A method, device, and storage medium for monitoring violation outreach

Abstract

The application discloses a method, device and equipment for monitoring illegal external connection and a storage medium, relates to the technical field of network security, and comprises the following steps: sending a detection packet to a preset Web service server to determine whether the Web service server is alive, and generating a corresponding determination result; inserting a target static code into the Web service server based on the determination result, so that the target static code is loaded to a terminal where the Web service server is located after the Web service server is started; accessing a preset public network receiving end platform based on the target static code, and determining whether to send access data to the preset public network receiving end platform by using the target static code based on an access result, so that the preset public network receiving end platform performs an alarm operation after receiving the access data. In this way, the detection packet can be sent to the server, the illegal external connection monitoring is implemented by inserting the static code into the server after confirming that the server is alive, and the installation of a client program is avoided, so that the operation process is effectively simplified.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a method and device for monitoring illegal external connection, and a storage medium. BACKGROUND

[0002] With the increasing maturity of Internet technology, various terminals emerge in endlessly, and PC terminals, Internet of Things terminals, video terminals and other types of devices accessing enterprise intranets have become a future development trend. In some confidential environments, only internal network devices such as OA (Office Automation) servers, NVR (Network Video Recorder) devices, network management switches, etc. are allowed to be accessed. However, there may still be illegal external connection phenomena such as privately connecting a mobile phone hotspot, privately connecting a router, and illegally connecting the Internet. Illegal external connection behavior may cause great security risks to enterprises and units, and the internal network of a unit may involve confidential information, and leakage of such confidential information may cause serious consequences to the unit or enterprise, and therefore a solution to illegal external connection is needed.

[0003] In the prior art, in order to achieve illegal external connection, a client plug-in needs to be installed on a PC terminal, i.e. a client plug-in and a violation external connection online monitoring management system are respectively installed on a PC terminal connected to an intranet and a server. However, in a large-flow intranet, PC terminals and a central I / O need powerful hardware as a basis for communication, and if the hardware cost is too high, the enterprise cannot afford it, and if the hardware configuration is too low, too much traffic access causes the server to be down, which makes it difficult to monitor illegal external connection behavior in the intranet. SUMMARY

[0004] Therefore, the present application aims to provide a method and device for monitoring illegal external connection, which can send a probe packet to a server, confirm the survival of the server, and implement illegal external connection monitoring by inserting a static code into the server, thereby avoiding the installation of a client program and effectively simplifying the operation process. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses a method for monitoring illegal external connection, applied to an intranet monitoring server, comprising:

[0006] sending a probe packet to a preset Web service server to determine whether the Web service server is alive, and generating a corresponding determination result;

[0007] inserting a target static code into the Web service server based on the determination result, so that the target static code is loaded to a terminal where the Web service server is located after the Web service server is started;

[0008] Access a preset public network receiving end platform based on the target static code, and determine whether to send access data to the preset public network receiving end platform based on the target static code based on the access result, so that the preset public network receiving end platform performs an alarm operation after receiving the access data.

[0009] Optionally, before the step of sending the probe packet to the preset Web service server to determine whether the Web service server is alive and generating a corresponding determination result, the method further comprises:

[0010] configuring a global JS service locally to generate the target static code based on the global JS service; the global JS service is a JavaScript service; and the target static code is static code generated based on JavaScript.

[0011] Optionally, before the step of sending the probe packet to the preset Web service server to determine whether the Web service server is alive and generating a corresponding determination result, the method further comprises:

[0012] configuring preset Web site information locally to insert the target static code into the Web service server based on the preset Web site information; the preset Web site information is information of a Web service server HTML portal website file directory.

[0013] Optionally, the step of sending the probe packet to the preset Web service server to determine whether the Web service server is alive and generating a corresponding determination result comprises:

[0014] sending an ICMP or TCPING probe packet to the preset Web service server to determine whether a response result fed back by the Web service server can be received;

[0015] if the response result fed back by the Web service server can be received, it is determined that the Web service server is in an alive state, and a first determination result that the Web service server is in the alive state is generated;

[0016] if the response result fed back by the Web service server cannot be received, it is determined that the Web service server is in a non-alive state, and a second determination result that the Web service server is in the non-alive state is generated.

[0017] Optionally, the step of inserting the target static code into the Web service server based on the determination result, so that the Web service server loads the target static code to a terminal where the Web service server is located after being started, comprises:

[0018] If the judgment result is the first judgment result, the target static code is inserted into an HTML portal website of the Web service server based on the preset Web site information, so that the target static code is loaded to a terminal where the Web service server is located based on the HTML portal website after the Web service server is started;

[0019] If the judgment result is the second judgment result, the illegal external connection monitoring is ended.

[0020] Optionally, the preset public network receiving end platform is accessed based on the target static code, and whether access data is sent to the preset public network receiving end platform by using the target static code is determined based on an access result, so that an alarm operation is performed by the preset public network receiving end platform after the access data is received.

[0021] It is judged whether the target static code is executed in the terminal, and if yes, the preset public network receiving end platform is accessed based on the target static code, and an access result is generated;

[0022] If the access result is successful access, it is indicated that the terminal exists illegal external connection operation, and the access data is sent to the preset public network receiving end platform by using the target static code, so that the alarm operation is performed by the preset public network receiving end platform after the access data is received.

[0023] If the access result is access failure, it is indicated that the terminal does not exist illegal external connection operation, and the illegal external connection monitoring is ended.

[0024] In a second aspect, the application discloses a device for illegal external connection monitoring, which is applied to an internal network monitoring server and includes:

[0025] A server state judgment module is configured to send a detection packet to a preset Web service server to judge whether the Web service server is alive, and generate a corresponding judgment result.

[0026] A code sending module is configured to insert a target static code into the Web service server based on the judgment result, so that the target static code is loaded to a terminal where the Web service server is located after the Web service server is started.

[0027] An alarm module is configured to access a preset public network receiving end platform based on the target static code, and determine whether access data is sent to the preset public network receiving end platform by using the target static code based on an access result, so that an alarm operation is performed by the preset public network receiving end platform after the access data is received.

[0028] Optionally, the server state judgment module includes:

[0029] The feedback receiving judging unit is configured to send an ICMP or TCPING probe packet to the preset Web service server to judge whether the response result fed back by the Web service server can be received or not;

[0030] The first judging result generating unit is configured to represent that the Web service server is in a live state if the response result fed back by the Web service server can be received, and generate a first judging result that the Web service server is in a live state.

[0031] The second judging result generating unit is configured to represent that the Web service server is in a non-live state if the response result fed back by the Web service server cannot be received, and generate a second judging result that the Web service server is in a non-live state.

[0032] In a third aspect, the present application discloses an electronic device, comprising:

[0033] A memory configured to save a computer program;

[0034] A processor configured to execute the computer program to implement the method for monitoring illegal external contact as described above.

[0035] In a fourth aspect, the present application discloses a computer readable storage medium configured to save a computer program, and the computer program is executed by a processor to implement the method for monitoring illegal external contact as described above.

[0036] In this application, a probe message is first sent to a preset Web service server to determine whether the Web service server is alive, and a corresponding judgment result is generated. Then, based on the judgment result, target static code is inserted into the Web service server so that after the Web service server starts, the target static code is loaded into the terminal where the Web service server is located. Finally, based on the target static code, a preset public network receiving platform is accessed, and based on the access result, it is determined whether to use the target static code to send access data to the preset public network receiving platform so that the preset public network receiving platform can perform an alarm operation after receiving the access data. Therefore, the unauthorized external connection monitoring method described in this application can first send a probe message to the Web service server to determine its liveness status, and based on the judgment result, determine whether to insert static code into the Web service server. If so, after the service server starts, the static code can be loaded into the terminal, and then it can be determined whether the public network receiving platform can be accessed through the static code. Based on the judgment result, it can be confirmed whether there is unauthorized external connection behavior, and corresponding alarm operations can be performed. In this way, on the one hand, probe messages can be sent to the web service server. Once the web service server is confirmed to be alive, static code can be sent to the service server. This avoids the situation where static code is still sent when the web service server is invalid, effectively reducing resource consumption and improving the efficiency of monitoring unauthorized external connections. On the other hand, by inserting static code into the server to monitor unauthorized external connections, the installation of client programs is avoided, which effectively simplifies the operation process. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0038] Figure 1 A flowchart of a method for monitoring unauthorized external connections provided in this application;

[0039] Figure 2 A flowchart illustrating a specific method for monitoring unauthorized external connections provided in this application;

[0040] Figure 3 A time-series diagram for monitoring unauthorized external connections provided in this application;

[0041] Figure 4 This application provides a schematic diagram of the structure of a monitoring device for unauthorized external connections.

[0042] Figure 5An electronic device structure diagram is provided for the present application. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0044] In the prior art, in order to realize the illegal external connection, a client plug-in needs to be installed on a PC end, that is, a client plug-in and a violation external connection online monitoring management system are respectively installed on a PC terminal connected to an intranet and a server, so as to realize the illegal external connection. However, in a large-flow intranet, the PC end communicates with a center I / O, which needs powerful hardware as a basis. If the hardware cost is too high, the enterprise is difficult to bear, and if the hardware configuration is too low, too much flow access causes the server to be down, so it is difficult to monitor the illegal external connection behavior in the intranet.

[0045] In order to overcome the above technical problems, the present application provides a violation external connection monitoring method, device, equipment and storage medium, which can send a probe packet to a server, confirm the survival of the server, and realize violation external connection monitoring by inserting a static code into the server, thereby avoiding the installation of a client program and effectively simplifying the operation process.

[0046] Referring to Figure 1 As shown in the figure, the embodiment of the present application discloses a violation external connection monitoring method applied to an intranet monitoring server, which comprises the following steps:

[0047] Step S11, a probe packet is sent to a preset Web service server to determine whether the Web service server is alive, and a corresponding determination result is generated.

[0048] In the embodiment, a probe packet is sent to a preset Web service server to determine whether the Web service server is alive, and a corresponding determination result is generated. That is, before performing the illegal external connection monitoring, a static code needs to be inserted into the preset Web service server, so that the static code is run on the Web service server to determine whether the Web service server can access the public network receiving end platform. It needs to be noted that if the Web service server has stopped running or has been damaged, continuing to perform the illegal external connection monitoring will cause waste of resources. Therefore, when performing the illegal external connection monitoring, first, the probe packet is sent to the Web service server to determine whether the Web service server is in an alive state, and a determination result that the Web service server is in the alive state and a determination result that the Web service server is in a non-alive state are generated, so that subsequent operations are performed based on the determination results. In this way, the probe packet is sent to the Web service server to determine the alive state of the server, which can make the illegal external connection monitoring method in the application more accurate and reliable, and can reduce waste of resources.

[0049] It needs to be further noted that before the probe packet is sent to the preset Web service server to determine whether the Web service server is alive, and a corresponding determination result is generated, the method further includes: locally configuring a global JS service to generate a target static code based on the global JS service; the global JS service is a JavaScript service; and the target static code is a static code generated based on JavaScript. That is, the static code inserted into the Web service server in the embodiment is a static code generated based on JavaScript, that is, a script program based on JavaScript static code, and therefore the global JavaScript service needs to be locally configured on the intranet detection server to facilitate generation of the script program.

[0050] It needs to be noted that before the probe packet is sent to the preset Web service server to determine whether the Web service server is alive, and a corresponding determination result is generated, the method further includes: locally configuring preset Web site information to insert a target static code into the Web service server based on the preset Web site information; and the preset Web site information is information of a Web service server HTML portal website file directory. That is, in the embodiment, the static code inserted into the Web service server needs to insert a script program generated based on the static code into the Web service server HTML portal website when the Web service server runs, and therefore the information of the Web service server HTML portal website file directory needs to be configured in advance to accurately insert the static code into the Web service server.

[0051] Step S12, inserting target static code into the Web service server based on the judgment result, so that the Web service server loads the target static code to the terminal where the Web service server is located after starting.

[0052] In this embodiment, target static code is inserted into the Web service server based on the judgment result, so that the Web service server loads the target static code to the terminal where the Web service server is located after starting. That is, it is necessary to determine whether to insert static code into the Web service server according to the judgment result. If the judgment result indicates that the Web service server is in a live state, static code can be generated based on the global JavaScript service to obtain a script program, and the script program is inserted into the Web service server, so that the script program obtained based on the static code is loaded to the intranet terminal host where the Web service server is located after the Web service server starts. If the judgment result indicates that the Web service server is in a non-live state, the illegal external connection monitoring is directly stopped to avoid waste of resources.

[0053] Step S13, accessing a preset public network receiving end platform based on the target static code, and determining whether to send access data to the preset public network receiving end platform using the target static code based on the access result, so that the preset public network receiving end platform performs an alarm operation after receiving the access data.

[0054] In this embodiment, a preset public network receiving end platform is accessed based on the target static code, and it is determined whether to send access data to the preset public network receiving end platform using the target static code based on the access result, so that the preset public network receiving end platform performs an alarm operation after receiving the access data. That is, after the script program obtained based on the static code is successfully loaded to the terminal host where the Web service server is located, the terminal host needs to access the preset public network receiving end platform through the script program. If the access is successful, it indicates that there is one or more network connection channels between the terminal host in the intranet and the public network receiving end platform, which can prove that the terminal host in the intranet has an illegal external connection behavior, and an alarm operation is needed at this time. If the access fails, it indicates that there is no network connection channel between the terminal host in the intranet and the public network receiving end platform, which can prove that the terminal host in the intranet does not have an illegal external connection behavior.

[0055] As can be seen, in the embodiment, first, a probe message is sent to the preset Web service server to determine whether the Web service server is alive, and a corresponding determination result is generated, then the target static code is inserted into the Web service server based on the determination result, so that the target static code is loaded to the terminal where the Web service server is located after the Web service server is started, finally, the target static code is used to access the preset public network receiving end platform based on the access result, and it is determined whether to send access data to the preset public network receiving end platform based on the access result, so that the preset public network receiving end platform performs an alarm operation after receiving the access data. As can be seen, by using the illegal external connection monitoring method, a probe message can be sent to the Web service server to determine the alive state of the Web service server, and it is determined whether to insert a static code into the Web service server according to the determination result. If the static code is sent, the static code can be loaded to the terminal after the service server is started, then it is determined whether the public network receiving end platform can be accessed through the static code, and it is determined whether there is an illegal external connection behavior according to the determination result, and a corresponding alarm operation is performed. In this way, on the one hand, a probe message can be sent to the Web service server, and a static code is sent to the service server after it is determined that the Web service server is alive, so that the situation that the static code is sent when the Web service server is invalid is avoided, resource consumption is effectively reduced, and the efficiency of illegal external connection monitoring is improved. On the other hand, the illegal external connection monitoring is realized by inserting a static code into the server, and the operation process is effectively simplified by avoiding the installation of a client program.

[0056] Referring to Figure 2 As shown in the figure, the embodiment of the application discloses an illegal external connection monitoring method, comprising:

[0057] Step S21, sending an ICMP or TCPING probe message to a preset Web service server to determine whether a response result fed back by the Web service server can be received.

[0058] In the embodiment, as Figure 3 Before the illegal external connection monitoring is performed, an internal network monitoring server needs to be installed and deployed in the internal network, a public network receiving end platform needs to be installed and deployed in the external network, then the internal network monitoring server sends an ICMP or TCPING probe message to a preset Web service server, and it is determined whether a response result fed back by the Web service server can be received, that is, the internal network monitoring server sends 3 rounds of probe fingerprint packages to determine whether the set Web service server IP address opens 80 / 8080 / 443 and other commonly used web ports. It needs to be noted that the internal network monitoring server needs to be hung beside the core switch and can communicate with the Web service server.

[0059] Step S22: If a response result is received from the Web service server, it indicates that the Web service server is alive, and a first judgment result indicating that the Web service server is alive is generated.

[0060] In this embodiment, if a response from the Web service server is received, it indicates that the Web service server is alive, and a first judgment result confirming the Web service server's liveness is generated. That is, if a correct HTTP response packet (response code 200) is received from the Web service server's IP address (ports such as 80 / 8080 / 443), it indicates that the service server is alive, and static code can be sent to the Web service server to enable unauthorized external connection monitoring, generating a judgment result confirming the Web service server's liveness.

[0061] Step S23: If no response is received from the Web service server, it indicates that the Web service server is in a non-live state, and a second judgment result indicating that the Web service server is in a non-live state is generated.

[0062] In this embodiment, if no response is received from the Web service server, it indicates that the Web service server is in a non-active state, and a second judgment result indicating that the Web service server is in a non-active state is generated. That is, if a correct HTTP response packet (response code 200) is not received from the Web service server's IP address (ports such as 80 / 8080 / 443), it indicates that the service server is in a non-active state. If static code continues to be sent to the Web service server, correct monitoring results will not be obtained, resulting in wasted resources. In this case, a judgment result indicating that the Web service server is in a non-active state is generated.

[0063] Step S24: If the judgment result is the first judgment result, then insert the target static code into the HTML portal website of the Web business server based on the preset Web site information, so that after the Web business server starts, the target static code is loaded into the terminal where the Web business server is located based on the HTML portal website.

[0064] In the embodiment, if the judgment result is the first judgment result, the target static code is inserted into the HTML portal website of the Web service server based on the preset Web site information, so that the target static code is loaded to the terminal where the Web service server is located based on the HTML portal website after the Web service server is started. That is, if the service server is in a survival state, a script program obtained based on static JavaScript code is inserted into the Web server HTML portal website based on a preset Web server HTML portal website file directory, so that the script program obtained based on the static JavaScript code is loaded to the internal network terminal host after the Web service server is started and the terminal host where the Web service server is located browses the HTML portal website.

[0065] In step S25, if the judgment result is the second judgment result, the violation external connection monitoring is ended.

[0066] In step S26, it is judged whether the target static code is executed in the terminal. If the target static code is executed, a preset public network receiving end platform is accessed based on the target static code, and an access result is generated.

[0067] In the embodiment, it is judged whether the target static code is executed in the terminal. If the target static code is executed, a preset public network receiving end platform is accessed based on the target static code, and an access result is generated. That is, if the script program obtained through the static code is executed in the internal network terminal host, it is indicated that the static code is successfully loaded to the internal network terminal host, and the public network receiving end platform in the external network needs to be accessed through the static code.

[0068] In step S27, if the access result is successful access, it is indicated that the terminal has a violation external connection operation, and access data is sent to the preset public network receiving end platform by using the target static code, so that the preset public network receiving end platform performs an alarm operation after the access data is received.

[0069] In the embodiment, if the access result is successful access, it is indicated that the terminal has a violation of external connection operation, and the target static code is used to send access data to the preset public network receiving end platform, so that the preset public network receiving end platform sends an alarm operation after receiving the access data. That is, if the static code can access the public network receiving end platform, the public network receiving end platform module receives the access data sent by the static code, indicating that there is a violation of external connection behavior, and then an alarm information is generated. The JS code is parsed and executed in the browser of the intranet terminal host, which will try to access the public network receiving end platform through a wired or wireless access, and the public network receiving end platform starts tcpdump packet capture analysis to extract the public network exit IP address and the intranet IP address in the access message data. It should be noted that the alarm information is an external network alarm information, and the external network alarm information includes the public network exit IP address and the intranet IP address of the terminal host and the external connection times.

[0070] In step S28, if the access result is access failure, it is indicated that the terminal does not have a violation of external connection operation, and the violation of external connection monitoring is ended.

[0071] As can be seen, in the embodiment, the static JavaScript technology is used, the specific code is actively inserted into the Web service server HTML portal website, and when the intranet terminal host accesses the web server portal website, the service server returns an http response message. The intranet terminal host receives the response packet containing the static JavaScript code, runs the static JavaScript code in the browser display page at the same time, and if the intranet terminal host is connected to the Internet at the same time, the detection packet containing the static JavaScript code will be sent to the public network receiving end platform through the network card that can access the external network, and an email alarm is generated. In this way, since the JS fixed code is inserted into the HTML homepage of the web server portal website, the JS code is run in the browser display interface at the same time, without the need to install any client program, the monitoring steps can be reduced, a large amount of resources can be saved, and the violation of external connection detection can be realized.

[0072] Referring to Figure 4 The embodiment of the application discloses a violation of external connection monitoring device, which comprises:

[0073] A server state judgment module 11 is used to send a detection message to a preset Web service server to judge whether the Web service server is alive, and to generate a corresponding judgment result;

[0074] A code sending module 12 is used to insert a target static code into the Web service server based on the judgment result, so that the target static code is loaded to the terminal where the Web service server is located after the Web service server is started.

[0075] The alarm module 13 is configured to determine whether to send access data to the preset public network receiving end platform based on the target static code according to an access result, so that the preset public network receiving end platform performs an alarm operation after receiving the access data.

[0076] In the present application, a detection packet is first sent to a preset Web service server to determine whether the Web service server is alive, and a corresponding determination result is generated. Then, the target static code is inserted into the Web service server based on the determination result, so that the target static code is loaded to a terminal where the Web service server is located after the Web service server is started. Finally, a preset public network receiving end platform is accessed based on the target static code, and it is determined whether to send access data to the preset public network receiving end platform based on the target static code according to an access result, so that the preset public network receiving end platform performs an alarm operation after receiving the access data. As can be seen, by using the illegal external connection monitoring method in the present application, a detection packet can be sent to a Web service server to determine the alive state of the Web service server, and it is determined whether to insert a static code into the Web service server according to the determination result. If the static code is sent, the static code can be loaded to a terminal after the service server is started. Then, it is determined whether the public network receiving end platform can be accessed through the static code, and it is determined whether there is an illegal external connection behavior according to the determination result, and a corresponding alarm operation is performed. In this way, on the one hand, a detection packet can be sent to a Web service server, and a static code is sent to the service server after it is determined that the Web service server is alive, so as to avoid the case that the static code is sent when the Web service server is invalid, effectively reducing resource consumption and improving the efficiency of illegal external connection monitoring. On the other hand, the illegal external connection monitoring is realized by inserting a static code into the server, which effectively simplifies the operation process.

[0077] In some embodiments, the illegal external connection monitoring apparatus can further include:

[0078] The code generation unit is configured to configure a global JS service locally, and generate a target static code based on the global JS service; the global JS service is a JavaScript service; and the target static code is a static code generated based on JavaScript.

[0079] In some embodiments, the illegal external connection monitoring apparatus can further include:

[0080] An information configuration unit is configured to configure preset Web site information locally, and insert target static code into the Web service server based on the preset Web site information; the preset Web site information is information of a Web service server HTML portal website file directory.

[0081] In some embodiments, the server state judging module 11 can specifically include:

[0082] A response judging unit is configured to send an ICMP or TCPING probe packet to a preset Web service server to judge whether a response result fed back by the Web service server can be received;

[0083] A first judging unit is configured to, if the response result fed back by the Web service server can be received, represent that the Web service server is in a live state, and generate a first judging result that the Web service server is in the live state;

[0084] A second judging unit is configured to, if the response result fed back by the Web service server cannot be received, represent that the Web service server is in a non-live state, and generate a second judging result that the Web service server is in the non-live state.

[0085] In some embodiments, the code sending module 12 can specifically include:

[0086] A code sending unit is configured to, if the judging result is the first judging result, insert the target static code into an HTML portal website of the Web service server based on the preset Web site information, so that the Web service server loads the target static code to a terminal where the Web service server is located based on the HTML portal website after being started up;

[0087] A first monitoring ending unit is configured to, if the judging result is the second judging result, end the violation external connection monitoring.

[0088] In some embodiments, the alarm module 13 can specifically include:

[0089] An access result generating unit is configured to judge whether the target static code is executed in the terminal, and if executed, access a preset public network receiving end platform based on the target static code, and generate an access result;

[0090] An alarm executing unit is configured to, if the access result is successful access, represent that the terminal has a violation external connection operation, and send access data to the preset public network receiving end platform by using the target static code, so that the preset public network receiving end platform performs an alarm operation after receiving the access data.

[0091] The second monitoring ending unit is configured to end the illegal external connection monitoring if the access result is an access failure, and the terminal does not perform the illegal external connection operation.

[0092] Further, the application also discloses an electronic device, Figure 5 The electronic device 20 is shown in a structural diagram according to an example embodiment, and the content in the diagram should not be considered as any limitation on the use range of the application.

[0093] Figure 5 The electronic device 20 is shown in a structural diagram according to an example embodiment, and the content in the diagram should not be considered as any limitation on the use range of the application. The electronic device 20 can specifically include at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25 and a communication bus 26. The memory 22 is configured to store a computer program, the computer program is loaded and executed by the processor 21, so as to realize the related steps in the illegal external connection monitoring method disclosed in any of the preceding embodiments. In addition, the electronic device 20 in the embodiment can be an electronic computer.

[0094] In the embodiment, the power supply 23 is configured to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol followed by the communication interface 24 can be any communication protocol applicable to the technical solution of the application, which is not limited here; the input / output interface 25 is configured to obtain external input data or output data to the outside, and the specific interface type can be selected according to the specific application needs, which is not limited here.

[0095] In addition, the memory 22 as a carrier of resource storage can be a read-only memory, a random access memory, a magnetic disk or an optical disk, and the resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage mode can be temporary storage or permanent storage.

[0096] The operating system 221 is configured to manage and control each hardware device on the electronic device 20 and the computer program 222, and can be Windows Server, Netware, Unix, Linux, etc. The computer program 222 can further include a computer program capable of completing other specific work in addition to the computer program capable of completing the illegal external connection monitoring method performed by the electronic device 20 disclosed in any of the preceding embodiments.

[0097] Further, the present application also discloses a computer readable storage medium for storing a computer program, wherein the computer program is executed by a processor to implement the foregoing disclosed method for monitoring violation of external contact. For the specific steps of the method, reference can be made to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

[0098] The various embodiments are described in the specification by way of progression, each building on the last to facilitate ease of understanding. The same reference numerals are used in different embodiments and have the same meaning unless otherwise defined. The embodiments disclosed in the specification are intended to be exemplary only, and the scope of the application is not intended to be in any way limited by the embodiments disclosed in the specification.

[0099] Those skilled in the art will further appreciate that the units and algorithm steps of the examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or any combination thereof. To clearly illustrate the interchangeability of hardware and software, various illustrative components, blocks, steps, and functions are described herein generally in terms of their functionality, whether implemented with hardware, software or combination thereof. The software can comprise one or more computer program elements to perform the methods described herein. The program elements can comprise computer code, routines, programs, objects, components, data structures, etc., that, when executed by a processor, perform steps of the methods described herein. The software is stored on one or more computer program

[0100] The steps of a method or algorithm described in connection with the embodiments disclosed herein can be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module can reside in random access memory (RAM), non-volatile memory (ROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0101] Finally, it needs to be explained that, in the present text, the terms of relationship such as first and second are merely used to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "comprise", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a list of elements does not only include those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such process, method, article or device. Without more limitations, the element defined by the phrase "comprising a" does not exclude the presence of additional identical elements in the process, method, article or device comprising the element.

[0102] The technical solutions provided by the present application are described in detail above, and the principles and implementation manners of the present application are described by using specific examples. The above description of the examples is only used to help understand the method of the present application and its core idea; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manners and application ranges will be changed, and the above description of the content of the specification should not be understood as a limitation on the present application.

Claims

1. A method of monitoring for rule violations outside of a connection, the method comprising: The application is applied to an intranet monitoring server, comprising: sending a probe message to a preset Web service server to determine whether the Web service server is alive, and generating a corresponding determination result; based on the determination result, inserting a target static code into the Web service server, so that the Web service server loads the target static code to the terminal where the Web service server is located after starting; based on the target static code, accessing a preset public network receiving end platform, and based on the access result, determining whether to send access data to the preset public network receiving end platform using the target static code, so that the preset public network receiving end platform performs an alarm operation after receiving the access data; wherein, before the step of sending a probe message to a preset Web service server to determine whether the Web service server is alive, and generating a corresponding determination result, the method further comprises: configuring a preset Web site information locally, to insert a target static code into the Web service server based on the preset Web site information; the preset Web site information is the information of the Web service server HTML portal website file directory; wherein, the step of sending a probe message to a preset Web service server to determine whether the Web service server is alive, and generating a corresponding determination result, comprises: sending an ICMP or TCPING probe message to a preset Web service server to determine whether the response result fed back by the Web service server can be received; if the response result fed back by the Web service server can be received, it indicates that the Web service server is in an alive state, and a first determination result that the Web service server is in an alive state is generated; if the response result fed back by the Web service server cannot be received, it indicates that the Web service server is in a non-alive state, and a second determination result that the Web service server is in a non-alive state is generated; wherein, the step of inserting a target static code into the Web service server based on the determination result, so that the Web service server loads the target static code to the terminal where the Web service server is located after starting, comprises: if the determination result is the first determination result, inserting the target static code into the HTML portal website of the Web service server based on the preset Web site information, so that the Web service server loads the target static code to the terminal where the Web service server is located based on the HTML portal website after starting; if the determination result is the second determination result, ending the violation of external connection monitoring.

2. The method of claim 1, wherein, before the step of sending a probe message to a preset Web service server to determine whether the Web service server is alive, and generating a corresponding determination result, the method further comprises: configuring a global JS service locally to generate a target static code based on the global JS service; the global JS service is a JavaScript service; the target static code is a static code generated based on JavaScript.

3. The method of breach-outreach monitoring according to any of claims 1 or 2, wherein, The target static code is accessed based on the target static code, and an access result is determined based on the access result whether to send access data to the preset public network receiving end platform by using the target static code, so that the preset public network receiving end platform receives the access data and performs an alarm operation, comprising: determine whether the target static code is executed in the terminal, if executed, access the preset public network receiving end platform based on the target static code, and generate an access result; if the access result is successful access, it indicates that the terminal exists illegal external connection operation, and the access data is sent to the preset public network receiving end platform by using the target static code, so that the preset public network receiving end platform receives the access data and performs an alarm operation; if the access result is access failure, it indicates that the terminal does not exist illegal external connection operation, and the illegal external connection monitoring is ended.

4. A device for monitoring violations of an external connection, characterized by Applied to an internal network monitoring server, comprising: a server state judgment module for sending a detection packet to a preset Web service server to determine whether the Web service server is alive, and generating a corresponding judgment result; a code sending module for inserting a target static code into the Web service server based on the judgment result, so that the target static code is loaded into the terminal where the Web service server is located after the Web service server is started; an alarm module for accessing a preset public network receiving end platform based on the target static code, and determining whether to send access data to the preset public network receiving end platform by using the target static code based on the access result, so that the preset public network receiving end platform receives the access data and performs an alarm operation; wherein the illegal external connection monitoring device further comprises: an information configuration unit for locally configuring preset Web site information to insert a target static code into the Web service server based on the preset Web site information; the preset Web site information is the information of the Web service server HTML portal website file directory; wherein the server state judgment module comprises: a response judgment unit for sending ICMP or TCPING detection packet to a preset Web service server to determine whether the response result fed back by the Web service server can be received; a first judgment unit for if the response result fed back by the Web service server can be received, it indicates that the Web service server is in a live state, and a first judgment result that the Web service server is in a live state is generated; a second judgment unit for if the response result fed back by the Web service server cannot be received, it indicates that the Web service server is in a non-live state, and a second judgment result that the Web service server is in a non-live state is generated; wherein the code sending module comprises: A code sending unit is configured to insert the target static code into an HTML portal website of the Web service server based on the preset Web site information if the judgment result is the first judgment result, so that the target static code is loaded to a terminal where the Web service server is located based on the HTML portal website after the Web service server is started. A first monitoring ending unit is configured to end the illegal external connection monitoring if the judgment result is the second judgment result.

5. An electronic device, comprising: The application relates to a computer program product, comprising: a memory configured to store a computer program; a processor configured to execute the computer program to implement the illegal external connection monitoring method according to any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that, The application relates to a computer program product, comprising: a memory configured to store a computer program; a processor configured to execute the computer program to implement the illegal external connection monitoring method according to any one of claims 1 to 3.

Images