Protection method, device and equipment for active external connection of terminal, medium and program product

Abstract

The invention provides a protection method for active external connection of a terminal, relates to the technical field of network security and the field of information security, and can be applied to the technical field of finance. The method comprises the following steps: acquiring malicious link information in response to alarm information of an active external connection behavior of a terminal; setting an intranet server to start request monitoring according to the malicious link information; modifying host tables or routing tables of all terminals in batches according to the malicious link information and the intranet monitoring address information; positioning the lost terminal according to the monitored request information; and performing isolation protection on the lost terminal based on the active external connection behavior stage of the lost terminal. The invention further provides a terminal active external connection protection device, equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, specifically to the field of network security technology, and more specifically to a terminal active external connection protection method, device, equipment, medium and program product. Background Art

[0002] The Internet security strategy of an enterprise usually restricts access to the network but not the Internet because of the need for interconnection and data exchange with third-party payment platforms and suppliers. It does not restrict the active Internet access of intranet terminal devices. When the terminal and server are attacked (such as phishing) and Trojans actively connect to the Internet, the relevant technology lacks the ability to trace the compromised terminal and block it in time. Therefore, how to improve the enterprise's ability to prevent the intranet terminal from actively connecting to malicious addresses has become a technical problem that needs to be solved urgently.

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a terminal active external connection protection method, device, equipment, medium and program product.

[0005] According to a first aspect of the present disclosure, a method for protecting a terminal from active external connection is provided, the method comprising:

[0006] Responding to the warning information of the terminal's active external connection behavior, obtaining malicious link information;

[0007] Setting the intranet server to start request monitoring according to the malicious link information;

[0008] Batch modify the host table or routing table of all terminals according to the malicious link information and the intranet monitoring address information;

[0009] Locating the lost terminal according to the intercepted request information; and

[0010] Based on the active external contact behavior stage of the compromised terminal, the compromised terminal is isolated and protected.

[0011] According to an embodiment of the present disclosure, batch modifying the host table or routing table of the terminal according to the malicious link information and the intranet listening address information includes:

[0012] If the malicious link is determined to be a domain name, the terminal local host table is modified in batches according to the intranet monitoring address information;

[0013] If it is determined that the malicious link is an Internet Protocol address, the terminal local routing table is modified in batches according to the intranet monitoring address information.

[0014] According to an embodiment of the present disclosure, the request information includes the request initiation time, the source IP address and the port information, and the positioning of the trapped terminal according to the monitored request information includes:

[0015] Query the terminal management platform for the physical address of the compromised host based on the source IP address.

[0016] According to an embodiment of the present disclosure, locating the trapped terminal according to the monitored request information further includes:

[0017] The physical address corresponding to the source IP address is found by calling the Dynamic Host Configuration Protocol table.

[0018] According to an embodiment of the present disclosure, isolating and protecting the trapped terminal based on the active external connection behavior stage of the trapped terminal includes:

[0019] Determine the active external connection behavior stage of the victim terminal according to the alarm information of the terminal's active external connection behavior;

[0020] If it is determined that the compromised terminal's active external connection behavior is in the domain name resolution recursive stage, batch modify the host table or routing table of all terminals according to the malicious link type; and

[0021] If it is determined that the active external connection behavior of the compromised terminal is in the stage of establishing a connection with a malicious link, the host table and / or routing table of the compromised terminal is modified and the connection of the source port is reset.

[0022] According to an embodiment of the present disclosure, the stage of determining the active external connection behavior of the trapped terminal according to the alarm information of the active external connection behavior of the terminal includes:

[0023] If it is determined that the alarm information does not include the IP port information of the victim terminal, it is determined that the active external contact behavior of the victim terminal is in the domain name resolution recursive stage; and

[0024] If it is determined that the alarm information contains the IP port information of the compromised terminal, it is determined that the active external connection behavior of the compromised terminal is in the stage of establishing a connection with a malicious link.

[0025] According to an embodiment of the present disclosure, the method further includes:

[0026] When the number of requests from the same host exceeds a preset threshold, the host is disconnected from the network and isolated.

[0027] A second aspect of the present disclosure provides a terminal active external connection protection device, the device comprising:

[0028] An acquisition module, used to obtain malicious link information in response to the warning information of the terminal's active external connection behavior;

[0029] A monitoring module, used to set the intranet server to start request monitoring according to the malicious link information;

[0030] A modification module, used for batch modifying the host table or routing table of all terminals according to the malicious link information and the intranet monitoring address information;

[0031] A trapped terminal positioning module, used to locate the trapped terminal according to the intercepted request information; and

[0032] The protection module is used to isolate and protect the compromised terminal based on the active external connection behavior stage of the compromised terminal.

[0033] According to an embodiment of the present disclosure, the modification module includes: a first modification submodule and a second modification submodule.

[0034] A first modification submodule is used to batch modify the terminal local host table according to the intranet monitoring address information if the malicious link is determined to be a domain name;

[0035] The second modification submodule is used to batch modify the terminal local routing table according to the intranet monitoring address information if it is determined that the malicious link is an Internet Protocol address.

[0036] According to an embodiment of the present disclosure, the trapped terminal positioning module includes: a first positioning submodule and a second positioning submodule.

[0037] The first positioning submodule is used to query the terminal management platform for the physical address of the trapped host according to the source IP address.

[0038] The second positioning submodule is used to find the physical address corresponding to the source IP address by calling the dynamic host configuration protocol table.

[0039] According to an embodiment of the present disclosure, the protection module includes: a first isolation protection submodule and a second isolation protection submodule.

[0040] A first isolation protection submodule is used to batch modify the host table or routing table of all terminals according to the malicious link type if it is determined that the active external connection behavior of the compromised terminal is in the domain name resolution recursive stage; and

[0041] The second isolation protection submodule is used to modify the host table and / or routing table of the compromised terminal and reset the connection of the source port if it is determined that the active external connection behavior of the compromised terminal is in the stage of establishing a connection with a malicious link.

[0042] According to an embodiment of the present disclosure, it also includes: a network disconnection isolation module.

[0043] The network disconnection isolation module is used to isolate the host from the network when the requests from the same host exceed a preset threshold.

[0044] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned terminal active external connection protection method.

[0045] The fourth aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above-mentioned terminal active external connection protection method.

[0046] The fifth aspect of the present disclosure also provides a computer program product, including a computer program, which implements the above-mentioned terminal active external connection protection method when executed by a processor.

[0047] A method for protecting a terminal from active external connection is provided through an embodiment of the present disclosure. When receiving an alarm message of an active external connection behavior of a terminal, malicious link information is obtained, request monitoring is started and the intranet monitoring address is returned. The host table or routing table of all terminals is modified in batches according to the malicious link type and the intranet monitoring address information to monitor the terminal's active external malicious links; the compromised terminal is located according to the request information monitored by the compromised terminal, and the compromised terminal is isolated and protected based on the stage of the compromised terminal's active external connection behavior. Compared with the related art, the method for protecting a terminal from active external connection provided by an embodiment of the present disclosure can directly jump to the internal monitoring device address for the terminal's active external connection IP behavior, thereby forming an effective blockade and quickly locating the detailed information of the compromised host. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0049] Figure 1 A system architecture diagram of a terminal active external connection protection device according to an embodiment of the present disclosure is schematically shown;

[0050] Figure 2 The application scenario diagram of the terminal active external connection protection method, device, equipment, medium and program product according to the embodiment of the present disclosure is schematically shown;

[0051] Figure 3 A flowchart of a terminal active external connection protection method provided according to an embodiment of the present disclosure is schematically shown;

[0052] Figure 4A flowchart of a terminal active external connection protection method provided according to another embodiment of the present disclosure is schematically shown;

[0053] Figure 5 A flowchart of a trapped terminal positioning method provided according to another embodiment of the present disclosure is schematically shown;

[0054] Figure 6 A flowchart of a trapped terminal isolation protection method provided according to another embodiment of the present disclosure is schematically shown;

[0055] Figure 7 A schematic diagram of a structural block diagram of a terminal active external connection protection device according to an embodiment of the present disclosure is shown; and

[0056] Figure 8 A block diagram of an electronic device suitable for implementing a protection method for active external connection of a terminal according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0057] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0058] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0059] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0060] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0061] In the related technology, the behavior of actively connecting to the outside world when the terminal and server are attacked (such as phishing) by Trojans is usually divided into the following two steps: the intranet terminal returns the IP address of the malicious address through the iterative query process of the local host table, the intranet domain name resolution (DNS, Domain Name System) server, and the intranet DNS request to the external DNS. The Trojan file in the intranet terminal communicates with the malicious IP address to establish a connection. Since Trojan files are usually immune to killing and cannot be checked by local antivirus methods, companies usually set up intrusion monitoring and protection equipment (IDS, Intrusion detection system) in the Internet access area to monitor active external connection traffic and identify the behavior of actively connecting to malicious addresses. However, the following problems still exist, causing most companies to lack prevention against active external connections:

[0062] 1. In the communication stage of the DNS recursive query phase, the IDS sees the traffic as being sent from the intranet DNS to the extranet DNS. At this stage, it is impossible to effectively determine which terminal is actively connecting externally, resulting in a lack of tracing and timely blocking capabilities. Waiting for the Trojan to establish a connection before tracing and handling it poses a greater security risk, and important data may have been leaked.

[0063] 2. When malicious address threat intelligence is obtained or a terminal actively connects to a malicious address, since Trojan files are usually immune to detection, there is no effective means to find out which other terminals on the intranet are infected with Trojans without leaving the network (no connection is established between the terminal and the malicious address). There is a lack of overall investigation and blocking capabilities.

[0064] Based on the above technical problems, an embodiment of the present disclosure provides a method for protecting terminals from active external connections, the method comprising: obtaining malicious link information in response to alarm information of active external connection behavior of the terminal; setting an intranet server to start request monitoring according to the malicious link information; batch modifying the host table or routing table of all terminals according to the malicious link information and the intranet monitoring address information; locating the compromised terminal according to the monitored request information; and isolating and protecting the compromised terminal based on the stage of active external connection behavior of the compromised terminal.

[0065] Figure 1 The system architecture diagram of the terminal active external connection protection device according to the embodiment of the present disclosure is schematically shown. Figure 1As shown, the device provided by the embodiment of the present disclosure is deployed in the enterprise intranet. First, the process of the enterprise intranet terminal requesting a domain name from the outside is introduced. Before the terminal (office book, server, etc.) of the enterprise intranet requests a domain name from the outside, after there is no resolution record in the local DNS, it will recursively query the DNS server on the Internet through the enterprise's intranet DNS server; the enterprise intrusion detection device is deployed at the enterprise Internet boundary. The enterprise has a terminal management system (such as domain control, client software, agent, etc.), and the terminal is managed and controlled by a unified management platform. The device provided by the embodiment of the present disclosure specifically includes: an intelligence access and command control module A1 and a monitoring discovery module A2, which is responsible for receiving malicious link intelligence and issuing commands to the terminal management platform or the monitoring discovery module A2 according to the intelligence. The terminal management platform is responsible for batch modifying the local hosts file or routing table of all terminals. The monitoring discovery module A2 is responsible for starting monitoring according to the command information, discovering and locating the trapped host. The intelligence access and command control module A1 includes an intelligence access unit A11 and a terminal command unit A12. The intelligence access unit A11 is mainly responsible for receiving external threat intelligence malicious link information input by the user, or malicious link information discovered and pushed by the intrusion monitoring system as an information source, so that the monitoring and discovery module A2 can start monitoring. And the terminal command unit A12 issues command tasks to perform terminal protection. The monitoring and discovery module A2 includes a monitoring unit A21 and a terminal positioning unit A22. The monitoring unit 21 is mainly responsible for setting the server to start request monitoring after receiving the command (malicious link information and start monitoring) sent by the intelligence access unit A11. The terminal positioning unit A22 is responsible for analyzing the requested information and locating the compromised host, and setting protection when necessary.

[0066] Figure 2 The application scenario diagram of the terminal active external connection protection method, device, equipment, medium and program product according to the embodiment of the present disclosure is schematically shown.

[0067] like Figure 2 As shown, the application scenario 200 according to this embodiment may include a protection scenario in which the terminal actively connects externally. The network 204 is used to provide a medium for a communication link between the terminal devices 201, 202, 203 and the server 205. The network 204 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0068] The user can use the terminal devices 201, 202, 203 to interact with the server 205 through the network 204 to receive or send messages, etc. Various communication client applications can be installed on the terminal devices 201, 202, 203, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0069] The terminal devices 201 , 202 , and 203 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0070] Server 205 can be a protection server for active external connection of terminals. The server can execute the protection method for active external connection of terminals provided in the embodiment of the present disclosure. After receiving the alarm information of the active external connection behavior of the terminal, the malicious link information is obtained. The malicious link information can be input by the user through the terminal devices 201, 202, and 203, or can be discovered by the intrusion detection system IDS monitoring. The intranet server is set to start request monitoring according to the malicious link information; the host table or routing table of all terminals is modified in batches according to the malicious link information and the intranet monitoring address information; the compromised terminal is located according to the monitored request information; and the compromised terminal is isolated and protected based on the active external connection behavior stage of the compromised terminal.

[0071] It should be noted that the terminal active external connection protection method provided in the embodiment of the present disclosure can generally be executed by the server 205. Accordingly, the terminal active external connection protection device provided in the embodiment of the present disclosure can generally be set in the server 205. The terminal active external connection protection method provided in the embodiment of the present disclosure can be executed by a server or server cluster that is different from the server 205 and can communicate with the terminal devices 201, 202, 203 and / or the server 205. Accordingly, the terminal active external connection protection device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 205 and can communicate with the terminal devices 201, 202, 203 and / or the server 205.

[0072] It should be understood that Figure 2 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0073] It should be noted that the protection method and device for active external connection of the terminal determined in the embodiments of the present disclosure can be used in the field of network security technology, the field of financial technology, and any field other than the financial field. The application field of the protection method and device for active external connection of the terminal determined in the embodiments of the present disclosure is not limited.

[0074] The following will be based on Figure 1 Describe the system architecture and Figure 2 The application scenario described by Figure 3 to Figure 6 The protection method for active external connection of a terminal in an embodiment of the present disclosure is described in detail.

[0075] Figure 3The flowchart of a terminal active external connection protection method provided according to an embodiment of the present disclosure is schematically shown. Figure 1 and Figure 3 As shown, the terminal active external connection protection method of this embodiment includes operations S210 to S250. The method can be performed by Figure 1 The process is executed by the apparatus shown, and may also be executed by a server or other computing device.

[0076] In operation S210, malicious link information is obtained in response to the warning information of the terminal's active external connection behavior.

[0077] In one example, when the intrusion detection system detects that a terminal actively connects to the outside world in the intranet, it issues an alarm message, and obtains malicious link information in response to the alarm message of the terminal's active external connection behavior. The malicious link information can be manually input by the user or discovered and pushed by the intrusion monitoring system.

[0078] In operation S220, the intranet server is set to start request monitoring according to the malicious link information.

[0079] In one example, when the intelligence access unit A11 receives malicious link information, it sends the malicious link domain name information or IP information and the command to start monitoring to the monitoring discovery module A2. The monitoring discovery module A2 activates the intranet server device to start monitoring the malicious link request, and returns the intranet monitoring address information corresponding to the malicious link to the terminal command unit A12.

[0080] In operation S230, the host table or routing table of all terminals is modified in batches according to the malicious link information and the intranet monitoring address information.

[0081] In one example, in order to effectively block all requests similar to the malicious link in the intranet, the host table or routing table of all terminals is modified in batches according to the malicious link information and the intranet listening address information. Specifically, an instruction is issued to the terminal management system to modify the local file hosts or routing table of all terminals in the intranet, and the DNS of the malicious domain name is resolved to the intranet device that continuously listens, that is, the device that starts request listening in step S220, so that the active external connection behavior skips the DNS recursive outward query stage, avoids the threat of DNS protocol outbound information and subsequent connection establishment, and effectively blocks all similar requests in the intranet.

[0082] In operation S240, the trapped terminal is located according to the intercepted request information.

[0083] According to an embodiment of the present disclosure, when the requests from the same host exceed a preset threshold, the host is disconnected from the network and isolated.

[0084] In one example, after the monitoring unit A21 sets the server to start request monitoring, the intranet device, such as the server, host, etc., is set to start monitoring. If a compromised host requests a malicious link address, the request record will be saved, the request information will be recorded, and the compromised terminal will be located based on the monitored request information. In addition, the terminal positioning unit A22 can set a threshold. When the request from the same host exceeds the preset threshold, the terminal command unit A12 is used to make the terminal management software on the host disconnect and isolate the compromised host, thereby reducing the risk of lateral spread.

[0085] In operation S250, isolation and protection are performed on the trapped terminal based on the active external connection behavior stage of the trapped terminal.

[0086] In one example, when the alarm information is received, the terminal's active external connection behavior may be in different stages, such as the DNS recursion stage or the connection establishment stage. The stage of the active external connection behavior of the victim terminal is determined according to the alarm information, and then isolation protection is performed according to the stage of the active external connection behavior of the victim terminal.

[0087] A method for protecting a terminal from active external connection is provided through an embodiment of the present disclosure. When receiving an alarm message of an active external connection behavior of a terminal, malicious link information is obtained, request monitoring is started and the intranet monitoring address is returned. The host table or routing table of all terminals is modified in batches according to the malicious link type and the intranet monitoring address information to monitor the terminal's active external malicious links; the compromised terminal is located according to the request information monitored by the compromised terminal, and the compromised terminal is isolated and protected based on the stage of the compromised terminal's active external connection behavior. Compared with the related art, the method for protecting a terminal from active external connection provided by an embodiment of the present disclosure can directly jump to the internal monitoring device address for the terminal's active external connection IP behavior, thereby forming an effective blockade and quickly locating the detailed information of the compromised host.

[0088] Figure 4 A flowchart of a terminal active external connection protection method provided according to another embodiment of the present disclosure is schematically shown.

[0089] like Figure 4 As shown, operation S230 includes operation S231 and operation S232.

[0090] In operation S231, if it is determined that the malicious link is a domain name, the terminal local host table is modified in batches according to the intranet monitoring address information;

[0091] In operation S232, if it is determined that the malicious link is an Internet Protocol address, the terminal local routing table is modified in batches according to the intranet monitoring address information.

[0092] In one example, when an alarm message is received and the device starts request monitoring, all devices in the intranet are modified in batches according to the malicious link information type and the intranet monitoring address information. Specifically, if the malicious link is determined to be a domain name, the terminal local host table is modified in batches according to the intranet monitoring address information, and its local host table is changed so that the DNS resolution address of the malicious link is the corresponding intranet monitoring address enabled in the monitoring unit A21.

[0093] In one example, if the malicious link is determined to be an IP address, the terminal local routing table is modified in batches according to the intranet listening address information so that its route finally points to the listening unit A21. By modifying the host table or routing table, the active external connection behavior skips the DNS recursive external query stage, avoiding the threat of DNS protocol outbound information and subsequent connection establishment, and effectively blocking all similar requests on the intranet.

[0094] Figure 5 A flowchart of a trapped terminal positioning method provided according to another embodiment of the present disclosure is schematically shown.

[0095] like Figure 5 As shown, operation S240 includes operation S241 and operation S242.

[0096] In operation S241, the physical address of the compromised host is queried from the terminal management platform according to the source IP address.

[0097] According to an embodiment of the present disclosure, the request information includes request initiation time, source IP address and port information.

[0098] In operation S242, the physical address corresponding to the source IP address is searched by calling the dynamic host configuration protocol table.

[0099] In one example, if a compromised host requests a malicious link address, a request record will be seen on the monitoring unit A21, recording the request information, including the request initiation time, source IP address, port information, etc. Usually, since it is impossible to know which port the compromised host will request the malicious address, the intranet device will do a full port forwarding monitoring. One implementation method is to configure the local firewall (such as iptables) to forward all non-dedicated (ftp / ssh / mysqk) port requests to a specific port.

[0100] In one example, the compromised device is located based on the request information monitored by the monitoring unit A21. In a feasible implementation, a command is sent to the terminal unified management platform through the terminal command unit A12, and the compromised host is found through the enterprise terminal management system based on the source IP address to determine the mac address of the compromised host; in another feasible implementation, if the corresponding compromised host is not found in the enterprise terminal management system, the MAC address corresponding to the IP can be found by calling the current DHCP table within the enterprise, and then the compromised host can be located according to the internal ledger of the enterprise. After locating the compromised host, the situation of the compromised host is presented to the user.

[0101] Through the method provided by the embodiment of the present invention, the compromised host mac can be quickly locked by querying the DHCP table or the terminal management system, and other compromised terminals requesting malicious addresses can be continuously monitored to achieve rapid positioning, thereby avoiding the situation where a unified investigation cannot be carried out due to Trojan horse anti-killing.

[0102] Figure 6 The flowchart of a method for isolating and protecting a trapped terminal according to another embodiment of the present disclosure is schematically shown. Figure 6 As shown, operation S250 includes operations S251 to S253.

[0103] In operation S251, the active external connection behavior stage of the trapped terminal is determined according to the alarm information of the active external connection behavior of the terminal.

[0104] According to an embodiment of the present disclosure, if it is determined that the alarm information does not contain the IP port information of the victim terminal, it is determined that the active external connection behavior of the victim terminal is in the domain name resolution recursive stage. If it is determined that the alarm information contains the IP port information of the victim terminal, it is determined that the active external connection behavior of the victim terminal is in the stage of establishing a connection with a malicious link.

[0105] In operation S252, if it is determined that the active external connection behavior of the compromised terminal is in the domain name resolution recursive stage, the host table or routing table of all terminals is modified in batches according to the malicious link type.

[0106] In operation S253, if it is determined that the active external connection behavior of the victim terminal is in the stage of establishing a connection with a malicious link, the host table and / or routing table of the victim terminal is modified and the connection of the source port is reset.

[0107] In an example, when the intelligence access unit A11 receives the active external malicious alarm information pushed by the intrusion monitoring system, the stage of the active external behavior of the compromised terminal is determined through the alarm information. When the active external behavior of the compromised terminal is in the stage of establishing a connection with a malicious link, it means that the compromised terminal has established a connection with the malicious link. The alarm information contains the IP address and port number information of the compromised terminal. Therefore, the current stage of the active external behavior of the compromised terminal can be judged by whether the alarm information contains the IP address and port number information of the compromised terminal.

[0108] In one example, if it is determined that the victim terminal is actively connecting to the Internet at the domain name resolution recursive stage, and the victim terminal has not yet established a connection with the malicious link, it only needs to execute Figure 4 Operation S231 and operation S232 are shown. If it is determined that the active external connection behavior of the victim terminal is in the stage of establishing a connection with a malicious link, the IP address and source port information of the victim terminal will be displayed in the alarm information. In order to block the connection in time, the host table and / or routing table of the victim terminal will be modified first through the terminal management platform and the connection of the source port will be reset.

[0109] Based on the above terminal active external connection protection method, the present disclosure also provides a terminal active external connection protection device. Figure 7 The device is described in detail.

[0110] Figure 7 The structure block diagram of a terminal active external connection protection device according to an embodiment of the present disclosure is schematically shown. Figure 7 As shown, the terminal active external connection protection device 800 of this embodiment includes an acquisition module 810, a monitoring module 820, a modification module 830, a trapped terminal positioning module 840 and a protection module 850.

[0111] The acquisition module 810 is used to obtain malicious link information in response to the warning information of the terminal's active external connection behavior. In one embodiment, the acquisition module 810 can be used to perform the operation S210 described above, which will not be repeated here.

[0112] The monitoring module 820 is used to set the intranet server to start request monitoring according to the malicious link information. In one embodiment, the monitoring module 820 can be used to perform the operation S220 described above, which will not be repeated here.

[0113] The modification module 830 is used to batch modify the host table or routing table of all terminals according to the malicious link information and the intranet monitoring address information. In one embodiment, the modification module 830 can be used to perform the operation S230 described above, which will not be repeated here.

[0114] The trapped terminal positioning module 840 is used to locate the trapped terminal according to the intercepted request information. In one embodiment, the trapped terminal positioning module 840 can be used to perform the operation S240 described above, which will not be described in detail here.

[0115] The protection module 850 is used to isolate and protect the trapped terminal based on the active external connection behavior stage of the trapped terminal. In one embodiment, the protection module 850 can be used to perform the operation S250 described above, which will not be repeated here.

[0116] According to an embodiment of the present disclosure, the modification module includes: a first modification submodule and a second modification submodule.

[0117] The first modification submodule is used to batch modify the terminal local host table according to the intranet monitoring address information if the malicious link is determined to be a domain name. In one embodiment, the first modification submodule can be used to perform the operation S231 described above, which will not be repeated here.

[0118] The second modification submodule is used to modify the terminal local routing table in batches according to the intranet listening address information if the malicious link is determined to be an Internet Protocol address. In one embodiment, the second modification submodule can be used to perform the operation S232 described above, which will not be repeated here.

[0119] According to an embodiment of the present disclosure, the trapped terminal positioning module includes: a first positioning submodule and a second positioning submodule. In one embodiment, the protection module 850 can be used to perform the operation S250 described above, which will not be repeated here.

[0120] The first positioning submodule is used to query the terminal management platform for the physical address of the trapped host according to the source IP address. In one embodiment, the first positioning submodule can be used to perform the operation S241 described above, which will not be repeated here.

[0121] The second positioning submodule is used to find the physical address corresponding to the source IP address by calling the dynamic host configuration protocol table. In one embodiment, the second positioning submodule can be used to perform the operation S242 described above, which will not be repeated here.

[0122] According to an embodiment of the present disclosure, the protection module includes: a first isolation protection submodule and a second isolation protection submodule.

[0123] The first isolation protection submodule is used to batch modify the host table or routing table of all terminals according to the malicious link type if it is determined that the active external connection behavior of the compromised terminal is in the domain name resolution recursive stage. In one embodiment, the first isolation protection submodule can be used to perform the operation S251 described above, which will not be repeated here.

[0124] The second isolation protection submodule is used to modify the host table and / or routing table of the victim terminal and reset the connection of the source port if it is determined that the victim terminal's active external connection behavior is in the stage of establishing a connection with a malicious link. In one embodiment, the second isolation protection submodule can be used to perform the operation S252 described above, which will not be repeated here.

[0125] According to an embodiment of the present disclosure, it also includes: a network disconnection isolation module.

[0126] The network disconnection isolation module is used to isolate the host from the network when the requests from the same host exceed a preset threshold.

[0127] According to an embodiment of the present disclosure, any multiple modules of the acquisition module 810, the monitoring module 820, the modification module 830, the trapped terminal positioning module 840 and the protection module 850 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 810, the monitoring module 820, the modification module 830, the trapped terminal positioning module 840 and the protection module 850 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or by any one of the three implementation methods of software, hardware and firmware or by a suitable combination of any of them. Alternatively, at least one of the acquisition module 810, the monitoring module 820, the modification module 830, the trapped terminal positioning module 840 and the protection module 850 can be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function can be executed.

[0128] Figure 8 A block diagram of an electronic device suitable for implementing a protection method for active external connection of a terminal according to an embodiment of the present disclosure is schematically shown.

[0129] like Figure 8As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0130] In RAM 903, various programs and data required for the operation of electronic device 900 are stored. Processor 901, ROM 902 and RAM 903 are connected to each other via bus 904. Processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 902 and / or RAM 903. It should be noted that the program can also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0131] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the I / O interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card, a modem, etc. The communication portion 909 performs communication processing via a network such as the Internet. A drive 909 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 909 as needed, so that a computer program read therefrom is installed into the storage portion 908 as needed.

[0132] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiment; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the terminal active external connection protection method according to the embodiment of the present disclosure is implemented.

[0133] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0134] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the terminal active external connection protection method provided by the embodiment of the present disclosure.

[0135] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 901. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0136] In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and downloaded and installed through the communication part 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0137] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0138] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0139] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0140] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0141] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A terminal active external connection protection method, characterized in that: The method comprises: Responding to the warning information of the terminal's active external connection behavior, obtaining malicious link information; Setting the intranet server to start request monitoring according to the malicious link information; Batch modify the host table or routing table of all terminals according to the malicious link information and the intranet monitoring address information; Locating the lost terminal according to the intercepted request information; and Based on the active external contact behavior stage of the compromised terminal, the compromised terminal is isolated and protected.

2. The method according to claim 1, characterized in that The batch modification of the host table or routing table of the terminal according to the malicious link information and the intranet monitoring address information includes: If the malicious link is determined to be a domain name, the terminal local host table is modified in batches according to the intranet monitoring address information; If it is determined that the malicious link is an Internet Protocol address, the terminal local routing table is modified in batches according to the intranet monitoring address information.

3. The method according to claim 1, characterized in that The request information includes the request initiation time, source IP address and port information, and the positioning of the trapped terminal according to the monitored request information includes: Query the terminal management platform for the physical address of the compromised host based on the source IP address.

4. The method according to claim 3, characterized in that The locating the trapped terminal according to the monitored request information also includes: The physical address corresponding to the source IP address is found by calling the Dynamic Host Configuration Protocol table.

5. The method according to claim 2, characterized in that: The isolating and protecting the trapped terminal based on the active external connection behavior stage of the trapped terminal includes: Determine the active external connection behavior stage of the victim terminal according to the alarm information of the terminal's active external connection behavior; If it is determined that the compromised terminal's active external connection behavior is in the domain name resolution recursive stage, batch modify the host table or routing table of all terminals according to the malicious link type; and If it is determined that the active external connection behavior of the compromised terminal is in the stage of establishing a connection with a malicious link, the host table and / or routing table of the compromised terminal is modified and the connection of the source port is reset.

6. The method according to claim 5, characterized in that The stage of determining the active external connection behavior of the trapped terminal according to the alarm information of the active external connection behavior of the terminal includes: If it is determined that the alarm information does not include the IP port information of the victim terminal, it is determined that the active external contact behavior of the victim terminal is in the domain name resolution recursive stage; and If it is determined that the alarm information contains the IP port information of the compromised terminal, it is determined that the active external connection behavior of the compromised terminal is in the stage of establishing a connection with a malicious link.

7. The method according to claim 1, characterized in that The method further comprises: When the number of requests from the same host exceeds a preset threshold, the host is disconnected from the network and isolated.

8. A terminal active external connection protection device, characterized in that: The device comprises: An acquisition module, used to obtain malicious link information in response to the warning information of the terminal's active external connection behavior; A monitoring module, used to set the intranet server to start request monitoring according to the malicious link information; A modification module, used for batch modifying the host table or routing table of all terminals according to the malicious link information and the intranet monitoring address information; A trapped terminal positioning module, used to locate the trapped terminal according to the intercepted request information; and The protection module is used to isolate and protect the compromised terminal based on the active external connection behavior stage of the compromised terminal.

9. An electronic device, comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors execute the terminal active external connection protection method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the terminal active external connection protection method according to any one of claims 1 to 7.

Images