Abnormal traffic interception method and device, equipment, medium and program product

Abstract

The invention discloses an abnormal traffic interception method and device, equipment, a medium and a program product, and the method comprises the steps: copying target traffic at a target communication interface, and obtaining target copied traffic; wherein the target communication interface comprises a first communication interface or a second communication interface, the first communication interface is connected with the base station equipment and the service gateway equipment, and the second communication interface is connected with the service gateway equipment and the packet data gateway equipment; identifying abnormal information in the target copy traffic according to preset abnormal information, and intercepting the target traffic; determining a first target terminal and a second target terminal according to the transmission link of the target traffic; and generating an interception message according to the traffic information of the target traffic, and respectively sending the interception message to the first target terminal and the second target terminal. That is, according to the scheme of the invention, the abnormal traffic can be intercepted between the base station equipment and the service gateway equipment or between the service gateway equipment and the packet data gateway equipment, so that the security of mobile communication is improved.

Description

Technical Field

[0001] The present application relates to the field of mobile communication technology, and in particular to an abnormal traffic interception method, device, equipment, medium and program product. Background Art

[0002] With the continuous expansion of 4G (fourth-generation mobile communication technology) and 5G (fifth-generation mobile communication technology) mobile networks, the security prevention and control of mobile communications has become increasingly severe, so as to prevent users from receiving bad information contained in abnormal traffic through mobile communications.

[0003] At present, traffic is sent to user equipment via base station equipment, service gateway equipment, packet data gateway equipment and the communication network link of user equipment. After the abnormal traffic is blocked between the packet data gateway equipment and the user equipment, the abnormal traffic is processed by traffic injection to intercept the abnormal traffic. Traffic injection processing refers to injecting the normal traffic obtained after cleaning the abnormal traffic into the access end and the accessed end through the injection interface and injection route. At this time, the access end and the accessed end are both injection points.

[0004] However, for abnormal traffic sent by roaming users entering the local network from other networks (such as roaming networks), the reinjection point during traffic reinjection processing is located at the home location of the roaming user. If the home location is outside the country, the reinjection point cannot be accessed due to inaccessibility, and the traffic reinjection processing of abnormal traffic cannot be implemented between the packet data gateway device and the customer device, which in turn affects the security of mobile communications. Summary of the invention

[0005] The present application provides an abnormal traffic interception method, device, equipment, medium and program product to solve the problem in the prior art that if the abnormal traffic is located outside the country, it will be impossible to access the re-injection point due to the inability to access it, so that the traffic re-injection processing of the abnormal traffic cannot be implemented between the packet data gateway device and the customer device, thereby affecting the security of mobile communications.

[0006] In a first aspect, the present application provides an abnormal traffic interception method, which is applied to an interception device, and the method includes:

[0007] Copying the target traffic at the target communication interface to obtain the target copied traffic; wherein the target communication interface includes a first communication interface or a second communication interface, the first communication interface is used to connect the base station device and the service gateway device, and the second communication interface is used to connect the service gateway device and the packet data gateway device;

[0008] Identify abnormal information in the target replication traffic according to preset abnormal information, and intercept the target traffic;

[0009] Determine a first target terminal and a second target terminal according to the transmission link of the target traffic; wherein the first target terminal is the next transmission node of the transmission link of the target traffic, and the second target terminal is the previous transmission node of the transmission link of the target traffic;

[0010] An intercept message is generated according to the traffic information of the target traffic, and the intercept message is sent to the first target terminal and the second target terminal respectively; wherein the intercept message is used to interrupt the data transmission between the transmission starting point of the target traffic and the transmission end point of the target traffic.

[0011] In a second aspect, the present application provides an abnormal traffic interception device, which is configured in an interception device, and the device includes:

[0012] A replication module, configured to replicate the target traffic at a target communication interface to obtain target replication traffic; wherein the target communication interface includes a first communication interface or a second communication interface, the first communication interface is used to connect a base station device with a serving gateway device, and the second communication interface is used to connect the serving gateway device with a packet data gateway device;

[0013] An interception module, used to identify abnormal information in the target replication traffic according to preset abnormal information, and intercept the target traffic;

[0014] A terminal determination module, configured to determine a first target terminal and a second target terminal according to a transmission link of the target flow; wherein the first target terminal is a next transmission node of the transmission link of the target flow, and the second target terminal is a previous transmission node of the transmission link of the target flow;

[0015] A sending module is used to generate an intercept message according to the traffic information of the target traffic, and send the intercept message to the first target terminal and the second target terminal respectively; wherein the intercept message is used to interrupt the data transmission between the transmission starting point of the target traffic and the transmission end point of the target traffic.

[0016] In a third aspect, the present application provides an interception device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, the abnormal traffic interception method as described in any embodiment of the present application is implemented.

[0017] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the abnormal traffic interception method as described in any embodiment of the present application.

[0018] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the abnormal traffic interception method as described in any embodiment of the present application.

[0019] The scheme of the present application copies the target traffic at the target communication interface to obtain the target copied traffic; wherein the target communication interface includes a first communication interface or a second communication interface, the first communication interface is used to connect the base station device and the service gateway device, and the second communication interface is used to connect the service gateway device and the packet data gateway device; according to the preset abnormal information, the abnormal information in the target copied traffic is identified, and the target traffic is intercepted; according to the transmission link of the target traffic, the first target terminal and the second target terminal are determined; wherein the first target terminal is the next transmission node of the transmission link of the target traffic, and the second target terminal is the previous transmission node of the transmission link of the target traffic; an intercept message is generated according to the traffic information of the target traffic, and the intercept message is sent to the first target terminal and the second target terminal respectively; wherein the intercept message is used to interrupt the data transmission between the transmission starting point of the target traffic and the transmission end point of the target traffic. That is, the solution of the present application, after determining the abnormal information in the target traffic, generates an intercept message according to the traffic information of the target traffic, and sends the intercept message to the first target terminal and the second target terminal, thereby interrupting the data transmission between the base station device and the service gateway device, or interrupting the data transmission between the service gateway device and the packet data gateway device, so that the abnormal traffic can be intercepted between the base station device and the service gateway device, or between the service gateway device and the packet data gateway device without accessing the re-injection point, thereby improving the security of mobile communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 It is a flowchart of the abnormal traffic interception method provided by this application;

[0022] Figure 2a is another flow chart of the abnormal traffic interception method provided by the present application;

[0023] Figure 2b It is an exemplary communication network traffic transmission link of the abnormal traffic interception method provided by the present application;

[0024] Figure 3 It is a structural schematic diagram of the abnormal flow interception device provided by the present application;

[0025] Figure 4 It is a structural schematic diagram of the interception device provided by this application. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Figure 1 The present invention provides a flowchart of an abnormal traffic interception method. The method can be performed by an abnormal traffic interception device, which can be implemented in software and / or hardware. In a specific embodiment, the device can be applied to an interception device, which can be a computer or a server. The following embodiments will be described by taking the application of the device in an interception device as an example. Figure 1 , the method may specifically include the following steps:

[0029] Step 101, copy the target traffic at the target communication interface to obtain the target copy traffic.

[0030] The target communication interface includes a first communication interface or a second communication interface, the first communication interface is used to connect the base station device with the service gateway device, and the second communication interface is used to connect the service gateway device with the packet data gateway device.

[0031] Specifically, traffic refers to data transmitted in a communication network. In the traffic transmission link of the communication network, traffic is sent from a base station device to a service gateway device, then from the service gateway device to a packet data gateway device, and then from the packet data gateway device to a user device. The interface connecting the base station device and the service gateway device is a first communication interface, that is, data is transmitted between the base station device and the service gateway device through the first communication interface. For example, the first communication interface may be an S1-U interface. The interface connecting the service gateway device and the packet data gateway device is a second communication interface, that is, data is transmitted between the service gateway device and the packet data gateway device through the second communication interface. For example, the second communication interface may be an S5 / S8 interface. Copying the target traffic refers to copying the data content of the target traffic for subsequent analysis. Copying the target traffic at the target communication interface means copying the target traffic passing through the target communication interface to obtain the target copied traffic.

[0032] Optionally, the interception device includes a device connected in parallel between the base station device and the service gateway device, or the interception device includes a device connected in parallel between the service gateway device and the packet data gateway device.

[0033] Specifically, the interception device can be a device connected between the access base station device and the service gateway device, in which case the target communication interface includes a first communication interface, and the interception device is used to process the traffic at the first communication interface, that is, to execute the abnormal traffic interception method of this embodiment. The interception device can also be a device connected between the access service gateway device and the packet data gateway device, in which case the target communication interface includes a second communication interface, and the interception device is used to process the traffic at the second communication interface, that is, to execute the abnormal traffic interception method of this embodiment. When the interception device is connected to the communication network, there is no need to change the original connection structure of the communication network, thereby facilitating the processing of abnormal traffic. In addition, the interface between the access base station device and the service gateway device of 2G (second generation mobile communication technology), 3G (third generation mobile communication technology), 4G and 5G networks, and the interface between the service gateway device and the packet data gateway device are the same, and only the interface between the packet data gateway device and the user equipment is different. Therefore, when connecting the interception device between the base station device and the service gateway device, or between the service gateway device and the packet data gateway device, there is no need to consider the type of communication network, that is, when the communication network is a 2G, 3G, 4G or 5G network, the interception device can process abnormal traffic.

[0034] For example, Figure 2b is an exemplary communication network traffic transmission link of the abnormal traffic interception method provided by this application. Figure 2bAs shown, traffic is sent from the base station device to the service gateway device, then sent from the service gateway device to the packet data gateway device, and then sent from the packet data gateway device to the user device. The interface connecting the base station device and the service gateway device is the first communication interface, and the interface connecting the service gateway device and the packet data gateway device is the second communication interface. The interception device can be connected between the base station device and the service gateway device based on the first communication interface, or can be connected between the service gateway device and the packet data gateway device based on the second communication interface.

[0035] Optionally, copying the target traffic at the target communication interface to obtain the target copy traffic can be achieved through step 11.

[0036] Step 11, using link splitting technology or traffic mirroring, copy the target traffic on the target communication interface to obtain the target copy traffic.

[0037] Specifically, link splitting technology can copy the access optical fiber transmission signal through the splitter, so as to collect traffic without affecting the original link transmission. Traffic mirroring can copy the traffic passing through the target communication interface without affecting the normal processing of traffic by the device. Link splitting technology or traffic mirroring is used to copy the target traffic on the target communication interface to obtain the target copy traffic.

[0038] Optionally, the target traffic is traffic encapsulated according to the target encapsulation method, and the target traffic is copied at the target communication interface to obtain the target copied traffic, which can be achieved through steps 12 to 14.

[0039] Step 12: Determine the traffic parsing method according to the target encapsulation method.

[0040] Specifically, since the target traffic is the traffic passing through the first communication interface or the second communication interface, the target traffic is the traffic encapsulated according to the target encapsulation method, and the target encapsulation method is an encapsulation method that enables the traffic to be transmitted on the first communication interface or the second communication interface. For example, when the first communication interface is the S1-U interface and the second communication interface is the S5 / S8 interface, the target encapsulation method is to encapsulate the traffic into the traffic format of GTPv2 (GPRS Tunneling Protocol version 2, GPRS Tunneling Protocol version 2), that is, the target traffic is the traffic format of GTPv2 traffic obtained after encapsulation according to the GTPv2 protocol. In addition, when the communication network is a 2G, 3G, 4G or 5G network, the GTPv2 protocol is encapsulated, so there is no need to consider the type of communication network, and the interception device can process any communication network. According to the target encapsulation method of the target traffic, the traffic parsing method corresponding to the target encapsulation method is determined, that is, the method that can unpack the encapsulation and obtain traffic information.

[0041] Step 13: parse the target traffic according to the traffic parsing method at the target communication interface to obtain the parsed target traffic information.

[0042] Specifically, after determining the traffic parsing method, the target traffic is parsed at the target communication interface according to the traffic parsing method, that is, the encapsulation of the target traffic is unpacked to obtain the parsed target traffic information.

[0043] Step 14: copy the target flow according to the parsed target flow information to obtain the target copy flow.

[0044] Specifically, the target flow is copied according to the parsed target flow information to obtain the target copy flow, so the flow information in the target copy flow is consistent with the target flow information.

[0045] Step 102, identifying abnormal information in the target replication traffic according to preset abnormal information, and intercepting the target traffic.

[0046] Specifically, traffic anomaly refers to traffic that includes information that is not suitable for users to receive, such as fraud information. Preset abnormal information is preset information that can determine traffic anomaly. For example, the preset abnormal information can be abnormal identification information, abnormal international mobile user identity code, abnormal international mobile equipment identity code, abnormal uniform resource locator, and abnormal string information. According to the preset abnormal information, the information in the target duplicate traffic is identified, such as determining whether the information in the target duplicate traffic contains the preset abnormal information, and when it is determined that the information in the target duplicate traffic contains the preset abnormal information, the target traffic is intercepted.

[0047] Optionally, identifying abnormal information in the target replication traffic according to preset abnormal information may be implemented through steps 21 and 22.

[0048] Step 21: determine characteristic information in the target replication traffic.

[0049] Specifically, in the target duplicate traffic, characteristic information in the target duplicate traffic is determined. The characteristic information is information that can characterize the characteristics of the target duplicate traffic, such as identification information of the target duplicate traffic, the international mobile subscriber identity of the target duplicate traffic, the international mobile equipment identity of the target duplicate traffic, the uniform resource locator of the target duplicate traffic, and the character string information of the target duplicate traffic.

[0050] Step 22: Use the information in the characteristic information that matches the preset abnormal information as the abnormal information in the target replication traffic.

[0051] Specifically, the information in the characteristic information that matches the preset abnormal information, that is, the information in the characteristic information that is consistent with the preset abnormal information, is used as the abnormal information in the target replication traffic.

[0052] Exemplarily, the characteristic information includes the string information of the target replication traffic as A, and the abnormal string information in the preset abnormal information is A. Since the string information of the target replication traffic in the characteristic information is consistent with the abnormal string information in the preset abnormal information, it is determined that the abnormal information in the target replication traffic is the string information of the target replication traffic as A.

[0053] Step 103: determine the first target terminal and the second target terminal according to the transmission link of the target traffic.

[0054] The first target terminal is the next transmission node of the transmission link of the target traffic, and the second target terminal is the previous transmission node of the transmission link of the target traffic.

[0055] Specifically, the transmission link of the target traffic is the transmission link of the target traffic in the communication network. The first target terminal is the next transmission node of the transmission link of the target traffic, and the second target terminal is the previous transmission node of the transmission link of the target traffic. If the target communication interface is the first communication interface, the next transmission node of the target traffic copied at the target communication interface is the service gateway device, and the previous transmission node of the target traffic is the base station device, that is, at this time, the first target terminal is the service gateway device, and the second target terminal is the base station device. If the target communication interface is the second communication interface, the next transmission node of the target traffic copied at the target communication interface is the packet data gateway device, and the previous transmission node of the target traffic is the service gateway device, that is, at this time, the first target terminal is the packet data gateway device, and the second target terminal is the service gateway device.

[0056] Step 104: Generate an intercept message according to the traffic information of the target traffic, and send the intercept message to the first target terminal and the second target terminal respectively.

[0057] The intercept message is used to interrupt the data transmission between the transmission start point of the target traffic and the transmission end point of the target traffic.

[0058] Specifically, the transmission starting point of the target traffic is the source device of the target traffic in the communication network, that is, the device that sends the target traffic. The transmission end point of the target traffic is the target device of the target traffic in the communication network, that is, the device that receives the target traffic. The intercept message generated according to the traffic information of the target traffic includes information that can interrupt the data transmission between the transmission starting point of the target traffic and the transmission end point of the target traffic, such as sending information to terminate the communication to the transmission starting point of the target traffic and the transmission end point of the target traffic respectively. The intercept message is generated according to the traffic information of the target traffic, so that the intercept message can be sent to the first target terminal and the second target terminal respectively, transmitted in the communication network transmission link via the first target terminal and the second target terminal, and finally sent to the transmission starting point of the target traffic and the transmission end point of the target traffic, thereby interrupting the data transmission between the transmission starting point of the target traffic and the transmission end point of the target traffic.

[0059] Exemplarily, the traffic information of the target traffic is information sent by the device of the transmission starting point of the target traffic to invite the device user of the transmission terminal of the target traffic to click link A. The intercept message generated at this time includes the device connection failure information between the device of the transmission starting point of the target traffic and the device of the transmission terminal of the target traffic. The intercept message is transmitted via the first target terminal and the second target terminal in the communication network transmission link, and is finally sent to the transmission starting point of the target traffic and the transmission end point of the target traffic, thereby interrupting the data transmission between the transmission starting point of the target traffic and the transmission end point of the target traffic.

[0060] Optionally, after executing steps 12 to 14, generating an intercept message according to the traffic information of the target traffic, and sending the intercept message to the first target terminal and the second target terminal respectively can also be achieved through steps 41 to 42.

[0061] Step 41, generating interception information according to the flow information of the target flow.

[0062] Specifically, after parsing the target traffic, interception information is generated according to the traffic information of the target traffic, that is, interception information capable of interrupting data transmission between the transmission start point and the transmission end point of the target traffic is generated according to the information contained in the target traffic.

[0063] Step 42, encapsulate the interception information according to the target encapsulation method to obtain an interception message, and send the interception message to the first target terminal and the second target terminal respectively.

[0064] Specifically, after the interception information is obtained, the interception information is encapsulated according to the target encapsulation method to obtain an interception message, and the interception message is sent to the first target terminal and the second target terminal respectively. Therefore, the interception message and the target traffic are traffic encapsulated in the same encapsulation method, so that the device in the communication network can transmit the interception message.

[0065] Exemplarily, the interception information is a reset message of the transmission control protocol, and the target encapsulation method is GPRS Tunnelling Protocol (GTP) encapsulation. The reset message of the transmission control protocol is GTP encapsulated, and the encapsulation content also includes identification information of the port that the interception information needs to access. After encapsulation, the interception message is obtained and sent to the first target terminal and the second target terminal respectively.

[0066] The scheme of the present application copies the target traffic at the target communication interface to obtain the target copied traffic; wherein the target communication interface includes a first communication interface or a second communication interface, the first communication interface is used to connect the base station device and the service gateway device, and the second communication interface is used to connect the service gateway device and the packet data gateway device; according to the preset abnormal information, the abnormal information in the target copied traffic is identified, and the target traffic is intercepted; according to the transmission link of the target traffic, the first target terminal and the second target terminal are determined; wherein the first target terminal is the next transmission node of the transmission link of the target traffic, and the second target terminal is the previous transmission node of the transmission link of the target traffic; an intercept message is generated according to the traffic information of the target traffic, and the intercept message is sent to the first target terminal and the second target terminal respectively; wherein the intercept message is used to interrupt the data transmission between the transmission starting point of the target traffic and the transmission end point of the target traffic. That is, the solution of the present application, after determining the abnormal information in the target traffic, generates an intercept message according to the traffic information of the target traffic, and sends the intercept message to the first target terminal and the second target terminal, thereby interrupting the data transmission between the base station device and the service gateway device, or interrupting the data transmission between the service gateway device and the packet data gateway device, so that the abnormal traffic can be intercepted between the base station device and the service gateway device, or between the service gateway device and the packet data gateway device without accessing the re-injection point, thereby improving the security of mobile communications.

[0067] Figure 2a is another flow chart of the abnormal traffic interception method provided by the present application. Figure 1 Based on the illustrated embodiment and various optional implementation schemes, when the intercept message includes a first intercept message and a second intercept message, and the first intercept message and the second intercept message are reverse messages, the steps of sending the intercept message to the first target terminal and the second target terminal are described in detail. Figure 2a As shown, the method may include the following steps:

[0068] Step 201, copy the target traffic at the target communication interface to obtain the target copy traffic.

[0069] Step 202, identifying abnormal information in the target duplicate traffic according to preset abnormal information, and intercepting the target traffic.

[0070] Step 203: determine the first target terminal and the second target terminal according to the transmission link of the target traffic.

[0071] Step 204: Generate a first intercept message according to the first flow information of the target flow, and generate a second intercept message according to the second flow information of the target flow.

[0072] The first flow information is used to characterize the received information at the transmission start point, and the second flow information is used to characterize the received information at the transmission end point.

[0073] Specifically, the first intercept message and the second intercept message are reverse messages representing that the first intercept message and the second intercept message are sent to the transmission starting point and the transmission end point of the target traffic, respectively. The first flow information in the target traffic is used to represent the receiving information of the transmission starting point, that is, the information received by the transmission starting point after the target traffic is transmitted. The second flow information in the target traffic is used to represent the receiving information of the transmission end point, that is, the information received by the transmission end point after the target traffic is transmitted. A first intercept message is generated based on the first flow information of the target traffic, so that the first intercept message can be sent to the transmission starting point via the first target terminal, and a second intercept message is generated based on the second flow information of the target traffic, so that the second intercept message can be sent to the transmission end point via the second target terminal. The first intercept message and the second intercept message are used to jointly interrupt the data transmission between the transmission starting point of the target traffic and the transmission end point of the target traffic.

[0074] Exemplarily, the traffic information of the target traffic is information sent by the device at the transmission starting point of the target traffic, inviting the device user at the transmission terminal of the target traffic to click link A. At this time, the first interception message generated includes information that the device user at the transmission terminal of the target traffic did not click link A, and the second interception message generated includes information that link A is not included in the target traffic.

[0075] Step 205: Send the first intercept message to the first target terminal, and send the second intercept message to the second target terminal.

[0076] Specifically, the first intercept message is sent to the first target terminal, and the second intercept message is sent to the second target terminal, so that the first intercept message can be sent to the transmission starting point, and the second intercept message can be sent to the transmission end point. Thus, the data transmission between the transmission starting point of the target flow and the transmission end point of the target flow is interrupted by the first intercept message and the second intercept message.

[0077] The solution of the present application generates a first intercept message according to the first flow information of the target flow, and generates a second intercept message according to the second flow information of the target flow, so that the first intercept message is more suitable for obtaining the transmission starting point of the target flow, and the second intercept message is more suitable for obtaining the transmission end point of the target flow, thereby improving the efficiency of data transmission between the transmission starting point of the interrupted target flow and the transmission end point of the target flow, and further improving the security of mobile communications.

[0078] Figure 3 Schematic diagram of the structure of the abnormal traffic interception device provided by the present application. The device is configured in an interception device and is suitable for executing the abnormal traffic interception method provided by the present application. Figure 3 As shown, the device may specifically include:

[0079] A replication module 301 is used to replicate the target traffic at the target communication interface to obtain the target replication traffic; wherein the target communication interface includes a first communication interface or a second communication interface, the first communication interface is used to connect the base station device and the serving gateway device, and the second communication interface is used to connect the serving gateway device and the packet data gateway device;

[0080] An interception module 302, configured to identify abnormal information in the target replication traffic according to preset abnormal information, and intercept the target traffic;

[0081] The terminal determination module 303 is used to determine a first target terminal and a second target terminal according to the transmission link of the target flow; wherein the first target terminal is the next transmission node of the transmission link of the target flow, and the second target terminal is the previous transmission node of the transmission link of the target flow;

[0082] The sending module 304 is used to generate an intercept message according to the traffic information of the target traffic, and send the intercept message to the first target terminal and the second target terminal respectively; wherein the intercept message is used to interrupt the data transmission between the transmission starting point of the target traffic and the transmission end point of the target traffic.

[0083] In one embodiment, the replication module 301 is specifically used to: adopt link splitting technology or traffic mirroring to replicate the target traffic on the target communication interface to obtain the target replicated traffic.

[0084] In one embodiment, the interception module 302, in terms of identifying abnormal information in the target replication traffic based on preset abnormal information, is specifically used to: determine characteristic information in the target replication traffic; and use information in the characteristic information that matches the preset abnormal information as the abnormal information in the target replication traffic.

[0085] In one embodiment, the intercept message includes a first intercept message and a second intercept message, and the first intercept message and the second intercept message are reverse messages; the sending module 304 is specifically used to: generate the first intercept message according to the first flow information of the target flow, and generate the second intercept message according to the second flow information of the target flow; wherein the first flow information is used to characterize the receiving information of the transmission starting point, and the second flow information is used to characterize the receiving information of the transmission end point; send the first intercept message to the first target terminal, and send the second intercept message to the second target terminal.

[0086] In one embodiment, the target traffic is traffic encapsulated according to a target encapsulation method, and the replication module 301 is specifically used to: determine a traffic parsing method according to the target encapsulation method; parse the target traffic according to the traffic parsing method at the target communication interface to obtain parsed target traffic information; and replicate the target traffic according to the parsed target traffic information to obtain target replicated traffic.

[0087] In one embodiment, the sending module 304 is specifically used to: generate interception information according to the traffic information of the target traffic; encapsulate the interception information according to the target encapsulation method to obtain the interception message, and send the interception message to the first target terminal and the second target terminal respectively.

[0088] In one embodiment, the interception device includes a device connected in parallel between the base station device and the serving gateway device, or the interception device includes a device connected in parallel between the serving gateway device and the packet data gateway device.

[0089] The device of the present application copies the target traffic at the target communication interface to obtain the target copied traffic; wherein the target communication interface includes a first communication interface or a second communication interface, the first communication interface is used to connect the base station device and the service gateway device, and the second communication interface is used to connect the service gateway device and the packet data gateway device; according to the preset abnormal information, the abnormal information in the target copied traffic is identified, and the target traffic is intercepted; according to the transmission link of the target traffic, the first target terminal and the second target terminal are determined; wherein the first target terminal is the next transmission node of the transmission link of the target traffic, and the second target terminal is the previous transmission node of the transmission link of the target traffic; an intercept message is generated according to the traffic information of the target traffic, and the intercept message is sent to the first target terminal and the second target terminal respectively; wherein the intercept message is used to interrupt the data transmission between the transmission starting point of the target traffic and the transmission end point of the target traffic. That is, the solution of the present application, after determining the abnormal information in the target traffic, generates an intercept message according to the traffic information of the target traffic, and sends the intercept message to the first target terminal and the second target terminal, thereby interrupting the data transmission between the base station device and the service gateway device, or interrupting the data transmission between the service gateway device and the packet data gateway device, so that the abnormal traffic can be intercepted between the base station device and the service gateway device, or between the service gateway device and the packet data gateway device without accessing the re-injection point, thereby improving the security of mobile communications.

[0090] The present application also provides an interception device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the abnormal traffic interception method provided in any of the above embodiments is implemented.

[0091] The present application also provides a computer-readable medium on which a computer program is stored. When the program is executed by a processor, the abnormal traffic interception method provided in any of the above embodiments is implemented.

[0092] Reference below Figure 4 , which shows a schematic structural diagram of an interception device 400 suitable for implementing the present application. Figure 4 The interception device shown is merely an example and should not bring any limitation to the functionality and scope of use of the present application.

[0093] like Figure 4As shown, the interception device 400 includes a central processing unit (CPU) 401, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 402 or the program loaded from the storage part 408 into the random access memory (RAM) 403. In the RAM 403, various programs and data required for the operation of the interception device 400 are also stored. The CPU 401, the ROM 402 and the RAM 403 are connected to each other through a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0094] The following components are connected to the I / O interface 405: an input section 406 including a keyboard, a mouse, etc.; an output section 407 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 408 including a hard disk, etc.; and a communication section 409 including a network interface card such as a LAN card, a modem, etc. The communication section 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the I / O interface 405 as needed. A removable medium 411, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 410 as needed, so that a computer program read therefrom is installed into the storage section 408 as needed.

[0095] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 409, and / or installed from the removable medium 411. When the computer program is executed by the central processing unit (CPU) 401, the above-mentioned functions defined in the system of the present application are executed.

[0096] It should be noted that the computer-readable medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0097] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0098] The modules and / or units described in this application may be implemented in software or hardware. The modules and / or units described may also be set in a processor. For example, it may be described as follows: a processor includes a copy module, an intercept module, a terminal determination module, and a sending module. The names of these modules do not, in some cases, constitute limitations on the modules themselves.

[0099] As another aspect, the present application also provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device performs the following operations:

[0100] The target traffic is copied at the target communication interface to obtain the target copied traffic; wherein the target communication interface includes a first communication interface or a second communication interface, the first communication interface is used to connect the base station device and the service gateway device, and the second communication interface is used to connect the service gateway device and the packet data gateway device; according to the preset abnormal information, the abnormal information in the target copied traffic is identified, and the target traffic is intercepted; according to the transmission link of the target traffic, the first target terminal and the second target terminal are determined; wherein the first target terminal is the next transmission node of the transmission link of the target traffic, and the second target terminal is the previous transmission node of the transmission link of the target traffic; an intercept message is generated according to the traffic information of the target traffic, and the intercept message is sent to the first target terminal and the second target terminal respectively; wherein the intercept message is used to interrupt the data transmission between the transmission starting point of the target traffic and the transmission end point of the target traffic.

[0101] According to the technical solution of the present application, the target traffic is copied at the target communication interface to obtain the target copied traffic; wherein the target communication interface includes a first communication interface or a second communication interface, the first communication interface is used to connect the base station device and the service gateway device, and the second communication interface is used to connect the service gateway device and the packet data gateway device; according to the preset abnormal information, the abnormal information in the target copied traffic is identified, and the target traffic is intercepted; according to the transmission link of the target traffic, the first target terminal and the second target terminal are determined; wherein the first target terminal is the next transmission node of the transmission link of the target traffic, and the second target terminal is the previous transmission node of the transmission link of the target traffic; an intercept message is generated according to the traffic information of the target traffic, and the intercept message is sent to the first target terminal and the second target terminal respectively; wherein the intercept message is used to interrupt the data transmission between the transmission starting point of the target traffic and the transmission end point of the target traffic. That is, the solution of the present application, after determining the abnormal information in the target traffic, generates an intercept message according to the traffic information of the target traffic, and sends the intercept message to the first target terminal and the second target terminal, thereby interrupting the data transmission between the base station device and the service gateway device, or interrupting the data transmission between the service gateway device and the packet data gateway device, so that the abnormal traffic can be intercepted between the base station device and the service gateway device, or between the service gateway device and the packet data gateway device without accessing the re-injection point, thereby improving the security of mobile communications.

[0102] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the abnormal traffic interception method provided in any embodiment of the present application.

[0103] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present application, and the programming language includes an object-oriented programming language, such as Java, Smalltalk, C++, and also includes a conventional procedural programming language, such as "C" language or similar programming language. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on the remote computer, or completely on the remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0104] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution of this application can be achieved, and this document is not limited here.

[0105] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A method for intercepting abnormal traffic, characterized in that: Applied to an interception device, the method comprises: Copying the target traffic at the target communication interface to obtain the target copied traffic; wherein the target communication interface includes a first communication interface or a second communication interface, the first communication interface is used to connect the base station device and the service gateway device, and the second communication interface is used to connect the service gateway device and the packet data gateway device; Identify abnormal information in the target replication traffic according to preset abnormal information, and intercept the target traffic; Determine a first target terminal and a second target terminal according to the transmission link of the target traffic; wherein the first target terminal is the next transmission node of the transmission link of the target traffic, and the second target terminal is the previous transmission node of the transmission link of the target traffic; An intercept message is generated according to the traffic information of the target traffic, and the intercept message is sent to the first target terminal and the second target terminal respectively; wherein the intercept message is used to interrupt the data transmission between the transmission starting point of the target traffic and the transmission end point of the target traffic.

2. The method according to claim 1, characterized in that: The step of duplicating the target traffic on the target communication interface to obtain the target duplicated traffic includes: The target traffic is copied on the target communication interface by using link splitting technology or traffic mirroring to obtain the target copied traffic.

3. The method according to claim 1, characterized in that The identifying the abnormal information in the target replication traffic according to the preset abnormal information includes: Determining characteristic information in the target replication traffic; The information in the characteristic information that matches the preset abnormal information is used as the abnormal information in the target replication traffic.

4. The method according to claim 1, characterized in that: The intercept message includes a first intercept message and a second intercept message, and the first intercept message and the second intercept message are reverse messages; The generating an intercept message according to the flow information of the target flow, and sending the intercept message to the first target terminal and the second target terminal respectively, comprises: Generate the first intercept message according to the first flow information of the target flow, and generate the second intercept message according to the second flow information of the target flow; wherein the first flow information is used to characterize the receiving information of the transmission starting point, and the second flow information is used to characterize the receiving information of the transmission focus; The first intercept message is sent to the first target terminal, and the second intercept message is sent to the second target terminal.

5. The method according to claim 1, characterized in that The target traffic is traffic encapsulated according to the target encapsulation mode, and the target traffic is copied on the target communication interface to obtain the target copied traffic, including: Determining a traffic parsing method according to the target encapsulation method; Parsing the target traffic according to the traffic parsing method at the target communication interface to obtain parsed target traffic information; The target flow is copied according to the parsed target flow information to obtain the target copied flow.

6. The method according to claim 5, characterized in that The generating an intercept message according to the flow information of the target flow, and sending the intercept message to the first target terminal and the second target terminal respectively, comprises: generating interception information according to the flow information of the target flow; The interception information is encapsulated according to the target encapsulation method to obtain the interception message, and the interception message is sent to the first target terminal and the second target terminal respectively.

7. The method according to claim 1, characterized in that The interception device includes a device connected in parallel between the base station device and the serving gateway device, or the interception device includes a device connected in parallel between the serving gateway device and the packet data gateway device.

8. An abnormal flow interception device, characterized in that: Configured in an interception device, the device comprises: A replication module, configured to replicate the target traffic at a target communication interface to obtain target replication traffic; wherein the target communication interface includes a first communication interface or a second communication interface, the first communication interface is used to connect a base station device with a serving gateway device, and the second communication interface is used to connect the serving gateway device with a packet data gateway device; An interception module, used to identify abnormal information in the target replication traffic according to preset abnormal information, and intercept the target traffic; A terminal determination module, configured to determine a first target terminal and a second target terminal according to a transmission link of the target flow; wherein the first target terminal is a next transmission node of the transmission link of the target flow, and the second target terminal is a previous transmission node of the transmission link of the target flow; A sending module is used to generate an intercept message according to the traffic information of the target traffic, and send the intercept message to the first target terminal and the second target terminal respectively; wherein the intercept message is used to interrupt the data transmission between the transmission starting point of the target traffic and the transmission end point of the target traffic.

9. An interception device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the abnormal traffic interception method as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the abnormal traffic interception method as described in any one of claims 1 to 7 is implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the abnormal traffic interception method according to any one of claims 1 to 7.

Images