A method, device, equipment and medium for blocking network equipment

Abstract

The present invention discloses a method, device, equipment and medium for blocking network equipment. The method comprises: determining the target physical address of the terminal to be blocked according to the address resolution protocol table and interface table of each network equipment in the enterprise network and the IP address of the terminal to be blocked; determining the number of physical addresses learned by each network equipment according to the media access control table of each network equipment, and determining the target network equipment connected to the terminal to be blocked according to the number of physical addresses learned by each network equipment; the port corresponding to the target physical address in the target network equipment is the target port; remotely log in to the target network equipment and block the target port on the target network equipment. The embodiment of the present invention realizes the rapid positioning of network resources and improves the efficiency of network operation and maintenance execution.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, device, equipment and medium for blocking network equipment. Background Art

[0002] With the gradual popularization of network security, in network attack and defense scenarios, security working groups, security incident response teams, and threat intelligence monitoring platforms or tools provide network administrators with malicious attack information about intranet branches, requiring network departments to promptly, quickly, and accurately disconnect and isolate terminals. Manually logging into the device and searching for and blocking the access ports corresponding to malicious IPs step by step is a complicated operation with the risk of human error. Summary of the invention

[0003] The present invention provides a method, device, equipment and medium for blocking a network device, so as to solve the problem that the existing method for determining the access port corresponding to a malicious IP and blocking it has complicated operation steps and the risk of human operation error.

[0004] According to one aspect of the present invention, a method for blocking a network device is provided, comprising:

[0005] Determine the target physical address of the terminal to be blocked according to the address resolution protocol table and interface table of each network device in the enterprise network and the IP address of the terminal to be blocked;

[0006] Determine the number of physical addresses learned by each network device according to the media access control table of each network device, and determine the target network device connected to the terminal to be blocked according to the number of physical addresses learned by each network device;

[0007] The port corresponding to the target physical address in the target network device is the target port;

[0008] Remotely log in to the target network device and block the target port on the target network device.

[0009] According to another aspect of the present invention, there is provided a blocking device for a network device, comprising:

[0010] A target physical address determination module is used to determine the target physical address of the terminal to be blocked according to the address resolution protocol table and interface table of each network device in the enterprise network and the IP address of the terminal to be blocked;

[0011] A target network device determination module is used to determine the number of physical addresses learned by each network device according to the media access control table of each network device, and determine the target network device connected to the terminal to be blocked according to the number of physical addresses learned by each network device; the port corresponding to the target physical address in the target network device is the target port;

[0012] The network device blocking module is used to remotely log in to the target network device and block the target port on the target network device.

[0013] According to another aspect of the present invention, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the method for blocking a network device according to any embodiment of the present invention is implemented.

[0014] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the blocking method for a network device described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for blocking a network device described in any embodiment of the present invention when executed.

[0019] The embodiment of the present invention does not need to determine the topology of the network. By analyzing the media access control table, address resolution protocol table and interface table of each network device, the network device port can be directly locked based on the terminal IP address information to achieve rapid positioning of network resources, and use remote login connection to automatically perform port operations on network devices, thereby achieving rapid isolation and disposal of terminal problems and improving the efficiency of network operation and maintenance.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 is a first flow chart of a method for blocking a network device provided by an embodiment of the present invention;

[0023] Figure 2 is a second flow chart of the method for blocking a network device provided by an embodiment of the present invention;

[0024] Figure 3 It is a structural schematic diagram of a blocking device for a network device provided by an embodiment of the present invention;

[0025] Figure 4 It is a schematic diagram of the structure of an electronic device implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Figure 1This is the first flow chart of a method for blocking a network device provided by an embodiment of the present invention. This embodiment can be applied to the case where a target network device and a target port to be blocked for terminal access are determined, and the target port on the target network device is blocked. This method can be executed by a blocking device of the network device, which can be implemented in the form of hardware and / or software, and can be configured in an electronic device with corresponding data processing capabilities. Figure 1 As shown, the method includes:

[0029] S110: Determine the target physical address of the terminal to be blocked according to the address resolution protocol table and interface table of each network device in the enterprise network and the IP address of the terminal to be blocked.

[0030] Specifically, obtain the IP address of the terminal that launches malicious attacks in the enterprise intranet from the security working group, security incident response team, threat intelligence monitoring platform or tools, etc. Obtain the media access control table (MAC table), address resolution protocol table (ARP table) and interface table (Interface table) of each network device in the enterprise network, such as gateways, switches, routers, etc., as well as the neighbor discovery information and interface description information of the device interface.

[0031] The address resolution protocol table is queried, and the physical address (Media Access Control Address, MAC address) corresponding to the IP address of the terminal to be blocked is obtained in combination with the interface information in the interface table as the target physical address.

[0032] In an optional embodiment, the method further comprises:

[0033] Obtain the IP network segment organization label data and asset grouping data of the IP to be blocked, and determine the subnet to which the IP to be blocked belongs; obtain the media access control table, address resolution protocol table and interface table of each network device in the subnet to which the IP to be blocked belongs.

[0034] Optionally, use the IPAM (IP Address Management) system to obtain the IP network segment organization label data of the IP to be blocked; determine the asset group to which the IP to be blocked belongs through the asset grouping data in the enterprise database, and then determine the subsidiary to which the IP to be blocked belongs. By further determining the subnet in the enterprise network where the IP to be blocked is located, the network scope is narrowed, the number of network devices to be analyzed is reduced, and the efficiency of network resource positioning is improved.

[0035] S120: Determine the number of physical addresses learned by each network device according to the media access control table of each network device, and determine the target network device connected to the terminal to be blocked according to the number of physical addresses learned by each network device.

[0036] Optionally, the network device that has learned the target physical address is used as a candidate network device; according to the media access control table of each candidate network device, the candidate network device that is in the same local area network as the terminal to be blocked and has the smallest network range with the terminal to be blocked is selected as the target network device. For example, the candidate network device that is directly connected to the terminal to be blocked, or is logically closest to the terminal to be blocked, so that the network data packet of the terminal to be blocked first passes through during the transmission process, is the network device to perform the blocking operation, that is, the target network device.

[0037] S130: Remotely log in to the target network device and block the target port on the target network device.

[0038] The target port is the port corresponding to the target physical address in the target network device;

[0039] Specifically, the port blocking operation of the target network device is automatically performed through the remote login connection program, thereby preventing the terminal from continuing to maliciously access the network. After confirming that the affected terminal has completely cleared the malware, virus or unauthorized program, the port unblocking operation of the target network device can also be automatically performed through the remote login connection program. After the target port of the target network device is blocked or unblocked, a change notification can be issued so that the network administrator can grasp the status of the network device in a timely manner.

[0040] By analyzing the media access control table, address resolution protocol table and interface table of each network device, the access network device and its port can be directly locked based on the terminal's IP address information without analyzing the network topology, thereby achieving rapid positioning of network resources.

[0041] In an optional implementation, it also includes: obtaining management attributes of the terminal to be blocked in the database, the management attributes including account information and address information associated with the terminal to be blocked; establishing an association relationship between the IP address of the terminal to be blocked and the management attributes, and displaying the association relationship.

[0042] Specifically, the management attributes include the account information and address information associated with the terminal to be blocked, such as the user name, password, asset management group, workstation information, employee name, contact information, position, etc. of the terminal to be blocked. Establish an association between the IP address and management attributes of the terminal to be blocked, and display the association. This allows network administrators to fully understand the detailed information of the terminal to be blocked, clarify the user of the terminal to be blocked, the department to which the user belongs, and the workstation, etc., which helps to quickly locate the source of the problem and provide strong support for subsequent investigations, processing, and preventive measures.

[0043] The embodiment of the present invention does not need to analyze the topological structure of the network. By analyzing the media access control table, address resolution protocol table and interface table of each network device, the network device port can be directly locked based on the terminal IP address information to achieve rapid positioning of network resources, and use the remote login connection program to automatically perform port operations on the network device, thereby achieving rapid isolation and disposal of terminal problems and improving the efficiency of network operation and maintenance.

[0044] Figure 2 This is a second flow chart of the method for blocking a network device provided by an embodiment of the present invention. This embodiment is optimized and improved on the basis of the above embodiment. Figure 2 As shown, the method includes:

[0045] S210: Determine the target physical address of the terminal to be blocked according to the address resolution protocol table and interface table of each network device in the enterprise network and the IP address of the terminal to be blocked.

[0046] S220: Determine each network device that includes the target physical address in the media access control table of each network device as a candidate network device.

[0047] Find the network devices that exchange data with the terminal to be blocked. Specifically, analyze the media access control table of each network device, and use each network device that includes the target physical address in the media access control table as a candidate network device. The number of candidate network devices is greater than or equal to 1.

[0048] S230: Count the number of physical addresses included in the media access control table of each candidate network device, and use the candidate network device with the least number of learned physical addresses as the target network device.

[0049] Specifically, the number of physical addresses learned by the candidate network device is counted according to the media access control table of the candidate network device. If the number of physical addresses learned by the candidate network device is 1, the candidate network device is used as the target network device, and the counting of the number of physical addresses learned by other candidate network devices is stopped; if the number of physical addresses learned by each candidate network device is greater than 1, the candidate network device with the least number of learned physical addresses is used as the target network device.

[0050] S240: Remotely log in to the target network device and block the target port on the target network device.

[0051] By analyzing the media access control table, address resolution protocol table and interface table of each network device, the network device that is in the same local area network as the terminal to be blocked and has the smallest network range with the terminal to be blocked can be determined based on the number of physical addresses learned by the network device, without analyzing the network topology, thereby achieving rapid positioning of network resources.

[0052] In an optional implementation, it also includes: if the target network device is determined to be a non-terminal type based on the number of physical addresses included in the media access control table of the target network device, a risk warning is issued when the target port on the target network device is blocked.

[0053] If the number of physical addresses learned by the target network device is 1, the type of the target network device is terminal type. If the number of physical addresses learned by the target network device is greater than 1, the type of the target network device is non-terminal type.

[0054] Optionally, the type of the target network device is judged based on the number of MAC address learning and information such as interface name, description, and neighbor to determine whether the target network device is a terminal type or a non-terminal type.

[0055] For example, the following prompt can be given to the network administrator: "Port E001 on network device A001 is a non-terminal type. Blocking it will affect multiple VLANs. Do you want to continue blocking it?" By providing blocking prompts for non-terminal network devices, it is easier for network administrators to understand the status of network devices to be blocked, which is beneficial for network administrators to evaluate the blocking risks of network devices and make disposal decisions for malicious terminals.

[0056] The embodiment of the present invention does not need to analyze the topological structure of the network. By analyzing the media access control table, address resolution protocol table and interface table of each network device, the network device port can be directly locked based on the terminal IP address information to achieve rapid positioning of network resources, and use the remote login connection program to automatically perform port operations on the network device, thereby achieving rapid isolation and disposal of terminal problems and improving the efficiency of network operation and maintenance.

[0057] Figure 3 Schematic diagram of the structure of the blocking device of the network device provided by the embodiment of the present invention. Figure 3 As shown, the device comprises:

[0058] The target physical address determination module 310 is used to determine the target physical address of the terminal to be blocked according to the address resolution protocol table and interface table of each network device in the enterprise network and the IP address of the terminal to be blocked;

[0059] The target network device determination module 320 is used to determine the number of physical addresses learned by each network device according to the media access control table of each network device, and determine the target network device connected to the terminal to be blocked according to the number of physical addresses learned by each network device; the port corresponding to the target physical address in the target network device is the target port;

[0060] The network device blocking module 330 is used to remotely log in to the target network device and block the target port on the target network device.

[0061] The blocking device for a network device provided in an embodiment of the present invention can execute the blocking method for a network device provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0062] Optionally, the target network device determination module includes:

[0063] A candidate network device determining unit, used to determine each network device including the target physical address in the media access control table of each network device as a candidate network device;

[0064] The target network device determination unit is used to count the number of physical addresses included in the media access control table of each candidate network device, and use the candidate network device with the least number of learned physical addresses as the target network device.

[0065] Optionally, the network device blocking module is also used for: if it is determined that the target network device is a non-terminal type based on the number of physical addresses included in the media access control table of the target network device, then the target port on the target network device is blocked and a risk warning is issued.

[0066] Optionally, the device further comprises:

[0067] The terminal information display module is used to obtain the management attributes of the terminal to be banned in the database, the management attributes including the account information and address information associated with the terminal to be banned; establish an association relationship between the IP address of the terminal to be banned and the management attributes, and display the association relationship.

[0068] Optionally, the device further comprises:

[0069] The subnet determination module is used to obtain the IP network segment organization label data and asset grouping data of the IP to be blocked, determine the subnet to which the IP to be blocked belongs; and obtain the media access control table, address resolution protocol table and interface table of each network device in the subnet to which the IP to be blocked belongs.

[0070] The blocking device of the network device further described can also execute the blocking method of the network device provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0071] Figure 4 A schematic diagram of an electronic device 40 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0072] like Figure 4 As shown, the electronic device 40 includes at least one processor 41, and a memory connected to the at least one processor 41, such as a read-only memory (ROM) 42, a random access memory (RAM) 43, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 41 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 42 or the computer program loaded from the storage unit 48 to the random access memory (RAM) 43. In the RAM 43, various programs and data required for the operation of the electronic device 40 can also be stored. The processor 41, the ROM 42, and the RAM 43 are connected to each other through a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0073] A number of components in the electronic device 40 are connected to the I / O interface 45, including: an input unit 46, such as a keyboard, a mouse, etc.; an output unit 47, such as various types of displays, speakers, etc.; a storage unit 48, such as a disk, an optical disk, etc.; and a communication unit 49, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 49 allows the electronic device 40 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0074] The processor 41 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 41 executes the various methods and processes described above, such as a blocking method for a network device.

[0075] In some embodiments, the blocking method of the network device may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 40 via the ROM 42 and / or the communication unit 49. When the computer program is loaded into the RAM 43 and executed by the processor 41, one or more steps of the blocking method of the network device described above may be performed. Alternatively, in other embodiments, the processor 41 may be configured to execute the blocking method of the network device in any other appropriate manner (e.g., by means of firmware).

[0076] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0077] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0078] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0079] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0080] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0081] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0082] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0083] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for blocking a network device, characterized in that: The method comprises: Determine the target physical address of the terminal to be blocked according to the address resolution protocol table and interface table of each network device in the enterprise network and the IP address of the terminal to be blocked; Determine the number of physical addresses learned by each network device according to the media access control table of each network device, and determine the target network device connected to the terminal to be blocked according to the number of physical addresses learned by each network device; The port corresponding to the target physical address in the target network device is the target port; Remotely log in to the target network device and block the target port on the target network device; The step of determining the number of physical addresses learned by each network device according to the media access control table of each network device, and determining the target network device connected to the terminal to be blocked according to the number of physical addresses learned by each network device, includes: Determine each network device including the target physical address in the media access control table of each network device as a candidate network device; According to the media access control table of the candidate network device, the number of physical addresses learned by the candidate network device is counted; if the number of physical addresses learned by the candidate network device is 1, the candidate network device is used as the target network device, and the number of physical addresses learned by other candidate network devices is stopped; if the number of physical addresses learned by each candidate network device is greater than 1, the candidate network device with the least number of physical addresses learned is used as the target network device; If the number of physical addresses learned by the target network device is 1, the type of the target network device is a terminal type; if the number of physical addresses learned by the target network device is greater than 1, the type of the target network device is a non-terminal type; Wherein, blocking the target port on the target network device includes: If it is determined that the target network device is a non-terminal type according to the number of physical addresses included in the media access control table of the target network device, a risk warning is issued when the target port on the target network device is blocked.

2. The method according to claim 1, characterized in that The method further comprises: Acquire management attributes of the terminal to be blocked in the database, wherein the management attributes include account information and address information associated with the terminal to be blocked; An association relationship between the IP address of the terminal to be blocked and the management attribute is established, and the association relationship is displayed.

3. The method according to claim 1, characterized in that The method further comprises: Obtain the IP network segment organization label data and asset grouping data of the IP to be blocked, and determine the subnet to which the IP to be blocked belongs; Obtain the media access control table, address resolution protocol table, and interface table of each network device in the subnet to which the IP to be blocked belongs.

4. A blocking device for a network device, characterized in that: The device comprises: A target physical address determination module is used to determine the target physical address of the terminal to be blocked according to the address resolution protocol table and interface table of each network device in the enterprise network and the IP address of the terminal to be blocked; A target network device determination module is used to determine the number of physical addresses learned by each network device according to the media access control table of each network device, and determine the target network device connected to the terminal to be blocked according to the number of physical addresses learned by each network device; the port corresponding to the target physical address in the target network device is the target port; A network device blocking module, used to remotely log in to the target network device and block the target port on the target network device; Wherein, the target network device determination module includes: A candidate network device determining unit, used to determine each network device including the target physical address in the media access control table of each network device as a candidate network device; a target network device determination unit, configured to count the number of physical addresses learned by the candidate network device according to the media access control table of the candidate network device; if the number of physical addresses learned by the candidate network device is 1, the candidate network device is used as the target network device, and the counting of the number of physical addresses learned by other candidate network devices is stopped; if the number of physical addresses learned by each candidate network device is greater than 1, the candidate network device with the least number of physical addresses learned is used as the target network device; It also includes a type judgment module, which is used to determine that if the number of physical addresses learned by the target network device is 1, the type of the target network device is a terminal type; if the number of physical addresses learned by the target network device is greater than 1, the type of the target network device is a non-terminal type; Wherein, the network device blocking module is also used for: If the target network device is determined to be a non-terminal type according to the number of physical addresses included in the media access control table of the target network device, the target port on the target network device is blocked and a risk warning is issued.

5. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the blocking method for a network device according to any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for blocking a network device according to any one of claims 1 to 3 when executed.

Images