Network address translation behavior detection method and device

Abstract

The invention provides a network address translation behavior detection method and device, and relates to the technical field of network security. The network address translation behavior detection method comprises: according to a first response message, determining a dynamic fingerprint of a terminal device, the first response message being obtained by the terminal device responding to a first detection message; the reference dynamic fingerprint is matched with the dynamic fingerprint of the terminal equipment to obtain a first detection result, the reference dynamic fingerprint is the dynamic fingerprint of the reference terminal equipment which is legally accessed, and the first detection result represents whether a network address translation behavior exists or not. According to the invention, whether the network address translation behavior occurs can be accurately and efficiently detected.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network security technology, and in particular to a method and device for detecting network address translation behavior. Background Art

[0002] With the rapid development of Internet technology, network security issues are becoming increasingly serious. A typical security issue is that attackers privately access terminals through network address translation devices (Network Address Translation, abbreviated as NAT) to achieve purposes such as network attacks, data theft, or billing evasion.

[0003] Existing technologies, such as determining information that can reflect whether network address translation occurs based on data such as messages sent by terminal devices, and using this as a reference for determining whether network translation occurs, have defects such as low detection accuracy. This makes how to accurately and efficiently perform network address translation a technical problem that needs to be solved urgently. Summary of the invention

[0004] The present application provides a method and device for detecting network address translation behavior.

[0005] In a first aspect, the present application relates to a method for detecting network address translation behavior, comprising: determining a dynamic fingerprint of a terminal device based on a first response message, wherein the first response message is obtained by the terminal device in response to a first detection message; matching the dynamic fingerprint of the terminal device with a benchmark dynamic fingerprint to obtain a first detection result, wherein the benchmark dynamic fingerprint is a dynamic fingerprint of a benchmark terminal device with legal access, and the first detection result characterizes whether there is network address translation behavior.

[0006] A fingerprint can be understood as information that can uniquely identify a terminal device, and a dynamic fingerprint can be understood as a dynamic characteristic of a terminal device that can uniquely identify the terminal device. The dynamic characteristic includes a response characteristic of the terminal device, and the response characteristic of the terminal device can be reflected through the first response message.

[0007] According to the network address translation behavior detection method of the present application, the dynamic fingerprint of the terminal device can be determined based on the first response message. The dynamic fingerprint of the terminal device can uniquely identify the terminal device from the dimension of the dynamic fingerprint, that is, the dynamic fingerprint is more unique and representative. Subsequently, the terminal device and the benchmark terminal device can be accurately matched based on the dynamic fingerprint. Since the benchmark terminal device is legally connected, the dynamic fingerprint of the terminal device is matched according to the benchmark dynamic fingerprint. The first detection result obtained can characterize whether the terminal device is legally connected, thereby characterizing whether there is a network address translation behavior. The network address translation behavior detection accuracy of the present application is higher.

[0008] In addition, since the first response message is obtained by the terminal device in response to the first detection message, the first detection message can be sent to the terminal device at any time, so that the first response message can be obtained at any time accordingly and the first detection result can be obtained based on the first response message. It will not be limited by the irregular sending of messages by the terminal device, so NAT detection is more timely.

[0009] In summary, the NAT detection of the network address translation behavior detection method of the present application has higher efficiency.

[0010] In a possible embodiment, the network address translation behavior detection method of the present application further includes: performing traffic behavior detection on a message from a terminal device to obtain a second detection result, wherein the second detection result indicates whether a network address translation behavior exists.

[0011] Exemplarily, for example, traffic statistics may be performed on messages from a terminal device to implement a specific example of traffic behavior detection, and a second detection result may be obtained.

[0012] According to the network address translation behavior detection method of the present application, by performing flow behavior detection on the message from the terminal device, it can be detected from the flow behavior dimension whether there is network address translation behavior.

[0013] In addition, traffic behavior detection of messages from terminal devices does not involve, for example, sending a probe message to the terminal device to make the terminal device respond. Therefore, traffic behavior detection is imperceptible to the terminal device, and NAT detection has better performance.

[0014] In a possible embodiment, the network address translation behavior detection method of the present application also includes: determining a static fingerprint of a terminal device based on a message parsing result, wherein the message parsing result is obtained by parsing a message from the terminal device; determining a terminal device detection result based on matching the static fingerprint of the terminal device with the static fingerprint of a reference device, wherein the terminal device detection result characterizes the device quantity and / or device attributes of the target terminal device where the network address translation behavior occurs.

[0015] The message includes a message header and a message body. The message header includes some device information. The message parsing result obtained by parsing the message can reflect some information of the terminal device. Therefore, the static fingerprint of the terminal device can be determined by the message parsing result.

[0016] A static fingerprint can be understood as a static characteristic of a terminal device that can uniquely identify the terminal device. For example, a "static fingerprint" and a "dynamic fingerprint" can be distinguished by whether the terminal device needs to be "sensitive".

[0017] By parsing the message, for example, multiple message fields can be obtained. The message parsing result can be in the form of a full amount of message fields obtained by parsing. For example, the static fingerprint of the terminal device can also be determined based on more identifiable message features (the message features here can also be understood as message fields) in the message parsing result.

[0018] A reference device may be understood to be a predetermined electronic device used for comparison.

[0019] According to the network address translation behavior detection method of the present application, the static fingerprint of the terminal device determined based on the message parsing result can uniquely identify the terminal device from the dimension of the static fingerprint, that is, the static fingerprint is more unique and representative, and the terminal device can be accurately identified based on the static fingerprint in the future. By matching the static fingerprint of the terminal device with the static fingerprint of the reference device, the terminal device detection result determined represents the number of devices and / or device attributes of the target terminal device that has undergone network address translation behavior, which is a more refined detection result and can realize the visualization of the terminal devices connected to the network address translation device. The "visualization" here is reflected in, for example, that the number of devices and / or device attributes of the target terminal devices connected to the network address translation device can be known, which is convenient for subsequent network security control, etc.

[0020] In addition, according to the message parsing results, the static fingerprint of the terminal device is determined, and the operation of determining the terminal device detection result based on the static fingerprint is also imperceptible to the terminal device, so the performance of NAT detection and terminal identification is better.

[0021] In a possible embodiment, the network address translation behavior detection method of the present application also includes: determining the static fingerprint of the terminal device based on the message parsing result, wherein the message parsing result is obtained by parsing the message from the terminal device; matching the static fingerprint of the terminal device with the benchmark static fingerprint to obtain a third detection result, wherein the benchmark static fingerprint is the static fingerprint of a benchmark terminal device with legal access, and the third detection result characterizes whether there is network address translation behavior.

[0022] According to the network address translation behavior detection method of the present application, the static fingerprint of the terminal device determined according to the message parsing result can uniquely identify the terminal device from the dimension of the static fingerprint, that is, the static fingerprint is more unique and representative, and the terminal device and the reference terminal device can be accurately matched based on the static fingerprint to detect the network address translation behavior. Since the reference terminal device is legally connected, the third detection result obtained by matching the static fingerprint of the terminal device with the reference static fingerprint can characterize whether the terminal device is legally connected, and thus can characterize whether there is a network address translation behavior. The network address translation behavior detection accuracy of the present application is higher.

[0023] In a possible embodiment, the network address translation behavior detection method of the present application further includes: determining a target detection result based on the second detection result and / or the third detection result and the first detection result, wherein the target detection result characterizes whether a network address translation behavior exists.

[0024] Determining the target detection result according to the second detection result and / or the third detection result and the first detection result includes the following situations:

[0025] (1) Determine a target detection result based on the second detection result and the first detection result.

[0026] Exemplarily, for example, when the second detection result indicates the existence of network address translation behavior, an operation of determining the dynamic fingerprint of the terminal device based on the first response message and matching the benchmark dynamic fingerprint with the dynamic fingerprint of the terminal device to obtain the first detection result is performed. For example, the first detection result can be determined as the target detection result.

[0027] Since NAT detection based on traffic behavior is not sensitive to terminal devices and does not require parsing of messages from terminal devices, the performance of NAT detection is better. Since dynamic fingerprints are more identifiable and unique, the accuracy of NAT detection based on dynamic fingerprints is higher. When the target detection result is determined based on the second detection result and the first detection result, the accuracy and performance of NAT detection are better, and the efficiency of NAT detection is higher.

[0028] (2) Determine the target detection result according to the third detection result and the first detection result.

[0029] (3) Determine the target detection result based on the first detection result, the second detection result, and the third detection result.

[0030] The first detection result, the second detection result and the third detection result are detection results characterizing whether there is network address translation behavior obtained from three dimensions, namely, dynamic fingerprint, traffic behavior and static fingerprint, respectively. Each detection result is obtained by a single NAT detection method. According to the network address translation behavior detection method of the present application, multiple single NAT detection results can be combined to obtain a more accurate target detection result.

[0031] In a possible embodiment, the network address translation behavior detection method of the present application further includes: in the case where the network address translation behavior exists, determining the target terminal device where the network address translation behavior occurs as an abnormally accessed terminal device.

[0032] The implementation method of privately accessing terminal devices for some purposes is usually to convert the network address, which poses a network security risk, so it is necessary to detect whether there is network address behavior. According to the network address conversion behavior detection method of the present application, by determining the target terminal device that has undergone network address conversion behavior as an abnormally accessed terminal device when there is a network address conversion behavior, this scenario can be dealt with, and the abnormally accessed terminal device in this scenario can be detected.

[0033] In a possible embodiment, the network address translation behavior detection method of the present application also includes: in the case where there is a network address translation behavior and the number of target terminal devices that have undergone the network address translation behavior is greater than or equal to a terminal quantity threshold, the target terminal device is determined as an abnormally accessed terminal device. In some scenarios, the existence of network address translation behavior is normal and legal, so even if the existence of network address translation behavior is detected, it does not represent the existence of network security risks. Instead, it is necessary to understand the information of the terminal device after the NAT device to determine whether there are network security risks. According to the network address translation behavior detection method of the present application, in the case where the target detection result represents the existence of a network address translation behavior and the number of target terminal devices that have undergone the network address translation behavior is greater than or equal to a terminal quantity threshold, determining the target terminal device as an abnormally accessed terminal device can cope with this scenario.

[0034] In a possible embodiment, the network address translation behavior detection method of the present application also includes: determining a benchmark dynamic fingerprint based on a second response message, wherein the benchmark terminal device is an authenticated terminal device that accesses for the first time, and the second response message is obtained by the benchmark terminal device in response to the second detection message.

[0035] In order to disguise the terminal devices that have accessed illegally, the terminal devices that have accessed illegally usually access the network after the legal terminal devices. Therefore, the probability that the terminal devices that have accessed for the first time and have been authenticated are legal terminal devices is higher. The network address translation behavior detection method of the present application can determine the accurate benchmark terminal device and the benchmark terminal dynamic fingerprint and benchmark static fingerprint based on the information of the terminal device that has accessed for the first time. The benchmark dynamic fingerprint serves as the basis for subsequent matching with the dynamic fingerprint of the terminal device, and can also accurately determine the first detection result accordingly. The benchmark static fingerprint serves as the basis for subsequent matching with the static fingerprint of the terminal device, and can also accurately determine the third detection result accordingly.

[0036] In a possible embodiment, performing traffic behavior detection on a message from a terminal device to obtain a second detection result includes: performing traffic behavior detection on a message from a terminal device using a machine learning model to obtain a second detection result.

[0037] Machine learning can be understood as a method in which a computer uses existing data to determine a model for performing a specific task and uses this model to predict the results of the task.

[0038] The machine learning model can process more data and improve data processing efficiency, and the trained machine learning model also meets the standards in terms of detection accuracy and performance. Therefore, according to the network address translation behavior detection method of the present application, by using the machine learning model to perform traffic behavior detection on the message from the terminal device, an accurate second detection result can be obtained efficiently.

[0039] In a possible embodiment, the machine learning model includes at least one of a pre-trained first machine learning model and an online trained second machine learning model; when the machine learning model includes the first machine learning model and the machine learning model, using the machine learning model to perform traffic behavior detection on the message from the terminal device to obtain a second detection result includes: using the first machine learning model to perform traffic behavior detection on the message from the terminal device to obtain the first machine learning model detection result; using the second machine learning model to perform traffic behavior detection on the message from the terminal device to obtain the second machine learning model detection result; determining the second detection result based on the first machine learning model detection result and the second machine learning model detection result.

[0040] The first machine learning model obtained by pre-training has already been trained and can be used directly, without requiring computing power resources for machine learning model training.

[0041] In some cases, the training samples used in the model training phase are significantly different from the input data of the actual application scenario, which causes the model that performs well in the training phase to have a sharp drop in performance in the application phase. The second machine learning model can cope with this situation through online training and improve the accuracy of traffic behavior detection.

[0042] According to the network address translation behavior detection method of the present application, by utilizing the first machine learning model and the second machine learning model to perform traffic behavior detection on the message, the respective advantages of the online training and pre-trained models can be utilized to obtain the detection results according to the first machine learning model and the detection results according to the second machine learning model, respectively, and the second detection result can be comprehensively and accurately determined based on the detection results of the first machine learning model and the detection results of the second machine learning model.

[0043] In a possible embodiment, the network address translation behavior detection method of the present application also includes: collecting traffic behavior samples, wherein the traffic behavior samples are used to train a second machine learning model.

[0044] According to the network address translation behavior detection method of the present application, a second machine learning model that adapts to the input data in the online scenario can be trained through the traffic behavior samples collected online, thereby improving the accuracy of traffic behavior detection.

[0045] In a possible embodiment, the network address translation behavior detection method of the present application also includes: training an initial second machine learning model based on traffic behavior samples to obtain a second machine learning model.

[0046] According to the network address translation behavior detection method of the present application, the three can be integrated: traffic behavior sample collection, model training using traffic behavior samples, and traffic behavior detection based on the second machine learning model obtained through training. This method is more suitable for online scenarios and can improve the accuracy of traffic behavior detection.

[0047] In a possible embodiment, performing traffic behavior detection on messages from a terminal device to obtain a second detection result includes: performing statistics on messages from the terminal device to obtain traffic behavior detection results of the messages; and determining the second detection result based on the traffic behavior detection results and a traffic behavior benchmark detection result, wherein the traffic behavior benchmark detection result is obtained by performing statistics on messages from a benchmark terminal device.

[0048] According to the network address translation behavior detection method of the present application, since the traffic behavior benchmark detection result is obtained by statistics of messages from the benchmark terminal device, the benchmark terminal device is a terminal device with legal access, and the traffic behavior benchmark detection result is the traffic behavior characteristic reflected by the legal terminal device, the second detection result obtained by NAT detection based on the traffic behavior can be accurately determined through the traffic behavior detection result and the traffic behavior benchmark detection result.

[0049] In a second aspect, the present application relates to a method for detecting network address translation behavior, including: sending a first detection instruction, wherein the first detection instruction is used to trigger detection of a first detection result, the first detection result is obtained by matching a benchmark dynamic fingerprint with a dynamic fingerprint of a terminal device, the benchmark dynamic fingerprint is a dynamic fingerprint of a legally connected benchmark terminal device, the dynamic fingerprint of the terminal device is obtained based on a first response message, and the first response message is obtained by the terminal device in response to a first probe message; receiving a first detection result, wherein the first detection result characterizes whether there is a network address translation behavior.

[0050] In a possible embodiment, the network address translation behavior detection method of the present application also includes: sending a second detection instruction, wherein the second detection instruction is used to trigger detection of a second detection result, and the second detection result is obtained by performing traffic behavior detection on a message from a terminal device; receiving the second detection result, wherein the second detection result characterizes whether there is a network address translation behavior.

[0051] In a possible embodiment, the network address translation behavior detection method of the present application also includes: sending a terminal device detection instruction, wherein the terminal device detection instruction is used to trigger the detection of the terminal device detection result, the terminal device detection result is obtained by matching the static fingerprint of the terminal device with the static fingerprint of the reference device, the static fingerprint of the terminal device is determined based on the message parsing result, and the message parsing result is obtained by parsing the message from the terminal device; receiving the terminal device detection result, the terminal device detection result characterizes the device quantity and / or device attributes of the target terminal device where the network address translation behavior occurs.

[0052] In a possible embodiment, the network address translation behavior detection method of the present application also includes: sending a third detection instruction, wherein the third detection instruction is used to trigger detection of a third detection result, the third detection result is obtained by matching a benchmark static fingerprint with a static fingerprint of a terminal device, the static fingerprint of the terminal device is determined based on a message parsing result, the message parsing result is obtained by parsing a message from the terminal device, and the benchmark static fingerprint is a static fingerprint of a legally connected benchmark terminal device; receiving the third detection result, wherein the third detection result characterizes whether there is a network address translation behavior.

[0053] In a possible embodiment, the network address translation behavior detection method of the present application also includes: receiving partial detection results in the full detection results, wherein the full detection results include the first detection result, the second detection result, the third detection result and the terminal device detection result; performing the remaining detection to obtain the remaining detection results in the full detection results.

[0054] In a possible embodiment, the network address translation behavior detection method of the present application further includes: determining a target detection result based on the second detection result and / or the third detection result and the first detection result, wherein the target detection result characterizes whether a network address translation behavior exists.

[0055] In a possible embodiment, the network address translation behavior detection method of the present application also includes: online training an initial second machine learning model based on traffic behavior samples to obtain a second machine learning model, wherein the second machine learning model is used to perform traffic behavior detection to determine a second detection result.

[0056] In a possible embodiment, the network address translation behavior detection method of the present application also includes: using a second machine learning model to perform traffic behavior detection on messages from a terminal device to obtain a second machine learning model detection result, and the second machine learning model detection result is used to determine the first detection result.

[0057] In a third aspect, the present application relates to a method for detecting network address translation behavior, comprising: in response to a received first detection instruction, determining a dynamic fingerprint of a terminal device according to a first response message, wherein the first response message is obtained by the terminal device in response to a first detection message; matching the dynamic fingerprint of the terminal device with a benchmark dynamic fingerprint to obtain a first detection result, wherein the benchmark dynamic fingerprint is a dynamic fingerprint of a benchmark terminal device that has legally accessed, and the first detection result characterizes whether there is a network address translation behavior; and sending the first detection result.

[0058] In a possible embodiment, the network address translation behavior detection method of the present application also includes: in response to a received second detection instruction, performing traffic behavior detection on the message from the terminal device to obtain a second detection result, wherein the second detection result represents whether there is a network address translation behavior.

[0059] In a possible embodiment, the network address translation behavior detection method of the present application also includes: in response to a received terminal device detection instruction, determining a static fingerprint of the terminal device according to a message parsing result, wherein the message parsing result is obtained by parsing the message from the terminal device; determining a terminal device detection result according to matching the static fingerprint of the terminal device with the static fingerprint of a reference device, wherein the terminal device detection result represents the device quantity and / or device attributes of the target terminal device where the network address translation behavior occurs; and sending the terminal device detection result.

[0060] In a possible embodiment, the network address translation behavior detection method of the present application also includes: in response to a received third detection instruction, determining the static fingerprint of the terminal device according to the message parsing result, wherein the message parsing result is obtained by parsing the message from the terminal device; matching the static fingerprint of the terminal device with the benchmark static fingerprint to obtain a third detection result, wherein the benchmark static fingerprint is the static fingerprint of a legally connected benchmark terminal device, and the third detection result characterizes whether there is a network address translation behavior; and sending the third detection result.

[0061] In a fourth aspect, the present application relates to a network address translation behavior detection device, including: a dynamic fingerprint determination module, used to determine the dynamic fingerprint of a terminal device based on a first response message, wherein the first response message is obtained by the terminal device in response to a first detection message; a dynamic fingerprint matching module, used to match the dynamic fingerprint of the terminal device with the benchmark dynamic fingerprint to obtain a first detection result, wherein the benchmark dynamic fingerprint is the dynamic fingerprint of a benchmark terminal device that has legally accessed, and the first detection result characterizes whether there is a network address translation behavior.

[0062] In a fifth aspect, the present application relates to a network address translation behavior detection device, including: a first detection instruction sending module, used to send a first detection instruction, wherein the first detection instruction is used to trigger a detection of a first detection result, the first detection result is obtained by matching a benchmark dynamic fingerprint with a dynamic fingerprint of a terminal device, the benchmark dynamic fingerprint is a dynamic fingerprint of a legally connected benchmark terminal device, the dynamic fingerprint of the terminal device is obtained based on a first response message, and the first response message is obtained by the terminal device in response to a first detection message; a first detection result receiving module, used to receive a first detection result, wherein the first detection result characterizes whether there is a network address translation behavior.

[0063] In a sixth aspect, the present application relates to a network address translation behavior detection device, including: a dynamic fingerprint determination module, used to respond to a received first detection instruction and determine the dynamic fingerprint of a terminal device according to a first response message, wherein the first response message is obtained by the terminal device responding to the first detection message; a dynamic fingerprint matching module, used to match the dynamic fingerprint of the terminal device according to a benchmark dynamic fingerprint to obtain a first detection result, wherein the benchmark dynamic fingerprint is the dynamic fingerprint of a legally connected benchmark terminal device, and the first detection result characterizes whether there is a network address translation behavior; a first detection result sending module, used to send the first detection result.

[0064] In a seventh aspect, the present application relates to a network device, comprising at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so as to enable the at least one processor to execute a network address translation behavior detection method.

[0065] In an eighth aspect, the present application relates to a network system, comprising a first network device and a second network device, wherein the first network device comprises at least one first processor and a first memory communicatively connected to the at least one first processor, the first memory stores instructions executable by the at least one first processor, the instructions are executed by the at least one first processor so that the at least one first processor can execute the network address translation behavior detection method of the second aspect; the second network device comprises at least one second processor and a second memory communicatively connected to the at least one second processor, the second memory stores instructions executable by the at least one second processor, the instructions are executed by the at least one second processor so that the at least one second processor can execute the network address translation behavior detection method of the third aspect.

[0066] In a possible embodiment, the network system further includes a terminal device, the terminal device is connected to the second network device, and the first network device and the second network device are used to determine whether the terminal device is an abnormally accessed terminal device.

[0067] Ninthly, the present application relates to a network system, comprising a network device and a terminal device, wherein the network device comprises at least one processor and a first memory communicatively connected to the at least one processor, the memory stores instructions executable by the at least one processor, the instructions are executed by the at least one processor so that the at least one processor can execute the network address translation behavior detection method of the first aspect; the terminal device is connected to the network device, and the network device is used to determine whether the terminal is an abnormally accessed terminal device. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] The following is an introduction to the drawings used in the embodiments of the present application.

[0069] Figure 1A A schematic diagram showing network address translation behavior in a medical scenario to steal data;

[0070] Figure 1B A schematic diagram showing network address translation behavior in an education scenario to avoid billing;

[0071] Figure 2A A schematic diagram schematically shows the system architecture of the network address translation behavior detection method and device according to an embodiment of the present disclosure;

[0072] Figure 2B A schematic diagram schematically shows another system architecture of a method and device for detecting network address translation behavior according to an embodiment of the present disclosure;

[0073] Figure 3 A flowchart of a method for detecting network address translation behavior according to an embodiment of the present disclosure is schematically shown;

[0074] Figure 4 A schematic diagram schematically shows a method for detecting network address translation behavior according to another embodiment of the present disclosure;

[0075] Figure 5 A flowchart of a method for detecting network address translation behavior according to an embodiment of the present disclosure is schematically shown;

[0076] Fig. 6A A schematic diagram schematically shows a method for detecting network address translation behavior according to another embodiment of the present disclosure;

[0077] Figure 6B A schematic diagram schematically shows a method for detecting network address translation behavior according to another embodiment of the present disclosure;

[0078] Fig. 7A A schematic diagram schematically shows the interaction between a first network device and a second network device according to a network address translation behavior detection method according to another embodiment of the present disclosure;

[0079] Figure 7B A schematic diagram schematically shows the interaction between a second network device and a first network device according to a network address translation behavior detection method according to another embodiment of the present disclosure;

[0080] Figure 8 A flowchart of a method for detecting network address translation behavior according to an embodiment of the present disclosure is schematically shown;

[0081] Fig. 9 A block diagram of a network address translation behavior detection device according to an embodiment of the present disclosure is schematically shown;

[0082] Fig.10 A block diagram of a network address translation behavior detection device according to another embodiment of the present disclosure is schematically shown;

[0083] Fig.11 A block diagram schematically shows a network address translation behavior detection device according to another embodiment of the present disclosure; and

[0084] Fig.12 A schematic diagram of a network device that can implement a network address translation behavior detection method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0085] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0086] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0087] The terms "first" and "second" in the description and claims of the embodiments of the present application are used to distinguish different objects rather than to describe a specific order of objects. For example, a first target object and a second target object are used to distinguish different target objects rather than to describe a specific order of target objects.

[0088] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0089] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0090] The following will describe in detail the relevant background of the network address translation behavior detection method according to the embodiment of the present disclosure.

[0091] Network Address Translation (NAT)

[0092] Network address translation is used to perform address translation, for example, it can convert a private IP address (IP address is Internet Protocol Address, also known as Internet Protocol address, Internet Protocol address) into a public IP address. The electronic device with network address translation function is referred to as a network address translation device, or NAT device for short. A NAT device may include a router, for example.

[0093] On the one hand, NAT can solve the problem of insufficient IP addresses. On the other hand, some attackers use NAT to privately access terminal devices to steal data, launch network attacks, evade billing, and other purposes, threatening network security.

[0094] Figure 1A A schematic diagram showing network address translation behavior in a medical scenario to steal data.

[0095] like Figure 1A As shown in the figure, the controller with unified asset management function is connected to the unified access gateway, and the unified access gateway is connected to various terminal devices. In this medical scenario, the legitimate terminal devices connected to the unified access gateway include medical devices such as blood cell counters, infusion pumps, and electrocardiographs. The attacker can privately connect to the NAT device (i.e. Figure 1A NAT routing in the network) allows the NAT device to connect not only legitimate terminal devices but also illegal privately connected terminals. That is, an attacker can use the privately connected NAT device to impersonate the media access control address (Media Access Control Address, MAC for short, also known as LAN address, Ethernet address or physical address) of a legitimate terminal, and then connect a legitimate terminal device (i.e. a normal terminal) to the privately connected NAT device, while also connecting a malicious device that steals data (i.e. an illegal privately connected terminal), which poses a network security risk. In this case, it is difficult for users of legitimate terminal devices and network administrators to detect abnormalities.

[0096] Figure 1B A schematic diagram showing network address translation behavior in an education scenario to avoid billing.

[0097] like Figure 1B As shown, for example, a broadband access server (Broadband Remote Access Server, referred to as BRAS) or other authentication gateways are connected to an aggregation switch (aggregation switch), and the aggregation switch is connected to an access point (Access Point, referred to as AP). One of the access points is connected to a mobile phone, a TV, a tablet computer, and a TV box, and the other access point is connected to a private router. The private router is a NAT device, so that the private router can obtain four private IP addresses from private IP1 to private IP4 through address conversion of a certain assigned address IP1, so that the private router can connect to four terminals, namely mobile phones, TVs, game consoles, and smart watches, to avoid billing, which poses a network security risk.

[0098] In some implementations, NAT detection is performed using an active NAT detection technique.

[0099] Active NAT detection technology, for example, actively scans the NAT device to detect whether it has opened the common port numbers of the NAT device, or detects the route to check whether there is a route between the network behind NAT and the external network.

[0100] Passive NAT detection technology, for example, determines whether there is a network address translation behavior by detecting whether one or some fields in the network data packet meet the characteristics of the network address translation behavior. For example, it can detect whether the number of concurrent connections, traffic volume, TTL value in the IP data packet header (TTL is Time To Live, which specifies the maximum number of network segments allowed to pass before the IP data packet is discarded by the router) is less than 1 of the operating system standard value, the ID value of the IP data packet, TCP timestamp (TCP is Transmission Control Protocol, which is a connection-oriented, reliable, byte stream-based transport layer communication protocol, TCP timestamp is a field in the TCP message header), ISN value in TCP SYN (SYN is synchronous, which is the handshake signal used by TCP to establish a connection, ISN is Initial Sequence Number, initialization sequence number) and other fields are in order.

[0101] Since the ID value of the IP data packet of operating systems such as OpenBSD (OpenBSD is a multi-platform, UNIX-like operating system based on 4.4BSD) is randomly generated, it will not increase in a fixed manner and there is no pattern. The ISN value of operating systems such as FreeBSD and Solaris increases randomly. Therefore, NAT detection based on the ID value and ISN value of the IP data packet is not accurate. In addition, the specific reduction value of the TTL value is related to the routing path. In order to detect NAT, the deployment constraints are large, and if the NAT device is a programmable router, the value can be easily modified, making NAT detection more difficult. Furthermore, for example, Windows does not actively use TCP timestamps when establishing a connection. At this time, NAT detection based on TCP timestamps is more complicated.

[0102] In summary, the accuracy of the NAT detection technology in these implementations is not high, and because the terminal device sends data packets irregularly, it takes a certain amount of time to detect whether there is NAT behavior in the network, and there is a lag, so the NAT detection is not timely. In addition, the NAT detection technology in the above implementation can only detect whether there is NAT behavior in the network, and the terminal device after NAT is still invisible, which poses a large network security risk.

[0103] The disclosed embodiment provides a network address translation behavior detection technology to improve the traditional network address translation behavior detection method.

[0104] Figure 2A and Figure 2B The following is a schematic diagram showing the system architecture of the network address translation behavior detection method and device according to an embodiment of the present disclosure. It should be noted that: Figure 2A and Figure 2B It is only an example of the system architecture to which the network address translation behavior detection method and device of the embodiments of the present disclosure can be applied, so as to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be applied to other devices, systems, environments or scenarios.

[0105] Figure 2A A system architecture of a network address translation behavior detection method and device according to an embodiment of the present disclosure is schematically shown.

[0106] like Figure 2A As shown, the system architecture in the embodiment of the present disclosure may include: network device 201, terminal device 202, and network 203.

[0107] The network device 201 may be an electronic device that provides network data forwarding and transmission. It should be noted that the network device may be a physical electronic device or a virtual device.

[0108] The network device 201 may include, for example, a router, a switch, an access point, a network controller, etc.

[0109] The switches may include, for example: core switches, aggregation switches, and edge switches.

[0110] Network controllers are used to allow electronic devices to communicate over a computer network.

[0111] The network controller may be mounted on a server, for example, and the server may also have a cloud computing function, that is, a cloud server.

[0112] The terminal device 202 can be understood as a device that inputs programs and data into a computer or receives computer output processing results via communication facilities. The terminal device 202 can be various electronic devices with a display and a processor. The terminal device 202 includes but is not limited to smart phones, tablet computers, laptops, desktop computers, smart watches, medical equipment, televisions, TV boxes, game consoles, cameras, and phones.

[0113] The network 203 may be used to provide a medium for a communication link between the network device 201 and the terminal device 202. The network 203 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0114] Figure 2AIn the embodiment of the present disclosure, for example, the network address translation behavior detection method of the embodiment of the present disclosure may be executed by the network device 201. Accordingly, the network address translation behavior detection device provided by the embodiment of the present disclosure may generally be disposed in the network device 201.

[0115] Exemplarily, the system architecture of the embodiment of the present disclosure may further include a server.

[0116] The server may be a server that provides various services. The server may also have a cloud computing function, that is, the server may be a cloud server. In the case where the network device 201 includes a network controller, the network controller may be deployed on the server, for example.

[0117] The server and the terminal device 202 can be the sending end and receiving end of network data such as messages. After the network data is sent from the sending end, it can be forwarded by the network device 201 and transmitted to the receiving end.

[0118] Figure 2B Another system architecture of the network address translation behavior detection method and device according to an embodiment of the present disclosure is schematically shown.

[0119] and Figure 2A Differently, Figure 2B In the system architecture shown, the network address translation behavior detection method of the embodiment of the present disclosure may be executed by a network system including a first network device 201 - 1 and a second network device 201 - 2 .

[0120] Exemplarily, the first network device 201-1 and the second network device 201-2 may be physical electronic devices or virtual devices. For example, the first network device 201-1 may be a core switch, and the second network device 201-2 may be an access layer switch (the core switch and the access layer switch are both physical electronic devices). For another example, the first network device 201-1 and the second network device may be virtual switches (the virtual switch is a virtual device). For another example, the first network device may be a core switch, and the second network device may be a virtual switch.

[0121] When the first network device includes a network controller, the network controller can be deployed on the server as well as together with the second network device.

[0122] Exemplarily, in a wireless local area network scenario (Wireless Local Area Network, abbreviated as WLAN), the first network device can be an access controller (Access Controller, abbreviated as AC)), and the second network device can be a (wireless) access point, a (wireless) access point, abbreviated as AP.

[0123] The network address translation behavior detection device provided in the embodiment of the present disclosure can generally be set in the first network device 201-1 and the second network device 201-2 of the network system.

[0124] The number of network devices 201, first network device 201-1, second network device 201-2, terminal device 202, and network 203 in the above embodiment is only for illustration, and any number of network devices 201, first network device 201-1, second network device 201-2, terminal device 202, and network 203 can be set as required.

[0125] The present disclosure provides a method for detecting network address translation behavior. Figure 2A The system architecture of Figure 3 to Figure 4 The network address translation behavior detection method of the exemplary embodiment of the present disclosure is described as follows. The network address translation behavior detection method of the exemplary embodiment of the present disclosure can be, for example, Figure 2A The network devices shown are executed.

[0126] Figure 3 The flowchart of the network address translation behavior detection method 300 according to an embodiment of the present disclosure is schematically shown.

[0127] like Figure 3 As shown, a network address translation behavior detection method 300 according to an embodiment of the present disclosure includes operations S310 to S320.

[0128] In operation S310, a dynamic fingerprint of the terminal device is determined according to the first response message.

[0129] The first response message is obtained by the terminal device in response to the first detection message.

[0130] Taking the network address translation behavior detection method executed by a network device in an embodiment of the present disclosure as an example, for example, a first detection message can be sent by a network device or other electronic devices in the current network to a terminal device, and the terminal device responds to the first detection message and generates a first response message to transmit to the network device, and the network device determines the dynamic fingerprint of the terminal device based on the first response message.

[0131] In the disclosed embodiments, a fingerprint may be understood as information that may uniquely identify a terminal device, and a dynamic fingerprint may be understood as a dynamic characteristic of a terminal device that may uniquely identify the terminal device, wherein the dynamic characteristic includes a response characteristic of the terminal device, and the response characteristic of the terminal device may be reflected through a first response message.

[0132] In operation S320, the reference dynamic fingerprint is matched with the dynamic fingerprint of the terminal device to obtain a first detection result.

[0133] The reference dynamic fingerprint is a dynamic fingerprint of a legally connected reference terminal device, and the first detection result indicates whether there is a network address translation behavior.

[0134] For example, the above operations S310 and S320 may be performed periodically to continuously track whether there is network address translation behavior in the current network. Correspondingly, sending the first detection message to the terminal device and obtaining the first response message are also periodic.

[0135] According to the network address translation behavior detection method of the embodiment of the present disclosure, the dynamic fingerprint of the terminal device can be determined according to the first response message. The dynamic fingerprint of the terminal device can uniquely identify the terminal device from the dimension of the dynamic fingerprint, that is, the dynamic fingerprint is more unique and representative. Subsequently, the terminal device and the benchmark terminal device can be accurately matched based on the dynamic fingerprint. Since the benchmark terminal device is legally connected, the dynamic fingerprint of the terminal device is matched according to the benchmark dynamic fingerprint. The first detection result obtained can characterize whether the terminal device is legally connected, thereby characterizing whether there is network address translation behavior. The network address translation behavior detection accuracy of the embodiment of the present disclosure is higher.

[0136] In addition, since the first response message is obtained by the terminal device in response to the first detection message, the first detection message can be sent to the terminal device at any time, so that the first response message can be obtained at any time accordingly and the first detection result can be obtained based on the first response message. It will not be limited by the irregular sending of messages by the terminal device, so NAT detection is more timely.

[0137] In summary, the NAT detection of the network address translation behavior detection method of the embodiment of the present disclosure has higher efficiency.

[0138] According to another embodiment of the present disclosure, the network address translation behavior detection method may further include: performing traffic behavior detection on the message from the terminal device to obtain a second detection result.

[0139] The second detection result indicates whether there is a network address translation behavior.

[0140] In e.g. Figure 1AIn scenarios such as , illegal terminal devices are connected privately on the basis of normal terminal devices, and the number of terminal devices is greater. In terms of traffic behavior, the maximum bandwidth, flow rate, packet interval and other traffic behaviors are different from those of only normal terminals. For example, the maximum bandwidth and flow rate will increase, and the packet interval will decrease. Therefore, based on the traffic behavior, it can be judged whether network address translation behavior occurs.

[0141] Exemplarily, for example, traffic statistics may be performed on messages from a terminal device to implement a specific example of traffic behavior detection, and a second detection result may be obtained.

[0142] According to the network address translation behavior detection method of the embodiment of the present disclosure, by performing traffic behavior detection on the message from the terminal device, it can be detected from the traffic behavior dimension whether there is network address translation behavior.

[0143] In addition, traffic behavior detection of messages from terminal devices does not involve, for example, sending a probe message to the terminal device to make the terminal device respond. Therefore, traffic behavior detection is imperceptible to the terminal device, and NAT detection has better performance.

[0144] According to another embodiment of the present disclosure, the network address translation behavior detection method may further include: determining a static fingerprint of the terminal device according to the message parsing result, and determining a terminal device detection result according to matching the static fingerprint of the terminal device with the static fingerprint of a reference device.

[0145] The message parsing result is obtained by parsing the message from the terminal device.

[0146] The terminal device detection result represents the number and / or device attributes of the target terminal devices that have undergone network address translation. The device attributes may include, for example, terminal type, manufacturer, model, operating system, etc.

[0147] The terminal device detection result can also be understood as the identification result of the terminal device.

[0148] The message includes a message header and a message body. The message header includes some device information. The message parsing result obtained by parsing the message can reflect some information of the terminal device. Therefore, the static fingerprint of the terminal device can be determined by the message parsing result.

[0149] A static fingerprint can be understood as a static characteristic of a terminal device that can uniquely identify the terminal device. For example, a "static fingerprint" and a "dynamic fingerprint" can be distinguished by whether the terminal device needs to be "sensitive".

[0150] By parsing the message, for example, multiple message fields can be obtained. The message parsing result can be in the form of a full amount of message fields obtained by parsing. For example, the static fingerprint of the terminal device can also be determined based on more identifiable message features (the message features here can also be understood as message fields) in the message parsing result.

[0151] Exemplarily, in the message parsing result obtained by parsing the message, fields such as DHCP Option and HTTP UserAgent can reflect the model, MAC address, etc. of the terminal device, which are more identifiable, so the static fingerprint of the terminal device can be determined based on this.

[0152] The reference device can be understood as a predetermined electronic device used for comparison. The reference device may include multiple ones.

[0153] Exemplarily, for example, a static fingerprint library may be pre-built and maintained, the static fingerprint library including the static fingerprint of the reference device. By matching the static fingerprint of the terminal device with the static fingerprint of the reference device, the terminal device may be identified, that is, a terminal device detection result may be obtained.

[0154] Exemplarily, the static fingerprint of each reference device may be associated with a corresponding device attribute. For example, when the static fingerprint of the terminal device matches the static fingerprint of a reference device, the device attribute corresponding to the reference device may be determined as the device attribute of the terminal device.

[0155] According to the network address translation behavior detection method of the embodiment of the present disclosure, the static fingerprint of the terminal device determined based on the message parsing result can uniquely identify the terminal device from the dimension of the static fingerprint, that is, the static fingerprint is more unique and representative, and the terminal device can be accurately identified based on the static fingerprint in the future. By matching the static fingerprint of the terminal device with the static fingerprint of the reference device, the terminal device detection result determined represents the device quantity and / or device attributes of the target terminal device that has undergone the network address translation behavior, which is a more refined detection result and can realize the visualization of the terminal device connected to the network address translation device. The "visualization" here is embodied in, for example, that the device quantity and / or device attributes of the target terminal device connected to the network address translation device can be known, which is convenient for subsequent network security control, etc.

[0156] In addition, according to the message parsing results, the static fingerprint of the terminal device is determined, and the operation of determining the terminal device detection result based on the static fingerprint is also imperceptible to the terminal device, so the performance of NAT detection and terminal identification is better.

[0157] According to another embodiment of the present disclosure, the network address translation behavior detection method may further include: determining a static fingerprint of the terminal device according to the message parsing result, and matching the static fingerprint of the terminal device with the reference static fingerprint to obtain a third detection result.

[0158] The message parsing result is obtained by parsing the message from the terminal device.

[0159] The reference static fingerprint is a static fingerprint of a legally connected reference terminal device, and the third detection result represents whether there is a network address translation behavior.

[0160] For the relevant description on the message parsing result and the static fingerprint of the terminal device, please refer to the previous embodiment and will not be repeated here.

[0161] The previous embodiment is to identify the terminal device, so the static fingerprint of the reference device is used to match the static fingerprint of the terminal device. Different from the previous embodiment, the embodiment of the present disclosure is to detect network address translation behavior based on static fingerprints, so the static fingerprint of the reference terminal device that is legally connected is used to match the static fingerprint of the terminal device.

[0162] Exemplarily, for example, the reference static fingerprint may also be maintained in a static fingerprint library, so that the third detection result and the terminal device detection result may be obtained by matching the static fingerprint of the terminal device with the static fingerprint of the reference device.

[0163] According to the network address translation behavior detection method of the embodiment of the present disclosure, the static fingerprint of the terminal device determined according to the message parsing result can uniquely identify the terminal device from the dimension of the static fingerprint, that is, the static fingerprint is more unique and representative, and the terminal device and the reference terminal device can be accurately matched based on the static fingerprint to detect the network address translation behavior. Since the reference terminal device is legally connected, the third detection result obtained by matching the static fingerprint of the terminal device with the reference static fingerprint can characterize whether the terminal device is legally connected, and thus can characterize whether there is a network address translation behavior. The network address translation behavior detection accuracy of the embodiment of the present disclosure is higher.

[0164] Exemplarily, for example, the target detection result may be determined based on the second detection result and / or the third detection result and the first detection result.

[0165] The target detection result indicates whether there is network address translation behavior.

[0166] Determining the target detection result according to the second detection result and / or the third detection result and the first detection result includes the following situations:

[0167] (1) Determine a target detection result based on the second detection result and the first detection result.

[0168] Exemplarily, for example, when the second detection result indicates the existence of network address translation behavior, an operation of determining the dynamic fingerprint of the terminal device based on the first response message and matching the benchmark dynamic fingerprint with the dynamic fingerprint of the terminal device to obtain the first detection result is performed. For example, the first detection result can be determined as the target detection result.

[0169] Exemplarily, for example, the target detection result may also be determined based on a weighted sum of the second detection result and the first detection result. The weights of the first detection result and the second detection result may be configured.

[0170] Since NAT detection based on traffic behavior is not sensitive to terminal devices and does not require parsing of messages from terminal devices, the performance of NAT detection is better. Since dynamic fingerprints are more identifiable and unique, the accuracy of NAT detection based on dynamic fingerprints is higher. When the target detection result is determined based on the second detection result and the first detection result, the accuracy and performance of NAT detection are better, and the efficiency of NAT detection is higher.

[0171] (2) Determine the target detection result according to the third detection result and the first detection result.

[0172] For example, when the third detection result indicates the existence of network address translation behavior, the operation of determining the dynamic fingerprint of the terminal device according to the first response message and matching the benchmark dynamic fingerprint with the dynamic fingerprint of the terminal device to obtain the first detection result can be performed. For example, the first detection result can be determined as the target detection result.

[0173] Exemplarily, for example, the target detection result may also be determined based on a weighted sum of the third detection result and the first detection result. The weights of the first detection result and the third detection result may be configured.

[0174] (3) Determine the target detection result based on the first detection result, the second detection result, and the third detection result.

[0175] Exemplarily, for example, when the second detection result indicates the existence of network address translation behavior, an operation of determining the dynamic fingerprint of the terminal device based on the first response message and matching the dynamic fingerprint of the terminal device based on the benchmark dynamic fingerprint to obtain the first detection result can be performed, and then an operation of determining the static fingerprint of the terminal device based on the message parsing result and matching the static fingerprint of the terminal device based on the benchmark static fingerprint to obtain the third detection result can be performed. At this time, for example, the target detection result can be determined based on the weighted sum of the first detection result and the third detection result.

[0176] Exemplarily, for example, the target detection result may also be determined according to a weighted sum of the first detection result, the second detection result, and the third detection result. The weights of the first detection result, the second detection result, and the third detection result may be configured.

[0177] The first detection result, the second detection result and the third detection result are detection results characterizing whether there is network address translation behavior obtained from three dimensions, namely, dynamic fingerprint, traffic behavior and static fingerprint, respectively. Each detection result is obtained by a single NAT detection method. According to the network address translation behavior detection method of the embodiment of the present disclosure, multiple single NAT detection results can be integrated to obtain a more accurate target detection result.

[0178] According to another embodiment of the present disclosure, the network address translation behavior detection method may further include: in the presence of the network address translation behavior, determining the target terminal device where the network address translation behavior occurs as an abnormally accessed terminal device.

[0179] It should be noted that, for example Figure 1A In the scenario shown, the implementation method of privately accessing a terminal device for some purpose is usually to convert the network address, which poses a network security risk, so it is necessary to detect whether there is network address behavior. According to the network address translation behavior detection method of the embodiment of the present disclosure, by determining the target terminal device that has undergone network address translation behavior as an abnormally accessed terminal device when there is a network address translation behavior, this scenario can be dealt with, and the abnormally accessed terminal device in this scenario can be detected.

[0180] Exemplarily, for example, whether there is a network address translation behavior can be determined by at least one of the first detection result, the second detection result, the third detection result, and the target detection result.

[0181] According to another embodiment of the present disclosure, the network address translation behavior detection method may also include: when the target detection result indicates the existence of network address translation behavior and the number of target terminal devices that have undergone network address translation behavior is greater than or equal to a terminal number threshold, determining the target terminal device as an abnormally accessed terminal device.

[0182] Different from the above scenarios, in some scenarios, the existence of network address translation behavior is normal and legal, so even if the network address translation behavior is detected, it does not indicate that there is a network security risk. Instead, it is necessary to understand the information of the terminal device behind the NAT device to determine whether there is a network security risk. Figure 1BIn the educational scenario shown, when there is network address translation behavior and the number of terminal devices behind the NAT device is greater than the terminal quantity threshold, it indicates that there are network security risks, such as the risk of billing evasion. According to the network address translation behavior detection method of the embodiment of the present disclosure, when the target detection result indicates that there is network address translation behavior and the number of target terminal devices that have undergone network address translation behavior is greater than or equal to the terminal quantity threshold, the target terminal device is determined as an abnormally accessed terminal device to cope with this scenario.

[0183] Exemplarily, for example, when there is a network address translation behavior and the model of the target terminal device where the network address translation behavior occurs is the target model, the target terminal device can be determined as an abnormally accessed terminal device.

[0184] Exemplarily, for example, in response to the target terminal device being an abnormally connected terminal device, a control operation may be performed on the target terminal device.

[0185] The control operation includes a flow control operation and / or an access restriction operation.

[0186] In the case where the target terminal device is an abnormally connected terminal device, it indicates that there is a network security risk. The network security risk can be addressed by controlling the target terminal device to ensure network security.

[0187] According to another embodiment of the present disclosure, the network address translation behavior detection method may further include: determining a reference dynamic fingerprint according to the second response message.

[0188] The reference terminal device is an authenticated terminal device that accesses for the first time, and the second response message is obtained by the reference terminal device responding to the second detection message.

[0189] In order to disguise the terminal devices that have accessed illegally, the terminal devices that have accessed illegally usually access the network after the legal terminal devices. Therefore, the probability that the terminal devices that have accessed for the first time and have been authenticated are legal terminal devices is higher. The network address translation behavior detection method of the embodiment of the present disclosure can determine the accurate benchmark terminal device and the benchmark terminal dynamic fingerprint and benchmark static fingerprint based on the information of the authenticated terminal device that has accessed for the first time. The benchmark dynamic fingerprint serves as the basis for subsequent matching with the dynamic fingerprint of the terminal device, and can also accurately determine the first detection result accordingly. The benchmark static fingerprint serves as the basis for subsequent matching with the static fingerprint of the terminal device, and can also accurately determine the third detection result accordingly.

[0190] According to another embodiment of the network address translation behavior detection method of the present disclosure, for example, a specific example of performing traffic behavior detection on a message from a terminal device to obtain a second detection result can be implemented according to the following embodiment: performing traffic behavior detection on a message from a terminal device using a machine learning model to obtain a second detection result.

[0191] Machine learning can be understood as a method in which a computer uses existing data to determine a model for performing a specific task and uses this model to predict the results of the task.

[0192] Exemplarily, the machine learning model may include, for example, a classification tree, a random forest model, etc. The machine learning model may also include, for example, a deep learning model.

[0193] Since the machine learning model is an end-to-end processing method, the data processing results can be determined by inputting data into the machine learning model, which is more efficient.

[0194] Exemplarily, for example, the message may be preprocessed so that the preprocessed message is easier to be processed by the machine learning model. After the preprocessed message is input into the machine learning model, the output of the machine learning model is the first detection result.

[0195] Exemplarily, the machine learning model may include a feature extraction subnetwork and a classification subnetwork. The preprocessed message may be input into the feature extraction subnetwork of the machine learning model to obtain traffic features, and then the classification subnetwork may be used to process the traffic features to obtain the first detection result.

[0196] The machine learning model can process more data and improve data processing efficiency, and the trained machine learning model also meets the standards in terms of detection accuracy and performance. Therefore, according to the network address translation behavior detection method of the embodiment of the present disclosure, by using the machine learning model to perform traffic behavior detection on the message from the terminal device, an accurate second detection result can be obtained efficiently.

[0197] According to a network address translation behavior detection method of another embodiment of the present disclosure, the machine learning model includes at least one of a pre-trained first machine learning model and an online trained second machine learning model. In the case where the machine learning model includes a first machine learning model and a machine learning model, for example, the following embodiments can be used to implement a specific example of using a machine learning model to perform traffic behavior detection on a message from a terminal device to obtain a second detection result: Use the first machine learning model to perform traffic behavior detection on a message from a terminal device to obtain a first machine learning model detection result. Use the second machine learning model to perform traffic behavior detection on a message from a terminal device to obtain a second machine learning model detection result. Determine the second detection result based on the first machine learning model detection result and the second machine learning model detection result.

[0198] The first machine learning model obtained by pre-training has already been trained and can be used directly, without requiring computing power resources for machine learning model training.

[0199] In some cases, the training samples used in the model training phase are significantly different from the input data of the actual application scenario, which causes the model that performs well in the training phase to perform poorly in the application phase. The second machine learning model can cope with this situation through online training and improve the accuracy of traffic behavior detection.

[0200] According to the network address translation behavior detection method of the embodiment of the present invention, by using the first machine learning model and the second machine learning model to perform traffic behavior detection on the message, the respective advantages of the online training and pre-trained models can be utilized to obtain the detection results according to the first machine learning model and the detection results according to the second machine learning model, respectively, and the second detection result can be comprehensively and accurately determined based on the detection results of the first machine learning model and the detection results of the second machine learning model.

[0201] Exemplarily, the network address translation behavior detection method according to yet another embodiment of the present disclosure may further include: collecting traffic behavior samples.

[0202] The traffic behavior samples are used to train a second machine learning model.

[0203] According to the network address translation behavior detection method of the embodiment of the present disclosure, a second machine learning model that adapts to the input data in the online scenario can be trained through the traffic behavior samples collected online, thereby improving the accuracy of traffic behavior detection.

[0204] Exemplarily, according to another embodiment of the network address translation behavior detection method of the present disclosure, it may also include: training an initial second machine learning model based on traffic behavior samples to obtain a second machine learning model.

[0205] It is understandable that training the initial second machine learning model according to the traffic behavior sample to obtain the second machine learning model is an operation of online training the second machine learning model. The initial second machine learning model and the second machine learning model have different model parameters, and the model parameters include, for example, weights and biases of the network layer.

[0206] According to the network address translation behavior detection method of the embodiment of the present disclosure, it is possible to integrate the collection of traffic behavior samples, model training using traffic behavior samples, and traffic behavior detection based on the second machine learning model obtained through training. This method is more suitable for online scenarios and can improve the accuracy of traffic behavior detection.

[0207] Exemplarily, according to the network address translation behavior detection method of another embodiment of the present disclosure, for example, the following embodiments can be used to implement flow behavior detection of messages from terminal devices to obtain a specific example of the second detection result: statistics are performed on messages from terminal devices to obtain flow behavior detection results of the messages. The second detection result is determined based on the flow behavior detection result and the flow behavior benchmark detection result.

[0208] The traffic behavior benchmark detection results are obtained by counting the messages from the benchmark terminal devices.

[0209] According to the network address translation behavior detection method of the embodiment of the present disclosure, since the traffic behavior benchmark detection result is obtained by statistics of messages from the benchmark terminal device, the benchmark terminal device is a terminal device with legal access, and the traffic behavior benchmark detection result is the traffic behavior characteristics reflected by the legal terminal device, the second detection result obtained by NAT detection based on the traffic behavior can be accurately determined through the traffic behavior detection result and the traffic behavior benchmark detection result.

[0210] Figure 4 A schematic diagram of a network address translation behavior detection method according to another embodiment of the present disclosure is schematically shown.

[0211] like Figure 4 As shown, according to the network address translation behavior detection method of the embodiment of the present disclosure, for example, baseline terminal fingerprint collection, NAT detection based on traffic behavior, NAT detection based on dynamic fingerprint, NAT behavior determination, and terminal identification based on static fingerprint can be performed in sequence.

[0212] The reference terminal fingerprint collection, for example, includes the operation of determining the reference terminal dynamic fingerprint in the above embodiment, and may also include determining the reference terminal static fingerprint.

[0213] NAT detection based on traffic behavior, for example, includes the operation of determining the second detection result of the above embodiment, NAT detection based on dynamic fingerprint, for example, includes the operation of determining the first detection result of the above embodiment, and terminal identification based on static fingerprint, for example, includes the operation of determining the terminal device detection result of the above embodiment, which will not be repeated here. NAT behavior determination includes determining the target detection result according to the second detection result and the first detection result.

[0214] According to the network address translation behavior detection method of the embodiment of the present invention, it is possible to comprehensively detect based on traffic behavior, dynamic fingerprint and static fingerprint, and not only accurately and efficiently detect whether there is NAT behavior in the network, but also detect the device information of the terminal device behind the NAT device, realize the visualization of the terminal after NAT, and facilitate network security operations.

[0215] Exemplarily, for example, baseline terminal fingerprint collection, NAT detection based on traffic behavior, NAT detection based on dynamic fingerprints, NAT detection based on static fingerprints, NAT behavior determination, and terminal identification based on static fingerprints may be performed in sequence. NAT detection based on static fingerprints, for example, includes the operation of determining the third detection result in the above-mentioned embodiment, which will not be repeated here.

[0216] The present disclosure also provides a method for detecting network address translation behavior. Figure 2B The system architecture of Figures 5 to 7B The network address translation behavior detection method of the exemplary embodiment of the present disclosure is described as follows. The network address translation behavior detection method of the exemplary embodiment of the present disclosure can be, for example, Figure 2B The first network device shown executes.

[0217] Figure 5 The flowchart of a network address translation behavior detection method 500 according to an embodiment of the present disclosure is schematically shown.

[0218] like Figure 5 As shown, a network address translation behavior detection method 500 according to an embodiment of the present disclosure includes operations S510 to S520.

[0219] In operation S510, a first detection instruction is sent.

[0220] The first detection instruction is used to trigger detection of a first detection result, which is obtained by matching a benchmark dynamic fingerprint with a dynamic fingerprint of a terminal device, the benchmark dynamic fingerprint is a dynamic fingerprint of a legally connected benchmark terminal device, the dynamic fingerprint of the terminal device is obtained based on a first response message, and the first response message is obtained by the terminal device in response to the first detection message.

[0221] In operation S520, a first detection result is received.

[0222] The first detection result indicates whether there is a network address translation behavior.

[0223] It should be noted that the corresponding Figure 2A The network address translation behavior detection method embodiment of the system architecture shown is different from that of the embodiment of the network address translation behavior detection method of the system architecture shown Figure 2B The embodiment of the network address translation behavior detection method of the system architecture shown involves the interaction between the first network device and the second network device. The specific interaction includes, for example, one party sending an instruction, and the other party responding to the instruction to perform a corresponding operation and send the operation result.

[0224] The specific interaction between the first network device and the second network device may be determined by the characteristics of the first network device and the second network device, the networking of the network system including the first network device and the second network device, etc. Figure 2A The same related operations as those in the network address translation behavior detection method embodiment of the system architecture shown have been described in detail in the above embodiments in terms of technical principles and technical effects, and will not be repeated here.

[0225] According to another embodiment of the present disclosure, the network address translation behavior detection method further includes: sending a second detection instruction and receiving a second detection result.

[0226] The second detection instruction is used to trigger detection of a second detection result, and the second detection result is obtained by performing traffic behavior detection on a message from a terminal device.

[0227] The second detection result indicates whether there is a network address translation behavior.

[0228] According to another embodiment of the present disclosure, the network address translation behavior detection method further includes: sending a terminal device detection instruction and receiving a terminal device detection result.

[0229] The terminal device detection instruction is used to trigger the detection of the terminal device detection results. The terminal device detection results are obtained by matching the static fingerprint of the terminal device with the static fingerprint of the reference device. The static fingerprint of the terminal device is determined based on the message parsing result. The message parsing result is obtained by parsing the message from the terminal device.

[0230] The terminal device detection result represents the device quantity and / or device attributes of the target terminal devices that have undergone network address translation behavior.

[0231] According to another embodiment of the present disclosure, the network address translation behavior detection method further includes: sending a third detection instruction and receiving a third detection result.

[0232] The third detection instruction is used to trigger detection of the third detection result, which is obtained by matching the benchmark static fingerprint with the static fingerprint of the terminal device, the static fingerprint of the terminal device is determined based on the message parsing result, and the message parsing result is obtained by parsing the message from the terminal device, and the benchmark static fingerprint is the static fingerprint of the benchmark terminal device that has legally accessed.

[0233] The third detection result indicates whether there is a network address translation behavior.

[0234] According to another embodiment of the present disclosure, the network address translation behavior detection method further includes: receiving a part of the detection results in the full detection results, and performing the remaining detection to obtain the remaining detection results in the full detection results.

[0235] The full test results include the first test results, the second test results, the third test results and the terminal device test results.

[0236] According to another embodiment of the present disclosure, the network address translation behavior detection method further includes: determining a target detection result according to the second detection result and / or the third detection result and the first detection result.

[0237] The target detection result indicates whether there is network address translation behavior.

[0238] According to another embodiment of the network address translation behavior detection method of the present disclosure, it also includes: online training an initial second machine learning model based on traffic behavior samples to obtain a second machine learning model.

[0239] The second machine learning model is used to perform traffic behavior detection to determine a second detection result.

[0240] According to another embodiment of the network address translation behavior detection method of the present disclosure, it also includes: using a second machine learning model to perform traffic behavior detection on messages from a terminal device to obtain a second machine learning model detection result.

[0241] The second machine learning model detection result is used to determine the first detection result.

[0242] According to the network address translation behavior detection method of the embodiment of the present disclosure, combined with Figure 2BAs shown, the first network device is connected to the second network device, and the second network device is connected to the terminal device. Compared with the first network device, the second network device is directly connected to the terminal device. Therefore, the communication link between the second network device and the terminal device is shorter than the communication link between the first network device and the terminal device, and the communication cost between the second network device and the terminal device is lower. Thus, for example, the second network device can perform at least one single detection and send the result of the single detection to the first network device. The single detection here can include, for example, the NAT detection based on traffic behavior, the NAT detection based on dynamic fingerprints, the terminal identification based on static fingerprints, and the NAT detection based on static fingerprints in the above-mentioned embodiments.

[0243] The first network device may, for example, receive a single detection result from the second network device, and learn whether there is NAT behavior based on the single detection result. Alternatively, the first network device may determine whether there is NAT behavior based on the results of multiple single detection results, for example, the first network device may determine the target detection result based on the second detection result and / or the third detection result and the first detection result.

[0244] In the following, the second network device used to perform at least one single detection will be referred to as an execution point, and the first network device used to determine whether there is NAT behavior based on the result of the single detection will be referred to as a decision point. The "execution point" here can be understood as a network node that mainly performs detection, and the "decision point" can be understood as a main execution decision to determine: whether there is NAT behavior, and the terminal device identification result when NAT behavior exists.

[0245] For example, when the first network device has sufficient computing resources, cache resources, etc., the first network device may perform operations that require higher computing resources, such as training the second machine learning model. For example, the first network device may also perform NAT detection operations based on dynamic fingerprints.

[0246] In summary, the operations of the first network device and the second network device can be determined according to the characteristics of the first network device and the second network device and the networking of the network system including the first network device and the second network device, so that the network system achieves the optimal performance of detecting network address translation behavior.

[0247] Fig. 6A A schematic diagram of a network address translation behavior detection method according to another embodiment of the present disclosure is schematically shown.

[0248] like Fig. 6AAs shown, for example, the first network device (i.e., the decision point) can perform the operation of training the second machine learning model, and the second network device (i.e., the execution point) can perform the operations of NAT detection based on dynamic fingerprints, NAT detection based on the first machine learning model, terminal identification based on static fingerprints, NAT detection based on static fingerprints, collecting traffic behavior samples, and collecting traffic behavior benchmark results. The first network device can be, for example, a network controller, and the second network device can be, for example, a switch, an access point, etc.

[0249] Figure 6B A schematic diagram of a network address translation behavior detection method according to another embodiment of the present disclosure is schematically shown.

[0250] like Figure 6B As shown, for example, the first network device (i.e., the decision point) can perform operations such as training the second machine learning model, performing NAT detection based on the first machine learning model, terminal identification based on static fingerprints, and NAT detection based on static fingerprints, and the second network device (i.e., the execution point) can perform operations such as NAT detection based on dynamic fingerprints, collecting traffic behavior samples, and collecting traffic behavior benchmark results.

[0251] Fig. 7A The diagram schematically shows the interaction between a first network device (ie, a decision point) and a second network device (ie, an execution point) according to a network address translation behavior detection method according to another embodiment of the present disclosure.

[0252] It should be noted that if Fig. 7A (and below Figure 7B ) corresponds to the schematic diagram of the network address translation behavior detection method shown in Figure 2B The system architecture shown is a network system including a first network device and a second network device, in which the second network device, for example, mainly performs a single detection and sends a single detection result to the second network device, and the first network device mainly receives a single detection result from the first network device and comprehensively determines whether there is NAT behavior and the terminal device identification result when there is NAT behavior based on at least one single detection result. Of course, the interaction between the first network device and the second network device is not limited to this example.

[0253] like Fig. 7AAs shown, for example, when a user turns on NAT detection, when a terminal device accesses for the first time and passes authentication, the second network device sends a second detection message to the terminal device, and the terminal device can respond to the second detection message to obtain a second response message, and send the second response message to the second network device, and the second network device determines the benchmark dynamic fingerprint based on the second response message. The second network device can also collect traffic behavior samples and send the traffic behavior samples to the first network device. The first network device can also send a second detection instruction, and the second network device uses the first machine learning model to perform traffic behavior detection to obtain the first machine learning model detection result and send the first machine learning model detection result to the first network device. The first network device can use the traffic behavior sample to train the initial second machine learning model to obtain the second machine learning model. The first network device can also use the second machine learning model to perform traffic behavior detection to obtain the second machine learning model detection result. The first network device can also determine the second detection result based on the first machine learning model detection result and the second machine learning model detection result. The first network device may also send a first detection instruction to the second network device. In response to receiving the first detection instruction, the second network device may send a first detection message to the terminal device. The terminal device may respond to the first detection message to obtain a first response message and send the first response message to the second network device. The second network device may determine the dynamic fingerprint of the terminal device based on the first response message and match the dynamic fingerprint of the terminal device with the reference dynamic fingerprint to implement "NAT detection based on dynamic fingerprint" to obtain a first detection result, and send the first detection result to the first network device. The first network device may determine the target detection result based on the first detection result and the second detection result, and may also send and display the target detection result to the user.

[0254] Figure 7B The diagram schematically shows the interaction between a first network device (ie, a decision point) and a second network device (ie, an execution point) according to a network address translation behavior detection method according to another embodiment of the present disclosure.

[0255] and Fig. 7A The illustrated embodiments are different. Figure 7B The illustrated embodiment also includes the first network device performing terminal identification based on static fingerprints to obtain a terminal device detection result. The first network device may also send and display the target detection result and the terminal device detection result to the user.

[0256] The present disclosure also provides a method for detecting network address translation behavior. Figure 2B The system architecture of Figure 8The network address translation behavior detection method of the exemplary embodiment of the present disclosure is described as follows. The network address translation behavior detection method of the exemplary embodiment of the present disclosure can be, for example, Figure 2B The second network device shown executes.

[0257] Figure 8 The flowchart of a network address translation behavior detection method 800 according to an embodiment of the present disclosure is schematically shown.

[0258] like Figure 8 As shown, a network address translation behavior detection method 800 according to an embodiment of the present disclosure includes operations S810 to S830.

[0259] In operation S810, in response to the received first detection instruction, a dynamic fingerprint of the terminal device is determined according to a first response message.

[0260] The first response message is obtained by the terminal device in response to the first detection message;

[0261] In operation S820, the reference dynamic fingerprint is matched with the dynamic fingerprint of the terminal device to obtain a first detection result.

[0262] The reference dynamic fingerprint is a dynamic fingerprint of a legally connected reference terminal device, and the first detection result indicates whether there is a network address translation behavior.

[0263] In operation S830, the first detection result is sent.

[0264] The network address translation behavior detection method of the disclosed embodiment corresponds to Figure 2B The system architecture involves the interaction between the first network device and the second network device and has been illustrated in the above embodiment, which will not be repeated here.

[0265] According to another embodiment of the present disclosure, the network address translation behavior detection method further includes: in response to a received second detection instruction, performing a flow behavior detection on a message from a terminal device to obtain a second detection result.

[0266] The second detection result indicates whether there is a network address translation behavior.

[0267] According to another embodiment of the present disclosure, the network address translation behavior detection method further includes: in response to the received terminal device detection instruction, determining the static fingerprint of the terminal device according to the message parsing result. According to the static fingerprint of the terminal device and the static fingerprint of the reference device, the terminal device detection result is matched to determine the terminal device detection result. Send the terminal device detection result.

[0268] The message parsing result is obtained by parsing the message from the terminal device.

[0269] The terminal device detection result represents the device quantity and / or device attributes of the target terminal devices that have undergone network address translation behavior.

[0270] According to another embodiment of the present disclosure, the network address translation behavior detection method further includes: in response to the received third detection instruction, determining the static fingerprint of the terminal device according to the message parsing result, matching the static fingerprint of the terminal device with the reference static fingerprint to obtain a third detection result, and sending the third detection result.

[0271] The message parsing result is obtained by parsing the message from the terminal device.

[0272] The reference static fingerprint is a static fingerprint of a legally connected reference terminal device, and the third detection result represents whether there is a network address translation behavior.

[0273] Fig. 9 The block diagram of a network address translation behavior detection device according to an embodiment of the present disclosure is schematically shown.

[0274] like Fig. 9 The network address translation behavior detection device 900 of the embodiment of the present disclosure includes, for example: a dynamic fingerprint determination module 910 and a dynamic fingerprint matching module 920.

[0275] The dynamic fingerprint determination module 910 is used to determine the dynamic fingerprint of the terminal device according to the first response message.

[0276] The first response message is obtained by the terminal device in response to the first detection message.

[0277] The dynamic fingerprint matching module 920 is used to match the dynamic fingerprint of the terminal device with the reference dynamic fingerprint to obtain a first detection result.

[0278] The reference dynamic fingerprint is a dynamic fingerprint of a legally connected reference terminal device, and the first detection result indicates whether there is a network address translation behavior.

[0279] Fig.10 A block diagram of a network address translation behavior detection device according to another embodiment of the present disclosure is schematically shown.

[0280] like Fig.10 The network address translation behavior detection device 1000 of the embodiment of the present disclosure includes, for example: a first detection instruction sending module 1010 and a first detection result receiving module 1020.

[0281] The first detection instruction sending module 1010 is used to send a first detection instruction.

[0282] The first detection instruction is used to trigger detection of a first detection result, which is obtained by matching a benchmark dynamic fingerprint with a dynamic fingerprint of a terminal device, the benchmark dynamic fingerprint is a dynamic fingerprint of a legally connected benchmark terminal device, the dynamic fingerprint of the terminal device is obtained based on a first response message, and the first response message is obtained by the terminal device in response to the first detection message.

[0283] The first detection result receiving module 1020 is used to receive the first detection result.

[0284] The first detection result indicates whether there is a network address translation behavior.

[0285] Fig.11 A block diagram of a network address translation behavior detection device according to another embodiment of the present disclosure is schematically shown.

[0286] like Fig.11 The network address translation behavior detection device 1100 of the embodiment of the present disclosure includes, for example: a dynamic fingerprint determination module 1110 , a dynamic fingerprint matching module 1120 , and a first detection result sending module 1130 .

[0287] The dynamic fingerprint determination module 1110 is configured to determine the dynamic fingerprint of the terminal device in response to the received first detection instruction and according to the first response message.

[0288] The first response message is obtained by the terminal device in response to the first detection message.

[0289] The dynamic fingerprint matching module 1120 is used to match the dynamic fingerprint of the terminal device with the reference dynamic fingerprint to obtain a first detection result.

[0290] The reference dynamic fingerprint is a dynamic fingerprint of a legally connected reference terminal device, and the first detection result indicates whether there is a network address translation behavior.

[0291] The first detection result sending module 1130 is used to send the first detection result.

[0292] It should be understood that the embodiments of the device part of the present disclosure are the same or similar to the embodiments of the method part of the present disclosure, and the technical problems solved and the technical effects achieved are also the same or similar, and the present disclosure will not go into details here.

[0293] Fig.12 The schematic diagram shows the structure of a network device according to an embodiment of the present disclosure.

[0294] like Fig.12As shown, the network device 1200 may include one or more processors 1201 (processors are central processing units, CPUs) and a memory 1205, in which one or more application programs or data are stored.

[0295] The memory 1205 may be a volatile storage or a persistent storage. The program stored in the memory 1205 may include one or more modules, each of which may include a series of instruction operations on the management server. Furthermore, the processor 1201 may be configured to communicate with the memory 1205 and execute a series of instruction operations in the memory 1205 on the network device 1200.

[0296] The processor 1201 is used to execute the computer program in the memory 1205, so that the network device 1200 is used to execute the computer program in the memory 1205. Figure 2A or Figure 2B The network address translation behavior detection method corresponding to the system architecture shown will not be repeated here.

[0297] The network device 1200 may also include one or more power supplies 1202, one or more wired or wireless network interfaces 1203, one or more input and output interfaces 1204, and / or one or more operating systems, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.

[0298] An embodiment of the present application further provides a network system, which includes a first network device and a second network device.

[0299] The first network device includes at least one first processor and a first memory in communication with the at least one first processor, wherein the first memory stores instructions executable by the at least one first processor, and the instructions are executed by the at least one first processor so that the at least one first processor can execute the instructions executed by the at least one first processor. Figure 2B The network address translation behavior detection method performed by the first network device shown.

[0300] The second network device includes at least one second processor and a second memory in communication with the at least one second processor, wherein the second memory stores instructions executable by the at least one second processor, and the instructions are executed by the at least one second processor so that the at least one second processor can execute the instructions executed by the at least one second processor. Figure 2B The network address translation behavior detection method performed by the second network device shown.

[0301] Exemplarily, the network system further includes a terminal device, the terminal device is connected to a second network device, and the first network device and the second network device are used to determine whether the terminal device is an abnormally accessed terminal device.

[0302] An embodiment of the present application also provides a network system, including a network device and a terminal device.

[0303] The network device includes at least one processor and a first memory in communication with the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the instructions executed by the at least one processor. Figure 2A The network address translation behavior detection method performed by the network device shown.

[0304] The terminal device is connected to the network device, and the network device is used to determine whether the terminal is an abnormally connected terminal device.

[0305] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loading and executing computer program instructions on a computer, all or part of the processes (or functions) described in the embodiments of the present application are implemented. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or may contain one or more servers, data centers and other data storage devices that can be integrated with the medium. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)), etc. In the embodiment of the present application, the computer may include the aforementioned device.

[0306] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0307] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for detecting network address translation behavior, characterized in that: include: Determine a dynamic fingerprint of the terminal device according to the first response message, wherein the first response message is obtained by the terminal device in response to the first detection message; A first detection result is obtained by matching the benchmark dynamic fingerprint with the dynamic fingerprint of the terminal device, wherein the benchmark dynamic fingerprint is the dynamic fingerprint of a legally connected benchmark terminal device, and the first detection result indicates whether there is a network address translation behavior.

2. The method according to claim 1, characterized in that Also includes: A traffic behavior detection is performed on the message from the terminal device to obtain a second detection result, wherein the second detection result indicates whether there is a network address translation behavior.

3. The method according to claim 1, characterized in that Also includes: Determine the static fingerprint of the terminal device according to the message parsing result, wherein the message parsing result is obtained by parsing the message from the terminal device; The static fingerprint of the terminal device is matched with the static fingerprint of a reference device to determine a terminal device detection result, wherein the terminal device detection result represents the device quantity and / or device attributes of the target terminal device where the network address translation behavior occurs.

4. The method according to claim 1, characterized in that: Also includes: Determine the static fingerprint of the terminal device according to the message parsing result, wherein the message parsing result is obtained by parsing the message from the terminal device; A third detection result is obtained by matching the benchmark static fingerprint with the static fingerprint of the terminal device, wherein the benchmark static fingerprint is the static fingerprint of a legally connected benchmark terminal device, and the third detection result indicates whether the network address translation behavior exists.

5. The method according to claim 2 or 4, characterized in that: Also includes: A target detection result is determined according to the second detection result and / or the third detection result and the first detection result, wherein the target detection result indicates whether the network address translation behavior exists.

6. The method according to any one of claims 1 to 5, characterized in that Also includes: In the case where the network address translation behavior occurs, the target terminal device where the network address translation behavior occurs is determined as an abnormally accessed terminal device.

7. The method according to any one of claims 1 to 5, characterized in that Also includes: In the case that the network address translation behavior exists and the number of target terminal devices that have undergone the network address translation behavior is greater than or equal to a terminal quantity threshold, the target terminal device is determined as an abnormally accessed terminal device.

8. The method according to claim 1, characterized in that: Also includes: The reference dynamic fingerprint is determined according to the second response message, wherein the reference terminal device is an authenticated terminal device accessing for the first time, and the second response message is obtained by the reference terminal device responding to the second detection message.

9. The method according to claim 2, characterized in that: in, The performing flow behavior detection on the message from the terminal device to obtain a second detection result includes: Use a machine learning model to perform traffic behavior detection on the message from the terminal device to obtain the second detection result.

10. The method according to claim 9, characterized in that in, The machine learning model includes at least one of a pre-trained first machine learning model and an online trained second machine learning model; when the machine learning model includes the first machine learning model and the machine learning model, performing traffic behavior detection on the message from the terminal device using the machine learning model to obtain the second detection result includes: Using the first machine learning model to perform traffic behavior detection on the message from the terminal device to obtain a first machine learning model detection result; Using the second machine learning model to perform traffic behavior detection on the message from the terminal device to obtain a second machine learning model detection result; Determine the second detection result based on the first machine learning model detection result and the second machine learning model detection result.

11. The method according to claim 10, characterized in that Also includes: Collect traffic behavior samples, wherein the traffic behavior samples are used to train the second machine learning model.

12. The method according to claim 11, characterized in that Also includes: An initial second machine learning model is trained according to the traffic behavior samples to obtain the second machine learning model.

13. The method according to claim 2, characterized in that in, The performing flow behavior detection on the message from the terminal device to obtain a second detection result includes: Collecting statistics on the messages from the terminal device to obtain flow behavior detection results of the messages; The second detection result is determined according to the traffic behavior detection result and the traffic behavior benchmark detection result, wherein the traffic behavior benchmark detection result is obtained by counting the messages from the benchmark terminal device.

14. A method for detecting network address translation behavior, characterized in that: include: Sending a first detection instruction, wherein the first detection instruction is used to trigger detection of a first detection result, the first detection result is obtained by matching a benchmark dynamic fingerprint with a dynamic fingerprint of a terminal device, the benchmark dynamic fingerprint is a dynamic fingerprint of a legally connected benchmark terminal device, the dynamic fingerprint of the terminal device is obtained according to a first response message, and the first response message is obtained by the terminal device in response to the first detection message; The first detection result is received, wherein the first detection result indicates whether a network address translation behavior exists.

15. The method according to claim 14, characterized in that Also includes: Sending a second detection instruction, wherein the second detection instruction is used to trigger detection of a second detection result, and the second detection result is obtained by performing traffic behavior detection on a message from the terminal device; The second detection result is received, wherein the second detection result indicates whether a network address translation behavior exists.

16. The method according to claim 14, characterized in that Also includes: Sending a terminal device detection instruction, wherein the terminal device detection instruction is used to trigger detection of a terminal device detection result, wherein the terminal device detection result is obtained by matching a static fingerprint of the terminal device with a static fingerprint of a reference device, wherein the static fingerprint of the terminal device is determined according to a message parsing result, wherein the message parsing result is obtained by parsing a message from the terminal device; The terminal device detection result is received, where the terminal device detection result represents the number of devices and / or device attributes of the target terminal devices where the network address translation behavior occurs.

17. The method according to claim 14, characterized in that Also includes: Sending a third detection instruction, wherein the third detection instruction is used to trigger detection of the third detection result, the third detection result is obtained by matching the benchmark static fingerprint with the static fingerprint of the terminal device, the static fingerprint of the terminal device is determined according to the message parsing result, the message parsing result is obtained by parsing the message from the terminal device, and the benchmark static fingerprint is the static fingerprint of the legally connected benchmark terminal device; The third detection result is received, wherein the third detection result indicates whether the network address translation behavior exists.

18. The method according to any one of claims 14 to 17, characterized in that: Also includes: Receiving partial detection results in the full detection result, wherein the full detection result includes the first detection result, the second detection result, the third detection result, and the terminal device detection result; Perform the remaining detection to obtain the remaining detection results in the full detection result.

19. The method according to claim 15 or 17, characterized in that: Also includes: A target detection result is determined according to the second detection result and / or the third detection result and the first detection result, wherein the target detection result indicates whether the network address translation behavior exists.

20. The method according to claim 15, characterized in that Also includes: An initial second machine learning model is trained online according to the traffic behavior samples to obtain a second machine learning model, wherein the second machine learning model is used to perform traffic behavior detection to determine the second detection result.

21. The method according to claim 20, characterized in that Also includes: The second machine learning model is used to perform traffic behavior detection on the message from the terminal device to obtain a second machine learning model detection result, and the second machine learning model detection result is used to determine the first detection result.

22. A method for detecting network address translation behavior, characterized in that: include: In response to the received first detection instruction, determining a dynamic fingerprint of the terminal device according to a first response message, wherein the first response message is obtained by the terminal device responding to the first detection message; Matching the dynamic fingerprint of the terminal device with the benchmark dynamic fingerprint to obtain a first detection result, wherein the benchmark dynamic fingerprint is a dynamic fingerprint of a legally connected benchmark terminal device, and the first detection result indicates whether there is a network address translation behavior; The first detection result is sent.

23. The method according to claim 22, characterized in that Also includes: In response to the received second detection instruction, a traffic behavior detection is performed on the message from the terminal device to obtain a second detection result, wherein the second detection result indicates whether there is a network address translation behavior.

24. The method according to claim 22, characterized in that Also includes: In response to the received terminal device detection instruction, determine the static fingerprint of the terminal device according to the message parsing result, wherein the message parsing result is obtained by parsing the message from the terminal device; According to the matching of the static fingerprint of the terminal device with the static fingerprint of the reference device, a terminal device detection result is determined, wherein the terminal device detection result represents the number of devices and / or device attributes of the target terminal devices where the network address translation behavior occurs; Send the terminal device detection result.

25. The method according to claim 22, characterized in that Also includes: In response to the received third detection instruction, determining the static fingerprint of the terminal device according to a message parsing result, wherein the message parsing result is obtained by parsing a message from the terminal device; Matching the static fingerprint of the terminal device with the benchmark static fingerprint to obtain a third detection result, wherein the benchmark static fingerprint is a static fingerprint of a legally connected benchmark terminal device, and the third detection result indicates whether the network address translation behavior exists; The third detection result is sent.

26. A network address translation behavior detection device, characterized in that: include: A dynamic fingerprint determination module, configured to determine a dynamic fingerprint of a terminal device according to a first response message, wherein the first response message is obtained by the terminal device in response to the first detection message; The dynamic fingerprint matching module is used to match the dynamic fingerprint of the terminal device with the benchmark dynamic fingerprint to obtain a first detection result, wherein the benchmark dynamic fingerprint is the dynamic fingerprint of the legally connected benchmark terminal device, and the first detection result indicates whether there is a network address translation behavior.

27. A network address translation behavior detection device, characterized in that: include: A first detection instruction sending module, used to send a first detection instruction, wherein the first detection instruction is used to trigger detection of a first detection result, the first detection result is obtained by matching a reference dynamic fingerprint with a dynamic fingerprint of a terminal device, the reference dynamic fingerprint is a dynamic fingerprint of a legally connected reference terminal device, the dynamic fingerprint of the terminal device is obtained according to a first response message, and the first response message is obtained by the terminal device in response to the first detection message; The first detection result receiving module is used to receive the first detection result, wherein the first detection result indicates whether there is a network address translation behavior.

28. A network address translation behavior detection device, characterized in that: include: A dynamic fingerprint determination module, configured to determine a dynamic fingerprint of a terminal device in response to a received first detection instruction and according to a first response message, wherein the first response message is obtained by the terminal device in response to the first detection message; A dynamic fingerprint matching module, configured to match a dynamic fingerprint of the terminal device with a reference dynamic fingerprint to obtain a first detection result, wherein the reference dynamic fingerprint is a dynamic fingerprint of a legally connected reference terminal device, and the first detection result indicates whether there is a network address translation behavior; The first detection result sending module is used to send the first detection result.

29. A network device, characterized in that: comprising at least one processor and a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 25.

30. A network system, characterized in that: comprising a first network device and a second network device, The first network device comprises at least one first processor and a first memory in communication with the at least one first processor, the first memory stores instructions executable by the at least one first processor, and the instructions are executed by the at least one first processor so that the at least one first processor can execute the method according to any one of claims 14 to 21; The second network device includes at least one second processor and a second memory communicatively connected to the at least one second processor, the second memory storing instructions executable by the at least one second processor, the instructions being executed by the at least one second processor so that the at least one second processor can execute the method described in any one of claims 22-25.

31. The network system according to claim 30, characterized in that: The network system also includes a terminal device, the terminal device is connected to the second network device, and the first network device and the second network device are used to determine whether the terminal device is an abnormally connected terminal device.

32. A network system, characterized in that: Including network equipment and terminal equipment, The network device comprises at least one processor and a first memory communicatively connected to the at least one processor, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method according to any one of claims 1 to 13; The terminal device is connected to the network device, and the network device is used to determine whether the terminal is an abnormally connected terminal device.

Images