Intranet terminal internet access control method and device

Abstract

The embodiment of the application discloses an intranet terminal internet access control method and device, which can be applied to the financial field or other technical fields, and the method comprises the following steps: when the intranet terminal is connected with a target proxy server, sending a compliance authentication request to the target proxy server; determining whether the target proxy server is a compliance proxy server according to the situation that the target proxy server returns authentication identification information based on the compliance authentication request; if the target proxy server is not a compliance proxy server, then the internet access of the intranet terminal is prohibited. The application helps to reduce the risk of enterprise internal information leakage.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network connection control, in particular to an intranet terminal internet access control method and device. BACKGROUND

[0002] Currently, many enterprises do not allow terminal devices to access the Internet when connecting to the internal network. For some businesses that need to access specific Internet websites, proxy servers built by the enterprise must be used for connection. At present, most enterprises physically isolate the intranet and the Internet through routing devices. When there is a specific business in the enterprise that needs to access a specific Internet website, a specific proxy server is built to provide the terminal with the business demand, and the website address that the proxy server can access is limited (such as website address white list method) to control the internet access behavior of this type of terminal. However, the existing method of limiting the website address that the proxy server can access cannot solve the problem of terminal access to the Internet using a privately built proxy server. If the terminal uses a privately built proxy server, it may cause the risk of leakage of enterprise internal information, and there is a large control gap and security risk. How to solve the problem of leakage of enterprise internal information caused by the use of non-compliant proxy servers by the terminal in the enterprise intranet, the existing technology urgently needs an effective solution. SUMMARY

[0003] The present application is proposed to solve at least one of the technical problems in the background art.

[0004] In order to achieve the above purpose, according to one aspect of the present application, an intranet terminal internet access control method is provided, which comprises:

[0005] When the intranet terminal is connected to the target proxy server, a compliance authentication request is sent to the target proxy server;

[0006] According to the situation that the target proxy server returns authentication identification information based on the compliance authentication request, it is determined whether the target proxy server is a compliant proxy server;

[0007] If the target proxy server is not a compliant proxy server, the internet access of the intranet terminal is prohibited.

[0008] Optionally, according to the situation that the target proxy server returns authentication identification information based on the compliance authentication request, it is determined whether the target proxy server is a compliant proxy server, specifically comprising:

[0009] According to the case that the target proxy server returns authentication identification information according to the compliance authentication request, an authentication result feature is generated;

[0010] Data transmitted by the target proxy server to the internal network terminal is acquired, and a data access feature is extracted from the data;

[0011] A proxy connection feature vector is generated according to the authentication result feature and the data access feature;

[0012] The proxy connection feature vector is input into a trained proxy server classification model, a classification result output by the proxy server classification model is obtained, and it is determined whether the target proxy server is a compliant proxy server according to the classification result.

[0013] Optionally, the internal network terminal Internet access control method further comprises:

[0014] A training sample set is acquired, wherein a training sample in the training sample set is a proxy connection feature vector used for model training with a labeled classification result;

[0015] Model training is performed according to the training sample set and a preset classification algorithm, and the proxy server classification model is obtained.

[0016] Optionally, the model training according to the training sample set and the preset classification algorithm to obtain the proxy server classification model specifically comprises:

[0017] A plurality of classification model training is performed according to the training sample set, and a plurality of classification models are obtained;

[0018] The plurality of classification models are integrated by using an ensemble learning algorithm, and the proxy server classification model is obtained.

[0019] Optionally, the case that the target proxy server returns authentication identification information according to the compliance authentication request specifically comprises: not returning authentication identification information within a required time, returning correct authentication identification information, and returning incorrect authentication identification information.

[0020] Optionally, the data access feature comprises a data type feature and a domain name feature.

[0021] Optionally, the case that the target proxy server returns authentication identification information according to the compliance authentication request to determine whether the target proxy server is a compliant proxy server specifically comprises:

[0022] If the target proxy server returns correct authentication identification information according to the compliance authentication request, it is determined that the target proxy server is a compliance proxy server.

[0023] If the target proxy server does not return authentication identification information within a required time or returns incorrect authentication identification information according to the compliance authentication request, it is determined that the target proxy server is not a compliance proxy server.

[0024] Optionally, the classification algorithm model comprises a logistic regression model, a random forest model, a Gaussian naive Bayes model, a multi-layer perceptron neural network model, an adaptive boosting algorithm model, a support vector machine model and a decision tree model.

[0025] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an internal network terminal Internet access control device is provided, which comprises:

[0026] A compliance authentication request sending unit is configured to send a compliance authentication request to a target proxy server when the internal network terminal is connected to the target proxy server.

[0027] A proxy server type identification unit is configured to determine whether the target proxy server is a compliance proxy server according to a condition that the target proxy server returns authentication identification information based on the compliance authentication request.

[0028] A network disconnection processing unit is configured to prohibit Internet access of the internal network terminal if the target proxy server is not a compliance proxy server.

[0029] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer device is also provided, which comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the internal network terminal Internet access control method when executing the computer program.

[0030] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer readable storage medium is also provided, which stores a computer program / instruction, and the computer program / instruction implements the steps of the internal network terminal Internet access control method when executed by a processor.

[0031] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer program product is also provided, which comprises a computer program / instruction, and the computer program / instruction implements the steps of the internal network terminal Internet access control method when executed by a processor.

[0032] The present application has the following beneficial effects:

[0033] The application sends a compliance authentication request to the target proxy server when the intranet terminal connects with the target proxy server, and then determines whether the target proxy server is a compliance proxy server according to the case that the target proxy server returns authentication identification information based on the compliance authentication request, and prohibits the intranet terminal to access the Internet when it is determined that the target proxy server is not a compliance proxy server, thereby effectively reducing the risk of enterprise internal information leakage. BRIEF DESCRIPTION OF DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor. In the drawings:

[0035] Figure 1 is a flow chart of the intranet terminal Internet access control method in the embodiment of the present application;

[0036] Figure 2 is a flow chart of determining whether the target proxy server is compliance in the embodiment of the present application;

[0037] Figure 3 is a first flow chart of training the proxy server classification model in the embodiment of the present application;

[0038] Figure 4 is a second flow chart of training the proxy server classification model in the embodiment of the present application;

[0039] Figure 5 is a schematic diagram of the existing enterprise intranet terminal connecting with the proxy server;

[0040] Figure 6 is a schematic diagram of the enterprise intranet terminal connecting with the proxy server in the present application;

[0041] Figure 7 is a structural block diagram of the intranet terminal Internet access control device in the embodiment of the present application;

[0042] Figure 8 is a schematic diagram of the computer device in the embodiment of the present application. DETAILED DESCRIPTION

[0043] In the following, the technical solutions in the embodiments of the present application will be described clearly and completely with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by a person of ordinary skill in the art without creative effort should belong to the protection scope of the present application.

[0044] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0045] It should be noted that the terms "comprising" and "having" and any variations thereof in the specification and claims of the present application and the above-described drawings are intended to cover not exclusive inclusion, for example, a process, method, system, product, or device containing a series of steps or units does not have to be limited to the clearly listed steps or units, but can include other steps or units that are not clearly listed or inherent to the process, method, product, or device.

[0046] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the drawings and in combination with the embodiments.

[0047] It should be noted that the information collected in the technical solutions of the present application is information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data comply with the relevant laws, regulations, and standards of the relevant countries and regions, take necessary security measures, do not violate public order and good customs, and provide corresponding operation portals for the user to choose authorization or refusal.

[0048] It should be noted that the present application provides corresponding operation portals for the user to choose to agree or refuse the automatic decision result; if the user chooses to refuse, the expert decision process is entered.

[0049] It should be noted that the intranet terminal Internet access control method and device of the present application can be used in the financial field, and can also be used in any field other than the financial field, and the application field of the intranet terminal Internet access control method and device of the present application is not limited.

[0050] Figure 5 is a schematic diagram of the connection between the existing enterprise intranet terminal and the proxy server, as shown in Figure 5 The current many enterprises do not allow the terminal device to access the Internet when connecting to the internal network. For some business needs to access specific Internet websites, the official proxy server (i.e. compliant proxy server) of the enterprise is used for connection, and the website address that the proxy server can access is limited (for example, the website address white list method) to control the terminal Internet access behavior. However, the existing method of limiting the website address that the proxy server can access cannot solve the problem of using a private proxy server (i.e. non-compliant proxy server) by the intranet terminal to access the Internet. If the intranet terminal uses a non-compliant proxy server, it may cause the risk of leakage of enterprise internal information, and there is a large control gap and security risk.

[0051] Figure 5 The existing process of the enterprise intranet terminal accessing the Internet through the proxy server mainly includes compliant proxy servers and non-compliant proxy servers. The compliant proxy server is a compliant method and can only access specific websites on the Internet. The non-compliant proxy server is a non-compliant method and can access all websites on the Internet. The compliant proxy server mainly limits the Internet addresses that the server can access through the white list. The non-compliant proxy server has no restriction on Internet access and is a private illegal device (indicated by a dashed line). From Figure 5 It can be seen from the flow that if the intranet terminal uses a compliant proxy server, the Internet access can be controlled. However, if the intranet terminal uses a non-compliant proxy server, it bypasses the white list control limit of the enterprise compliant proxy server, and the user can transmit intranet data to a private cloud disk or other websites on the Internet, causing information leakage.

[0052] In the present application, the compliant proxy server limits the intranet terminal to access only the websites that the enterprise allows to access through the website address white list.

[0053] Figure 6 is a schematic diagram of the connection between the enterprise intranet terminal and the proxy server of the present application, as shown in Figure 6 In order to solve the defects of the prior art, the present application sets a proxy connection control module on the intranet terminal side to distinguish whether the proxy server connected by the intranet terminal is a compliant proxy server or a non-compliant proxy server. If it is a non-compliant proxy server, the intranet terminal is disconnected from the network to prevent leakage of enterprise information.

[0054] As shown in Figure 6As shown, the proxy connection control module comprises a compliant proxy judgment module and a non-compliant proxy interception model. The compliant proxy judgment module is used to judge whether the proxy server connected by the intranet terminal is a compliant proxy server or a non-compliant proxy server, and the non-compliant proxy interception model is used to disconnect the intranet terminal when the intranet terminal connects the non-compliant proxy server. As shown in the figure, Figure 6 As shown, a compliant proxy communication module and a white list website restriction model are arranged on the compliant proxy server. The compliant proxy communication module is used to return authentication identification information to the proxy connection control module based on the compliant authentication request sent by the proxy connection control module, and the white list website restriction model is used to restrict the intranet terminal to only access the websites that can be accessed as stipulated by the enterprise, i.e. the white list websites.

[0055] It should be noted that the intranet terminal internet access control method of the embodiments of the present application is applied to the proxy connection control module arranged on the intranet terminal, i.e. the execution subject of the intranet terminal internet access control method of the present application is the proxy connection control module arranged on the intranet terminal.

[0056] Figure 1 The flowchart of the intranet terminal internet access control method of the embodiments of the present application is shown in the figure, Figure 1 As shown in the figure, in one embodiment of the present application, the intranet terminal internet access control method of the present application comprises steps S101 to S103.

[0057] Step S101, when the intranet terminal connects to a target proxy server, a compliant authentication request is sent to the target proxy server.

[0058] Step S102, according to the situation that the target proxy server returns authentication identification information based on the compliant authentication request, it is determined whether the target proxy server is a compliant proxy server.

[0059] Step S103, if the target proxy server is not a compliant proxy server, the internet access of the intranet terminal is prohibited.

[0060] In the present application, if the target proxy server is a compliant proxy server, no processing is performed.

[0061] In the optional embodiment of the present application, the internet access of the intranet terminal can be prohibited by disabling the network driver.

[0062] Therefore, when the intranet terminal is connected with the target proxy server, the compliance authentication request is sent to the target proxy server, and then whether the target proxy server is a compliance proxy server is determined according to the case that the target proxy server returns authentication identification information based on the compliance authentication request, and the internet access of the intranet terminal is prohibited when it is determined that the target proxy server is not a compliance proxy server, thereby effectively reducing the risk of enterprise internal information leakage.

[0063] As shown in the figure, Figure 2 In one embodiment of the present application, the step S102 of determining whether the target proxy server is a compliance proxy server according to the case that the target proxy server returns authentication identification information based on the compliance authentication request specifically comprises steps S201 to S204.

[0064] Step S201, generating an authentication result feature according to the case that the target proxy server returns authentication identification information based on the compliance authentication request.

[0065] Step S202, obtaining data transmitted by the target proxy server to the intranet terminal, and extracting data access features from the data.

[0066] In one embodiment of the present application, the data access features include data type features and domain name features.

[0067] Step S203, generating a proxy connection feature vector according to the authentication result feature and the data access feature.

[0068] In the present application, the authentication result feature and the data access feature are feature coded and then spliced to obtain a proxy connection feature vector.

[0069] Step S204, inputting the proxy connection feature vector into a trained proxy server classification model to obtain a classification result output by the proxy server classification model, and determining whether the target proxy server is a compliance proxy server according to the classification result.

[0070] The present application improves the accuracy of classification by pre-training the proxy server classification model and combining multiple features, and realizes the technical effect of accurately determining whether the target proxy server is a compliance proxy server.

[0071] As shown in the figure, Figure 3 In one embodiment of the present application, the training process of the proxy server classification model in the above step S204 comprises steps S301 and S302.

[0072] Step S301: Obtain a training sample set, wherein the training samples in the training sample set are surrogate connection feature vectors labeled with classification results for model training.

[0073] Step S302: Train the model based on the training sample set and the preset classification algorithm to obtain the proxy server classification model.

[0074] like Figure 4 As shown, in one embodiment of the present invention, the above step S302, which involves training the model based on the training sample set and a preset classification algorithm to obtain the proxy server classification model, specifically includes steps S401 and S402.

[0075] Step S401: Train multiple preset classification algorithm models based on the training sample set to obtain multiple classification models.

[0076] In one embodiment of the present invention, the classification algorithm model includes: logistic regression model, random forest model, Gaussian Naive Bayes model, multilayer perceptron neural network model, adaptive boosting algorithm model, support vector machine model, and decision tree model.

[0077] Step S402: The multiple classification models are integrated using an ensemble learning algorithm to obtain the proxy server classification model.

[0078] In one embodiment of the present invention, the present invention integrates multiple classification models through a voting ensemble learning algorithm to form a final proxy server classification model, thereby improving the accuracy of classification and overcoming the shortcomings of single classification models in terms of incomplete feature extraction due to model capability limitations.

[0079] In one embodiment of the present invention, the situation in which the target proxy server returns authentication identifier information according to the compliance authentication request specifically includes: not returning authentication identifier information within the required time, returning correct authentication identifier information, and returning incorrect authentication identifier information.

[0080] In an optional embodiment of the present invention, step S102, which determines whether the target proxy server is a compliant proxy server based on the authentication identifier information returned by the target proxy server based on the compliance authentication request, specifically includes:

[0081] If the target proxy server returns the correct authentication identifier information based on the compliance authentication request, then the target proxy server is determined to be a compliance proxy server.

[0082] If the target proxy server fails to return authentication identification information within the required time or returns incorrect authentication identification information in response to the compliance authentication request, then the target proxy server is determined to be a non-compliant proxy server.

[0083] In an optional embodiment of the present invention, the authentication identifier information is a key pre-agreed between the compliant proxy server and the proxy connection control module. The proxy connection control module verifies the key to determine whether the target proxy server returns the correct authentication identifier information according to the compliant authentication request.

[0084] As can be seen from the above embodiments, this invention proposes a security enhancement method or device to prevent intranet terminals from using non-compliant proxies. This invention adds an intranet terminal proxy connection control module to determine the proxy currently used by the terminal and check the compliance of the terminal's network access. By detecting connections to the enterprise proxy server, this invention prevents the use of privately or illegally built proxy servers, promptly isolates abnormal outbound access behavior of terminals, and prevents the risk of internal information leakage.

[0085] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0086] Based on the same inventive concept, embodiments of the present invention also provide an intranet terminal internet access control device, which can be used to implement the intranet terminal internet access control method described in the above embodiments, as described in the following embodiments. Since the principle of the intranet terminal internet access control device in solving the problem is similar to that of the intranet terminal internet access control method, embodiments of the intranet terminal internet access control device can refer to embodiments of the intranet terminal internet access control method, and repeated details will not be elaborated further. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0087] Figure 7 This is a structural block diagram of the intranet terminal Internet access control device according to an embodiment of the present invention, as shown below. Figure 7 As shown, in one embodiment of the present invention, the intranet terminal Internet access control device of the present invention includes:

[0088] The compliance authentication request sending unit 1 is used to send a compliance authentication request to the target proxy server when the intranet terminal connects to the target proxy server;

[0089] The proxy server type identification unit 2 is used to determine whether the target proxy server is a compliant proxy server based on the authentication identifier information returned by the target proxy server based on the compliance authentication request.

[0090] The network disconnection processing unit 3 is used to prohibit the internal network terminal from accessing the Internet if the target proxy server is not a compliant proxy server.

[0091] In one embodiment of the present invention, the proxy server type identification unit 2 specifically includes:

[0092] The authentication result feature generation module is used to generate authentication result features based on the authentication identifier information returned by the target proxy server according to the compliance authentication request;

[0093] The data access feature generation module is used to obtain the data transmitted from the target proxy server to the intranet terminal and extract the data access features from the data.

[0094] The proxy connection feature vector generation module is used to generate a proxy connection feature vector based on the authentication result features and the data access features.

[0095] The classification module is used to input the proxy connection feature vector into a trained proxy server classification model, obtain the classification result output by the proxy server classification model, and determine whether the target proxy server is a compliant proxy server based on the classification result.

[0096] In one embodiment of the present invention, the data access features include: data type features and domain name features.

[0097] In one embodiment of the present invention, the intranet terminal Internet access control device of the present invention further includes:

[0098] The training sample set acquisition unit is used to acquire a training sample set, wherein the training samples in the training sample set are surrogate connection feature vectors labeled with classification results for model training.

[0099] The model training unit is used to train the model based on the training sample set and a preset classification algorithm to obtain the proxy server classification model.

[0100] In one embodiment of the present invention, the model training unit specifically includes:

[0101] A multi-model training module is used to train multiple preset classification algorithm models based on the training sample set to obtain multiple classification models;

[0102] The model ensemble module is used to integrate the multiple classification models using an ensemble learning algorithm to obtain the proxy server classification model.

[0103] In one embodiment of the present invention, the classification algorithm model includes: logistic regression model, random forest model, Gaussian Naive Bayes model, multilayer perceptron neural network model, adaptive boosting algorithm model, support vector machine model, and decision tree model.

[0104] In one embodiment of the present invention, the situation in which the target proxy server returns authentication identifier information according to the compliance authentication request specifically includes: not returning authentication identifier information within the required time, returning correct authentication identifier information, and returning incorrect authentication identifier information.

[0105] In one embodiment of the present invention, the proxy server type identification unit 2 specifically includes:

[0106] The first determining module is used to determine that the target proxy server is a compliant proxy server if the target proxy server returns the correct authentication identifier information according to the compliance authentication request.

[0107] The second determining module is used to determine that the target proxy server is not a compliant proxy server if the target proxy server fails to return the authentication identifier information within the required time or returns incorrect authentication identifier information in accordance with the compliance authentication request.

[0108] To achieve the above objectives, according to another aspect of this application, a computer device is also provided. For example... Figure 8 As shown, the computer device includes a memory, a processor, a communication interface, and a communication bus. The memory stores a computer program that can run on the processor. When the processor executes the computer program, it implements the steps in the method of the above embodiments.

[0109] The processor can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0110] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and units, such as the program units corresponding to the above-described method embodiments of the present invention. The processor executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions, and modules stored in the memory, thereby implementing the methods described in the above-described method embodiments.

[0111] The memory may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the processor, etc. Furthermore, the memory may include high-speed random access memory and non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include memory remotely located relative to the processor, which can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0112] The one or more units are stored in the memory and, when executed by the processor, perform the methods described in the above embodiments.

[0113] The specific details of the aforementioned computer equipment can be understood by referring to the relevant descriptions and effects in the above embodiments, and will not be repeated here.

[0114] To achieve the above objectives, according to another aspect of this application, a computer-readable storage medium is also provided, which stores a computer program that, when executed in a computer processor, implements the steps in the above-described intranet terminal internet access control method. Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium may also include combinations of the above types of memory.

[0115] To achieve the above objectives, according to another aspect of this application, a computer program product is also provided, including a computer program / instructions that, when executed by a processor, implement the steps of the above-described intranet terminal Internet access control method.

[0116] Obviously, those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device, or fabricating them separately as individual integrated circuit modules, or fabricating multiple modules or steps as a single integrated circuit module. Thus, the present invention is not limited to any particular hardware and software combination.

[0117] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for controlling internet access to intranet terminals, characterized in that, Applied to intranet terminals, including: When the intranet terminal connects to the target proxy server, it sends a compliance authentication request to the target proxy server. Based on the authentication identifier information returned by the target proxy server in response to the compliance authentication request, it is determined whether the target proxy server is a compliance proxy server. If the target proxy server is not a compliant proxy server, then the intranet terminal's internet access is prohibited. The method of determining whether the target proxy server is a compliant proxy server based on the authentication identifier information returned by the target proxy server based on the compliance authentication request specifically includes: Based on the authentication identifier information returned by the target proxy server according to the compliance authentication request, an authentication result feature is generated; The system acquires data transmitted from the target proxy server to the intranet terminal and extracts data access features from the data; the data access features include: data type features and domain name features; Generate a proxy connection feature vector based on the authentication result features and the data access features; The proxy connection feature vector is input into a trained proxy server classification model to obtain the classification result output by the proxy server classification model, and the target proxy server is determined to be a compliant proxy server based on the classification result.

2. The intranet terminal internet access control method according to claim 1, characterized in that, Also includes: Obtain a training sample set, wherein the training samples in the training sample set are surrogate connection feature vectors labeled with classification results for model training; The proxy server classification model is obtained by training the model based on the training sample set and the preset classification algorithm.

3. The intranet terminal internet access control method according to claim 2, characterized in that, The process of training the model based on the training sample set and a preset classification algorithm to obtain the proxy server classification model specifically includes: The training sample set is used to train multiple preset classification algorithm models to obtain multiple classification models; The various classification models are integrated using an ensemble learning algorithm to obtain the proxy server classification model.

4. The intranet terminal internet access control method according to claim 3, characterized in that, The classification algorithm models include: logistic regression model, random forest model, Gaussian Naive Bayes model, multilayer perceptron neural network model, adaptive boosting algorithm model, support vector machine model, and decision tree model.

5. An intranet terminal Internet access control device, characterized in that, include: The compliance authentication request sending unit is used to send a compliance authentication request to the target proxy server when the intranet terminal connects to the target proxy server; The proxy server type identification unit is used to determine whether the target proxy server is a compliant proxy server based on the authentication identifier information returned by the target proxy server based on the compliance authentication request. A network disconnection processing unit is used to prohibit the internal network terminal from accessing the Internet if the target proxy server is not a compliant proxy server. The proxy server type identification unit specifically includes: The authentication result feature generation module is used to generate authentication result features based on the authentication identifier information returned by the target proxy server according to the compliance authentication request; The data access feature generation module is used to acquire the data transmitted from the target proxy server to the intranet terminal, and extract data access features from the data; the data access features include: data type features and domain name features; The proxy connection feature vector generation module is used to generate a proxy connection feature vector based on the authentication result features and the data access features. The classification module is used to input the proxy connection feature vector into a trained proxy server classification model, obtain the classification result output by the proxy server classification model, and determine whether the target proxy server is a compliant proxy server based on the classification result.

6. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 4.

8. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 4.

Images