figure 4 yes Figure 3 Detailed flowchart of step S320 in the corresponding embodiment;

[0050] Figure 5 It is a module layered diagram of the active detection system;

[0051] Figure 6It is a flowchart of the identification method of the Internet phone service end provided in the embodiment of the present application;

[0052] Figure 7 This is a block diagram of an identification device for an Internet phone service end according to an embodiment of the present application. DETAILED DESCRIPTION

[0053] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0054] Similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0055] Figure 1 This is a schematic diagram of the architecture of the identification system of the Internet phone service end provided in the embodiment of the present application. Figure 1 As shown, the identification system includes: a big data analysis system 110 , a database system 120 and an active detection system 130 .

[0056] The big data analysis system 110 is used to obtain SIP traffic, analyze the SIP traffic, and obtain the destination IP information; the database system 120 is connected to the big data analysis system and is used to store the destination IP information; the active detection system 130 is connected to the database system and is used to scan the communication port of the target server according to the destination IP information and find the target port of the open service; establish a connection with the target port of the open service and send an HTTP message to the target port of the open service; determine whether the target server is an Internet phone service according to the response message of the HTTP message.

[0057] The big data analysis system 110, the database system 120 and the active detection system 130 can be integrated in one device or dispersed in multiple devices. The device can be an electronic device such as a desktop computer, a laptop computer or a server. The recognition process of the above recognition system can be described in detail below.

[0058] Figure 2 200 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device can be used as the above-mentioned identification system, and the electronic device 200 can be used to execute the identification method of the Internet phone service end provided in an embodiment of the present application. Figure 2As shown, the electronic device 200 includes: one or more processors 202, and one or more memories 204 storing processor executable instructions. The processor 202 is configured to perform the identification of the Internet phone service end provided in the following embodiments of the present application.

[0059] The processor 202 may be a device including a central processing unit (CPU), a graphics processing unit (GPU), or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may process data of other components in the electronic device 200, and may also control other components in the electronic device 200 to perform desired functions.

[0060] The memory 204 may include one or more computer program products, and the computer program product may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 202 may run the program instructions to implement the identification method of the Internet phone service end described below. Various applications and various data may also be stored in the computer-readable storage medium, such as various data used and / or generated by the application.

[0061] In one embodiment, Figure 2 The electronic device 200 shown may also include an input device 206, an output device 208, and a data acquisition device 210, and these components are interconnected via a bus system 212 and / or other forms of connection mechanisms (not shown). It should be noted that Figure 2 The components and structures of the electronic device 200 shown are merely exemplary and non-limiting. The electronic device 200 may also have other components and structures as required.

[0062] The input device 206 may be a device used by a user to input instructions, and may include one or more of a keyboard, a mouse, a microphone, a touch screen, etc. The output device 208 may output various information (e.g., images or sounds) to the outside (e.g., a user), and may include one or more of a display, a speaker, etc. The data acquisition device 210 may acquire an image of an object, and store the acquired image in the memory 204 for use by other components. Exemplarily, the data acquisition device 210 may be a camera.

[0063] In one embodiment, the various components in the example electronic device 100 for implementing the identification method of the Internet telephone server of the embodiment of the present application can be integrated or dispersed, such as integrating the processor 202, memory 204, input device 206 and output device 208 into one, while separating the data acquisition device 210.

[0064] In one embodiment, the exemplary electronic device 200 for implementing the identification method of the Internet phone service end of the embodiment of the present application may be implemented as an intelligent device such as a computer, a server, or the like.

[0065] Figure 3 1 is a flow chart of a method for identifying a VOIP (Voice over Internet Protocol) server provided in an embodiment of the present application. Figure 3 As shown, the method includes the following steps S310-S340.

[0066] Step S310: Acquire SIP traffic, analyze the SIP traffic, and obtain destination IP information.

[0067] In one embodiment, the original SIP (Session Initiation Protocol) traffic can be obtained at a certain period (e.g., every day, every 12 hours). SIP traffic can be considered as voice communication information. SIP traffic can be actively sent by the VOIP server to the big data analysis system, so that the big data analysis system performs Spark (a computing engine) passive traffic analysis. The destination ip (Internet Protocol Address) information refers to the communication address of the VOIP server.

[0068] In one embodiment, the registration message in the SIP traffic can be searched and the destination IP information in the registration message can be extracted. Specifically, the registration message can be obtained by searching for a message with the keyword "register" in the SIP traffic and the destination IP information can be extracted from the registration message.

[0069] Step S320: Scan the communication port of the target server according to the destination IP information to find the target port of the open service.

[0070] The target server refers to the server corresponding to the destination IP information. The target port refers to the port of the target server's communication port that is open for service.

[0071] In one embodiment, after the big data analysis system extracts the destination IP information from the registration message, it can deduplicate the destination IP information and store it in the intermediate database. Deduplication refers to removing duplicate destination IP information. The destination IP information of the suspected SIP platform is stored in the intermediate database and provided to the active detection system for processing. The intermediate database can be Figure 1 The database system in the corresponding embodiment.

[0072] The active detection system can actively extract the destination IP information from the intermediate database. For each entry of IP information in the intermediate database, determine the target server corresponding to each entry of IP information. Then, for each target server, the communication port of the target server can be scanned one by one to find the target port of the open service. According to the arrangement order of the IP information of multiple entries in the intermediate database, when the target server corresponding to the previous destination IP information does not have an open service communication port, the communication port of the target server corresponding to the next destination IP information is scanned to find the target port of the open service until the detection of all target servers is completed.

[0073] In one embodiment, if Figure 4 As shown, the above step S320 specifically includes: step S321-step S323.

[0074] Step S321: Perform a semi-open scan on the standard network port of the target server to determine whether the standard network port is open for service.

[0075] Among them, standard network ports refer to standard HTTP ports 80, 8000, and 8080. Semi-open scanning refers to scanning standard network ports using TCP SYN scanning. The active detection system can send a SYN packet to a standard network port of the target server to request a connection. After the active detection system receives the SYN / ACK returned by the target server, it does not send an ACK response but sends a RST packet to request disconnection. Therefore, when the active detection system receives the SYN / ACK packet, it can be considered that the current standard network port is open for service.

[0076] Step S322: If the standard network port is an open service, the standard network port of the open service is used as the target port.

[0077] Assuming that the standard network port 80 is open for service, port 80 can be considered as the target port. Assuming that the standard network port 8080 is open for service, port 8080 can be considered as the target port.

[0078] Step S323: If the standard network port has no open service, a semi-open scan is performed on the communication port of the target server whose port number is less than the specified value to find the communication port of the open service as the target port.

[0079] The specified value can be 10000. If the standard HTTP ports 80, 8000, and 8080 do not have open services, use TCP SYN scanning for all ports with port numbers less than 10000 to find the communication ports of open services, and use the communication ports of open services as the target ports.

[0080] Step S330: Establish a connection with the target port of the open service, and send an HTTP message to the target port of the open service.

[0081] HTTP messages refer to the detection data packets sent by the active detection system to the target port of the target server. The active detection system can use the TCP protocol (Transmission Control Protocol) to establish a TCP connection with the target port of the open service, and then send HTTP messages to the target port.

[0082] Figure 5 It is a module layered diagram of the active detection system, such as Figure 5 As shown in the figure, the upper layer is responsible for the creation, scheduling and deletion of detection tasks. The middle layer is responsible for the construction and response processing of detection messages (i.e., the above-mentioned HTTP messages), such as: port opening detection packets and HTTP request packets. The lower layer is responsible for the establishment of connections and the sending of messages. Therefore, the upper layer creates detection tasks, and the lower layer establishes connections with the target port. The middle layer constructs HTTP messages, and then the lower layer sends HTTP messages.

[0083] Since there may be more than one target port for an open service, for a target port, the active detection system can establish a connection with the target port based on the TCP protocol and send an HTTP message to the target port. If no response message to the HTTP message is received or the response code of the response message is not a preset value (for example, the response code is not 200), a connection with the next target port can be established based on the TCP protocol according to the port number of each target port (for example, the port numbers are in order from small to large or from large to small), and an HTTP message can be sent to the next target port until the response code of the received response message is the preset value.

[0084] Specifically, after sending an HTTP message to a target port of an open service, if no response message of this HTTP message is received within 5 seconds, an HTTP message is sent to the target port of the next open service. If a response message of this HTTP message is received, the HTTP response header is parsed. If the response code is 200, step S340 is executed to determine whether the target server is an Internet phone server according to the response message of the HTTP message, and the detection of this target server is completed; if the response code is not 200, HTTP messages are continued to be sent to the target port of the next open service until there is no target port of open service, the detection of this target server is completed, and the detection of the next target server is continued.

[0085] Step S340: Determine whether the target server is an Internet phone service terminal according to the response message of the HTTP message.

[0086] In one embodiment, for a response message whose response code is a preset value (e.g., 200), the title field of the response message is obtained; according to the platform type indicated by the title field, it is determined whether the target server is the Internet phone server. The target port corresponding to the response message whose response code is the preset value is determined as the service port of the target server.

[0087] Specifically, the response message of the HTTP message can be parsed to obtain its title field. If there are words such as VOS or PBX in it, it is considered to be VOS (voip soft switch billing system) or PBX operation gateway, that is, the target server belongs to the Internet phone service end. For VOS or PBX operation gateways, the target ports whose response codes corresponding to these gateways are preset values ​​can be determined as the service ports of these gateways. For example, the open service port with a response code of 200 can be considered to be the service port of the VOS or PBX operation gateway.

[0088] Therefore, according to the platform type indicated by the header field in the response message, it can be determined whether the target server corresponding to the destination IP information is an Internet phone server, and the response port of the response message can be considered as the service port of the target server. In this way, the VOIP servers of the entire network and the service IP and service port of the VoIP server can be analyzed.

[0089] Figure 6 FIG. 1 is a flow chart of the identification method of the Internet phone service end provided in the embodiment of the present application. Figure 6 As shown, the method includes:

[0090] Step S601: The big data analysis system analyzes SIP traffic.

[0091] Step S602, the big data analysis system determines the "register" keyword in the SIP traffic and extracts the destination IP information in the registration message;

[0092] Step S603, the big data analysis system filters and removes duplicates from the destination IP information and stores it in an intermediate database;

[0093] Step S604, the active detection system reads the IP list to be detected from the intermediate database to obtain the destination IP information;

[0094] Step S605, using TCP SYN scanning method to scan standard HTTP ports 80, 8000 and 8080 for the destination IP information;

[0095] Step S606, if the scan shows that the standard HTTP port has no open service, use TCP SYN scan for all ports less than 10000; if there is an open port, execute step S607; if there is no open port, execute step S610;

[0096] Step S607, after connecting to an open port using the TCP protocol, send an HTTP message. If an HTTP response is received, execute step S608. If no response is received within 5 seconds, execute step S607 for the next open port;

[0097] Step S608, parse the HTTP response header, if the response code is 200, execute step S609, otherwise, execute step S607 for the next open port;

[0098] Step S609, parse the HTTP response content and obtain its title field. If there are words such as VOS or PBX in it, it is considered to be a VOS or PBX operation gateway, that is, it belongs to the Internet phone service end. At the same time, the detection result is saved in the intermediate database, returned to the big data analysis system, and step S610 is executed;

[0099] Step S610, obtain the IP of the next SIP platform from the IP list to be detected, and execute step S605; if there is no available IP information, the current detection task ends.

[0100] The traditional passive parsing system analyzes the HTTP traffic in the network and extracts the server information that meets the specified traffic characteristics. Due to the large network transmission traffic and the low performance of parsing HTTP text, it has high requirements for computing and processing resources. The traditional active method performs a full analysis of non-C network addresses in the entire network. It has poor targeting and the detection target group is too large, resulting in a long detection cycle and low detection efficiency.

[0101] The embodiment of the present application uses a combination of active and passive methods to obtain SIP traffic, extract the destination IP information from it, scan the port of the destination IP information, determine the port of the open service, and determine whether the target server corresponding to the target IP information is an Internet phone server based on the platform type indicated by the response message of the port. In this way, most of the VoIP operating platform information in the network can be efficiently filtered out, which requires fewer resources and is more flexible than the traditional passive parsing method, and is more efficient and more purposeful than the traditional active method. While consuming a small amount of resources, directional analysis can be efficiently performed, greatly improving the efficiency of the overall analysis. The identification and analysis of the voip operating platform can effectively monitor harmful voip operating platforms in real time, and provide a basis for subsequent penetration and platform analysis.

[0102] The following is an embodiment of the device of the present application, which can be used to execute the embodiment of the identification method of the Internet phone service end of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the identification method of the Internet phone service end of the present application.

[0103] Figure 7 A block diagram of an identification device of an Internet phone service end is shown in an embodiment of the present application. Figure 7 The device includes: an address obtaining module 710 , a port scanning module 720 , a request sending module 730 and a type determining module 740 .

[0104] The address acquisition module 710 is used to acquire SIP traffic, analyze the SIP traffic, and acquire destination IP information.

[0105] The port scanning module 720 is used to scan the communication port of the target server according to the target IP information to find the target port of the open service.

[0106] The request sending module 730 is used to establish a connection with the target port of the open service and send an HTTP message to the target port of the open service.

[0107] The type determination module 740 is used to determine whether the target server is an Internet phone service terminal according to the response message of the HTTP message.

[0108] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned identification method for an Internet phone service end, and will not be repeated here.

[0109] In several embodiments provided in the present application, the disclosed devices and methods may also be implemented in other ways. The device embodiments described above are merely schematic, for example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to the multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram may represent a module, a program segment or a part of a code, and a module, a program segment or a part of a code contains one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the box may also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they may sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of boxes in the block diagram and / or the flowchart, can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0110] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0111] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

Claims

1. A method for identifying an Internet phone service end, It is characterized in that include: Acquire SIP traffic, analyze the SIP traffic, and obtain destination IP information; Scan the communication port of the target server according to the target IP information to find the target port of the open service; Establishing a connection with the target port of the open service and sending an HTTP message to the target port of the open service; Determine whether the target server is an Internet phone server according to the response message of the HTTP message; The scanning of the communication port of the target server to find the target port of the open service includes: Perform a semi-open scan on the standard network port of the target server to determine whether the standard network port is open for service; If the standard network port is an open service, use the standard network port of the open service as the target port; If the standard network port has no open service, a semi-open scan is performed on the communication port of the target server whose port number is less than the specified value, and a communication port of an open service is found as the target port; Wherein, if there are multiple target ports, establishing a connection with the target port of the open service and sending an HTTP message to the target port of the open service includes: For one of the target ports, establishing a connection with the target port based on the transmission control protocol, and sending an HTTP message to the target port; If no response message to the HTTP message is received or the response code of the response message is not a preset value, a connection with the next target port is established based on the transmission control protocol according to the port number of each target port and an HTTP message is sent to the next target port until the response code of the received response message is a preset value.

2. The method according to claim 1, It is characterized in that The analyzing the SIP traffic to obtain the destination IP information includes: Search for a registration message in the SIP traffic, and extract destination IP information in the registration message.

3. The method according to claim 1, It is characterized in that Before performing a semi-open scan on the standard network port of the target server to determine whether the standard network port is open for service, the method further includes: Deduplication of the destination IP information is performed and then stored in an intermediate database; For each item of IP information in the intermediate database, a target server corresponding to each item of IP information is determined.

4. The method according to claim 3, It is characterized in that Scanning the communication port of the target server to find the target port of the open service includes: According to the arrangement order of the multiple entries of IP information in the intermediate database, when the target server corresponding to the previous destination IP information does not have an open service communication port, the communication port of the target server corresponding to the next destination IP information is scanned to find the target port of the open service until the detection of all target servers is completed.

5. The method according to claim 1, It is characterized in that The step of determining whether the target server is an Internet phone service end according to the response message of the HTTP message comprises: For a response message whose response code is a preset value, obtaining a title field of the response message; According to the platform type indicated by the title field, it is determined whether the target server is the Internet phone server.

6. An identification device for an Internet phone service end, It is characterized in that The device comprises: An address acquisition module is used to acquire SIP traffic, analyze the SIP traffic, and acquire destination IP information; A port scanning module is used to scan the communication port of the target server according to the target IP information to find the target port of the open service; A request sending module, used to establish a connection with the target port of the open service and send an HTTP message to the target port of the open service; A type determination module, used to determine whether the target server is an Internet phone server according to a response message of the HTTP message; The scanning of the communication port of the target server to find the target port of the open service includes: Perform a semi-open scan on the standard network port of the target server to determine whether the standard network port is open for service; If the standard network port is an open service, use the standard network port of the open service as the target port; If the standard network port has no open service, a semi-open scan is performed on the communication port of the target server whose port number is less than the specified value, and a communication port of an open service is found as the target port; Wherein, if there are multiple target ports, establishing a connection with the target port of the open service and sending an HTTP message to the target port of the open service includes: For one of the target ports, establishing a connection with the target port based on the transmission control protocol, and sending an HTTP message to the target port; If no response message to the HTTP message is received or the response code of the response message is not a preset value, a connection with the next target port is established based on the transmission control protocol according to the port number of each target port and an HTTP message is sent to the next target port until the response code of the received response message is a preset value.

7. An identification system for an Internet phone service end, It is characterized in that The identification system comprises: A big data analysis system is used to obtain SIP traffic, analyze the SIP traffic, and obtain destination IP information; A database system, connected to the big data analysis system, for storing the destination IP information; An active detection system, connected to the database system, is used to scan the communication port of the target server according to the destination IP information, find the target port of the open service; establish a connection with the target port of the open service, and send an HTTP message to the target port of the open service; determine whether the target server is an Internet phone service according to a response message of the HTTP message; The scanning of the communication port of the target server to find the target port of the open service includes: Perform a semi-open scan on the standard network port of the target server to determine whether the standard network port is open for service; If the standard network port is an open service, use the standard network port of the open service as the target port; If the standard network port has no open service, a semi-open scan is performed on the communication port of the target server whose port number is less than the specified value, and a communication port of an open service is found as the target port; Wherein, if there are multiple target ports, establishing a connection with the target port of the open service and sending an HTTP message to the target port of the open service includes: For one of the target ports, establishing a connection with the target port based on the transmission control protocol, and sending an HTTP message to the target port; If no response message to the HTTP message is received or the response code of the response message is not a preset value, a connection with the next target port is established based on the transmission control protocol according to the port number of each target port and an HTTP message is sent to the next target port until the response code of the received response message is a preset value.

8. An electronic device, It is characterized in that The electronic device comprises: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to execute the identification method of the Internet telephone server as described in any one of claims 1-5.

Images