Processing method and device of terminal equipment, storage medium and electronic equipment

Abstract

The invention discloses a processing method and device of terminal equipment, a storage medium and electronic equipment, and relates to the technical field of computers. The method comprises the following steps: TCP messages sent by a plurality of terminal devices are received through a network device, the TCP message sent by each terminal device comprises identification information of the terminal device, and the plurality of terminal devices are terminal devices after network address translation; the method comprises the steps of determining whether abnormal traffic exists or not through network equipment, and analyzing a TCP message flow of the abnormal traffic to obtain a target identifier under the condition that the abnormal traffic exists, the TCP message flow of the abnormal traffic being composed of a plurality of TCP messages; and according to the target identifier, determining a target terminal device which generates the abnormal traffic from the plurality of terminal devices. Through application of the method and the device, the problem that the security of the network is difficult to guarantee due to the fact that the specific terminal generating the abnormal traffic is difficult to accurately locate in a network address translation environment in the related technology is solved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a processing method and apparatus for a terminal device, a storage medium, and an electronic device. Background Art

[0002] With the continuous development of the network, more and more Windows (operating system) terminal devices are in the Network Address Translation (NAT) environment. For the management departments of enterprises and institutions, NAT network reduces the occupation of Internet Protocol (IP) addresses, but also puts forward higher requirements for the management of terminal devices. Among them, locating the terminal behind the NAT network environment is the biggest challenge faced by managers.

[0003] Moreover, in the big data network scenario, there are a large number of NAT network environments. When the upper-layer Internet behavior management devices discover anomalies, they can only locate the IP of the device providing the NAT network environment, but it is difficult to accurately locate the specific terminal that generates abnormal traffic, which makes it difficult to ensure the security of the network.

[0004] With regard to the problem in the related art that it is difficult to accurately locate the specific terminal that generates abnormal traffic in a network address translation environment, which makes it difficult to ensure the security of the network, no effective solution has been proposed yet. Summary of the invention

[0005] The main purpose of this application is to provide a processing method and device for a terminal device, a storage medium and an electronic device to solve the problem in the related art that it is difficult to accurately locate the specific terminal that generates abnormal traffic in a network address translation environment, making it difficult to ensure the security of the network.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for processing a terminal device is provided. The method comprises: receiving TCP messages sent by multiple terminal devices through a network device, wherein the TCP message sent by each terminal device includes identification information of the terminal device, and the multiple terminal devices are terminal devices after network address translation; determining whether there is abnormal traffic through the network device, and if there is abnormal traffic, parsing the TCP message flow of the abnormal traffic to obtain a target identifier, wherein the TCP message flow of the abnormal traffic is composed of multiple TCP messages; and determining the target terminal device that generates the abnormal traffic from the multiple terminal devices according to the target identifier.

[0007] Furthermore, parsing the TCP message flow of the abnormal traffic to obtain the target identifier includes: parsing the TCP message flow of the abnormal traffic to obtain multiple TCP messages in the TCP message flow of the abnormal traffic, and obtaining multiple field information in each TCP message; determining data information corresponding to the option field in each TCP message based on the multiple field information in each TCP message; and obtaining the target identifier based on the data information corresponding to the option field in each TCP message.

[0008] Furthermore, based on the data information corresponding to the option field in each TCP message, obtaining the target identifier includes: based on the data information corresponding to the option field in each TCP message, obtaining the data information corresponding to each bit in the identification information to obtain multiple data; and according to the number of bits of the identification information, splicing the multiple data to obtain the target identifier.

[0009] Further, based on the target identifier, determining the target terminal device that generates the abnormal traffic from the multiple terminal devices includes: based on the target identifier, determining the target information of the terminal device that generates the abnormal traffic, wherein the target information includes at least one of the following: name information, IP information and MAC information; based on the target information of the terminal device that generates the abnormal traffic, determining the target terminal device that generates the abnormal traffic from the multiple terminal devices.

[0010] Furthermore, before receiving TCP messages sent by multiple terminal devices through the network device, the method also includes: obtaining identification information of each terminal device; starting a driver in each terminal device through an application installed on each terminal device; and inserting the identification information of each terminal device into the TCP message to be sent by each terminal device through the driver in each terminal device.

[0011] Furthermore, inserting the identification information of each terminal device into the TCP message to be sent by each terminal device through the driver program in each terminal device includes: obtaining multiple field information in the TCP message to be sent by each terminal device; determining the option field in the TCP message to be sent by each terminal device based on the multiple field information in the TCP message to be sent by each terminal device; and inserting the identification information of each terminal device into the option field in the TCP message to be sent by each terminal device based on the data information corresponding to each bit in the identification information of each terminal device through the driver program in each terminal device.

[0012] Furthermore, after determining the target terminal device that generates abnormal traffic from the multiple terminal devices based on the target identifier, the method also includes: obtaining the threat level of the target terminal device to the target network, and determining whether the threat level of the target terminal device to the target network is greater than a preset threat level; if the threat level of the target terminal device to the target network is not greater than the preset threat level, sending a prompt message to the target object using the target terminal device, wherein the prompt message is used to prompt that the target terminal device has abnormal behavior; if the threat level of the target terminal device to the target network is greater than the preset threat level, disconnecting the target terminal device from the network.

[0013] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a processing device for a terminal device is provided. The device comprises: a first receiving unit, used to receive TCP messages sent by multiple terminal devices through a network device, wherein each TCP message sent by the terminal device includes identification information of the terminal device, and the multiple terminal devices are terminal devices after network address translation; a first processing unit, used to determine whether there is abnormal traffic through the network device, and if there is abnormal traffic, parse the TCP message flow of the abnormal traffic to obtain a target identifier, wherein the TCP message flow of the abnormal traffic is composed of multiple TCP messages; a first determining unit, used to determine the target terminal device that generates the abnormal traffic from the multiple terminal devices according to the target identifier.

[0014] Furthermore, the first processing unit includes: a first parsing module, used to parse the TCP message flow of the abnormal traffic, obtain multiple TCP messages in the TCP message flow of the abnormal traffic, and obtain multiple field information in each TCP message; a first determination module, used to determine the data information corresponding to the option field in each TCP message based on the multiple field information in each TCP message; a second determination module, used to obtain the target identifier based on the data information corresponding to the option field in each TCP message.

[0015] Furthermore, the second determination module includes: a first acquisition submodule, used to obtain the data information corresponding to each bit in the identification information based on the data information corresponding to the option field in each TCP message, and obtain multiple data; a first processing submodule, used to splice the multiple data according to the number of bits of the identification information, and obtain the target identifier.

[0016] Furthermore, the first determination unit includes: a third determination module, used to determine the target information of the terminal device that generates the abnormal traffic based on the target identifier, wherein the target information includes at least one of the following: name information, IP information and MAC information; a fourth determination module, used to determine the target terminal device that generates the abnormal traffic from the multiple terminal devices based on the target information of the terminal device that generates the abnormal traffic.

[0017] Furthermore, the device also includes: a first acquisition unit, used to acquire identification information of each terminal device before receiving TCP messages sent by multiple terminal devices through the network device; a first startup unit, used to start the driver program in each terminal device through the application installed on each terminal device; and a first insertion unit, used to insert the identification information of each terminal device into the TCP message to be sent by each terminal device through the driver program in each terminal device.

[0018] Furthermore, the first insertion unit includes: a first acquisition module, used to acquire multiple field information in the TCP message to be sent by each terminal device; a fifth determination module, used to determine the option field in the TCP message to be sent by each terminal device based on the multiple field information in the TCP message to be sent by each terminal device; the first insertion module, used to insert the identification information of each terminal device into the option field in the TCP message to be sent by each terminal device through a driver in each terminal device according to the data information corresponding to each bit in the identification information of each terminal device.

[0019] Furthermore, the device also includes: a second processing unit, which is used to obtain the threat level of the target terminal device to the target network after determining the target terminal device that generates abnormal traffic from the multiple terminal devices based on the target identifier, and determine whether the threat level of the target terminal device to the target network is greater than a preset threat level; a first sending unit, which is used to send a prompt message to the target object using the target terminal device if the threat level of the target terminal device to the target network is not greater than the preset threat level, wherein the prompt message is used to prompt that the target terminal device has abnormal behavior; and a third processing unit, which is used to disconnect the target terminal device from the network if the threat level of the target terminal device to the target network is greater than the preset threat level.

[0020] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer-readable storage medium is provided, wherein the storage medium stores a program, wherein the program executes any one of the above-mentioned processing methods of the terminal device.

[0021] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an electronic device is provided, which includes one or more processors and a memory, and the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the processing method of the terminal device described in any one of the above-mentioned items.

[0022] Through the present application, the following steps are adopted: receiving TCP messages sent by multiple terminal devices through a network device, wherein the TCP message sent by each terminal device includes identification information of the terminal device, and the multiple terminal devices are terminal devices after network address translation; determining whether there is abnormal traffic through the network device, and when there is abnormal traffic, parsing the TCP message flow of the abnormal traffic to obtain a target identification, wherein the TCP message flow of the abnormal traffic is composed of multiple TCP messages; based on the target identification, determining the target terminal device that generates the abnormal traffic from the multiple terminal devices, thereby solving the problem in the related art that it is difficult to accurately locate the specific terminal that generates the abnormal traffic in a network address translation environment, resulting in difficulty in ensuring the security of the network. By inserting the information (i.e. identification information) of the terminal (i.e. multiple terminal devices) into the TCP message sent from the terminal (i.e. multiple terminal devices), and then in a network address translation (NAT) environment, when the upper layer device (i.e. network device) finds abnormal traffic, the TCP message flow of the abnormal traffic is parsed to obtain the terminal information (i.e. target identification) recorded in the TCP message flow of the abnormal traffic, and then according to the terminal information (i.e. target identification) recorded in the TCP message flow of the abnormal traffic, the specific terminal (i.e. target terminal device) behind the NAT network environment (i.e. network address translation environment) is located, so that in the network address translation environment, the specific terminal generating the abnormal traffic can be accurately located, thereby achieving the effect of ensuring the security of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0024] Figure 1 is a flowchart of a processing method of a terminal device provided according to an embodiment of the present application;

[0025] Figure 2 is a flowchart of an optional processing method of a terminal device provided according to an embodiment of the present application;

[0026] Figure 3 This is a schematic diagram of inserting the terminal information computer name into the TCP header in this embodiment;

[0027] Figure 4 is a schematic diagram of a processing device of a terminal device provided according to an embodiment of the present application;

[0028] Figure 5 is a schematic diagram of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0029] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0030] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0033] For the convenience of description, some nouns or terms involved in the embodiments of the present application are explained below:

[0034] NAT is the abbreviation of Network Address Translation. It is a network technology used to convert IP addresses in private networks into routable IP addresses in public networks to enable communication between internal networks and external networks. NAT technology is often used to share a public IP address in a home or corporate network so that multiple devices can access the Internet.

[0035] TCP (Transmission Control Protocol) is a connection-oriented, reliable transport layer protocol used to transmit data in computer networks. TCP messages are data units transmitted in TCP connections, which contain some control information and actual data content.

[0036] Network equipment refers to hardware devices used to connect, transmit and manage network communications. Common network equipment includes routers, switches, firewalls, gateways, modems, network cards, etc. These devices can help users achieve network connection, data transmission, network security and management functions.

[0037] Terminal devices refer to devices connected to a network or system and are used for data transmission, communication or access to information. Common terminal devices include personal computers, smartphones, tablets, routers, switches, fax machines, etc.

[0038] An IP (Internet Protocol) address is an Internet Protocol address, which is a unique identifier assigned to a device on a network. It is an address consisting of numbers and dots that is used to identify a device on a network.

[0039] MAC (Media Access Control) information refers to media access control. MAC information is a unique identifier of a network device (such as a computer, router, switch, etc.) in a local area network, which is used to identify the device and control its connection and communication with the network.

[0040] The present invention is described below in conjunction with preferred implementation steps. Figure 1 is a flowchart of a processing method of a terminal device provided in an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0041] Step S101: receiving TCP messages sent by multiple terminal devices through a network device, wherein the TCP message sent by each terminal device includes identification information of the terminal device, and the multiple terminal devices are terminal devices after network address translation.

[0042] For example, the above-mentioned network devices refer to hardware devices used to connect, transmit and manage network communications, and the above-mentioned network devices can be devices such as routers, switches and firewalls.

[0043] For example, the above-mentioned terminal device refers to a device connected to a network or system, which is a tool for data transmission, communication or access to information, and the above-mentioned terminal device can be a personal computer, a smart phone, a tablet computer and other devices.

[0044] For example, after performing network address translation for multiple terminal devices, that is, in a network address translation (NAT) environment, multiple terminal devices can send multiple TCP messages to a network device, and each terminal device can send one or more TCP messages to a network device. Moreover, when each terminal device sends multiple TCP messages to a network device, or before each terminal device sends multiple TCP messages to a network device, the information of each terminal device (corresponding to the above-mentioned identification information) can be inserted into the TCP message sent out by each terminal device, and the above-mentioned identification information can be the name information, IP (Internet Protocol) address and MAC (Media Access Control) address of each terminal device. Therefore, in a network address translation (NAT) environment, multiple TCP messages sent by multiple terminal devices can be received by a network device, and each TCP message carries the information of each terminal device (corresponding to the above-mentioned identification information).

[0045] Step S102, determining whether there is abnormal traffic through the network device, and if there is abnormal traffic, parsing the TCP message flow of the abnormal traffic to obtain a target identifier, wherein the TCP message flow of the abnormal traffic consists of multiple TCP messages.

[0046] For example, a network device can detect whether multiple terminal devices to which multiple TCP messages are sent have abnormal behavior. For example, if a terminal device visits a prohibited website or terminal device, or the terminal device generates abnormal traffic, that is, the terminal device generates an abnormally large amount of data transmission, which may exceed the needs of normal business. All of the above can be considered as abnormal behavior of the terminal device. And when the network device detects that multiple terminal devices to which multiple TCP messages are sent do not have abnormal behavior, the network device can continue to receive multiple TCP messages sent to it by multiple terminal devices; when the network device detects that multiple terminal devices to which multiple TCP messages are sent have abnormal behavior, it can first determine the existence of abnormal traffic, and then parse the TCP message stream of the abnormal traffic to obtain the identification information of the terminal carried in the abnormal traffic (corresponding to the above-mentioned target identification).

[0047] Step S103: determining a target terminal device generating abnormal traffic from a plurality of terminal devices according to the target identifier.

[0048] For example, based on the terminal identification information recorded in the TCP message of the abnormal traffic (corresponding to the above-mentioned target identification), the terminal device with abnormal behavior (corresponding to the above-mentioned target terminal device that generates abnormal traffic) can be determined from multiple terminal devices that send multiple TCP messages to the network device.

[0049] Through the above steps S101 to S103, by inserting the information (i.e., identification information) of the terminal (i.e., multiple terminal devices) into the TCP message sent from the terminal (i.e., multiple terminal devices), and then in the network address translation (Network Address Translation, NAT) environment, when the upper-layer device (i.e., network device) finds abnormal traffic, the TCP message flow of the abnormal traffic is parsed to obtain the terminal information (i.e., target identification) recorded in the TCP message flow of the abnormal traffic, and then based on the terminal information (i.e., target identification) recorded in the TCP message flow of the abnormal traffic, the specific terminal (i.e., target terminal device) behind the NAT network environment (i.e., network address translation environment) is located, so that in the network address translation environment, the specific terminal that generates the abnormal traffic can be accurately located, thereby achieving the effect of ensuring the security of the network.

[0050] Optionally, in the processing method of the terminal device provided in the embodiment of the present application, before receiving TCP messages sent by multiple terminal devices through a network device, the method also includes: obtaining identification information of each terminal device; starting a driver in each terminal device through an application installed on each terminal device; and inserting the identification information of each terminal device into the TCP message to be sent by each terminal device through the driver in each terminal device.

[0051] For example, the Windows operating system can be installed on each terminal device, and then the client application (corresponding to the above-mentioned application) can be installed on the controlled Windows terminal (corresponding to each of the above-mentioned terminal devices), and then the corresponding driver (corresponding to the driver in each of the above-mentioned terminal devices) is started to configure the corresponding configuration, and then the terminal information (corresponding to the identification information of each of the above-mentioned terminal devices) is inserted into the TCP message, so that the terminal information (corresponding to the identification information of each of the above-mentioned terminal devices) can be inserted into the TCP message sent out by the terminal (corresponding to each of the above-mentioned terminal devices). Moreover, the identification information inserted in each TCP message can be the name information, IP (Internet Protocol) address and MAC (Media Access Control) address of each terminal device. In addition, the terminal device can be installed with the Windows operating system or other operating systems.

[0052] In summary, by installing the client application on the terminal device, the identification information of each terminal device can be conveniently inserted into the TCP message to be sent.

[0053] Optionally, in the processing method of the terminal device provided in the embodiment of the present application, inserting the identification information of each terminal device into the TCP message to be sent by each terminal device through the driver in each terminal device includes: obtaining multiple field information in the TCP message to be sent by each terminal device; determining the option field in the TCP message to be sent by each terminal device based on the multiple field information in the TCP message to be sent by each terminal device; and inserting the identification information of each terminal device into the option field in the TCP message to be sent by each terminal device according to the data information corresponding to each bit in the identification information of each terminal device through the driver in each terminal device.

[0054] For example, a TCP message may contain the following fields:

[0055] (1) Source port number: the port number of the sending end;

[0056] (2) Destination port number: the port number of the receiving end;

[0057] (3) Sequence number: used to sort and reorganize data;

[0058] (4) Confirmation number: used to confirm received data;

[0059] (5) Data offset: indicates the length of the TCP header;

[0060] (6) Reserved bit: reserved field, not used;

[0061] (7) Control bit: used to identify the type of TCP message, such as SYN, ACK, FIN, etc.

[0062] (8) Window size: used for flow control, indicating how much data the sender can send;

[0063] (9) Checksum: used to verify the integrity of TCP messages;

[0064] (10) Emergency pointer: used to indicate emergency data;

[0065] (11) Option: An optional field used to extend TCP functions.

[0066] For example, the option field in a TCP message may include the following fields:

[0067] (1) Option type (Kind field): specifies the type of the option, such as maximum segment length, window scaling factor, etc.

[0068] (2) Option length (Length field): specifies the length of the option in bytes;

[0069] (3) Option data (Info field): Specific option data, such as the value of the maximum segment length, the value of the window scaling factor, etc.

[0070] For example, the option field (option field) can be first determined from the multiple fields contained in the TCP message (corresponding to the multiple field information mentioned above), and then the meaning of each byte of the option data (Info field) in the option field (option field) can be defined, the first byte in the Info field can be defined to represent the number of data in the terminal identification, and the second byte in the Info field can be defined to represent a certain byte in the terminal identification data; then, through the driver in each terminal device, according to the pre-defined meaning of each byte of the Info field and the data information corresponding to each bit in the identification information of each terminal device, the identification information of each terminal device is inserted into the option field (option field) of the TCP message header to be sent by each terminal device.

[0071] Through the above solution, the terminal information can be quickly and accurately inserted into the custom Option segment of the TCP message header.

[0072] Optionally, in the processing method of the terminal device provided in the embodiment of the present application, parsing the TCP packet stream of the abnormal traffic to obtain a target identifier includes: parsing the TCP packet stream of the abnormal traffic to obtain multiple TCP packets in the TCP packet stream of the abnormal traffic, and obtaining multiple field information in each TCP packet; determining data information corresponding to the option field in each TCP packet based on the multiple field information in each TCP packet; and obtaining the target identifier based on the data information corresponding to the option field in each TCP packet.

[0073] For example, the TCP message stream of the abnormal traffic can be parsed first to obtain multiple TCP messages in the TCP message stream of the abnormal traffic, and then the source port number, destination port number, sequence number, confirmation number, checksum and option field (option field) and other field information (corresponding to the above-mentioned multiple field information) in each TCP message can be obtained, and then the data information corresponding to the option field (option field) in each TCP message can be obtained from the parsed multiple fields, and then the identification information of the terminal carried in the abnormal traffic (corresponding to the above-mentioned target identification) can be obtained according to the data information corresponding to the option field (option field) in each TCP message.

[0074] Through the above solution, the terminal information recorded in the TCP message can be quickly and accurately determined according to the data information corresponding to the parsed option field (option field).

[0075] Optionally, in the processing method of the terminal device provided in the embodiment of the present application, obtaining the target identifier based on the data information corresponding to the option field in each TCP message includes: based on the data information corresponding to the option field in each TCP message, obtaining the data information corresponding to each bit in the identification information to obtain multiple data; based on the number of bits of the identification information, splicing the multiple data to obtain the target identifier.

[0076] For example, based on the data information corresponding to the option field (option field) and the meaning of each byte of the pre-defined Info field, the data information corresponding to each bit in the terminal information carried in the TCP message of the abnormal traffic (corresponding to the above-mentioned multiple data) can be determined, and then the data information corresponding to each bit (corresponding to the above-mentioned multiple data) can be spliced ​​together according to the order and the total number of bits of the identifier to obtain the terminal information carried in the TCP message of the abnormal traffic (corresponding to the above-mentioned target identifier).

[0077] In summary, by splicing the data corresponding to each bit of the analysis, the terminal information recorded in the TCP message can be obtained quickly and accurately.

[0078] Optionally, in the processing method of the terminal device provided in the embodiment of the present application, determining the target terminal device that generates abnormal traffic from multiple terminal devices based on the target identifier includes: determining the target information of the terminal device that generates abnormal traffic based on the target identifier, wherein the target information includes at least one of the following: name information, IP information, and MAC information; determining the target terminal device that generates abnormal traffic from multiple terminal devices based on the target information of the terminal device that generates abnormal traffic.

[0079] For example, based on the terminal information carried in the TCP message of the abnormal traffic (corresponding to the above-mentioned target identifier), the name, IP address, MAC address and other information of the terminal device generating the abnormal traffic (corresponding to the above-mentioned target information) can be obtained, and then based on the name, IP address, MAC address and other information of the terminal device generating the abnormal traffic (corresponding to the above-mentioned target information), it is possible to determine which terminal device (corresponding to the above-mentioned target terminal device) is generating the abnormal traffic.

[0080] Through the above solution, the terminal device that generates abnormal traffic can be quickly and accurately determined based on information such as name, IP address and MAC address.

[0081] Optionally, in the processing method of the terminal device provided in the embodiment of the present application, after determining the target terminal device that generates abnormal traffic from multiple terminal devices based on the target identifier, the method also includes: obtaining the threat level of the target terminal device to the target network, and determining whether the threat level of the target terminal device to the target network is greater than a preset threat level; if the threat level of the target terminal device to the target network is not greater than the preset threat level, sending a prompt message to the target object using the target terminal device, wherein the prompt message is used to prompt that the target terminal device has abnormal behavior; if the threat level of the target terminal device to the target network is greater than the preset threat level, disconnecting the target terminal device from the network.

[0082] For example, after determining the terminal device that generates abnormal traffic (corresponding to the above-mentioned target terminal device), the threat level of the terminal device that generates abnormal traffic (corresponding to the above-mentioned target terminal device) to the network (corresponding to the above-mentioned target network) can be determined first. If the preset threat level is 90%, and the threat level of the terminal device that generates abnormal traffic (corresponding to the above-mentioned target terminal device) to the network (corresponding to the above-mentioned target network) is determined to be 85%, this means that the threat level of 85% of the terminal device that generates abnormal traffic (corresponding to the above-mentioned target terminal device) to the network (corresponding to the above-mentioned target network) is not greater than the preset threat level of 90%, and a prompt message can be sent to the user (corresponding to the above-mentioned target object) to prompt the user (corresponding to the above-mentioned target object) that the terminal device (corresponding to the above-mentioned target terminal device) has abnormal behavior; if the threat level of the terminal device that generates abnormal traffic (corresponding to the above-mentioned target terminal device) to the network (corresponding to the above-mentioned target network) is determined to be 93%, this means that the threat level of 93% of the terminal device that generates abnormal traffic (corresponding to the above-mentioned target terminal device) to the network (corresponding to the above-mentioned target network) is greater than the preset threat level of 90%, and the terminal device (corresponding to the above-mentioned target terminal device) can be disconnected from the network.

[0083] Through the above solution, the security of the network can be easily guaranteed and the network can be prevented from being damaged.

[0084] For example, this embodiment provides an implementation scheme for marking terminals based on TCP protocol messages on Windows system terminals, and this method only requires installing a client application on the controlled Windows terminal, starting the corresponding driver program and configuring the corresponding configuration, and then inserting the terminal information into the TCP message sent from the terminal.

[0085] Moreover, the TCP header customization options are described as follows:

[0086] According to the TCP protocol, we know that the maximum length of the TCP Option field is 40 bytes, and the general data structure of the field is defined as follows:

[0087] Kind(1Byte) Length(1Byte) Info(nByte)

[0088] Kind field: describes the option type;

[0089] Length field: records the overall length of the option;

[0090] Info field: data carried by the option.

[0091] In addition, define a custom TCP option data structure as follows:

[0092] Kind(0xe0) Length(4Byte) Info(2Byte)

[0093] Kind field: 0xF0;

[0094] Length field: The entire option occupies 4 bytes;

[0095] Info field: 2 Bytes;

[0096] The meaning of each byte in the Info field is as follows:

[0097] The first byte: the number of data in the terminal identification The second byte: a byte in the terminal identification data

[0098] For example, Figure 2 is a flowchart of an optional processing method of a terminal device provided according to an embodiment of the present application, such as Figure 2 As shown, the terminal device can first insert the terminal information (corresponding to the above-mentioned identification information) into the custom Option segment (option field) of the TCP message header, and then send the TCP message with the inserted terminal information (corresponding to the above-mentioned identification information) to the network device. The network device then receives the TCP message sent by the terminal device, and parses the inserted terminal information (corresponding to the above-mentioned target identification) from the custom option segment (option field) of the TCP message header, and then locates the terminal behind the NAT network environment (corresponding to the above-mentioned target terminal device) through the parsed terminal information (corresponding to the above-mentioned target identification).

[0099] For example, the processing method of the terminal device provided in this embodiment includes the following steps:

[0100] (1) Install the client program on the controlled Windows terminal;

[0101] (2) The driver inserts the terminal information (corresponding to the above identification information) into the custom Option segment (option field) of the TCP message header;

[0102] (3) The upper-layer device (i.e., the network device) parses the inserted terminal information (corresponding to the target identifier mentioned above) from the custom option segment (option field) of the TCP message header;

[0103] (4) The terminal behind the NAT network environment (corresponding to the target terminal device mentioned above) is located through the parsed terminal information (corresponding to the target identifier mentioned above).

[0104] For example, Figure 3 Schematic diagram of inserting the terminal information computer name into the TCP header in this embodiment, such as Figure 3As shown, the terminal information (corresponding to the above-mentioned identification information) inserted into the TCP message of the terminal device can be the name information of the computer. The name of the computer terminal can be obtained first as DESKTOP-GH-188, and the number of digits of the computer name is 14. Then, when the driver processes the TCP message, the data of the digit can be inserted cyclically according to the predefined TCP option data structure; then the network device can parse and record the received TCP message according to the predefined TCP option data structure, and after processing the 15th TCP message, the terminal computer name can be obtained: DESKTOP-GH-188.

[0105] In addition, the method provided in this embodiment has a highly universal feature and can be applied to most Windows terminal devices and terminal devices of other operating systems, and this embodiment does not need to rely on a third-party customized system.

[0106] Therefore, this embodiment can record the terminal information in the TCP message, so that in the NAT network environment, when the upper layer device (i.e., the network device) finds abnormal traffic, the terminal information recorded in the TCP message can be used to locate the specific terminal behind the NAT network environment. For large network data organizations, it can provide the ability to locate terminals and users behind the NAT network environment.

[0107] In summary, the processing method of the terminal device provided in the embodiment of the present application receives TCP messages sent by multiple terminal devices through a network device, wherein the TCP message sent by each terminal device includes the identification information of the terminal device, and the multiple terminal devices are terminal devices after network address conversion; determines whether there is abnormal traffic through the network device, and when there is abnormal traffic, parses the TCP message stream of the abnormal traffic to obtain a target identifier, wherein the TCP message stream of the abnormal traffic is composed of multiple TCP messages; based on the target identifier, determines the target terminal device that generates the abnormal traffic from the multiple terminal devices, which solves the problem in the related art that it is difficult to accurately locate the specific terminal that generates the abnormal traffic in the network address conversion environment, resulting in difficulty in ensuring the security of the network. By inserting the information (i.e. identification information) of the terminal (i.e. multiple terminal devices) into the TCP message sent from the terminal (i.e. multiple terminal devices), and then in a network address translation (NAT) environment, when the upper layer device (i.e. network device) finds abnormal traffic, the TCP message flow of the abnormal traffic is parsed to obtain the terminal information (i.e. target identification) recorded in the TCP message flow of the abnormal traffic, and then according to the terminal information (i.e. target identification) recorded in the TCP message flow of the abnormal traffic, the specific terminal (i.e. target terminal device) behind the NAT network environment (i.e. network address translation environment) is located, so that in the network address translation environment, the specific terminal generating the abnormal traffic can be accurately located, thereby achieving the effect of ensuring the security of the network.

[0108] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0109] The embodiment of the present application also provides a processing device for a terminal device. It should be noted that the processing device for a terminal device in the embodiment of the present application can be used to execute the processing method for a terminal device provided in the embodiment of the present application. The processing device for a terminal device provided in the embodiment of the present application is introduced below.

[0110] Figure 4 Schematic diagram of a processing device of a terminal device provided according to an embodiment of the present application. Figure 4 As shown, the device includes: a first receiving unit 401, a first processing unit 402 and a first determining unit 403.

[0111] Specifically, the first receiving unit 401 is used to receive TCP messages sent by multiple terminal devices through a network device, wherein the TCP message sent by each terminal device includes identification information of the terminal device, and the multiple terminal devices are terminal devices after network address translation;

[0112] The first processing unit 402 is used to determine whether there is abnormal traffic through the network device, and if there is abnormal traffic, parse the TCP message flow of the abnormal traffic to obtain a target identifier, wherein the TCP message flow of the abnormal traffic is composed of multiple TCP messages;

[0113] The first determining unit 403 is configured to determine a target terminal device generating abnormal traffic from a plurality of terminal devices according to a target identifier.

[0114] In summary, the processing device of the terminal device provided in the embodiment of the present application receives TCP messages sent by multiple terminal devices through a network device through a first receiving unit 401, wherein the TCP message sent by each terminal device includes identification information of the terminal device, and the multiple terminal devices are terminal devices after network address conversion; the first processing unit 402 determines whether there is abnormal traffic through the network device, and when there is abnormal traffic, parses the TCP message stream of the abnormal traffic to obtain a target identifier, wherein the TCP message stream of the abnormal traffic is composed of multiple TCP messages; the first determination unit 403 determines the target terminal device that generates the abnormal traffic from the multiple terminal devices based on the target identifier, which solves the problem in the related art that it is difficult to accurately locate the specific terminal that generates the abnormal traffic in a network address conversion environment, resulting in difficulty in ensuring the security of the network. By inserting the information (i.e. identification information) of the terminal (i.e. multiple terminal devices) into the TCP message sent from the terminal (i.e. multiple terminal devices), and then in a network address translation (NAT) environment, when the upper layer device (i.e. network device) finds abnormal traffic, the TCP message flow of the abnormal traffic is parsed to obtain the terminal information (i.e. target identification) recorded in the TCP message flow of the abnormal traffic, and then according to the terminal information (i.e. target identification) recorded in the TCP message flow of the abnormal traffic, the specific terminal (i.e. target terminal device) behind the NAT network environment (i.e. network address translation environment) is located, so that in the network address translation environment, the specific terminal generating the abnormal traffic can be accurately located, thereby achieving the effect of ensuring the security of the network.

[0115] Optionally, in the processing device of the terminal device provided in the embodiment of the present application, the first processing unit includes: a first parsing module, used to parse the TCP packet flow of abnormal traffic, obtain multiple TCP packets in the TCP packet flow of abnormal traffic, and obtain multiple field information in each TCP packet; a first determination module, used to determine the data information corresponding to the option field in each TCP message based on the multiple field information in each TCP message; a second determination module, used to obtain the target identifier based on the data information corresponding to the option field in each TCP message.

[0116] Optionally, in the processing device of the terminal device provided in the embodiment of the present application, the second determination module includes: a first acquisition sub-module, used to obtain data information corresponding to each bit in the identification information based on the data information corresponding to the option field in each TCP message, and obtain multiple data; a first processing sub-module, used to splice the multiple data according to the number of bits of the identification information, and obtain a target identification.

[0117] Optionally, in the processing device of the terminal device provided in the embodiment of the present application, the first determination unit includes: a third determination module, used to determine the target information of the terminal device generating the abnormal traffic based on the target identifier, wherein the target information includes at least one of the following: name information, IP information and MAC information; a fourth determination module, used to determine the target terminal device generating the abnormal traffic from multiple terminal devices based on the target information of the terminal device generating the abnormal traffic.

[0118] Optionally, in the processing device of the terminal device provided in the embodiment of the present application, the device also includes: a first acquisition unit, used to obtain identification information of each terminal device before receiving TCP messages sent by multiple terminal devices through a network device; a first starting unit, used to start a driver program in each terminal device through an application installed on each terminal device; and a first insertion unit, used to insert the identification information of each terminal device into the TCP message to be sent by each terminal device through the driver program in each terminal device.

[0119] Optionally, in the processing device of the terminal device provided in the embodiment of the present application, the first insertion unit includes: a first acquisition module, used to acquire multiple field information in the TCP message to be sent by each terminal device; a fifth determination module, used to determine the option field in the TCP message to be sent by each terminal device based on the multiple field information in the TCP message to be sent by each terminal device; the first insertion module, used to insert the identification information of each terminal device into the option field in the TCP message to be sent by each terminal device through a driver in each terminal device according to the data information corresponding to each bit in the identification information of each terminal device.

[0120] Optionally, in the processing device of the terminal device provided in the embodiment of the present application, the device also includes: a second processing unit, used to obtain the threat level of the target terminal device to the target network after determining the target terminal device that generates abnormal traffic from multiple terminal devices based on the target identifier, and determine whether the threat level of the target terminal device to the target network is greater than a preset threat level; a first sending unit, used to send a prompt message to the target object using the target terminal device if the threat level of the target terminal device to the target network is not greater than the preset threat level, wherein the prompt message is used to prompt that the target terminal device has abnormal behavior; and a third processing unit, used to disconnect the target terminal device from the network if the threat level of the target terminal device to the target network is greater than the preset threat level.

[0121] The processing device of the terminal device includes a processor and a memory. The above-mentioned first receiving unit 401, first processing unit 402 and first determination unit 403 are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0122] The processor contains a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the security of the network can be guaranteed by adjusting the kernel parameters.

[0123] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0124] An embodiment of the present invention provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the processing method of the terminal device is implemented.

[0125] An embodiment of the present invention provides a processor, which is used to run a program, wherein the processing method of the terminal device is executed when the program is run.

[0126] like Figure 5As shown, an embodiment of the present invention provides an electronic device, the device includes a processor, a memory and a program stored in the memory and executable on the processor, and the processor implements the following steps when executing the program: receiving TCP packets sent by multiple terminal devices through a network device, wherein the TCP packet sent by each terminal device includes identification information of the terminal device, and the multiple terminal devices are terminal devices after network address conversion; determining whether there is abnormal traffic through the network device, and in the case of abnormal traffic, parsing the TCP packet flow of the abnormal traffic to obtain a target identifier, wherein the TCP packet flow of the abnormal traffic is composed of multiple TCP packets; and determining a target terminal device generating the abnormal traffic from the multiple terminal devices based on the target identifier.

[0127] When the processor executes the program, the following steps are also implemented: parsing the TCP message flow of abnormal traffic to obtain a target identifier, including: parsing the TCP message flow of abnormal traffic to obtain multiple TCP messages in the TCP message flow of abnormal traffic, and obtaining multiple field information in each TCP message; determining data information corresponding to an option field in each TCP message based on the multiple field information in each TCP message; and obtaining a target identifier based on the data information corresponding to the option field in each TCP message.

[0128] When the processor executes the program, the following steps are also implemented: based on the data information corresponding to the option field in each TCP message, a target identifier is obtained, including: based on the data information corresponding to the option field in each TCP message, the data information corresponding to each bit in the identification information is obtained to obtain multiple data; based on the number of bits of the identification information, multiple data are spliced ​​to obtain the target identifier.

[0129] When the processor executes the program, the following steps are also implemented: based on the target identifier, determining the target terminal device that generates abnormal traffic from multiple terminal devices includes: based on the target identifier, determining the target information of the terminal device that generates abnormal traffic, wherein the target information includes at least one of the following: name information, IP information and MAC information; based on the target information of the terminal device that generates abnormal traffic, determining the target terminal device that generates abnormal traffic from multiple terminal devices.

[0130] When the processor executes the program, the following steps are also implemented: before receiving TCP messages sent by multiple terminal devices through the network device, it also includes: obtaining identification information of each terminal device; starting the driver in each terminal device through the application installed on each terminal device; and inserting the identification information of each terminal device into the TCP message to be sent by each terminal device through the driver in each terminal device.

[0131] When the processor executes the program, the following steps are also implemented: inserting the identification information of each terminal device into the TCP message to be sent by each terminal device through the driver program in each terminal device, including: obtaining multiple field information in the TCP message to be sent by each terminal device; determining the option field in the TCP message to be sent by each terminal device based on the multiple field information in the TCP message to be sent by each terminal device; inserting the identification information of each terminal device into the option field in the TCP message to be sent by each terminal device according to the data information corresponding to each bit in the identification information of each terminal device through the driver program in each terminal device.

[0132] When the processor executes the program, the following steps are also implemented: after determining the target terminal device that generates abnormal traffic from multiple terminal devices based on the target identifier, it also includes: obtaining the threat level of the target terminal device to the target network, and judging whether the threat level of the target terminal device to the target network is greater than the preset threat level; if the threat level of the target terminal device to the target network is not greater than the preset threat level, sending a prompt message to the target object using the target terminal device, wherein the prompt message is used to prompt that the target terminal device has abnormal behavior; if the threat level of the target terminal device to the target network is greater than the preset threat level, disconnecting the target terminal device from the network.

[0133] The devices in this article can be servers, PCs, PADs, mobile phones, etc.

[0134] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having the following method steps: receiving TCP messages sent by multiple terminal devices through a network device, wherein the TCP message sent by each terminal device includes identification information of the terminal device, and the multiple terminal devices are terminal devices after network address conversion; determining whether there is abnormal traffic through the network device, and if there is abnormal traffic, parsing the TCP message flow of the abnormal traffic to obtain a target identification, wherein the TCP message flow of the abnormal traffic is composed of multiple TCP messages; and determining, based on the target identification, a target terminal device that generates the abnormal traffic from the multiple terminal devices.

[0135] When executed on a data processing device, it is also suitable for executing a program that is initialized with the following method steps: parsing the TCP message flow of abnormal traffic to obtain a target identifier, including: parsing the TCP message flow of abnormal traffic to obtain multiple TCP messages in the TCP message flow of abnormal traffic, and obtaining multiple field information in each TCP message; determining data information corresponding to an option field in each TCP message based on the multiple field information in each TCP message; and obtaining a target identifier based on the data information corresponding to the option field in each TCP message.

[0136] When executed on a data processing device, it is also suitable for executing an initialization program having the following method steps: based on the data information corresponding to the option field in each TCP message, obtaining the target identifier includes: based on the data information corresponding to the option field in each TCP message, obtaining the data information corresponding to each bit in the identification information to obtain multiple data; based on the bit number information of the identification information, splicing the multiple data to obtain the target identifier.

[0137] When executed on a data processing device, it is also suitable for executing an initialization program having the following method steps: determining a target terminal device generating abnormal traffic from multiple terminal devices based on a target identifier, including: determining target information of the terminal device generating abnormal traffic based on the target identifier, wherein the target information includes at least one of the following: name information, IP information, and MAC information; determining the target terminal device generating abnormal traffic from multiple terminal devices based on the target information of the terminal device generating abnormal traffic.

[0138] When executed on a data processing device, it is also suitable for executing an initialization program having the following method steps: before receiving TCP messages sent by multiple terminal devices through a network device, it also includes: obtaining identification information of each terminal device; starting a driver in each terminal device through an application installed on each terminal device; and inserting the identification information of each terminal device into the TCP message to be sent by each terminal device through the driver in each terminal device.

[0139] When executed on a data processing device, it is also suitable for executing an initialization program having the following method steps: inserting the identification information of each terminal device into the TCP message to be sent by each terminal device through the driver program in each terminal device, including: obtaining multiple field information in the TCP message to be sent by each terminal device; determining the option field in the TCP message to be sent by each terminal device based on the multiple field information in the TCP message to be sent by each terminal device; inserting the identification information of each terminal device into the option field in the TCP message to be sent by each terminal device according to the data information corresponding to each bit in the identification information of each terminal device through the driver program in each terminal device.

[0140] When executed on a data processing device, it is also suitable for executing an initialization program having the following method steps: after determining the target terminal device that generates abnormal traffic from multiple terminal devices based on the target identifier, it also includes: obtaining the threat level of the target terminal device to the target network, and judging whether the threat level of the target terminal device to the target network is greater than the preset threat level; if the threat level of the target terminal device to the target network is not greater than the preset threat level, sending a prompt message to the target object using the target terminal device, wherein the prompt message is used to prompt that the target terminal device has abnormal behavior; if the threat level of the target terminal device to the target network is greater than the preset threat level, disconnecting the target terminal device from the network.

[0141] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0142] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0143] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0144] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0145] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0146] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0147] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0148] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0149] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0150] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A processing method of a terminal device, characterized in that: include: Receiving TCP messages sent by multiple terminal devices through a network device, wherein the TCP message sent by each terminal device includes identification information of the terminal device, and the multiple terminal devices are terminal devices after network address translation; Determine whether there is abnormal traffic through the network device, and if there is abnormal traffic, parse the TCP message flow of the abnormal traffic to obtain a target identifier, wherein the TCP message flow of the abnormal traffic consists of multiple TCP messages; According to the target identifier, a target terminal device generating abnormal traffic is determined from the multiple terminal devices.

2. The method according to claim 1, characterized in that Parse the TCP message flow of abnormal traffic and obtain the target identifiers including: Parsing the TCP message flow of the abnormal traffic to obtain multiple TCP messages in the TCP message flow of the abnormal traffic, and obtaining multiple field information in each TCP message; Determine data information corresponding to an option field in each TCP message based on multiple field information in each TCP message; The target identifier is obtained based on the data information corresponding to the option field in each TCP message.

3. The method according to claim 2, characterized in that Based on the data information corresponding to the option field in each TCP message, obtaining the target identifier includes: Based on the data information corresponding to the option field in each TCP message, the data information corresponding to each bit in the identification information is obtained to obtain multiple data; The multiple data are concatenated according to the number of bits of the identification information to obtain the target identification.

4. The method according to claim 1, characterized in that: Determining, according to the target identifier, a target terminal device generating abnormal traffic from the multiple terminal devices comprises: Determine target information of the terminal device generating the abnormal traffic according to the target identifier, wherein the target information includes at least one of the following: name information, IP information and MAC information; According to the target information of the terminal device that generates the abnormal traffic, the target terminal device that generates the abnormal traffic is determined from the multiple terminal devices.

5. The method according to claim 1, characterized in that Before receiving the TCP messages sent by the plurality of terminal devices through the network device, the method further comprises: Obtain identification information of each terminal device; Start the driver in each terminal device through the application installed in each terminal device; The identification information of each terminal device is inserted into the TCP message to be sent by each terminal device through the driver in each terminal device.

6. The method according to claim 5, characterized in that Inserting the identification information of each terminal device into the TCP message to be sent by each terminal device through the driver in each terminal device includes: Obtain information of multiple fields in the TCP message to be sent by each terminal device; Determine the option field in the TCP message to be sent by each terminal device according to multiple field information in the TCP message to be sent by each terminal device; Through the driver in each terminal device, the identification information of each terminal device is inserted into the option field in the TCP message to be sent by each terminal device according to the data information corresponding to each bit in the identification information of each terminal device.

7. The method according to claim 1, characterized in that After determining the target terminal device generating abnormal traffic from the multiple terminal devices according to the target identifier, the method further includes: Obtaining the threat level of the target terminal device to the target network, and determining whether the threat level of the target terminal device to the target network is greater than a preset threat level; If the threat level of the target terminal device to the target network is not greater than the preset threat level, sending a prompt message to the target object using the target terminal device, wherein the prompt message is used to prompt that the target terminal device has abnormal behavior; If the threat level of the target terminal device to the target network is greater than the preset threat level, the target terminal device is disconnected from the network.

8. A processing device of a terminal device, characterized in that: include: A first receiving unit, configured to receive TCP packets sent by a plurality of terminal devices through a network device, wherein the TCP packets sent by each terminal device include identification information of the terminal device, and the plurality of terminal devices are terminal devices after network address translation; A first processing unit is used to determine whether there is abnormal traffic through the network device, and if there is abnormal traffic, parse the TCP message flow of the abnormal traffic to obtain a target identifier, wherein the TCP message flow of the abnormal traffic is composed of multiple TCP messages; The first determining unit is used to determine a target terminal device generating abnormal traffic from the multiple terminal devices according to the target identifier.

9. A computer-readable storage medium, characterized in that: The storage medium stores a program, wherein the program executes the processing method of the terminal device according to any one of claims 1 to 7.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the processing method of the terminal device described in any one of claims 1 to 7.

Images