Method, device, medium and equipment for identifying network address translation (NAT) device

Abstract

The present disclosure provides a network address translation (NAT) device identification method, a network address translation (NAT) device identification device, a computer readable storage medium and an electronic device, and relates to the technical field of computers. The method comprises: obtaining i-th traffic information of a to-be-tested device within an i-th preset time period, i being a positive integer; calculating a first similarity between the i-th traffic information and preset standard traffic information corresponding to the to-be-tested device, a second similarity between the i-th traffic information and historical maximum traffic information corresponding to the to-be-tested device, and a third similarity between the i-th traffic information and authentication traffic information corresponding to the to-be-tested device; in the case that the first similarity is greater than the second similarity and greater than the third similarity, comparing authentication device information and actual device information of the to-be-tested device; and in the case that the authentication device information does not match the actual device information, determining that the to-be-tested device is a NAT device. The technical solution can improve the timeliness of identifying a NAT device.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a method and apparatus for identifying Network Address Translation (NAT) devices, a computer-readable storage medium, and an electronic device. Background Technology

[0002] Network Address Translation (NAT) refers to multiple devices using Intellectual Property (IP) sharing a single external IP address to access the external network. Behind a NAT device, there are hidden private IP devices that can access or disconnect from the external network at any time without control, which significantly disrupts endpoint security management.

[0003] In related technologies, NAT devices are discovered through timed scanning via endpoint security asset management.

[0004] However, the time intervals for periodic scanning of terminal devices in related technologies are relatively long, resulting in low timeliness of NAT device identification and the potential for security incidents.

[0005] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] The purpose of this disclosure is to provide a method for identifying Network Address Translation (NAT) devices, a device for identifying NAT devices, a computer-readable storage medium, and an electronic device, which can at least improve the timeliness of NAT device identification to a certain extent.

[0007] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part by practice of this disclosure.

[0008] According to one aspect of this disclosure, a method for identifying a Network Address Translation (NAT) device is provided. The method includes: acquiring i-th traffic information of a device under test within an i-th preset time period, where i is a positive integer; calculating a first similarity between the i-th traffic information and preset standard traffic information corresponding to the device under test; calculating a second similarity between the i-th traffic information and historical maximum traffic information corresponding to the device under test; and calculating a third similarity between the i-th traffic information and authentication traffic information corresponding to the device under test; acquiring actual device information of the device under test and comparing the authentication device information of the device under test with the actual device information when the first similarity is greater than both the second and third similarity; and determining the device under test to be a NAT device when the authentication device information does not match the actual device information.

[0009] According to another aspect of this disclosure, an identification device for a Network Address Translation (NAT) device is provided, the device comprising: an acquisition module, a calculation module, a comparison module, and a determination module.

[0010] The acquisition module is used to acquire the i-th traffic information of the device under test within the i-th preset time period, where i is a positive integer; the calculation module is used to calculate the first similarity between the i-th traffic information and the preset standard traffic information corresponding to the device under test, the second similarity between the i-th traffic information and the historical maximum traffic information corresponding to the device under test, and the third similarity between the i-th traffic information and the authentication traffic information corresponding to the device under test; the comparison module is used to acquire the actual device information of the device under test and compare the authentication device information of the device under test with the actual device information when the first similarity corresponding to the i-th traffic information is greater than and greater than the third similarity corresponding to the i-th traffic information; and the determination module is used to determine that the device under test is a NAT device when the authentication device information and the actual device information do not match.

[0011] According to another aspect of this disclosure, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method for identifying a Network Address Translation (NAT) device as described in the above embodiments.

[0012] According to another aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method for identifying a Network Address Translation (NAT) device as described in the above embodiments.

[0013] The method for identifying Network Address Translation (NAT) devices, the device for identifying NAT devices, the computer-readable storage medium, and the electronic device provided in the embodiments of this disclosure have the following technical effects:

[0014] This technical solution, for each device under test (DUT), acquires the i-th traffic information of the DUT within an i-th preset time period, calculates the first similarity between the i-th traffic information and the preset standard traffic information corresponding to the DUT, calculates the second similarity between the i-th traffic information and the historical maximum traffic information, and calculates the third similarity between the i-th traffic information and the authentication traffic information. If the first similarity corresponding to the i-th traffic information is greater than the second similarity and the third similarity, it indicates that the DUT is preliminarily judged to be highly likely to be a NAT device. Continuous detection helps to promptly detect NAT devices, thus effectively ensuring the timeliness of identification. Furthermore, to ensure the accuracy of NAT device identification, the actual device information of the DUT is acquired and compared with the authentication device information. If the authentication device information and the actual device information do not match, the DUT can be determined to be a NAT device. Therefore, this technical solution, by combining passive detection of traffic characteristics with active feature comparison to identify NAT devices, can ensure identification accuracy while effectively improving identification timeliness, thereby effectively enhancing the security of terminal devices.

[0015] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0017] Figure 1 This diagram illustrates a flowchart of a method for identifying a Network Address Translation (NAT) device in an exemplary embodiment of this disclosure.

[0018] Figure 2 This diagram illustrates a flowchart of a method for identifying a Network Address Translation (NAT) device in another exemplary embodiment of this disclosure.

[0019] Figure 3 A schematic diagram of the structure of an identification device for a Network Address Translation (NAT) device that can be applied according to an embodiment of the present disclosure is shown.

[0020] Figure 4 A schematic diagram of the structure of an identification device for a Network Address Translation (NAT) device according to another embodiment of the present disclosure is shown.

[0021] Figure 5 A schematic diagram of the structure of an electronic device suitable for implementing embodiments of the present disclosure is shown. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this disclosure clearer, the embodiments of this disclosure will be described in further detail below with reference to the accompanying drawings.

[0023] In the following description, when referring to the accompanying drawings, the same numbers in different drawings denote the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0024] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this disclosure more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more of these specific details omitted, or other methods, components, apparatus, steps, etc., can be employed. In other instances, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0025] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0026] The following is a detailed description of the embodiments of the Network Address Translation (NAT) device identification method provided in this disclosure:

[0027] Figure 1 and Figure 2The following are schematic flowcharts illustrating the identification method of a Network Address Translation (NAT) device in an exemplary embodiment of this disclosure. Figure 2 right Figure 1 The specific implementation methods of the illustrated embodiments will be described below:

[0028] In S50, the flow information of the device under test within the i-th preset time period is obtained, where i is a positive integer.

[0029] In an exemplary embodiment, the device under test can be any single device, and this embodiment can identify each device in parallel. The following embodiment identifies whether one of the devices (the device under test) is a NAT device.

[0030] In an exemplary embodiment, the aforementioned traffic information includes multiple traffic parameters, specifically: the number of Domain Name Server (DNS) packets per unit time, Transmission Control Protocol (TCP) status information, and the idle time of the IP address. The TCP status information includes the following: PORT (indicating port status), SYN (indicating connection establishment), FIN (indicating connection closure), and RST (indicating connection reset). The idle time of the IP address is obtained through idle information. In this embodiment, the preliminary identification of the device under test will be achieved through the aforementioned traffic information that reflects the performance of the NAT device. Specifically, the device's current traffic information is compared with the historical maximum traffic information, the standard traffic information corresponding to the device, and the traffic information during the device's network access authentication (denoted as "authentication traffic information"), and the preliminary identification of whether the device is a NAT device is achieved based on the comparison results.

[0031] In an exemplary embodiment, for each device under test, the network access authentication traffic information (denoted as "authentication traffic information"), operating system (denoted as "authentication operating system"), and device type (denoted as "authentication device type") are obtained. The authentication traffic information is used to initially identify whether the device under test is a NAT device. Furthermore, the authentication operation information and the authentication device type are used to verify whether the device under test is indeed a NAT device after the initial identification, thereby effectively improving the accuracy of the identification.

[0032] In an exemplary embodiment, for each device under test, traffic information within one minute is acquired. This one-minute traffic information is then sampled multiple times, and the traffic information corresponding to each sample (the i-th sample yields the i-th traffic information) is used for the aforementioned preliminary identification step. For example, if the preset duration is 10 seconds, then the first 10 seconds obtained from the first sample correspond to the first preset duration, and the traffic data corresponding to the first 10 seconds is used as the first traffic data. For example, to improve identification accuracy, the preset duration / sampling duration can be adaptively changed based on a full-traffic machine learning model.

[0033] For example, to ensure smooth transitions in the data used, there is an overlapping time period between the i-th preset duration and the (i+1)-th preset duration. For instance, the period from 1s to 10s is the first preset duration, and the period from 8s to 18s is the second preset duration. The overlapping traffic data from 8s to 10s facilitates a smoother transition between the two data uses, thereby improving recognition accuracy. For example, to further improve recognition accuracy, the duration of the overlapping time period can also be corrected using a full-traffic machine learning model. This machine learning model can employ an XGradient Boosting (xgboost) model.

[0034] In S120, a first similarity is calculated between the i-th traffic information and the preset standard traffic information corresponding to the device under test, a second similarity is calculated between the i-th traffic information and the historical maximum traffic information corresponding to the device under test, and a third similarity is calculated between the i-th traffic information and the authentication traffic information corresponding to the device under test.

[0035] In an exemplary embodiment, the initial value of the historical maximum traffic information corresponding to the device under test is a preset value, and it is updated in real time during the preliminary identification process. For example, to improve identification accuracy, the preset standard traffic information can also be corrected using a full-traffic machine learning model.

[0036] This embodiment can use Euclidean distance to calculate the aforementioned similarity. For example, using the traffic parameter values ​​in the authentication traffic information as the expected values, the variance corresponding to each traffic parameter in the i-th traffic information is calculated. Further, based on the variances corresponding to each traffic parameter, the Euclidean distance is calculated to obtain the first similarity, the second similarity, and the third similarity. The first similarity, the second similarity, and the third similarity will be used to preliminarily determine whether the device under test might be a NAT device.

[0037] For example, in S210, it is determined whether the first similarity is greater than the second similarity and greater than the third similarity. That is, compared with the authentication traffic information and the historical maximum traffic information corresponding to the device, it is determined whether each traffic parameter in the i-th traffic information is closest to the corresponding traffic parameter in the preset standard traffic information of the device.

[0038] If, based on the determination in S210, the first similarity corresponding to the i-th traffic information is not greater than the second similarity corresponding to the i-th traffic information and is not greater than the third similarity corresponding to the i-th traffic information, then S230 is executed: determine whether the second similarity corresponding to the i-th traffic information is greater than the first similarity corresponding to the i-th traffic information and is greater than the third similarity corresponding to the i-th traffic information.

[0039] Specifically, if the second similarity corresponding to the i-th traffic information is greater than both the first and third similarity corresponding to the i-th traffic information, it indicates that the current i-th traffic information may be considered as the historical maximum traffic information corresponding to the device. In this embodiment, before executing S240, another judgment is made:

[0040] Compare the number of the i-th DNS packets in the i-th traffic information with the number of historical DNS packets in the historical maximum traffic information corresponding to the device under test, and compare the i-th TCP status information in the i-th traffic information with the historical TCP status information in the historical maximum traffic information corresponding to the device under test.

[0041] If the number of the i-th DNS packets is greater than the number of the historical DNS packets, and / or the number of the i-th TCP state information is greater than the number of the historical TCP state information, then execute S240: update the historical maximum traffic information corresponding to the device under test to the i-th traffic information.

[0042] If the number of the i-th DNS packets is not greater than the number of the historical DNS packets, and the number of the i-th TCP state information is not greater than the number of the historical TCP state information, then the process of obtaining the traffic information corresponding to the next preset duration is performed, and the comparison process corresponding to the above embodiment is executed to achieve iteration. Specifically, i+1 is assigned to i to obtain the i+1-th traffic information of the device under test within the i+1-th preset duration, and the steps of calculating the first similarity between the i+1-th traffic information and the preset standard traffic information corresponding to the device under test, and calculating the second similarity between the i+1-th traffic information and the historical maximum traffic information corresponding to the device under test are performed.

[0043] In an exemplary embodiment, if the one-minute traffic information obtained during the iteration process provided in the above embodiment is not enough to determine whether the device under test is a NAT device, then traffic data for a duration of one minute is obtained again to perform the above sampling and comparison process.

[0044] If, based on the judgment in S210, the first similarity corresponding to the i-th traffic information is greater than both the second and third similarity corresponding to the i-th traffic information, it is preliminarily determined that the device under test is highly likely to be a NAT device. To verify this, S130 is executed to obtain the actual device information of the device under test, and S220 is executed to compare whether the authenticated device information of the device under test matches the actual device information.

[0045] For example, the authentication device information of the device under test includes: the authentication operating system and authentication device type of the device under test. Correspondingly, the actual device information of the device under test includes: the actual operating system and actual device type of the device under test. The authentication device information can be obtained during device authentication. The actual device information can be obtained by sending a SYN packet to the device under test to probe its actual operating system, or by sending an HTTP / SSH packet to the device to probe its actual device type.

[0046] Specifically, if the certified device information of the device under test does not match the actual device information mentioned above—that is, if the actual operating system of the device under test does not match the certified operating system, and / or the actual device type of the device under test does not match the certified device type—then the device is identified as a NAT device, and step S140 is executed: determine that the device under test is a NAT device. Furthermore, after identifying a NAT device, it can be reported to enable management of that device. If the certified device information of the device under test matches the actual device information mentioned above—that is, if the actual operating system of the device under test matches the certified operating system, and the actual device type of the device under test matches the certified device type—then the device is not a NAT device, and step S150 is executed: determine that the device under test is a non-NAT device.

[0047] The NAT device identification scheme provided in this specification's embodiments sets various traffic parameters / traffic features and makes a preliminary judgment on whether the device under test is a NAT device based on these traffic features. In the preliminary judgment process, an improved KNN algorithm is used for classification (i.e., S210 and S220), which helps improve the timeliness of identification. Furthermore, after initially determining that the device under test is likely a NAT device, it is further verified for NAT status by checking the device type and operating system, thereby effectively ensuring the accuracy of device identification and thus effectively improving the security of the terminal device.

[0048] It should be noted that the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Furthermore, it is readily understood that these processes may, for example, be executed synchronously or asynchronously in multiple modules.

[0049] The following are embodiments of the apparatus disclosed herein, which can be used to execute embodiments of the method disclosed herein. For details not disclosed in the apparatus embodiments of this disclosure, please refer to the embodiments of the method disclosed herein.

[0050] in, Figure 3 A schematic diagram of the structure of an identification device for a Network Address Translation (NAT) device according to an embodiment of this disclosure is shown. Please refer to... Figure 3 The identification device of the Network Address Translation (NAT) device shown in the figure can be implemented as a whole or part of the electronic device through software, hardware, or a combination of both, or it can be integrated as an independent module in the electronic device or server.

[0051] The NAT device identification device 300 in this embodiment includes: an acquisition module 310, a calculation module 320, a comparison module 330, and a determination module 340.

[0052] The acquisition module 310 is used to acquire the i-th traffic information of the device under test within the i-th preset time period, where i is a positive integer; the calculation module 320 is used to calculate the first similarity between the i-th traffic information and the preset standard traffic information corresponding to the device under test, the second similarity between the i-th traffic information and the historical maximum traffic information corresponding to the device under test, and the third similarity between the i-th traffic information and the authentication traffic information corresponding to the device under test; the comparison module 330 is used to acquire the actual device information of the device under test and compare the authentication device information of the device under test with the actual device information when the first similarity corresponding to the i-th traffic information is greater than both the second and third similarity corresponding to the i-th traffic information; and the determination module 340 is used to determine that the device under test is a NAT device when the authentication device information and the actual device information do not match.

[0053] In an exemplary embodiment, Figure 4 A schematic diagram illustrating a structural arrangement of a NAT device identification apparatus according to another exemplary embodiment of this disclosure is provided. See also... Figure 4 :

[0054] In an exemplary embodiment, based on the foregoing scheme, the identification device 300 for the NAT device further includes an update module 350.

[0055] The update module 350 is used to update the historical maximum traffic information of the device under test to the i-th traffic information when the second similarity corresponding to the i-th traffic information is greater than the first similarity corresponding to the i-th traffic information and is also greater than the third similarity corresponding to the i-th traffic information.

[0056] In an exemplary embodiment, based on the foregoing scheme, the NAT device identification device 300 further includes an iteration module 360.

[0057] The iterative module 360 ​​is configured to, when the third similarity corresponding to the i-th traffic information is greater than both the first and second similarity corresponding to the i-th traffic information, obtain the i+1th traffic information of the device under test within a preset time period, and perform the steps of calculating the first similarity between the i+1th traffic information and the preset standard traffic information corresponding to the device under test, and calculating the second similarity between the i+1th traffic information and the historical maximum traffic information corresponding to the device under test.

[0058] In an exemplary embodiment, based on the foregoing scheme, the traffic information includes: the number of DNS packets per unit time, TCP state information, and the idle time of the Internet Protocol IP address;

[0059] The update module 350 is specifically configured to: when the second similarity corresponding to the i-th traffic information is greater than the first similarity corresponding to the i-th traffic information and greater than the third similarity corresponding to the i-th traffic information, compare the number of i-th DNS packets in the i-th traffic information with the number of historical DNS packets corresponding to the historical maximum traffic information of the device under test, and compare the i-th TCP status information in the i-th traffic information with the historical TCP status information of the historical maximum traffic information of the device under test; and when the number of i-th DNS packets is greater than the number of historical DNS packets, and / or the i-th TCP status information is greater than the historical TCP status information, update the historical maximum traffic information corresponding to the device under test to the i-th traffic information.

[0060] In an exemplary embodiment, based on the aforementioned scheme, the iterative module 360 ​​is specifically used for: obtaining the (i+1)th traffic information of the device under test within the (i+1)th preset time period, and performing the steps of calculating the first similarity between the (i+1)th traffic information and the preset standard traffic information corresponding to the device under test, and calculating the second similarity between the (i+1)th traffic information and the historical maximum traffic information corresponding to the device under test.

[0061] In an exemplary embodiment, based on the aforementioned scheme, there is an overlapping time period between the i-th preset duration and the i+1-th preset duration.

[0062] In an exemplary embodiment, based on the aforementioned scheme, the initial value of the historical maximum traffic information corresponding to the device under test is a preset value; the preset standard traffic information corresponding to the device under test is updated based on machine learning of the full traffic data.

[0063] In an exemplary embodiment, based on the foregoing scheme, the comparison module 330 is specifically used to: obtain the actual operating system and actual device type of the device under test; and compare the actual operating system and the authentication operating system of the device under test, and compare the actual device type and the authentication device type of the device under test; the authentication device information of the device under test includes the authentication operating system and authentication device type of the device under test.

[0064] In an exemplary embodiment, based on the foregoing scheme, the determining module 340 is specifically used to: determine the device under test as a NAT device when the actual operating system and the certified operating system of the device under test do not match, and / or the actual device type and the certified device type of the device under test do not match.

[0065] In an exemplary embodiment, based on the foregoing scheme, the determining module 340 is further specifically used to: determine that the device under test is a non-NAT device when the actual operating system and the certified operating system of the device under test are consistent, and the actual device type and the certified device type of the device under test are inconsistent.

[0066] It should be noted that the NAT device identification device provided in the above embodiments is only illustrated by the division of the above functional modules when executing the NAT device identification method. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the NAT device identification device and the NAT device identification method embodiments provided in the above embodiments belong to the same concept. Therefore, for details not disclosed in the device embodiments of this disclosure, please refer to the embodiments of the NAT device identification method of this disclosure, which will not be repeated here.

[0067] The sequence numbers of the embodiments disclosed above are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0068] This disclosure also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the methods described in the foregoing embodiments. The computer-readable storage medium may include, but is not limited to, any type of disk, including floppy disks, optical disks, DVDs, CD-ROMs, microdrives, as well as magneto-optical disks, ROMs, RAMs, EPROMs, EEPROMs, DRAMs, VRAMs, flash memory devices, magnetic cards or optical cards, nanosystems (including molecular memory ICs), or any type of medium or device suitable for storing instructions and / or data.

[0069] This disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of any of the methods described above.

[0070] Figure 5 This schematically illustrates a structural diagram of an electronic device according to an exemplary embodiment of the present disclosure. Please see [link to relevant documentation]. Figure 5 As shown, the electronic device 500 includes a processor 501 and a memory 502.

[0071] In this embodiment, the processor 501 is the control center of the computer system, and can be a processor of a physical machine or a processor of a virtual machine. The processor 501 may include one or more processing cores, such as a 4-core processor or an 8-core processor. The processor 501 can be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 501 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state.

[0072] In this embodiment of the disclosure, the processor 501 is specifically used for:

[0073] The process involves: acquiring the i-th traffic information of the device under test (DUT) within a preset time period (i), where i is a positive integer; calculating a first similarity between the i-th traffic information and the preset standard traffic information corresponding to the DUT; calculating a second similarity between the i-th traffic information and the historical maximum traffic information corresponding to the DUT; and calculating a third similarity between the i-th traffic information and the authentication traffic information corresponding to the DUT. If the first similarity is greater than both the second and third similarity, the process involves acquiring the actual device information of the DUT and comparing it with the authentication device information. If the authentication device information does not match the actual device information, the process determines that the DUT is a NAT device.

[0074] Furthermore, the aforementioned processor 501 is also specifically used for:

[0075] If the second similarity corresponding to the i-th traffic information is greater than the first similarity corresponding to the i-th traffic information and greater than the third similarity corresponding to the i-th traffic information, the historical maximum traffic information corresponding to the device under test is updated to the i-th traffic information.

[0076] Furthermore, the aforementioned processor 501 is also specifically used for:

[0077] If the third similarity corresponding to the i-th traffic information is greater than the first similarity corresponding to the i-th traffic information and greater than the second similarity corresponding to the i-th traffic information, the steps are as follows: obtain the i+1-th traffic information of the device under test within the i+1-th preset time period, and perform the steps of calculating the first similarity between the i+1-th traffic information and the preset standard traffic information corresponding to the device under test, and calculating the second similarity between the i+1-th traffic information and the historical maximum traffic information corresponding to the device under test.

[0078] Furthermore, the number of DNS messages per unit time, the TCP state information of the Transmission Control Protocol, and the idle time of the Internet Protocol IP address;

[0079] The processor 501 is further configured to: when the second similarity corresponding to the i-th traffic information is greater than the first similarity corresponding to the i-th traffic information and greater than the third similarity corresponding to the i-th traffic information, compare the number of i-th DNS packets in the i-th traffic information with the number of historical DNS packets corresponding to the historical maximum traffic information of the device under test, and compare the i-th TCP state information in the i-th traffic information with the historical TCP state information of the historical maximum traffic information of the device under test; and when the number of i-th DNS packets is greater than the number of historical DNS packets, and / or the i-th TCP state information is greater than the historical TCP state information, update the historical maximum traffic information corresponding to the device under test to the i-th traffic information.

[0080] Furthermore, the aforementioned processor 501 is also specifically used for:

[0081] If the number of the i-th DNS packets is not greater than the number of the historical DNS packets, and the number of the i-th TCP state information is not greater than the number of the historical TCP state information, the steps are as follows: obtain the i+1-th traffic information of the device under test within the i+1-th preset time period, and perform the steps of calculating the first similarity between the i+1-th traffic information and the preset standard traffic information corresponding to the device under test, and calculating the second similarity between the i+1-th traffic information and the historical maximum traffic information corresponding to the device under test.

[0082] Furthermore, there is an overlapping time period between the aforementioned i-th preset duration and the aforementioned i+1-th preset duration.

[0083] Furthermore, the initial value of the historical maximum traffic information corresponding to the aforementioned device under test is a preset value; the preset standard traffic information corresponding to the aforementioned device under test is updated based on machine learning of the full traffic data.

[0084] Furthermore, the above-mentioned acquisition of the actual device information of the device under test includes: acquiring the actual operating system and actual device type of the device under test;

[0085] The comparison of the certified device information of the device under test with the actual device information includes: comparing the actual operating system and certified operating system of the device under test, and comparing the actual device type and certified device type of the device under test; the certified device information of the device under test includes the certified operating system and certified device type of the device under test.

[0086] Furthermore, determining the device under test as a NAT device when the authentication device information does not match the actual device information includes: determining the device under test as a NAT device when the actual operating system of the device under test does not match the authentication operating system, and / or when the actual device type of the device under test does not match the authentication device type.

[0087] Furthermore, the aforementioned processor 501 is also specifically used for:

[0088] If the actual operating system of the device under test matches the certified operating system, but the actual device type of the device under test does not match the certified device type, then the device under test is determined to be a non-NAT device.

[0089] Memory 502 may include one or more computer-readable storage media, which may be non-transitory. Memory 502 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments of this disclosure, the non-transitory computer-readable storage media in memory 502 is used to store at least one instruction, which is executed by processor 501 to implement the methods in the embodiments of this disclosure.

[0090] In some embodiments, the electronic device 500 further includes a peripheral device interface 503 and at least one peripheral device. The processor 501, memory 502, and peripheral device interface 503 are connected via a bus or signal line. Each peripheral device can be connected to the peripheral device interface 503 via a bus, signal line, or circuit board. Specifically, the peripheral device includes at least one of a display screen 504, a camera 505, and an audio circuit 506.

[0091] Peripheral device interface 503 can be used to connect at least one I / O (Input / Output) related peripheral device to processor 501 and memory 502. In some embodiments of this disclosure, processor 501, memory 502, and peripheral device interface 503 are integrated on the same chip or circuit board; in other embodiments of this disclosure, any one or two of processor 501, memory 502, and peripheral device interface 503 can be implemented on separate chips or circuit boards. This disclosure does not specifically limit the scope of the embodiments.

[0092] Display screen 504 is used to display a UI (User Interface). This UI may include graphics, text, icons, videos, and any combination thereof. When display screen 504 is a touch display screen, it also has the ability to collect touch signals on or above its surface. These touch signals can be input as control signals to processor 501 for processing. In this case, display screen 504 can also be used to provide virtual buttons and / or a virtual keyboard, also known as soft buttons and / or a soft keyboard. In some embodiments of this disclosure, there may be one display screen 504, which serves as the front panel of the electronic device 500; in other embodiments, there may be at least two display screens 504, respectively disposed on different surfaces of the electronic device 500 or in a folded design; in still other embodiments, display screen 504 may be a flexible display screen, disposed on a curved or folded surface of the electronic device 500. Furthermore, display screen 504 may be configured as a non-rectangular irregular shape, i.e., a non-rectangular screen. Display screen 504 may be made of materials such as LCD (Liquid Crystal Display) or OLED (Organic Light-Emitting Diode).

[0093] Camera 505 is used to capture images or videos. Optionally, camera 505 includes a front-facing camera and a rear-facing camera. Typically, the front-facing camera is located on the front panel of the electronic device, and the rear-facing camera is located on the back of the electronic device. In some embodiments, there are at least two rear-facing cameras, which are any one of a main camera, a depth-sensing camera, a wide-angle camera, and a telephoto camera, to achieve background blurring by fusion of the main camera and the depth-sensing camera, panoramic shooting by fusion of the main camera and the wide-angle camera, VR (Virtual Reality) shooting, or other fusion shooting functions. In some embodiments of this disclosure, camera 505 may also include a flash. The flash can be a single-color temperature flash or a dual-color temperature flash. A dual-color temperature flash refers to a combination of a warm light flash and a cool light flash, which can be used for light compensation at different color temperatures.

[0094] The audio circuit 506 may include a microphone and a speaker. The microphone is used to collect sound waves from the user and the environment, and convert the sound waves into electrical signals that are input to the processor 501 for processing. For stereo sound acquisition or noise reduction purposes, there may be multiple microphones, each located in a different part of the electronic device 500. The microphone may also be an array microphone or an omnidirectional microphone.

[0095] Power supply 507 is used to supply power to the various components in electronic device 500. Power supply 507 can be AC ​​power, DC power, a disposable battery, or a rechargeable battery. When power supply 507 includes a rechargeable battery, the rechargeable battery can be a wired rechargeable battery or a wireless rechargeable battery. A wired rechargeable battery is a battery that is charged via a wired line, while a wireless rechargeable battery is a battery that is charged via a wireless coil. The rechargeable battery can also be used to support fast charging technology.

[0096] The block diagram of the electronic device shown in the embodiments of this disclosure does not constitute a limitation on the electronic device 500. The electronic device 500 may include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0097] In the description of this disclosure, it should be understood that the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Those skilled in the art can understand the specific meaning of the above terms in this disclosure based on the specific circumstances. Furthermore, in the description of this disclosure, unless otherwise stated, "multiple" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0098] The above description is merely a specific embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure. Therefore, equivalent variations made in accordance with the claims of this disclosure are still within the scope of this disclosure.

Claims

1. A method for identifying Network Address Translation (NAT) devices, characterized in that, The method includes: Obtain the flow information of the device under test within the i-th preset time period, where i is a positive integer; Calculate the first similarity between the i-th traffic information and the preset standard traffic information corresponding to the device under test, calculate the second similarity between the i-th traffic information and the historical maximum traffic information corresponding to the device under test, and calculate the third similarity between the i-th traffic information and the authentication traffic information corresponding to the device under test; If the first similarity corresponding to the i-th traffic information is greater than the second similarity corresponding to the i-th traffic information and is also greater than the third similarity corresponding to the i-th traffic information, then the actual device information of the device under test is obtained, and the authentication device information of the device under test and the actual device information are compared. If the certified device information does not match the actual device information, the device under test is determined to be a NAT device.

2. The method according to claim 1, characterized in that, The method further includes: If the second similarity corresponding to the i-th traffic information is greater than both the first and third similarity corresponding to the i-th traffic information, the historical maximum traffic information corresponding to the device under test is updated to the i-th traffic information.

3. The method according to claim 1, characterized in that, The method further includes: If the third similarity corresponding to the i-th traffic information is greater than the first similarity corresponding to the i-th traffic information and greater than the second similarity corresponding to the i-th traffic information, the steps are as follows: obtain the i+1-th traffic information of the device under test within the i+1-th preset time period, and perform the steps of calculating the first similarity between the i+1-th traffic information and the preset standard traffic information corresponding to the device under test, and calculating the second similarity between the i+1-th traffic information and the historical maximum traffic information corresponding to the device under test.

4. The method according to claim 1, characterized in that, The traffic information includes: the number of DNS packets per unit time, TCP state information, and the idle time of the Internet Protocol IP address; The method further includes: If the second similarity corresponding to the i-th traffic information is greater than the first similarity corresponding to the i-th traffic information and greater than the third similarity corresponding to the i-th traffic information, the number of i-th DNS packets in the i-th traffic information is compared with the number of historical DNS packets corresponding to the historical maximum traffic information of the device under test, and the i-th TCP state information in the i-th traffic information is compared with the historical TCP state information corresponding to the historical maximum traffic information of the device under test. If the number of the i-th DNS packets is greater than the number of historical DNS packets, and / or the number of the i-th TCP state information is greater than the number of historical TCP state information, the historical maximum traffic information corresponding to the device under test will be updated to the i-th traffic information.

5. The method according to claim 4, characterized in that, The method further includes: When the number of the i-th DNS packets is not greater than the number of historical DNS packets, and the number of the i-th TCP state information is not greater than the number of historical TCP state information, the steps are as follows: obtain the i+1-th traffic information of the device under test within the i+1-th preset time period, and perform the following steps: calculate the first similarity between the i+1-th traffic information and the preset standard traffic information corresponding to the device under test, and calculate the second similarity between the i+1-th traffic information and the historical maximum traffic information corresponding to the device under test.

6. The method according to claim 5, characterized in that, There is an overlapping time period between the i-th preset duration and the (i+1)-th preset duration.

7. The method according to any one of claims 1 to 6, characterized in that, The initial value of the historical maximum traffic information corresponding to the device under test is a preset value; the preset standard traffic information corresponding to the device under test is updated based on machine learning of the full traffic data.

8. The method according to any one of claims 1 to 6, characterized in that, The step of obtaining the actual device information of the device under test includes: Obtain the actual operating system and actual device type of the device under test; Comparing the certified device information of the device under test with the actual device information includes: The actual operating system and the certified operating system of the device under test are compared, as are the actual device type and the certified device type. The certified device information of the device under test includes the certified operating system and the certified device type.

9. The method according to claim 8, characterized in that, The step of determining the device under test as a NAT device when the authenticated device information does not match the actual device information includes: If the actual operating system and the certified operating system of the device under test do not match, and / or the actual device type and the certified device type of the device under test do not match, the device under test is determined to be a NAT device.

10. The method according to claim 9, characterized in that, The method further includes: If the actual operating system of the device under test matches the certified operating system, but the actual device type of the device under test does not match the certified device type, the device under test is determined to be a non-NAT device.

11. A device for identifying Network Address Translation (NAT) devices, characterized in that, The device includes: The acquisition module is used to acquire the i-th flow information of the device under test within the i-th preset time period, where i is a positive integer; The calculation module is used to calculate the first similarity between the i-th traffic information and the preset standard traffic information corresponding to the device under test, calculate the second similarity between the i-th traffic information and the historical maximum traffic information corresponding to the device under test, and calculate the third similarity between the i-th traffic information and the authentication traffic information corresponding to the device under test. The comparison module is used to obtain the actual device information of the device under test and compare the certified device information of the device under test with the actual device information when the first similarity corresponding to the i-th traffic information is greater than the second similarity corresponding to the i-th traffic information and the third similarity corresponding to the i-th traffic information. The determination module is used to determine that the device under test is a NAT device when the certified device information does not match the actual device information.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed on a computer or processor, cause the computer or processor to perform the method for identifying a Network Address Translation (NAT) device as described in any one of claims 1 to 10.

13. An electronic device, characterized in that, The device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method for identifying a Network Address Translation (NAT) device as described in any one of claims 1 to 10.

Images