Enterprise network behavior management method and system

Abstract

The invention relates to an enterprise network behavior management method and system, and the method comprises the steps: obtaining a local network driver list, and helping an administrator to monitor the network flow; starting the equipment and setting the equipment to be in a promiscuous mode for monitoring all data traffic passing through a network interface; compiling and setting a filter to filter the data packet so as to supervise bad behaviors in the network; capturing and storing a data packet so as to know the actual use condition of the network; the data packet protocol analysis is used for analyzing and monitoring network traffic; the network behavior management system has access to the network in a bypass monitoring mode, the topological structure of a network system is not changed, and the network performance is not affected at all. And a network user management function is added, so that a network administrator can manage user information conveniently and grasp the use condition of the network user constantly.

Description

Technical Field

[0001] The present invention relates to the technical field of network management, and in particular to an enterprise network behavior management method and system. Background Art

[0002] With the rapid development of computer technology and the Internet, network informatization has become an indispensable element in our life and work. The network not only shortens the distance between people, but also provides a broader information platform for enterprises, improves the competitiveness of enterprises, and makes outstanding contributions to production and office efficiency. However, the subsequent network behaviors such as online games and online downloads have affected the network speed, reduced office efficiency, and increased management costs.

[0003] The current network situation in enterprises is that most intranet users have access to the Internet due to business needs, but the bandwidth of the link connecting to the Internet is limited, and the bandwidth is often full during working hours. Administrative managers cannot find the users who use the most bandwidth and the users who do network activities unrelated to work during working hours, resulting in users in need being unable to work efficiently and normally. Summary of the invention

[0004] In view of the deficiencies of the prior art, the present invention provides an enterprise network behavior management method and system for solving the problems raised by the above-mentioned background technology.

[0005] An enterprise network behavior management method and system of the present invention comprises the following steps:

[0006] S1. Get a list of local network drivers to help administrators monitor network traffic;

[0007] S2. Turn on the device and set it to promiscuous mode to monitor all data traffic passing through the network interface.

[0008] S3, compile and set filters to filter data packets to monitor bad behaviors in the network;

[0009] S4. Capture and save data packets to understand the actual usage of the network;

[0010] S5, packet protocol parsing, used to analyze and monitor network traffic.

[0011] As a further improvement of the present invention, in step S1, by obtaining a list of local network drivers, the administrator can understand which network interfaces and devices exist in the network, thereby effectively monitoring and managing network traffic.

[0012] As a further improvement of the present invention, in step S2, opening the device settings and changing to promiscuous mode can enable the network management system to capture and analyze all data packets sent and received on the network on the network card. Administrators can use this data to detect abnormal network traffic, identify potential network security threats, and monitor network usage.

[0013] As a further improvement of the present invention, in step S3, the filter will be applied to all data packets from the network. All data packets that meet the requirements will be copied to the application.

[0014] As a further improvement of the present invention, in step S4, by capturing and analyzing network traffic data packets, the administrator can understand the actual usage of the network, identify bandwidth bottlenecks and inefficient traffic, and thus perform traffic optimization and bandwidth management.

[0015] As a further improvement of the present invention, in step S5, after capturing and saving the data packet, protocol parsing can be performed to conduct an in-depth analysis of the data packet to identify the characteristics and field information of different protocols. Through protocol parsing, the network management system can further analyze and monitor network traffic, including evaluation of traffic usage, connection status, service quality, etc.

[0016] As a further improvement of the present invention, the captured data must be parsed to obtain the desired information, such as source address, destination address, protocol type and other information. The parsing process is to analyze and extract the data in the data frame according to different protocols.

[0017] A system for managing enterprise network behavior includes a computer device, wherein the computer device includes a processor, a memory, and a local network driver list stored on the memory and executable by the processor, and is used to implement the above-mentioned enterprise network behavior management method.

[0018] Compared with the prior art, the present invention has the following beneficial effects:

[0019] The network behavior management system accesses the network in a bypass monitoring mode, does not change the topology of the network system, and has no effect on network performance. It adds a network user management function, which is convenient for network administrators to manage user information and keep track of network users' usage. The network behavior management system is developed based on Windows XP system, and has very low requirements for server configuration. Even a simple PC can fully cope with the work. For network administrators, they can open the management platform through a browser on any intranet machine, which greatly reduces the management cost in terms of network. The network behavior management system can monitor the data in the network, analyze it and provide a management platform. It can be used as an effective network management tool for network administrators to improve network usage efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0021] Figure 1 A flowchart for the use of enterprise network behavior management methods. DETAILED DESCRIPTION

[0022] The following will disclose multiple embodiments of the present invention with diagrams. For the purpose of clear description, many physical details will be described together in the following description. However, it should be understood that these physical details should not be used to limit the present invention. In other words, in some embodiments of the present invention, these physical details are not necessary. In addition, for the purpose of simplifying the diagram, some conventional structures and components will be depicted in a simple schematic manner in the diagram.

[0023] In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on the fact that ordinary technicians in the field can implement it. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0024] See also Figure 1 , a method for managing enterprise network behavior of the present invention comprises the following steps:

[0025] S1. Get a list of local network drivers to help administrators monitor network traffic;

[0026] S2. Turn on the device and set it to promiscuous mode to monitor all data traffic passing through the network interface.

[0027] S3, compile and set filters to filter data packets to monitor bad behaviors in the network;

[0028] S4. Capture and save data packets to understand the actual usage of the network;

[0029] S5, packet protocol parsing, used to analyze and monitor network traffic.

[0030] In step S1, by obtaining a list of local network drivers, the administrator can understand which network interfaces and devices exist in the network, so that the network traffic can be effectively monitored and managed. The main function of this step is to obtain a list of network interfaces on the local computer, including physical network cards and virtual network cards, etc. By obtaining the list of network interfaces, the network interfaces that need to be monitored and managed are determined to ensure effective management and control of all interfaces that need to be monitored.

[0031] In step S2, opening the device settings and changing to promiscuous mode enables the network management system to capture and analyze all data packets sent and received on the network on the network card. Administrators can use this data to detect abnormal network traffic, identify potential network security threats, and monitor network usage.

[0032] Through the above technical solution, it can be ensured that the entire network traffic is monitored and no data packets are missed. This is very important for the network management system because only when all data packets are obtained can comprehensive monitoring and analysis be carried out.

[0033] In the S3 step, the filter will be applied to all packets from the network. All packets that meet the requirements will be copied to the application.

[0034] The function of this step is to filter and screen network traffic according to specific conditions. By setting filters, you can filter data packets according to source or destination IP address, protocol type, port number and other conditions. You can also set filters to only capture data packets with specific source or destination IP addresses, specific protocol types, etc. By filtering and capturing only data packets of interest, you can reduce the amount of data captured and analyzed, improve system efficiency, and focus only on data packets of interest, which is more conducive to quickly discovering and solving problems.

[0035] In step S4, by capturing and analyzing network traffic packets, administrators can understand the actual usage of the network, identify bandwidth bottlenecks and inefficient traffic, and thus perform traffic optimization and bandwidth management.

[0036] This step is the actual data packet capture and storage operation. By placing the network device in promiscuous mode and setting up filters, the network management system can begin to capture data packets passing through the network interface and save them to local storage media. This can save real-time information on network traffic and provide important basis for subsequent analysis and review.

[0037] In step S5, after capturing and saving the data packets, protocol parsing can be performed to conduct in-depth analysis of the data packets and identify the characteristics and field information of different protocols. Through protocol parsing, the network management system can further analyze and monitor network traffic, including evaluation of traffic usage, connection status, service quality, etc.

[0038] This plays an important role in network management systems, as it can better understand the operating status of the network, quickly discover abnormal behaviors and security threats, and make targeted adjustments and optimizations.

[0039] The captured data must be parsed to obtain the desired information, such as source address, destination address, protocol type, etc. The parsing process is to analyze and extract the data in the data frame according to different protocols.

[0040] In summary, the local network drive list can help administrators monitor network traffic. By obtaining the local network drive list, administrators can understand which network interfaces and devices exist in the network, so that they can effectively monitor and manage network traffic.

[0041] First, use the WinPcap application function to obtain the server-side network card list, and then set the port for capturing network data. WinPcap provides the pcap_findalldevs_ex() function to implement this function. The function returns a pcap_if structure list, which contains the detailed information of an adapter. After obtaining the network card list, it is displayed for the user to select. If the network card is not found, an error is displayed.

[0042] Turn on the device and set it to promiscuous mode to monitor all data traffic passing through the network interface. Setting the device to promiscuous mode allows the network management system to capture and analyze all data packets sent and received on the network on the network card. Administrators can use this data to detect abnormal network traffic, identify potential network security threats, and monitor network usage.

[0043] In normal working mode, the network card only accepts packets destined for it and ignores data destined for other hosts. In promiscuous mode, the network card will receive all data flowing through it, which means that the device in the same network can capture data from other devices in the network. Therefore, common packet capture tools usually use promiscuous mode. After using pcap_findalldevs_ex() to capture the network card, call this device through the pcap_open() function.

[0044] Compile and set up filters to monitor bad behavior on the network. For example, in a corporate network, you can set up filters to restrict employees from accessing specific websites or to limit the use of certain network applications.

[0045] Packet filtering is the difficulty and focus of packet capture technology. One of the most powerful features of WinPcap or libpcap is the data stream filtering engine. Set data stream filtering rules to implement packet filtering. The functions used to filter packets are pcap_compile() and pcap_setfilter(). pcap_compile() compiles a high-level Boolean filter expression into a low-level bytecode that can be interpreted by the filtering engine.

[0046] pcap_setfilter() associates a filter with a kernel capture session. When pcap_setfilter() is called, the filter will be applied to all packets from the network, and all packets that meet the requirements will be copied to the application.

[0047] By capturing and analyzing network traffic packets, administrators can understand the actual usage of the network, identify bandwidth bottlenecks and inefficient traffic, and thus perform traffic optimization and bandwidth management. For example, they can find out traffic fluctuations or anomalies in the network, identify major traffic consumers, and make reasonable resource allocation.

[0048] Use a loop to call pcap_next to receive data packets. The parameters of this function are the same as the callback function pcap_loop(), which is a network card descriptor as the entry parameter and two pointers as the exit parameters. These two pointers will be initialized in the function and then returned to the user. We use pcap_next_ex() to capture data packets.

[0049] By parsing the data packet protocol, the network management system can analyze and monitor network traffic. Administrators can understand the different types of protocols transmitted in the network, such as TCP, UDP, ICMP, etc., as well as the various fields and flags in the protocol, which helps to conduct a deeper analysis and monitoring of network traffic, including evaluation of traffic usage, connection status, service quality, etc.

[0050] A system for managing enterprise network behavior includes a computer device, wherein the computer device includes a processor, a memory, and a local network driver list stored on the memory and executable by the processor, and is used to implement the above-mentioned enterprise network behavior management method.

[0051] The above description is only an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A method for managing enterprise network behavior, characterized in that: The steps include: S1. Get a list of local network drivers to help administrators monitor network traffic; S2. Turn on the device and set it to promiscuous mode to monitor all data traffic passing through the network interface. S3, compile and set filters to filter data packets to monitor bad behaviors in the network; S4. Capture and save data packets to understand the actual usage of the network; S5, packet protocol parsing, used to analyze and monitor network traffic.

2. The enterprise network behavior management method according to claim 1, characterized in that: In step S1, by obtaining a list of local network drivers, the administrator can understand which network interfaces and devices exist in the network, thereby effectively monitoring and managing network traffic.

3. The enterprise network behavior management method according to claim 1, characterized in that: In step S2, opening the device settings and changing to promiscuous mode enables the network management system to capture and analyze all data packets sent and received on the network on the network card. Administrators can use this data to detect abnormal network traffic, identify potential network security threats, and monitor network usage.

4. The enterprise network behavior management method according to claim 1, characterized in that: In the S3 step, the filter will be applied to all packets from the network. All packets that meet the requirements will be copied to the application.

5. The enterprise network behavior management method according to claim 1, characterized in that: In step S4, by capturing and analyzing network traffic packets, administrators can understand the actual usage of the network, identify bandwidth bottlenecks and inefficient traffic, and thus perform traffic optimization and bandwidth management.

6. The enterprise network behavior management method according to claim 1, characterized in that: In step S5, after capturing and saving the data packets, protocol parsing can be performed to conduct in-depth analysis of the data packets and identify the characteristics and field information of different protocols. Through protocol parsing, the network management system can further analyze and monitor network traffic, including evaluation of traffic usage, connection status, service quality, etc.

7. The enterprise network behavior management method according to claim 6, characterized in that: The captured data must be parsed to obtain the desired information, such as source address, destination address, protocol type, etc. The parsing process is to analyze and extract the data in the data frame according to different protocols.

8. A system for enterprise network behavior management, characterized by: It comprises a computer device, which comprises a processor, a memory and a local network driver list stored on the memory and executable by the processor, and is used to implement an enterprise network behavior management method as described in any one of claims 1-7.

Images