Data flow blocking system, method, apparatus, electronic device, and storage medium

Abstract

The present disclosure provides a data flow blocking system, method, device, electronic equipment and storage medium, comprising: a data flow information acquisition component, configured to acquire socket state information, acquire port state of a receiving port, and identify whether a data flow is a candidate risk data flow; an acquisition timing component, configured to acquire a state information table and transmit the state information table to a data analysis component; the data analysis component, configured to identify whether the candidate risk data flow is a target risk data flow; and a blocking component, configured to block and control the target risk data flow. By setting the data flow blocking system on the BRAS, real-time automatic monitoring of the data flow can be realized. When it is judged that the data flow is a candidate risk data flow, a state information table is generated for in-depth analysis to determine whether the candidate risk data flow is a target risk data flow. In this way, the accuracy of judging whether the data flow is P2P can be improved, a data basis for subsequent blocking of P2P service interaction is provided, and the traffic operation control capability is improved.

Description

Technical Field

[0001] This disclosure relates to the field of home network technology, and in particular to a data flow blocking system, method, apparatus, electronic device, and storage medium. Background Technology

[0002] Original peer-to-peer (P2P) traffic distribution required first hole punching (i.e., node discovery) to obtain the Internet Protocol Address (IP address) and port number of both parties before establishing a connection to transmit data. When the Network Address Translation (NAT) mode changed from a cone-shaped to a symmetrical type, the connection between the server and the client required a five-tuple of source IP, source port number, destination IP, destination port number, and protocol, which upgraded the original one-to-many correspondence to a one-to-one correspondence. This caused the original conventional P2P data distribution mode of obtaining IP address and port number to become invalid.

[0003] The new P2P service distribution implementation process is as follows: During the node discovery process before P2P service distribution, it is monitored whether both ends are in symmetrical mode. When one or both ends are in symmetrical mode, the method of multiple relay connection establishment is first used to detect the port change pattern used by each end. Then, during the node discovery process, the principle of collision attempt using regular ports is used to find the port for new P2P service distribution, thereby establishing a P2P connection.

[0004] Currently, the conversion mode of new P2P services in the technology is mostly dynamic NAT, which is untraceable and costly. It can only block the distribution of regular P2P services, while the new P2P distribution traffic is mostly non-mobile IDC / CDN regular traffic distribution, which often has poor quality and stability, and the effect of controlling P2P distribution traffic is poor. Summary of the Invention

[0005] This disclosure aims to at least partially address one of the technical problems in the related art.

[0006] Therefore, one objective of this disclosure is to propose a data stream blocking system.

[0007] The second objective of this disclosure is to propose a data stream blocking method.

[0008] The third objective of this disclosure is to provide a data stream blocking device.

[0009] The fourth objective of this disclosure is to provide an electronic device.

[0010] The fifth objective of this disclosure is to provide a non-transitory computer-readable storage medium.

[0011] The sixth objective of this disclosure is to provide a computer program product.

[0012] To achieve the above objectives, a first aspect of this disclosure provides a data stream blocking system, comprising: the data stream blocking system being installed on a BRAS, the system including a data stream information acquisition component, an acquisition timing component, a data analysis component, and a blocking component; wherein, the data stream information acquisition component is used to acquire socket status information of the data stream, acquire the port status of the receiving port of the data stream based on the socket status information, and identify whether the data stream is a candidate risk data stream based on the port status; the acquisition timing component is used to acquire a status information table of the candidate risk data stream and transmit the status information table to the data analysis component, wherein the status information table includes an information acquisition time table and a data stream port status table of the candidate risk data stream; the data analysis component is used to perform risk analysis on the status information table and identify whether the candidate risk data stream is a target risk data stream based on the risk analysis results; the blocking component is used to block and control the target risk data stream in response to the data analysis component identifying the candidate risk data stream as the target risk data stream.

[0013] According to one embodiment of this disclosure, the data stream information acquisition component is further configured to: monitor the data tuples of each data stream in the data stream set, wherein, for any data stream, the data tuple includes at least the source address, destination address, source port, destination port, and communication protocol of the data stream; and for any data stream, obtain the initial information acquisition time of the data stream passing through the BRAS, and associate the initial information acquisition time with the data tuple to obtain the socket status information of the data stream.

[0014] According to one embodiment of this disclosure, the data stream information acquisition component is further configured to: determine the data stream as the candidate risk data stream in response to the socket status information indicating that the receiving port of the data stream is in a port closed state.

[0015] According to one embodiment of this disclosure, the information collection timing component is further configured to: acquire information collection timing data of the candidate risk data stream; acquire information collection time interval data of the candidate risk data stream; and construct the information collection time schedule of the candidate risk data stream based on the information collection timing data and the information collection time interval data.

[0016] According to one embodiment of this disclosure, obtaining the information collection timing data of the candidate risk data stream includes: obtaining an information collection reference duration for the candidate risk data stream; obtaining a first collection time for the candidate risk data stream, wherein the first collection time is the time when the candidate risk data stream is first detected by the data stream information collection component when it passes through the BRAS; starting from the first collection time, obtaining a plurality of second collection times when the candidate risk data stream is collected during its passage through the BRAS within the information collection reference duration; and sorting the first collection time and the plurality of second collection times in order from earliest to latest to obtain the information collection schedule of the candidate risk data stream.

[0017] According to one embodiment of this disclosure, obtaining the information collection time interval data of the candidate risk data stream includes: obtaining a first collection time interval based on the first collection time for each of the plurality of second collection times; and sorting the first collection time intervals according to the information collection time schedule to obtain the information collection time interval data of the candidate risk data stream.

[0018] According to one embodiment of this disclosure, the data stream information acquisition component is further configured to: for any information acquisition time in the information acquisition schedule, obtain from the socket status information of the candidate risk data stream the first port status of the source port and the second port status of the target port of the candidate risk data stream at the information acquisition time; and obtain the data stream port status table of the candidate risk data stream based on the first port status and the second port status at each information acquisition time.

[0019] According to one embodiment of this disclosure, the data stream information acquisition component is further configured to: acquire a third acquisition time of the candidate risk data stream in real time; and initiate a new information acquisition process for the candidate risk data stream in response to the third acquisition time reaching the information acquisition reference duration based on a third acquisition time interval between the first acquisition times.

[0020] According to one embodiment of this disclosure, the data analysis component is further configured to: extract abnormal state information of the candidate risk data stream based on the risk analysis results; and determine the candidate risk data stream as the target risk data stream in response to a match between the abnormal state information and preset risk state information.

[0021] According to one embodiment of this disclosure, the system further includes an aging process component, configured to: acquire the blocking and control duration of the target risk data stream; and, in response to the blocking and control duration reaching a preset blocking and control reference duration, stop the blocking and control of the target risk data stream and restore the target risk data stream to its state before the blocking and control.

[0022] According to one embodiment of this disclosure, the target risk data stream is a P2P business interaction data stream.

[0023] To achieve the above objectives, a second aspect of this disclosure provides a data stream blocking method, comprising: acquiring a data stream blocking system, wherein the data stream blocking system is based on the data stream blocking system described in the first aspect embodiment; acquiring socket status information of a data stream through the data stream blocking system, and acquiring the port status of the receiving port of the data stream based on the socket status information; determining the data stream as a candidate risky data stream in response to the port status being a port closed state; acquiring a status information table of the candidate risky data stream through the data stream blocking system, performing risk analysis on the status information table, and acquiring the risk analysis result of the risk analysis; and blocking and controlling the target risky data stream in response to the risk analysis result indicating that the candidate risky data stream is a target risky data stream.

[0024] To achieve the above objectives, a third aspect of this disclosure provides a data stream blocking device, comprising: an acquisition module for acquiring a data stream blocking system, wherein the data stream blocking system is based on the data stream blocking system described in the first aspect embodiment; a positioning module for acquiring socket status information of a data stream through the data stream blocking system, and acquiring the port status of the receiving port of the data stream based on the socket status information; a determination module for determining the data stream as a candidate risk data stream in response to the port status being a port closed state; an analysis module for acquiring a status information table of the candidate risk data stream through the data stream blocking system, performing risk analysis on the status information table, and acquiring the risk analysis result of the risk analysis; and an implementation module for blocking and controlling the target risk data stream in response to the risk analysis result indicating that the candidate risk data stream is a target risk data stream.

[0025] To achieve the above objectives, a fourth aspect of this disclosure provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to implement the data flow blocking method as described in the first aspect of this disclosure.

[0026] To achieve the above objectives, a fifth aspect of this disclosure provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to implement the data stream blocking method as described in the first aspect of this disclosure.

[0027] To achieve the above objectives, a sixth aspect of this disclosure provides a computer program product including a computer program that, when executed by a processor, is used to implement the data flow blocking method as described in the first aspect of this disclosure.

[0028] Therefore, by setting up a data flow blocking system on the BRAS, real-time automatic monitoring of data flows can be achieved. When a data flow is determined to be a candidate risk data flow, a status information table is generated for in-depth analysis to determine whether the candidate risk data flow is the target risk data flow. This can improve the accuracy of judging whether a data flow is P2P, provide a data foundation for subsequent blocking of P2P business interactions, and improve traffic operation and management capabilities. Attached Figure Description

[0029] Figure 1 This is a schematic diagram of a data stream blocking system according to one embodiment of the present disclosure;

[0030] Figure 2 This is a schematic diagram illustrating the timing data of information collection for acquiring candidate risk data streams according to one embodiment of this disclosure;

[0031] Figure 3 This is a schematic diagram of an information collection schedule for acquiring candidate risk data streams according to one embodiment of this disclosure;

[0032] Figure 4 This is a schematic diagram illustrating the information collection time interval data of acquiring candidate risk data stream according to one embodiment of this disclosure;

[0033] Figure 5 This is a schematic diagram of a data stream blocking method according to one embodiment of the present disclosure;

[0034] Figure 6 This is a schematic diagram of a data stream blocking device according to one embodiment of the present disclosure;

[0035] Figure 7 This is a schematic diagram of an electronic device according to one embodiment of the present disclosure. Detailed Implementation

[0036] Embodiments of this disclosure are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this disclosure, and should not be construed as limiting this disclosure.

[0037] The acquisition, storage, use, and processing of data in this disclosed technical solution all comply with the relevant provisions of relevant laws and regulations.

[0038] Current technologies for mobile network flow control systems primarily achieve multi-dimensional analysis of network traffic, but lack correlation analysis between network traffic packets and between network traffic packets with the same source and destination, as well as correlation analysis of changes in the state of network packets' network tuples (sockets).

[0039] Figure 1 This is a schematic diagram of a data stream blocking system 100 according to one embodiment of this disclosure, as shown below. Figure 1 As shown, the data stream blocking system is installed on the BRAS. The system includes a data stream information acquisition component 110, an acquisition timing component 120, a data analysis component 130, and a blocking component 140.

[0040] It should be noted that a Broadband Remote Access Server (BRAS) is a network device located at the edge of a carrier's network, specifically designed to handle and manage user access services. In broadband network architecture, the BRAS plays a crucial role.

[0041] The data stream information acquisition component 110 is used to acquire the socket status information of the data stream, acquire the port status of the receiving port of the data stream based on the socket status information, and identify whether the data stream is a candidate risky data stream based on the port status.

[0042] The data acquisition timing component 120 is used to acquire the status information table of the candidate risk data stream and transmit the status information table to the data analysis component 130. The status information table includes the information acquisition time schedule of the candidate risk data stream and the data stream port status table.

[0043] The data analysis component 130 is used to perform risk analysis on the status information table and identify whether the candidate risk data stream is the target risk data stream based on the risk analysis results.

[0044] The blocking component 140 is used to block and control the target risk data stream in response to the data analysis component 130 identifying the candidate risk data stream as the target risk data stream.

[0045] In this embodiment, the blocking component 140 can be used to detect abnormal changes in network tuples (sockets) and incremental relationships with port functions under different classifications, and push the refined socket state classification changes and port changes to the matching management policy in real time, dynamically update the policy management information database, and send it to the BRAS link control module to realize user-level autonomous management of data flow, thereby effectively blocking the distribution of illegal P2P traffic and improving traffic operation and control capabilities.

[0046] Therefore, by setting up a data flow blocking system on the BRAS, real-time automatic monitoring of data flows can be achieved. When a data flow is determined to be a candidate risk data flow, a status information table is generated for in-depth analysis to determine whether the candidate risk data flow is the target risk data flow. This can improve the accuracy of judging whether a data flow is P2P, provide a data foundation for subsequent blocking of P2P business interactions, and improve traffic operation and management capabilities.

[0047] In this embodiment of the disclosure, the data stream information acquisition component 110 is also used to monitor the data tuples of each data stream in the data stream set. For any data stream, the data tuple includes at least the source address, destination address, source port, destination port and communication protocol of the data stream. For any data stream, the initial information acquisition time of the data stream passing through the BRAS is obtained, and the initial information acquisition time is associated with the data tuple to obtain the socket status information of the data stream.

[0048] In this embodiment of the disclosure, one data stream corresponds to one Public System of Digital Identity (SPID). Different data streams correspond to different SPIDs, which can be used as a basis for distinguishing different data streams. One data stream may include multiple data tuples, that is, one SPID can correspond to multiple data tuples. Different data tuples can be distinguished by differentiating their SPIDs to determine whether they belong to the same data stream.

[0049] If the socket status information indicates that the receiving port of the data stream is in a closed state, it can be considered that the current data stream may be transmitted via P2P, and thus the data stream is identified as a candidate risky data stream.

[0050] It should be noted that the receiving port includes the source port and the destination port. When the port status information of both the source port and the destination port is in the closed state, it is determined that the receiving port of the data stream is in the closed state.

[0051] It should be noted that, based on the characteristics of P2P, when the receiving port of the data stream is in a closed state, it is determined that the two parties are suspected of engaging in P2P business interaction to establish a node discovery process. At this time, the data stream can be identified as a candidate risky data stream.

[0052] In the above embodiments, the information collection timing component 120 is further configured to: acquire information collection timing data of the candidate risk data stream, then acquire information collection time interval data of the candidate risk data stream, and finally construct an information collection schedule for the candidate risk data stream based on the information collection timing data and the information collection time interval data.

[0053] It should be noted that the information collection time-series data is the time interval between the timestamps of subsequent listening and the timestamps of the first listening. It should also be noted that the time interval can be of fixed length or random length; no limitation is made here.

[0054] In this embodiment of the disclosure, the system further includes an aging process component, wherein the aging process component is used to obtain the blocking and control duration of the target risk data stream, and in response to the blocking and control duration reaching a preset blocking and control reference duration, stops the blocking and control of the target risk data stream and restores the target risk data stream to the state before the blocking and control.

[0055] It should be noted that the blocking and control duration is pre-designed and can be changed according to actual design needs; no limitations are imposed here. By setting the blocking and control duration, the control time for the data flow can be controlled, avoiding prolonged control from affecting normal data transmission.

[0056] In the above embodiments, the information collection time-series data of the candidate risk data stream can also be obtained through... Figure 2 To further explain, the method includes:

[0057] S201, Obtain the reference duration for information collection of candidate risk data streams.

[0058] In this embodiment of the disclosure, the information collection reference duration is the maximum duration of seconds elapsed since the earliest SPID capture. If the information collection reference duration is exceeded and it is impossible to determine whether the candidate risk data stream is the target risk data stream, the current data judgment operation can be cancelled, the corresponding data can be deleted, and the data stream can be monitored again.

[0059] In this embodiment of the disclosure, a third collection time of the candidate risk data stream in real time can be obtained, and in response to the third collection time reaching the information collection reference duration based on the third collection time between the first collection time, a new information collection process is initiated for the candidate risk data stream.

[0060] S202, Obtain the first collection time of the candidate risk data stream, wherein the first collection time is the time when the candidate risk data stream is first detected by the data stream information collection component when it passes through the BRAS for the first time.

[0061] It should be noted that the first collection time is the time when the data stream is first detected and determined to be a candidate risk data stream. For example, such as... Figure 3 As shown, the receiving ports corresponding to the first acquisition time are all in the port closed state.

[0062] S203, starting from the first collection time, acquire multiple second collection times when the candidate risk data stream passes through the BRAS within the information collection reference time.

[0063] S204, based on the order from earliest to latest, sort the first collection time and multiple second collection times to obtain the information collection schedule of the candidate risk data stream.

[0064] It should be noted that, as Figure 3 As shown, the information collection schedule may include a variety of information, without any limitation here. For example, the information collection schedule may include the Service Profile Identifier (SPID), the active connection status of the port, the first collection time, and multiple second collection times.

[0065] In this embodiment, the information collection reference duration for the candidate risk data stream is first obtained. Then, the first collection time of the candidate risk data stream is obtained, where the first collection time is the time when the candidate risk data stream is first detected by the data stream information collection component 110 when it passes through the BRAS. Then, starting from the first collection time, multiple second collection times are obtained when the candidate risk data stream passes through the BRAS within the information collection reference duration. Finally, the first collection time and multiple second collection times are sorted in ascending order to obtain the information collection schedule for the candidate risk data stream. Therefore, by setting an information collection reference duration and collecting data within that duration, continuous monitoring of the same data stream can be avoided, preventing disruption to normal data stream transmission, and reducing the amount of data processing.

[0066] In the above embodiments, the information collection time interval data of the candidate risk data stream can also be obtained through... Figure 4 To further explain, the method includes:

[0067] S401, acquire multiple second acquisition times, each based on the first acquisition time, with a first acquisition time interval.

[0068] In this embodiment of the disclosure, the first acquisition time interval can be obtained by subtracting the second acquisition time from the first acquisition time.

[0069] S402, according to the information collection schedule, sort the first collection time intervals to obtain the information collection time interval data of the candidate risk data stream.

[0070] It should be noted that the data can be sorted in descending or ascending order of the first data collection time interval to obtain the information collection time interval data of the candidate risk data stream; no specific restriction is imposed here. This sorting order facilitates subsequent data comparison and analysis, while reducing the difficulty of data processing.

[0071] In this embodiment of the disclosure, the data stream information acquisition component 110 is further configured to: for any information acquisition time in the information acquisition schedule, obtain the first port status of the source port of the candidate risk data stream at the information acquisition time and the second port status of the target port at the information acquisition time from the socket status information of the candidate risk data stream, and obtain the data stream port status table of the candidate risk data stream based on the first port status and the second port status at each information acquisition time.

[0072] In this embodiment of the disclosure, the socket status information can be stored in the socket status information register. The first port status and the second port status can be obtained by calling the data in the socket status information register or by retrieving the socket status information register.

[0073] In this embodiment of the disclosure, the data analysis component 130 is further configured to: firstly extract abnormal state information of candidate risk data streams based on risk analysis results, and determine the candidate risk data stream as the target risk data stream in response to the matching of the abnormal state information with preset risk state information.

[0074] It should be noted that, based on the principles of P2P traffic distribution, before P2P data transmission and file sharing, the focus is on the new P2P node discovery process. Specifically, when users and servers establish connectivity through the fusion of five-tuple data, NAT traversal is required. The key focus is exploring the handling of Source Network Address Translation (SNAT) / Destination Network Address Translation (DNAT) in P2P hole-punching mechanisms under NAT4 type. Based on the new port prediction traversal principle, the correlation of port statistics can be predicted to calculate the incremental change between ports during each prediction.

[0075] Based on the PSP traffic distribution principle, the information collection schedule is analyzed. If the incremental value of the change in the information collection schedule meets the classification of P2P characteristic processes, then the data stream is considered to be a P2P business interaction data stream.

[0076] It should be noted that there can be multiple conditions for determining an anomaly, and no limitations are set here. For example, the information collection schedule may have periodic intervals between different ports.

[0077] It should be noted that the increment of change refers to the degree of change of a quantity over a period of time or a certain process. It is usually expressed as the difference between the current value and the value at the previous moment (or state).

[0078] Figure 5 This is a schematic diagram of a data stream blocking method according to one embodiment of the present disclosure, as shown below. Figure 5 As shown, the method includes:

[0079] S501, Acquisition Data Stream Blocking System.

[0080] It should be noted that the data flow blocking system in this embodiment is as follows: Figures 1-4 The data stream blocking system shown.

[0081] S502 obtains the socket status information of the data stream through the data stream blocking system, and obtains the port status of the receiving port of the data stream based on the socket status information.

[0082] S503, in response to the port status being closed, determines the data flow as a candidate risky data flow.

[0083] S504: Through the data flow blocking system, obtain the status information table of candidate risk data flows, perform risk analysis on the status information table, and obtain the risk analysis results.

[0084] S505, in response to the risk analysis results indicating that the candidate risk data stream is the target risk data stream, blocks and controls the target risk data stream.

[0085] It should be noted that the specific steps of S502-S505 can be referred to the content of the above embodiments, and will not be repeated here.

[0086] In this embodiment, a data flow blocking system is first acquired. Then, the socket status information of the data flow is obtained through the data flow blocking system. Based on the socket status information, the port status of the receiving port of the data flow is obtained. If the port status is closed, the data flow is determined to be a candidate risk data flow. Next, the status information table of the candidate risk data flow is obtained through the data flow blocking system, and risk analysis is performed on the status information table to obtain the risk analysis results. If the risk analysis results indicate that the candidate risk data flow is a target risk data flow, the target risk data flow is blocked and controlled. Therefore, by setting up a data flow blocking system on the BRAS, real-time automatic monitoring of the data flow can be achieved. When a data flow is determined to be a candidate risk data flow, a status information table is generated for in-depth analysis to determine whether the candidate risk data flow is the target risk data flow. This improves the accuracy of determining whether a data flow is P2P and enhances the accuracy of blocking P2P services, thereby improving traffic operation and management capabilities.

[0087] Corresponding to the data stream blocking methods provided in the above embodiments, one embodiment of this disclosure also provides a data stream blocking device. Since the data stream blocking device provided in this disclosure corresponds to the data stream blocking methods provided in the above embodiments, the implementation methods of the above data stream blocking methods are also applicable to the data stream blocking device provided in this disclosure, and will not be described in detail in the following embodiments.

[0088] Figure 6 Figure 6 is a schematic diagram of a data stream blocking device according to one embodiment of the present disclosure. As shown in Figure 6, the data stream blocking device 600 includes: an acquisition module 610, a positioning module 620, a determination module 630, an analysis module 640, and an implementation module 650.

[0089] The acquisition module is used to acquire the data stream blocking system, wherein the data stream blocking system is as follows: Figures 1-4 The data stream blocking system shown.

[0090] The positioning module is used to obtain the socket status information of the data stream through the data stream blocking system, and obtain the port status of the receiving port of the data stream based on the socket status information.

[0091] The determination module is used to determine whether a data stream is a candidate risky data stream in response to a port status that is in a port closed state.

[0092] The analysis module is used to obtain the status information table of candidate risk data streams through the data stream blocking system, perform risk analysis on the status information table, and obtain the risk analysis results.

[0093] The implementation module is used to block and control the target risk data stream in response to the risk analysis results indicating that the candidate risk data stream is the target risk data stream.

[0094] Therefore, by setting up a data flow blocking system on the BRAS, real-time automatic monitoring of data flows can be achieved. When a data flow is determined to be a candidate risk data flow, a status information table is generated for in-depth analysis to determine whether the candidate risk data flow is the target risk data flow. This can improve the accuracy of judging whether a data flow is P2P, and at the same time improve the accuracy of blocking P2P services, thereby enhancing traffic operation and management capabilities.

[0095] To implement the above embodiments, this disclosure also proposes an electronic device 700. Figure 7 This is a schematic diagram of an electronic device according to one embodiment of the present disclosure, such as... Figure 7 As shown, the electronic device 700 includes: a processor 701 and a memory 702 communicatively connected to the processor. The memory 702 stores instructions executable by at least one processor. The instructions are executed by at least one processor 701 to implement the functions described in this disclosure. Figure 5 Data stream blocking method in the embodiment.

[0096] To implement the above embodiments, this disclosure also proposes a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to implement the present disclosure. Figure 5 Data stream blocking method in the embodiment.

[0097] To implement the above embodiments, this disclosure also proposes a computer program product, including a computer program, which, when executed by a processor, implements the features of this disclosure. Figure 5 Data stream blocking method in the embodiment.

[0098] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0099] This application is intended to provide an implementation scheme for users to selectively prevent the use or access to their personal information data. Specifically, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information is de-identified to protect user privacy.

[0100] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0101] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0102] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0103] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that contains, stores, communicates, propagates, or transmits programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0104] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0105] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it includes one or a combination of the steps of the method embodiments.

[0106] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0107] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A data stream blocking system, characterized in that, The data stream blocking system is installed on the BRAS. The system includes a data stream information acquisition component, an acquisition timing component, a data analysis component, and a blocking component. The data stream information acquisition component is used to acquire the socket status information of the data stream, acquire the port status of the receiving port of the data stream based on the socket status information, and identify whether the data stream is a candidate risky data stream based on the port status. The acquisition timing component is used to acquire the status information table of the candidate risk data stream and transmit the status information table to the data analysis component, wherein the status information table includes the information acquisition time table and the data stream port status table of the candidate risk data stream; The data analysis component is used to perform risk analysis on the status information table and identify whether the candidate risk data stream is the target risk data stream based on the risk analysis results. The blocking component is used to block and control the target risk data stream in response to the data analysis component identifying the candidate risk data stream as the target risk data stream.

2. The system according to claim 1, characterized in that, The data stream information acquisition component is also used for: The data tuples of each data stream in the monitoring data stream set, wherein, for any data stream, the data tuples include at least the source address, destination address, source port, destination port and communication protocol of the data stream; For any data stream, the initial information collection time of the data stream passing through the BRAS is obtained, and the initial information collection time is associated with the data tuple to obtain the socket status information of the data stream.

3. The system according to claim 1, characterized in that, The data stream information acquisition component is also used for: In response to the socket status information indicating that the receiving port of the data stream is in a closed state, the data stream is determined to be the candidate risky data stream.

4. The system according to claim 1, characterized in that, The information acquisition timing component is also used for: Acquire the information collection time-series data of the candidate risk data stream; Obtain the information collection time interval data of the candidate risk data stream; Based on the information collection time sequence data and the information collection time interval data, the information collection time schedule of the candidate risk data stream is constructed.

5. The system according to claim 4, characterized in that, The acquisition of the candidate risk data stream information collection time-series data includes: Obtain the reference duration for information collection of the candidate risk data stream; The first collection time of the candidate risk data stream is obtained, wherein the first collection time is the time when the candidate risk data stream is first detected by the data stream information collection component when it passes through the BRAS for the first time; Starting from the first collection time, multiple second collection times are obtained when the candidate risk data stream passes through the BRAS within the information collection reference duration; Based on the order from earliest to latest, the first collection time and the plurality of second collection times are sorted to obtain the information collection schedule of the candidate risk data stream.

6. The system according to claim 5, characterized in that, The information collection time interval data for acquiring the candidate risk data stream includes: Each of the plurality of second acquisition times is obtained based on a first acquisition time interval of the first acquisition time; According to the information collection schedule, each first collection time interval is sorted to obtain the information collection time interval data of the candidate risk data stream.

7. The system according to claim 6, characterized in that, The data stream information acquisition component is also used for: For any information collection time in the information collection schedule, obtain the first port status of the source port and the second port status of the target port of the candidate risk data stream at the information collection time from the socket status information of the candidate risk data stream. Based on the first port status and the second port status at each information collection time, the data stream port status table of the candidate risk data stream is obtained.

8. The system according to claim 7, characterized in that, The data stream information acquisition component is also used for: The third acquisition time of the candidate risk data stream in real time is obtained; In response to the third acquisition time reaching the information acquisition reference duration based on the third acquisition time between the first acquisition time, a new information acquisition process is initiated for the candidate risk data stream.

9. The system according to claim 1, characterized in that, The data analysis component is also used for: Based on the risk analysis results, extract the abnormal state information of the candidate risk data stream; In response to the abnormal state information matching the preset risk state information, the candidate risk data stream is determined as the target risk data stream.

10. The system according to claim 1, characterized in that, The system also includes an aging process component for: Obtain the duration of blocking and control of the target risk data stream; In response to the blocking control duration reaching a preset blocking control reference duration, the blocking control of the target risk data stream is stopped, and the target risk data stream is restored to its state before the blocking control.

11. The system according to any one of claims 1-10, characterized in that, The target risk data stream is a P2P business interaction data stream.

12. A data stream blocking method, characterized in that, The method includes: A data stream blocking system is acquired, wherein the data stream blocking system is based on the data stream blocking system according to any one of claims 1-11; The data stream blocking system obtains the socket status information of the data stream and obtains the port status of the receiving port of the data stream based on the socket status information. In response to the port status being closed, the data stream is determined to be a candidate risky data stream; The data stream blocking system obtains the status information table of the candidate risk data streams, performs risk analysis on the status information table, and obtains the risk analysis results. In response to the risk analysis results indicating that the candidate risk data stream is the target risk data stream, the target risk data stream is blocked and controlled.

13. A data stream blocking device, characterized in that, The device includes: An acquisition module is used to acquire a data stream blocking system, wherein the data stream blocking system is based on the data stream blocking system according to any one of claims 1-11; The positioning module is used to obtain the socket status information of the data stream through the data stream blocking system, and to obtain the port status of the receiving port of the data stream based on the socket status information. The determination module is used to determine the data stream as a candidate risky data stream in response to the port status being a port closed state; The analysis module is used to obtain the status information table of the candidate risk data stream through the data stream blocking system, perform risk analysis on the status information table, and obtain the risk analysis results of the risk analysis. The implementation module is used to block and control the target risk data stream in response to the risk analysis result indicating that the candidate risk data stream is the target risk data stream.

14. An electronic device, characterized in that, Including memory and processor; The processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the method as described in claim 12.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in claim 12.

Images