Illegal external connection detection method, system and device and storage medium

Abstract

The invention relates to the technical field of computer networks, and particularly provides an illegal external connection detection method, system and device and a storage medium, and the method comprises the steps: compiling a detection script in advance; the method comprises the following steps: sending a connection request to an active address in a local area network by utilizing a detection server, if the connection is successful, sending a detection script to the active address, and if the connection is failed, writing the active address and a connection failure event into a detection log; receiving state information, collected by the detection script, of the detected terminal through the local area network, and writing the state information into a detection log; sniffing an external network connection request sent to the target external network address by the detected terminal in a switch mirror image, and writing a sniffing result into the detection log; and analyzing the detection log by using a preset detection rule, and positioning the tested terminal which is in illegal external connection. According to the invention, the influence of the firewall on illegal external connection detection is eliminated, and the accuracy of illegal external connection detection is improved.

Description

Technical Field

[0001] The present invention belongs to the field of computer network technology, and specifically relates to a method, system, device and storage medium for detecting illegal external connections. Background Art

[0002] Existing technologies for detecting illegal external connections are mostly based on deploying client programs, that is, deploying client programs on terminals, attempting external connections, and generating alarm information when successful external connections are made. However, the biggest shortcoming of the client program deployment solution lies in the deployment itself. Many terminals connected to the intranet may only be temporarily connected and have not been discovered, or they may be discovered but before the client is deployed, illegal external connections have already occurred, resulting in the inability to record illegal external connections.

[0003] Although it is not necessary to be a client to detect illegal external connections through ping, if the operating system of the confidential computer in the confidential network has been security-hardened, such as a firewall has been set up, resulting in the inability to receive the request packet from the packet-sending server or the inability to send the response packet, the detection server in the external network will not be able to monitor the illegal external connection behavior, resulting in underreporting. Summary of the invention

[0004] In view of the above-mentioned deficiencies in the prior art, the present invention provides a method, system, device and storage medium for detecting illegal external connections to solve the above-mentioned technical problems.

[0005] In a first aspect, the present invention provides a method for detecting illegal external connections, comprising: Precompile a detection script, configure a status information acquisition instruction and an external network connection instruction in the detection script, wherein the external network connection instruction defines a target external network address and an interval time for cyclically sending the external network connection instruction; Using the detection server to send a connection request to the active address in the local area network, if the connection is successful, sending a detection script to the active address, if the connection fails, writing the active address and the connection failure event into the detection log; Receive the status information of the terminal under test collected by the detection script through the local area network, and write the status information into the detection log; Sniffing the external network connection request sent by the tested terminal to the target external network address in the switch mirror, and writing the sniffing result into the detection log; The detection log is analyzed using pre-set inspection rules to locate the tested terminal that has violated the external connection rules.

[0006] In an optional implementation, a detection script is pre-compiled, and a status information acquisition instruction and an external network connection instruction are configured in the detection script, wherein the external network connection instruction defines a target external network address and an interval time for cyclically sending the external network connection instruction, including: Configure the target external network address, the interval time for sending external network connection requests in a loop, and the log file path; The status information acquisition instruction includes commands for acquiring system information, process information, network connection status, and network card information; The external network connection instruction uses the check_external_connection function to loop and check the connection status to the target external network address, and uses the ping command to send an ICMP request packet to the target external network address at a specified interval, and writes the result to the log file; The main program obtains the status information of the current terminal, starts the external network connection check, regularly checks other network information, and processes logs; Send status information and log files to the detection server via the local area network.

[0007] In an optional embodiment, the method further comprises: Configure the get_os_version function in the detection script to obtain the name and version information of the operating system; Writing execution codes corresponding to multiple operating system versions into the detection script; Use the case statement to select the matching execution code based on the operating system name.

[0008] In an optional implementation, analyzing the detection log using a preset inspection rule to locate the tested terminal that has violated the external connection rules includes: Parse the status information of the terminal under test from the detection log. If there are multiple network cards in the status information, compare the information of the multiple network cards of the terminal under test with the network card information in the authorized list. If there is an unauthorized network card in the terminal under test, mark the terminal under test as an illegal device. Parsing status information from the detection log, and if the network connection status is unstable, marking the terminal under test as an unstable device; Parse the time when the tested terminal sends a connection request to the target external network address from the received log file; Match the sniffing result in the detection log with the time, if there is no match, it is determined that the external network connection fails, if there is a match, it is determined that the external network connection is successful; If there is a LAN connection failure event in the detected terminal in the detection log, the time of the LAN connection failure event and the network status of the tested terminal are matched with the shutdown event in the log. If the match is successful, it is ignored. If the match is unsuccessful, a prompt message indicating that the tested terminal is abnormal is generated; If the terminal under test in the detection log always maintains a successful local area network connection and a successful external network connection, it is determined that the terminal under test is normal; If the terminal under test always maintains a successful LAN connection in the detection log, but there are two consecutive external network connection failure events, it is determined that the terminal under test has violated the external connection regulations.

[0009] In a second aspect, the present invention provides a system for detecting illegal external connections, comprising: A script compiling module, used to compile a detection script in advance, configure a status information acquisition instruction and an external network connection instruction in the detection script, wherein the external network connection instruction defines a target external network address and an interval time for cyclically sending the external network connection instruction; A script deployment module is used to use the detection server to send a connection request to the active address in the local area network. If the connection is successful, a detection script is sent to the active address. If the connection fails, the active address and the connection failure event are written into the detection log. A status recording module is used to receive the status information of the terminal under test collected by the detection script through the local area network, and write the status information into the detection log; A request sniffing module, used to sniff the external network connection request sent by the tested terminal to the target external network address in the switch mirror, and write the sniffing result into the detection log; The rule verification module is used to analyze the detection log using preset verification rules to locate the tested terminal that has violated the external connection rules.

[0010] In an optional implementation, the script compilation module includes: A parameter configuration unit, used to configure the target external network address, the interval time for cyclically sending external network connection requests, and the log file path; A status acquisition unit, used for status information acquisition instructions including commands for acquiring system information, process information, network connection status, and network card information; The external network detection unit is used for the external network connection instruction to use the check_external_connection function to cyclically check the connection status to the target external network address, and use the ping command to send an ICMP request packet to the target external network address at a specified interval, and write the result to the log file; The global setting unit is used by the main program to obtain the status information of the current terminal, start the external network connection check, regularly check other network information, and process logs; The result processing unit is used to send the status information and log files to the detection server through the local area network.

[0011] In an optional embodiment, the system further includes: A version acquisition unit, used to configure a get_os_version function in the detection script to obtain the name and version information of the operating system; A code setting unit, used for writing execution codes corresponding to multiple operating system versions into the detection script; The version matching unit is used to select the matching execution code using the case statement according to the operating system name.

[0012] In an optional implementation, the rule verification module includes: A network card verification unit, used to parse the state information of the terminal under test from the detection log, and if there are multiple network cards in the state information, compare the information of the multiple network cards of the terminal under test with the network card information in the authorized list, and if there is an unauthorized network card in the terminal under test, mark the terminal under test as an illegal device; A signal verification unit, used to parse the status information from the detection log, and if the network connection status is unstable, mark the terminal under test as an unstable device; A time extraction unit, used for parsing the time when the tested terminal sends a connection request to the target external network address from the received log file; A time matching unit, used to match the sniffing result in the detection log with the time, if there is no match, it is determined that the external network connection fails, if there is a match, it is determined that the external network connection is successful; A first determination unit is configured to, if there is a LAN connection failure event in the detected terminal in the detection log, match the time of the LAN connection failure event with the network state of the detected terminal and the shutdown event in the log, and ignore the event if the match is successful, or generate prompt information indicating that the detected terminal is abnormal if the match is unsuccessful; A second determination unit is used to determine that the terminal under test is normal if the terminal under test in the detection log always maintains a successful local area network connection and a successful external network connection; The third determination unit is configured to determine that the terminal under test has violated the external connection rules if the terminal under test always maintains a successful local area network connection in the detection log, but there are two consecutive external network connection failure events.

[0013] In a third aspect, a device is provided, comprising: A memory device for storing an illegal external connection detection program; A processor is used to implement the steps of the illegal external connection detection method provided in the first aspect when executing the illegal external connection detection program.

[0014] In a fourth aspect, a computer-readable storage medium is provided, on which a program for detecting illegal external connections is stored. When the program for detecting illegal external connections is executed by a processor, the steps of the method for detecting illegal external connections provided in the first aspect are implemented.

[0015] The beneficial effects of the present invention are that the illegal external connection detection method, system, device and storage medium provided by the present invention can realize timely discovery of new terminals by detecting and connecting to active addresses in the local area network, and can collect terminal status information and control new terminals to initiate external network connections by issuing detection scripts, thereby eliminating the influence of firewalls on illegal external connection detection and improving the accuracy of illegal external connection detection.

[0016] In addition, the invention has a reliable design principle, a simple structure and a very broad application prospect. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 is a schematic flow chart of a method according to an embodiment of the present invention.

[0019] Figure 2 is a schematic block diagram of a system according to an embodiment of the present invention.

[0020] Figure 3 A schematic diagram of the structure of a device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the technical solutions in the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0022] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0023] The illegal external connection detection method provided in the embodiment of the present invention is executed by a computer device, and accordingly, the illegal external connection detection system runs in the computer device.

[0024] Figure 1 is a schematic flow chart of a method according to an embodiment of the present invention. Figure 1 The execution subject may be a violation external connection detection system. According to different requirements, the order of the steps in the flowchart may be changed, and some may be omitted.

[0025] like Figure 1 As shown, the method includes: S1 pre-compiled detection script, in the detection script configuration status information acquisition instructions and external network connection instructions, the external network connection instructions define the target external network address and the interval time of the cycle to send external network connection instructions; S2. Use the detection server to send a connection request to the active address in the local area network. If the connection is successful, the detection script is sent to the active address. If the connection fails, the active address and the connection failure event are written to the detection log; S3 receives the status information of the terminal under test collected by the detection script via the local area network, and writes the status information to the detection log; S4. Sniffing the external network connection request sent by the tested terminal to the target external network address in the switch mirror, and writing the sniffing result to the detection log; S5. Analyze the detection log using pre-set inspection rules to locate the tested terminal that has violated the external connection rules.

[0026] In an embodiment of the present invention, based on step S1, a possible embodiment is given below to illustrate its specific implementation scheme in a non-limiting manner.

[0027] Configure the target external network address, the interval time for sending external network connection requests in a loop, and the log file path; the status information acquisition instruction includes commands for obtaining system information, process information, network connection status, and network card information; the external network connection instruction uses the check_external_connection function to cyclically check the connection status to the target external network address, and uses the ping command to send an ICMP request packet to the target external network address at a specified interval, and writes the result to the log file; the main program obtains the status information of the current terminal, starts the external network connection check, regularly checks other network information, and processes logs; sends the status information and log files to the detection server via the local area network.

[0028] A get_os_version function is configured in the detection script to obtain the name and version information of the operating system; execution codes corresponding to multiple operating system versions are written in the detection script; and a case statement is used to select matching execution codes according to the operating system name.

[0029] In a specific example, the detection script code is as follows: #! / bin / bash # Configuration partTARGET_EXTERNAL_IP="8.8.8.8" # Target external network address, such as Google's public DNS serverINTERVAL=60 # Interval (in seconds) for sending external network connection requests in a loop LOG_FILE=" / var / log / network_monitor.log" # Log file pathPID_FILE=" / var / run / network_monitor.pid" # File used to store the ping test process ID (new) EXIT_FLAG=0 # Exit flag, initialized to 0 to indicate that no exit signal was received (new) # Operating system version acquisition instructionget_os_version() { if [[ -f / etc / os-release ]]; then . / etc / os-release OS_NAME="${NAME}"OS_VERSION="${VERSION}" elif [[ -f / etc / lsb-release ]]; then . / etc / lsb-release OS_NAME="${DISTRIB_DESCRIPTION}" else OS_NAME="Unknown" OS_VERSION="Unknown" fi echo "=== Operating System Information ===">>$LOG_FILE echo "OSName: $OS_NAME">>$LOG_FILE echo "OS Version: $OS_VERSION">>$LOG_FILE} # Status information acquisition instructions (example) # Call different acquisition commands according to the operating system version get_system_info() {get_os_version case "$OS_NAME" in *Ubuntu*) echo "=== Ubuntu SystemInformation ===">>$LOG_FILE uname -a>>$LOG_FILE 2>&1 df -h>>$LOG_FILE 2>&1free -m>>$LOG_FILE 2>&1 # You can add more Ubuntu-specific system status acquisition commands;;*CentOS*|*RHEL*) echo "=== CentOS / RHEL System Information ===">>$LOG_FILEuname -a>>$LOG_FILE 2>&1 df -hT>>$LOG_FILE 2>&1 # NOTE: CentOS / RHEL's df command may support -T option to display file system type free -m>>$LOG_FILE 2>&1 # More CentOS / RHEL specific system status commands can be added;; *Debian*) echo "=== Debian System Information ===">>$LOG_FILE uname -a>>$LOG_FILE 2>&1 df -h>>$LOG_FILE 2>&1 free -m>>$LOG_FILE 2>&1 # More Debian specific system status commands can be added;; *) echo "=== UnknownOS System Information ===">>$LOG_FILE uname -a>>$LOG_FILE 2>&1 df -h>>$LOG_FILE 2>&1 free -m>>$LOG_FILE 2>&1 # For unknown operating systems, use the general system status acquisition command;;esac} # External network connection command check_external_connection() { echo "=== CheckingExternal Connection to $TARGET_EXTERNAL_IP ===" 。 ;

[0030] Specifically, the configuration part: TARGET_EXTERNAL_IP: The specified target external network address. Here, Google's public DNS server address 8.8.8.8 is used as an example.

[0031] INTERVAL: The interval time for sending external network connection requests in a loop, which is set to 60 seconds here.

[0032] LOG_FILE: Log file path, used to record information during the detection process.

[0033] Status information acquisition instructions: The get_system_info function is used to obtain system information, such as kernel version, disk usage, memory usage, etc., and write this information to the log file.

[0034] External network connection instructions: The check_external_connection function is used to loop through the connections to the target external network address. Here, the ping command is used as an example to send an ICMP request packet to the target address at a specified interval and write the result to the log file.

[0035] Main program: The main function is the entry point of the script. It first calls the get_system_info function to obtain system status information, and then calls the check_external_connection function to start the external network connection check.

[0036] In an embodiment of the present invention, based on step S2, a possible embodiment is given below to illustrate its specific implementation scheme in a non-limiting manner.

[0037] A specially configured detection server is used as the core operating platform. The server has strong computing power and stable network connection to ensure the smooth progress of the detection task. Before the detection begins, the administrator will first perform necessary configuration on the server, including setting the path of the detection script, specifying the target external network address, and the interval time for cyclically sending external network connection instructions.

[0038] Afterwards, the detection server will start an automated detection process. The process will first scan all currently active IP addresses in the LAN, which usually represent various devices and terminals running in the LAN. To ensure the comprehensiveness of the detection, the server will try to establish TCP / IP connections with these active addresses one by one.

[0039] Once a connection is successfully established with an active address, the detection server will immediately start the transmission mechanism, take the active address as the target, and send the previously compiled detection script to it. This script contains status information acquisition instructions and external network connection instructions, which can be executed on the terminal under test and collect various required status information.

[0040] If the connection attempt fails, the detection server will immediately record the active address and the specific event of the connection failure. This information is crucial for subsequent analysis and tracking, because it may reveal network problems or configuration errors in certain devices or terminals in the LAN. Detailed information, including the time and reason of the connection failure and possible solution suggestions, will be written to the detection log for administrators to review and handle later.

[0041] The detection log is an integral part of this detection process. It not only records the results of connection attempts and the execution of detection scripts, but also contains key data such as the status information of the tested terminal and the sniffing results of external network connection requests. This data provides administrators with a comprehensive perspective, allowing them to gain in-depth understanding of the network behavior and status of devices within the LAN, so as to promptly discover and deal with any potential security risks or compliance issues.

[0042] Through such a detailed detection process and logging mechanism, administrators can more efficiently manage and maintain the security and stability of the LAN, ensuring that all devices and terminals comply with established network policies and compliance requirements.

[0043] In an embodiment of the present invention, based on step S3, a possible embodiment is given below to illustrate its specific implementation scheme in a non-limiting manner.

[0044] After the detection script is successfully deployed to the terminal under test, its operation process and security are of vital importance. In order to ensure that the script can smoothly collect various status information of the terminal and prevent it from being maliciously deleted or tampered with, it is necessary to set the running permissions and protection mechanism of the detection script in detail.

[0045] S301. Set the execution permissions of the detection script Administrator privileges: The detection script should be run as an administrator or user with appropriate privileges to ensure that it has access to critical data such as system health status, network configuration details, and process lists.

[0046] When deploying a script, you can use specific tools or commands (such as runas in Windows or sudo in Linux) to elevate the script's execution permissions.

[0047] Permission control: Strictly limit the script's access to system files and sensitive data, and grant only necessary read permissions to avoid potential security risks to the system.

[0048] Isolate the script's running environment to ensure that it is executed in a controlled context and reduce interactions with external systems.

[0049] S302. Prevent detection scripts from being deleted and tampered with File Protection: Place the detection script in a protected directory or system so that only users with administrator privileges can access and modify it.

[0050] Use file system-level protection mechanisms, such as "attribute" settings (read-only, hidden, etc.) in Windows or file permissions (chmod command) in Linux to restrict operations on script files.

[0051] Digital Signature: Digitally sign the detection script to verify its integrity and origin. This ensures that the script has not been tampered with in transit and was issued by a trusted entity.

[0052] Install the corresponding verification tool on the terminal under test to check whether its digital signature is valid when the script is running.

[0053] Periodic calibration: Set up a regular verification mechanism to perform integrity verification on the detection script. This can be achieved by comparing the script file's hash value or size and other attributes.

[0054] If it is found that the script file has been tampered with or deleted, the system should immediately issue an alarm and take appropriate recovery measures.

[0055] Monitoring and logging: Install a monitoring tool on the terminal under test to monitor the access and operation of script files in real time.

[0056] Record all operations on script files, including detailed information such as access time, operation type (such as read, write, delete, etc.) and operation results.

[0057] By analyzing the log data, any abnormal operation on the script file can be discovered and handled in a timely manner.

[0058] Updates and backups: Detection scripts are regularly updated to fix known security vulnerabilities and add new features.

[0059] Before updating a script, back it up to ensure quick recovery if something goes wrong.

[0060] Through the above measures, we can ensure that the detection script has sufficient running permissions on the tested terminal and prevent it from being maliciously deleted or tampered with. This helps to ensure that the script can successfully collect various status information of the terminal and provide accurate and reliable data support for subsequent audits and analysis.

[0061] In an embodiment of the present invention, based on step S4, a possible embodiment is given below to illustrate its specific implementation scheme in a non-limiting manner.

[0062] S401. Deployment and configuration of sniffing mechanism To ensure the effectiveness and accuracy of the sniffing mechanism, careful deployment and configuration are required on the switch's mirror port. A mirror port (also known as a SPAN port or monitoring port) is a special physical or virtual port on a switch that can copy and forward packets in one or more VLANs (virtual local area networks) to another designated port for analysis or monitoring.

[0063] When deploying the sniffing mechanism, first select a mirror port on the switch as the receiving end of the sniffing data. Then, through the switch configuration command, mirror the data flow of the VLAN or specific port to be monitored to the port. In this way, the sniffing mechanism can capture all external network connection requests from the tested terminal in real time.

[0064] S402. Capture and analysis of sniffing data The core of the sniffing mechanism is to be able to capture and analyze key information in the data packet. After capturing the data packet, the sniffing mechanism will parse it and extract key information such as the request time, source address, destination address, and possible connection data. This information is crucial for subsequent security audits and compliance checks.

[0065] To further improve the efficiency and accuracy of the sniffing mechanism, some advanced packet analysis techniques can be used, such as deep packet inspection (DPI) or flow analysis. These techniques can analyze the contents of the data packets more deeply and identify potential security threats or violations.

[0066] S403. Recording and management of test logs Every external network connection attempt detected will be recorded in detail in the detection log. These log data not only contain basic information of the request, but may also include the complete content or summary of the data packet. In order to ensure the integrity and traceability of the log data, a reliable storage and management mechanism is required, such as using a dedicated log server or cloud storage service to save the log data.

[0067] In addition, it is necessary to review and analyze the detection logs regularly. By reviewing the log data, any abnormal or illegal external network access behavior can be discovered and handled in a timely manner. At the same time, these log data can also serve as the basis for subsequent security audits and compliance checks.

[0068] In an embodiment of the present invention, based on step S5, a possible embodiment is given below to illustrate its specific implementation in a non-limiting manner.

[0069] S501. Analyze the status information of the tested terminal from the detection log The detection log records the status information of the tested terminal in detail, including network card information, network connection status, etc. In order to more accurately determine the compliance and stability of the tested terminal, it is necessary to conduct in-depth analysis of this information.

[0070] Network card information comparison: When the network card information of the tested terminal is parsed from the detection log, the system will automatically compare the network card information with the pre-set authorization list.

[0071] If the tested terminal has an unauthorized network card, that is, the network card information is not in the authorized list, the system will mark the tested terminal as an illegal device and generate a corresponding warning message.

[0072] Network connection status assessment: The system will also evaluate the stability of the terminal under test based on the network connection status information in the detection log.

[0073] If the network connection status of the tested terminal is unstable, such as frequent disconnection or abnormal connection speed, the system will mark the tested terminal as an unstable device and recommend that the administrator conduct further investigation and processing.

[0074] S502. Matching and judging external network connection requests In order to accurately determine the external network connection status of the terminal under test, it is necessary to match the sniffing results in the detection log with the time when the terminal under test sends a connection request to the target external network address.

[0075] Time matching and judgment: The system will parse the received log files to find out the specific time when the terminal under test sends a connection request to the target external network address.

[0076] The system then matches this moment with the sniffing results in the detection log.

[0077] If the timestamp in the sniffing result matches the time when the tested terminal sends the connection request, it is determined that the external network connection is successful.

[0078] If no data matching the time when the tested terminal sends the connection request is found in the sniffing result, it is determined that the external network connection has failed.

[0079] S503. Matching and processing of LAN connection failure events The detection log may also record the LAN connection failure event of the terminal under test. In order to accurately determine whether these events constitute anomalies, it is necessary to match these events with the network status of the terminal under test and the shutdown events in the log.

[0080] Match and Ignore: When the system detects a LAN connection failure event, it automatically matches the time of the event with the network status of the terminal under test.

[0081] If the network status of the tested terminal is shutdown or dormant during the same time period, and the corresponding shutdown event is recorded in the log, the system will consider the LAN connection failure event to be reasonable and ignore the event.

[0082] If the network status of the tested terminal is online during the same time period and no shutdown event is recorded in the log, the system will consider the LAN connection failure event to be abnormal and generate a corresponding prompt message.

[0083] S504. Compliance determination of the tested terminal Finally, based on the records in the detection log, the compliance of the tested terminal can be determined.

[0084] Normal and illegal judgment: If the terminal under test always maintains a successful LAN connection and an external network connection, the system determines that the terminal under test is a normal device.

[0085] If the terminal under test always maintains a successful LAN connection, but there are two or more consecutive external network connection failure events, the system determines that the terminal under test has illegal external connection behavior and generates a corresponding warning message.

[0086] Through the above expanded detection process and log analysis mechanism, the network behavior and status of the tested terminal can be more comprehensively evaluated, and any potential security risks or compliance issues can be discovered and handled in a timely manner. This helps to ensure the security and stability of the LAN, while improving the administrator's ability to monitor and manage the network environment.

[0087] In some embodiments, the illegal outbound connection detection system may include multiple functional modules composed of computer program segments. The computer programs of each program segment in the illegal outbound connection detection system may be stored in a memory of a computer device and executed by at least one processor to perform (see Figure 1 Description) The function of illegal external connection detection.

[0088] In this embodiment, the illegal external connection detection system can be divided into multiple functional modules according to the functions it performs, such as Figure 2As shown. The functional modules of the system 200 may include: a script compilation module 210, a script deployment module 220, a status recording module 230, a request sniffing module 240 and a rule verification module 250. The module referred to in the present invention refers to a series of computer program segments that can be executed by at least one processor and can complete fixed functions, which are stored in a memory. In this embodiment, the functions of each module will be described in detail in subsequent embodiments.

[0089] A script compiling module, used to compile a detection script in advance, configure a status information acquisition instruction and an external network connection instruction in the detection script, wherein the external network connection instruction defines a target external network address and an interval time for cyclically sending the external network connection instruction; A script deployment module is used to use the detection server to send a connection request to the active address in the local area network. If the connection is successful, a detection script is sent to the active address. If the connection fails, the active address and the connection failure event are written into the detection log. A status recording module is used to receive the status information of the terminal under test collected by the detection script through the local area network, and write the status information into the detection log; A request sniffing module, used to sniff the external network connection request sent by the tested terminal to the target external network address in the switch mirror, and write the sniffing result into the detection log; The rule verification module is used to analyze the detection log using preset verification rules to locate the tested terminal that has violated the external connection rules.

[0090] Optionally, as an embodiment of the present invention, the script compilation module includes: A parameter configuration unit, used to configure the target external network address, the interval time for cyclically sending external network connection requests, and the log file path; A status acquisition unit, used for status information acquisition instructions including commands for acquiring system information, process information, network connection status, and network card information; The external network detection unit is used for the external network connection instruction to use the check_external_connection function to cyclically check the connection status to the target external network address, and use the ping command to send an ICMP request packet to the target external network address at a specified interval, and write the result to the log file; The global setting unit is used by the main program to obtain the status information of the current terminal, start the external network connection check, regularly check other network information, and process logs; The result processing unit is used to send the status information and log files to the detection server through the local area network.

[0091] Optionally, as an embodiment of the present invention, it further includes: A version acquisition unit, used to configure a get_os_version function in the detection script to obtain the name and version information of the operating system; A code setting unit, used for writing execution codes corresponding to multiple operating system versions into the detection script; The version matching unit is used to select the matching execution code using the case statement according to the operating system name.

[0092] Optionally, as an embodiment of the present invention, the rule verification module includes: A network card verification unit, used to parse the state information of the terminal under test from the detection log, and if there are multiple network cards in the state information, compare the information of the multiple network cards of the terminal under test with the network card information in the authorized list, and if there is an unauthorized network card in the terminal under test, mark the terminal under test as an illegal device; A signal verification unit, used to parse the status information from the detection log, and if the network connection status is unstable, mark the terminal under test as an unstable device; A time extraction unit, used for parsing the time when the tested terminal sends a connection request to the target external network address from the received log file; A time matching unit, used to match the sniffing result in the detection log with the time, if there is no match, it is determined that the external network connection fails, if there is a match, it is determined that the external network connection is successful; A first determination unit is configured to, if there is a LAN connection failure event in the detected terminal in the detection log, match the time of the LAN connection failure event with the network state of the detected terminal and the shutdown event in the log, and ignore the event if the match is successful, or generate prompt information indicating that the detected terminal is abnormal if the match is unsuccessful; A second determination unit is used to determine that the terminal under test is normal if the terminal under test in the detection log always maintains a successful local area network connection and a successful external network connection; The third determination unit is configured to determine that the terminal under test has violated the external connection rules if the terminal under test always maintains a successful local area network connection in the detection log, but there are two consecutive external network connection failure events.

[0093] Figure 3The illegal outreach detection method provided for the embodiment of the present application can be applied to the device. It will be appreciated by those skilled in the art that the device structure involved in the embodiment of the present invention does not constitute a limitation on the device, and the device may include more or fewer components than shown, or combine certain components, or arrange different components. In an embodiment of the present invention, the device includes but is not limited to a laptop computer, a desktop computer, a workbench, a personal digital assistant, a server, a blade server, a mainframe computer, and other suitable computers. The device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of the present application described and / or required herein.

[0094] The device 300 may include: a processor 310, a memory 320 and a communication unit 330. These components communicate via one or more buses. Those skilled in the art will appreciate that the server structure shown in the figure does not limit the present invention, and it may be a bus structure or a star structure, and may include more or fewer components than shown in the figure, or combine certain components, or arrange components differently.

[0095] The memory 320 may be used to store the execution instructions of the processor 310, and the memory 320 may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. When the execution instructions in the memory 320 are executed by the processor 310, the device 300 is enabled to perform some or all of the steps in the following method embodiments.

[0096] The processor 310 is the control center of the storage device, and uses various interfaces and lines to connect various parts of the entire electronic device. It runs or executes software programs and / or modules stored in the memory 320, and calls data stored in the memory to perform various functions of the electronic device and / or process data. The processor can be composed of an integrated circuit (IC), for example, it can be composed of a single packaged IC, or it can be composed of a plurality of packaged ICs with the same or different functions. For example, the processor 310 can include only a central processing unit (CPU). In an embodiment of the present invention, the CPU can be a single computing core or multiple computing cores.

[0097] The communication unit 330 is used to establish a communication channel so that the storage device can communicate with other devices, receive user data sent by other devices or send user data to other devices.

[0098] The present invention also provides a computer storage medium, wherein the computer storage medium may store a program, and when the program is executed, the program may include some or all of the steps in each embodiment provided by the present invention. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM).

[0099] Those skilled in the art can clearly understand that the technology in the embodiments of the present invention can be implemented by means of software plus a necessary general hardware platform. Based on this understanding, the technical solution in the embodiments of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, and other media that can store program codes, including several instructions for enabling a computer device (which can be a personal computer, a server, or a second device, a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention.

[0100] In this specification, the same or similar parts between the various embodiments can be referred to each other. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description in the method embodiment.

[0101] In the several embodiments provided by the present invention, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or modules, which can be electrical, mechanical or other forms.

[0102] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0103] In addition, each functional module in each embodiment of the present invention may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0104] Although the present invention has been described in detail by referring to the accompanying drawings and in combination with the preferred embodiments, the present invention is not limited thereto. Without departing from the spirit and essence of the present invention, a person skilled in the art may make various equivalent modifications or substitutions to the embodiments of the present invention, and these modifications or substitutions shall be within the scope of the present invention. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, and they shall be within the scope of protection of the present invention.

Claims

1. A method for detecting illegal external connections, characterized in that: include: Precompile a detection script, configure a status information acquisition instruction and an external network connection instruction in the detection script, wherein the external network connection instruction defines a target external network address and an interval time for cyclically sending the external network connection instruction; Using the detection server to send a connection request to the active address in the local area network, if the connection is successful, sending a detection script to the active address, if the connection fails, writing the active address and the connection failure event into the detection log; Receive the status information of the terminal under test collected by the detection script through the local area network, and write the status information into the detection log; Sniffing the external network connection request sent by the tested terminal to the target external network address in the switch mirror, and writing the sniffing result into the detection log; The detection log is analyzed using pre-set inspection rules to locate the tested terminal that has violated the external connection rules.

2. The method according to claim 1, characterized in that Precompile a detection script, configure a status information acquisition instruction and an external network connection instruction in the detection script, and define a target external network address and an interval time for cyclically sending the external network connection instruction in the external network connection instruction, including: Configure the target external network address, the interval time for sending external network connection requests in a loop, and the log file path; The status information acquisition instruction includes commands for acquiring system information, process information, network connection status, and network card information; The external network connection instruction uses the check_external_connection function to loop and check the connection status to the target external network address, and uses the ping command to send an ICMP request packet to the target external network address at a specified interval, and writes the result to the log file; The main program obtains the status information of the current terminal, starts the external network connection check, regularly checks other network information, and processes logs; Send status information and log files to the detection server via the local area network.

3. The method according to claim 2, characterized in that The method further comprises: Configure the get_os_version function in the detection script to obtain the name and version information of the operating system; Writing execution codes corresponding to multiple operating system versions into the detection script; Use the case statement to select the matching execution code based on the operating system name.

4. The method according to claim 2, characterized in that: The detection log is analyzed using the preset inspection rules to locate the tested terminal that has violated the external connection rules, including: Parse the status information of the terminal under test from the detection log. If there are multiple network cards in the status information, compare the information of the multiple network cards of the terminal under test with the network card information in the authorized list. If there is an unauthorized network card in the terminal under test, mark the terminal under test as an illegal device. Parsing status information from the detection log, and if the network connection status is unstable, marking the terminal under test as an unstable device; Parse the time when the tested terminal sends a connection request to the target external network address from the received log file; Match the sniffing result in the detection log with the time, if there is no match, it is determined that the external network connection fails, if there is a match, it is determined that the external network connection is successful; If there is a LAN connection failure event in the detected terminal in the detection log, the time of the LAN connection failure event and the network status of the tested terminal are matched with the shutdown event in the log. If the match is successful, it is ignored. If the match is unsuccessful, a prompt message indicating that the tested terminal is abnormal is generated; If the terminal under test in the detection log always maintains a successful local area network connection and a successful external network connection, it is determined that the terminal under test is normal; If the terminal under test always maintains a successful LAN connection in the detection log, but there are two consecutive external network connection failure events, it is determined that the terminal under test has violated the external connection regulations.

5. A system for detecting illegal external connections, characterized in that: include: A script compiling module, used to compile a detection script in advance, configure a status information acquisition instruction and an external network connection instruction in the detection script, wherein the external network connection instruction defines a target external network address and an interval time for cyclically sending the external network connection instruction; A script deployment module is used to use the detection server to send a connection request to the active address in the local area network. If the connection is successful, a detection script is sent to the active address. If the connection fails, the active address and the connection failure event are written into the detection log. A status recording module is used to receive the status information of the terminal under test collected by the detection script through the local area network, and write the status information into the detection log; A request sniffing module, used to sniff the external network connection request sent by the tested terminal to the target external network address in the switch mirror, and write the sniffing result into the detection log; The rule verification module is used to analyze the detection log using preset verification rules to locate the tested terminal that violates the external connection rules.

6. The system according to claim 5, characterized in that The script compilation module includes: The parameter configuration unit is used to configure the target external network address, the interval time for cyclically sending external network connection requests, and the log file path; A status acquisition unit, used for status information acquisition instructions including commands for acquiring system information, process information, network connection status, and network card information; The external network detection unit is used for the external network connection instruction to use the check_external_connection function to cyclically check the connection status to the target external network address, and use the ping command to send an ICMP request packet to the target external network address at a specified interval, and write the result to the log file; The global setting unit is used by the main program to obtain the status information of the current terminal, start the external network connection check, regularly check other network information, and process logs; The result processing unit is used to send the status information and log files to the detection server through the local area network.

7. The system according to claim 6, characterized in that The system further comprises: A version acquisition unit, used to configure a get_os_version function in the detection script to obtain the name and version information of the operating system; A code setting unit, used for writing execution codes corresponding to multiple operating system versions into the detection script; The version matching unit is used to select the matching execution code using the case statement according to the operating system name.

8. The system according to claim 6, characterized in that The rule verification module comprises: A network card verification unit, used to parse the state information of the terminal under test from the detection log, and if there are multiple network cards in the state information, compare the information of the multiple network cards of the terminal under test with the network card information in the authorized list, and if there is an unauthorized network card in the terminal under test, mark the terminal under test as an illegal device; A signal verification unit, used to parse the status information from the detection log, and if the network connection status is unstable, mark the terminal under test as an unstable device; A time extraction unit, used for parsing the time when the tested terminal sends a connection request to the target external network address from the received log file; A time matching unit, used to match the sniffing result in the detection log with the time, if there is no match, it is determined that the external network connection fails, if there is a match, it is determined that the external network connection is successful; A first determination unit is configured to, if there is a LAN connection failure event in the detected terminal in the detection log, match the time of the LAN connection failure event with the network state of the detected terminal and the shutdown event in the log, and ignore the event if the match is successful, or generate prompt information indicating that the detected terminal is abnormal if the match is unsuccessful; A second determination unit is used to determine that the terminal under test is normal if the terminal under test in the detection log always maintains a successful local area network connection and a successful external network connection; The third determination unit is configured to determine that the terminal under test has violated the external connection rules if the terminal under test always maintains a successful local area network connection in the detection log, but there are two consecutive external network connection failure events.

9. A device, characterized in that: include: A memory device for storing an illegal external connection detection program; A processor, used to implement the steps of the illegal external connection detection method as described in any one of claims 1 to 4 when executing the illegal external connection detection program.

10. A computer-readable storage medium storing a computer program, characterized in that: The readable storage medium stores an illegal external connection detection program, and when the illegal external connection detection program is executed by the processor, the steps of the illegal external connection detection method according to any one of claims 1 to 4 are implemented.

Images