Method and device for identifying IP (Internet Protocol) address of illegal operation IDC (Internet Data Center) service in metropolitan area network

Abstract

The invention discloses a method and device for identifying an IP address of an IDC service running illegally in a metropolitan area network, and the method comprises the steps: S01, defining a description rule of a downlink IDC circuit port of the metropolitan area network, and automatically discovering the downlink IDC port information of the metropolitan area network based on the description rule; s02, the system forms a metropolitan area network downlink IDC port set according to the discovered IDC port information; s03, on the basis of the Netflow data of the formed metropolitan area network downlink IDC port set, acquiring an IP address library for operating the IDC service in the metropolitan area network; and S04, starting a timer by the system, and automatically and synchronously updating the IP address base of the lower IDC of the metropolitan area network every day to a flow analysis system for analysis. According to the method and the device for identifying the IP address of the IDC service running illegally in the metropolitan area network, the IP address of the IDC service running in the metropolitan area network can be accurately identified through automatic analysis and manual confirmation, the method and the device have an IDC IP address learning function, manual intervention is reduced, and rapid identification, confirmation and dynamic updating of an IDC IP address field can be realized.

Description

Technical Field

[0001] The present invention relates to the field of metropolitan area network, and in particular to a method and a device for identifying an IP address of an IDC service running illegally in a metropolitan area network. Background Art

[0002] With the rapid development of information technology, Internet data centers (IDCs) and metropolitan area networks (MANs) are becoming increasingly important as key infrastructures supporting modern network applications and services. IDCs usually provide high reliability, high security, and large-scale data storage, processing, and transmission services, and are widely used in cloud computing, big data, enterprise hosting, and other fields. The metropolitan area network is mainly responsible for data communications within a city or region, providing relatively basic network access and data transmission services, and its price is more affordable than that of IDCs.

[0003] Since the settlement price of IDC services is significantly higher than that of metropolitan area networks, some users or service providers, for cost considerations, try to illegally migrate services that should belong to the IDC category to the metropolitan area network to avoid high IDC fees and reduce costs. This behavior not only disrupts the normal order of the market, but may also have a negative impact on network stability, security, and user experience. How to quickly identify the IP addresses of IDC services that are illegally running in the metropolitan area network has become an urgent problem to be solved in the industry. Summary of the invention

[0004] In order to solve the problems existing in the prior art, the present invention provides a method and device for identifying the IP addresses of IDC services running illegally in a metropolitan area network. Through automated analysis and manual confirmation, the IP addresses of IDC services running in the metropolitan area network can be accurately identified. The method and device have an IDC IP address learning function, reduce manual intervention, and can realize rapid identification, confirmation and dynamic update of IDC IP address segments.

[0005] To achieve the above object, the present invention adopts the following technical solutions:

[0006] In one embodiment of the present invention, a method for identifying an IP address of an IDC service running illegally in a metropolitan area network is proposed, the method comprising:

[0007] S01. Define the description rules of the IDC circuit ports in the metropolitan area network, and automatically discover the IDC port information in the metropolitan area network based on the description rules;

[0008] Further, the S01 includes:

[0009] S011. Define the description rules of the IDC circuit port under the metropolitan area network, including: port name, interface type, IDC identifier, etc.

[0010] Furthermore, the port name in S011 includes: "dT" as a downstream port keyword, and "uT" as an upstream port keyword.

[0011] S012. Set the "Enable automatic confirmation port mode" configuration item. If the automatic confirmation port mode is not enabled, the port information is confirmed and adjusted through the manual interface; if the automatic confirmation port mode is enabled, the system automatically scans the network configuration and automatically discovers and confirms the IDC port information according to the description rules.

[0012] S02, the system forms a metropolitan area network downlink IDC port set according to the discovered IDC port information;

[0013] Furthermore, the IDC port set information includes: port name, port description, Flow-Index, device name, device IP, interface type, and IDC identifier.

[0014] S03, based on the formed Netflow data of the IDC port set connected to the metropolitan area network, obtain the IP address library running the IDC service in the metropolitan area network;

[0015] Further, the S03 includes:

[0016] S031. Based on the formation of the metropolitan area network downlink IDC port set, the system uses Netflow data collection technology to capture the network traffic data flowing through the port in real time;

[0017] Furthermore, the Netflow data collection technology collects the flow information of the IDC port set using the NetFlowV9 protocol.

[0018] Furthermore, the traffic information includes: source IP, destination IP, source port, destination port, collection time, protocol, source AS number, destination AS number, etc.

[0019] S032, filtering Netflow data to extract a candidate set of IP addresses that may run IDC services in the metropolitan area network;

[0020] Further, the S032 includes:

[0021] S0321. Check each NetFlow data flow. If the Output field value in the NetFlow data flow matches the Flow-Index of the downstream port of the MAN device, the NetFlow data flow is the outgoing traffic through the downstream port of this MAN CR. The system collects the destination IP of the NetFlow data flow and adds it to the candidate set of IP addresses running IDC services in the metropolitan area network.

[0022] S0322. If the Input field value in the NetFlow data flow matches the Flow-Index of the downstream port of the MAN device, the NetFlow data flow is the inbound traffic through the downstream port of this MAN CR. The system collects the source IP of the NetFlow data flow and adds it to the candidate set of IP addresses running IDC services in the metropolitan area network.

[0023] S033. Compare the IP address candidate set in the previous step with the national IDC registered address database to find out the IP address database running IDC services in the metropolitan area network.

[0024] Further, the S033 includes:

[0025] S0331. The system compares the IP address candidate set with the national IDC registered address database, aggregates the consistent IP addresses, and adds them to the IP address database for running IDC services in the metropolitan area network;

[0026] S0332. If the system turns on the "Ignore manual confirmation" configuration item, inconsistent IP addresses will be discarded without manual intervention;

[0027] S0333: If the "Ignore Manual Confirmation" configuration item is not enabled and there are inconsistent IP addresses in the system, the system triggers the manual confirmation process;

[0028] S04. The system starts the timer and automatically updates the IDC IP address database of the metropolitan area network to the traffic analysis system for analysis every day;

[0029] Further, the S04 includes:

[0030] S041. The system automatically updates the provincial metropolitan area network downlink IDC IP address database to the traffic analysis object every day to ensure the timeliness and accuracy of the analysis data;

[0031] S042. For the out-of-province IDC IP address library, the system manually downloads the latest address data daily or weekly through the interface provided by the traffic analysis system, and imports it into the system's "out-of-province IDC IP address library", which is then automatically updated to the traffic analysis object to achieve unified management of cross-regional IDC IP addresses.

[0032] In one embodiment of the present invention, a device for identifying an IP address of an IDC service running illegally in a metropolitan area network is also proposed, the device comprising:

[0033] The description rule module defines the description rules of the IDC circuit ports in the metropolitan area network and automatically discovers the IDC port information in the metropolitan area network based on the description rules;

[0034] The IDC port collection module forms a metropolitan area network downlink IDC port collection based on the discovered IDC port information;

[0035] An IP address library acquisition module, based on the formed Netflow data of the IDC port set connected to the metropolitan area network, acquires the IP address library running the IDC service in the metropolitan area network;

[0036] The timer starts the module, automatically and synchronously updates the IDC IP address database of the metropolitan area network to the traffic analysis system for analysis every day.

[0037] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the aforementioned method of identifying IP addresses of IDC services that are illegally running in a metropolitan area network is implemented.

[0038] In one embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores a computer program for executing a method for identifying an IP address of an IDC service that is illegally running in a metropolitan area network.

[0039] Beneficial effects:

[0040] The present invention discloses a method and device for identifying an IDC service IP address that is illegally running in a metropolitan area network. The method and device can accurately identify an IDC service IP address that is running in a metropolitan area network through automated analysis and manual confirmation. The present invention has an IDC IP address learning function, reduces manual intervention, and can realize rapid identification, confirmation, and dynamic update of IDC IP address segments, thereby ensuring that a traffic analysis system can perform efficient and accurate traffic monitoring and analysis based on the latest IDC IP address library, thereby significantly improving system operation and maintenance efficiency and data accuracy, and reducing operation and maintenance costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a logical schematic diagram of a method for identifying an IP address of an IDC service running illegally in a metropolitan area network according to the present invention;

[0042] Figure 2 It is a specific flow chart of the method for identifying the IP address of IDC service running illegally in the metropolitan area network of the present invention;

[0043] Figure 3 It is a schematic diagram of the structure of a device for identifying IP addresses of IDC services running illegally in a metropolitan area network according to the present invention;

[0044] Figure 4 It is a schematic diagram of the structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0045] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0046] Those skilled in the art will appreciate that the embodiments of the present invention may be implemented as a system, device, apparatus, method or computer program product. Therefore, the present disclosure may be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0047] According to the implementation mode of the present invention, a method and device for identifying the IP addresses of IDC services running illegally in a metropolitan area network are proposed. Through automated analysis and manual confirmation, the IP addresses of IDC services running in the metropolitan area network can be accurately identified. The method and device have an IDC IP address learning function, reduce manual intervention, and can realize rapid identification, confirmation and dynamic update of IDC IP address segments.

[0048] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0049] like Figure 1 , Figure 2 As shown, the present invention relates to a method for identifying an IP address of an IDC service running illegally in a metropolitan area network, the method comprising:

[0050] S01. Define the description rules of the IDC circuit ports in the metropolitan area network, and automatically discover the IDC port information in the metropolitan area network based on the description rules;

[0051] The S01 includes:

[0052] S011. Define the description rules of the IDC circuit port under the metropolitan area network, including: port name, interface type, IDC identifier, etc.

[0053] The port name in S011 includes: "dT" as a downstream port keyword, and "uT" as an upstream port keyword.

[0054] S012. Set the "Enable automatic confirmation port mode" configuration item. If the automatic confirmation port mode is not enabled, the port information is confirmed and adjusted through the manual interface; if the automatic confirmation port mode is enabled, the system automatically scans the network configuration and automatically discovers and confirms the IDC port information according to the description rules.

[0055] S02, the system forms a metropolitan area network downlink IDC port set according to the discovered IDC port information;

[0056] The IDC port set information includes: port name, port description, Flow-Index, device name, device IP, interface type, and IDC identifier.

[0057] S03, based on the formed Netflow data of the IDC port set connected to the metropolitan area network, obtain the IP address library running the IDC service in the metropolitan area network;

[0058] The S03 includes:

[0059] S031. Based on the formation of the metropolitan area network downlink IDC port set, the system uses Netflow data collection technology to capture the network traffic data flowing through the port in real time;

[0060] The Netflow data collection technology uses the NetFlowV9 protocol to collect flow information of IDC port sets.

[0061] The traffic information includes: source IP, destination IP, source port, destination port, collection time, protocol, source AS number, destination AS number, etc.

[0062] S032, filtering Netflow data to extract a candidate set of IP addresses that may run IDC services in the metropolitan area network;

[0063] The S032 includes:

[0064] S0321. Check each NetFlow data flow. If the Output field value in the NetFlow data flow matches the Flow-Index of the downstream port of the MAN device, the NetFlow data flow is the outgoing traffic through the downstream port of this MAN CR. The system collects the destination IP of the NetFlow data flow and adds it to the candidate set of IP addresses running IDC services in the metropolitan area network.

[0065] S0322. If the Input field value in the NetFlow data flow matches the Flow-Index of the downstream port of the MAN device, the NetFlow data flow is the inbound traffic through the downstream port of this MAN CR. The system collects the source IP of the NetFlow data flow and adds it to the candidate set of IP addresses running IDC services in the metropolitan area network.

[0066] S033. Compare the IP address candidate set in the previous step with the national IDC registered address database to find out the IP address database running IDC services in the metropolitan area network.

[0067] The S033 includes:

[0068] S0331. The system compares the IP address candidate set with the national IDC registered address database, aggregates the consistent IP addresses, and adds them to the IP address database for running IDC services in the metropolitan area network;

[0069] S0332. If the system turns on the "Ignore manual confirmation" configuration item, inconsistent IP addresses will be discarded without manual intervention;

[0070] S0333: If the "Ignore Manual Confirmation" configuration item is not enabled and there are inconsistent IP addresses in the system, the system triggers the manual confirmation process;

[0071] S04. The system starts the timer and automatically updates the IDC IP address database of the metropolitan area network to the traffic analysis system for analysis every day;

[0072] The S04 includes:

[0073] S041. The system automatically updates the provincial metropolitan area network downlink IDC IP address database to the traffic analysis object every day to ensure the timeliness and accuracy of the analysis data;

[0074] S042. For the out-of-province IDC IP address library, the system manually downloads the latest address data daily or weekly through the interface provided by the traffic analysis system, and imports it into the system's "out-of-province IDC IP address library", which is then automatically updated to the traffic analysis object to achieve unified management of cross-regional IDC IP addresses.

[0075] It should be noted that, although the operations of the method of the present invention are described in a specific order in the above embodiments and the accompanying drawings, this does not require or imply that the operations must be performed in the specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0076] In order to explain more clearly the above method for identifying the IP address of IDC service running illegally in the metropolitan area network, it is described in conjunction with a specific embodiment below. However, it is worth noting that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation to the present invention.

[0077] Suppose there is a computer room called "Yunwang IDC" under the metropolitan area network of Nanjing, Jiangsu Province. This computer room is responsible for hosting servers and network equipment of multiple companies and providing Internet access and data center services.

[0078] To configure the automatic confirmation port mode:

[0079] The system administrator logs in to the system management interface, finds the "IDC Port Management" module, and sets the switch of "Whether to enable automatic port confirmation mode" to "On".

[0080] Based on the actual situation of the cloud network IDC, the administrator defined the port description rule: "dT: province code + city code + computer room abbreviation + device name + port name", such as: "dT:JS_NJ_YW_device1_100G1 / 2 / 0 / 0".

[0081] Automatically discover IDC ports:

[0082] Based on the preset port description rules, the system automatically scans the network devices in the metropolitan area network, identifies all ports that meet the rules, and classifies them into the "Cloud Network IDC Port Collection".

[0083] Administrators can see the cloud network IDC port list automatically generated by the system on the management interface, including port name, interface type, connection status and other information.

[0084] Enable the "Ignore manual confirmation" configuration item:

[0085] After the system administrator confirms that the port information is correct, he or she can turn on the "Ignore manual confirmation" configuration item, and the system will automatically discard inconsistent IP addresses without manual intervention.

[0086] Automatically learn IDC service IP addresses:

[0087] The system starts to collect Netflow data flowing through the cloud network IDC port set. The Netflow data includes information such as source IP, destination IP, source port, destination port, collection time, protocol, source AS number, and destination AS number.

[0088] The system screens Netflow data and extracts a candidate set of IP addresses that may run IDC services in the metropolitan area network;

[0089] Check each NetFlow data flow. If the Output field value in the NetFlow data flow matches the Flow-Index of the downstream port of the MAN device, it indicates that the NetFlow data flow is the outgoing traffic through the downstream port of this MANCR. The system collects the destination IP of the NetFlow data flow and adds it to the candidate set of IP addresses that may run IDC services in the metropolitan area network;

[0090] If the Input field value in the NetFlow data flow matches the Flow-Index of the downstream port of the MAN device, it indicates that the NetFlow data flow is the inbound traffic through the downstream port of this MANCR. The system collects the source IP of the NetFlow data flow and adds it to the candidate set of IP addresses that may run IDC services in the metropolitan area network;

[0091] Compare the above IP address candidate set with the national IDC registered address database, find out the IP address database running IDC services in the metropolitan area network, and add it to the "Cloud Network IDC IP Address Database" for subsequent traffic analysis.

[0092] In the specific implementation, assuming that the Flow-Index of the port of a metropolitan area network CR device is 247, the Netflow data content is shown in Table 1 below:

[0093] serial number Source IP Source Port Destination IP Destination Port protocol Router IP Input Output 1 1.1.1.1 51358 192.168.1.21 443 6 192.168.1.10 247 221 2 1.1.1.2 53692 192.168.1.21 443 6 192.168.2.10 221 247 3 1.1.1.6 52891 192.168.1.31 443 6 192.168.1.11 256 221

[0094] Table 1

[0095] From the above Netflow data, it can be seen that the input of the first Netflow data and the output of the second Netflow data are consistent with the Flow-Index of the port of the MAN CR device. Therefore, the source IP of the first Netflow data and the destination IP of the second Netflow data are added to the candidate set of IP addresses that may run IDC services in the MAN.

[0096] IP address database synchronous update:

[0097] Every morning, the system automatically synchronizes the latest data in the "Cloud Network IDC IP Address Library" to the traffic analysis object according to the preset synchronization strategy. In this way, the traffic analysis system can accurately monitor and analyze traffic based on the latest IP address library.

[0098] Address update of IDCs in other provinces: For IDCs in other provinces (such as IDCs in Beijing, Shanghai, etc.), the system administrator downloads the latest address data through the group traffic analysis system. These data are usually provided in the form of files. The administrator manually imports these files into the system and triggers the update operation to ensure the synchronization of the IP address database of IDCs in other provinces.

[0099] Through the above specific embodiments, the present invention realizes a method for identifying IP addresses of IDC services that are illegally running in a metropolitan area network, ensuring that the traffic analysis system can perform efficient and accurate traffic monitoring and analysis based on the latest IDC IP address library, thereby significantly improving system operation and maintenance efficiency and data accuracy, and reducing operation and maintenance costs.

[0100] Based on the same inventive concept, the present invention also proposes a device for identifying an IP address of an IDC service running in violation of regulations in a metropolitan area network. The implementation of the device can refer to the implementation of the above method, and the repeated parts will not be repeated. The term "module" used below can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0101] Figure 3 FIG. 1 is a schematic diagram of the structure of the device for identifying the IP address of the IDC service running illegally in the metropolitan area network according to the present invention. Figure 3 As shown, the device comprises:

[0102] A description rule module 110 defines a description rule for a circuit port of a metropolitan area network downlink IDC, and automatically discovers the port information of the metropolitan area network downlink IDC based on the description rule;

[0103] The IDC port aggregation module 120 forms a metropolitan area network downlink IDC port aggregation according to the discovered IDC port information;

[0104] The IP address library acquisition module 130 acquires the IP address library for running IDC services in the metropolitan area network based on the formed Netflow data of the metropolitan area network downlink IDC port set;

[0105] The timer starts the module 140, and automatically updates the metropolitan area network downstream IDC IP address database to the traffic analysis system for analysis every day.

[0106] It should be noted that although several modules of the device for identifying the IP address of the IDC service running illegally in the metropolitan area network are mentioned in the above detailed description, this division is only exemplary and not mandatory. In fact, according to the embodiment of the present invention, the features and functions of two or more modules described above can be concretized in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules for concretization.

[0107] Based on the above invention concept, Figure 4 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the computer program 230, the aforementioned method for identifying the IP addresses of IDC services that are illegally running in a metropolitan area network is implemented.

[0108] Based on the aforementioned inventive concept, the present invention further proposes a computer-readable storage medium, which stores a computer program for executing the aforementioned method for identifying IP addresses of IDC services that are illegally running in a metropolitan area network.

[0109] The present invention discloses a method and device for identifying an IDC service IP address that is illegally running in a metropolitan area network. The method and device can accurately identify an IDC service IP address that is running in a metropolitan area network through automated analysis and manual confirmation. The present invention has an IDC IP address learning function, reduces manual intervention, and can realize rapid identification, confirmation, and dynamic update of IDC IP address segments, thereby ensuring that a traffic analysis system can perform efficient and accurate traffic monitoring and analysis based on the latest IDC IP address library, thereby significantly improving system operation and maintenance efficiency and data accuracy, and reducing operation and maintenance costs.

[0110] Although the spirit and principle of the present invention have been described with reference to several specific embodiments, it should be understood that the present invention is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements contained in the spirit and scope of the attached claims.

[0111] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0112] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0113] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0114] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0115] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0116] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0117] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0118] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

[0119] Regarding the limitation of the protection scope of the present invention, those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the protection scope of the present invention.

Claims

1. A method for identifying IP addresses of IDC services that are illegally running in a metropolitan area network, characterized in that: The method includes: S01. Define the description rules of the IDC circuit ports in the metropolitan area network, and automatically discover the IDC port information in the metropolitan area network based on the description rules; S02, the system forms a metropolitan area network downlink IDC port set according to the discovered IDC port information; S03, based on the formed Netflow data of the IDC port set connected to the metropolitan area network, obtain the IP address library running the IDC service in the metropolitan area network; S04. The system starts a timer to automatically update the metropolitan area network downstream IDCIP address database to the traffic analysis system for analysis every day.

2. The method for identifying the IP address of IDC service running illegally in the metropolitan area network according to claim 1, characterized in that: The S01 includes: S011. Define description rules for the IDC circuit port in the metropolitan area network, including: port name, interface type, and IDC ID; S012. Set the "Enable automatic port confirmation mode" configuration item. If the automatic port confirmation mode is not enabled, the port information is confirmed and adjusted through the manual interface; if the automatic port confirmation mode is enabled, the system automatically scans the network configuration and automatically discovers and confirms the IDC port information according to the description rules.

3. The method for identifying the IP address of IDC service running illegally in the metropolitan area network according to claim 2, characterized in that: The port name in S011 includes: "dT" as the downstream port keyword, and "uT" as the upstream port keyword.

4. The method for identifying the IP address of IDC service running illegally in the metropolitan area network according to claim 1, characterized in that: The IDC port set information includes: port name, port description, Flow-Index, device name, device IP, interface type, and IDC identifier.

5. The method for identifying the IP address of IDC service running illegally in the metropolitan area network according to claim 1, characterized in that: The S03 includes: S031. Based on the formation of the metropolitan area network downlink IDC port set, the system uses Netflow data collection technology to capture the network traffic data flowing through the port in real time; S032, filtering Netflow data to extract a candidate set of IP addresses that may run IDC services in the metropolitan area network; S033. Compare the IP address candidate set in the previous step with the national IDC registered address database to find out the IP address database running IDC services in the metropolitan area network.

6. The method for identifying the IP address of IDC service running illegally in the metropolitan area network according to claim 5, characterized in that: The Netflow data collection technology uses the NetFlowV9 protocol to collect flow information of IDC port sets.

7. The method for identifying the IP address of IDC service running illegally in the metropolitan area network according to claim 6, characterized in that: The traffic information includes: source IP, destination IP, source port, destination port, collection time, protocol, source AS number, destination AS number, etc.

8. The method for identifying IP addresses of IDC services that are illegally running in a metropolitan area network according to claim 5, characterized in that: The S032 includes: S0321. Check each NetFlow data flow. If the Output field value in the NetFlow data flow matches the Flow-Index of the downstream port of the MAN device, the NetFlow data flow is the outgoing traffic through the downstream port of this MAN CR. The system collects the destination IP of the NetFlow data flow and adds it to the candidate set of IP addresses running IDC services in the metropolitan area network. S0322. If the Input field value in the NetFlow data flow matches the Flow-Index of the downstream port of the MAN device, the NetFlow data flow is the inbound traffic through the downstream port of this MAN CR. The system collects the source IP of the NetFlow data flow and adds it to the candidate set of IP addresses running IDC services in the metropolitan area network.

9. The method for identifying IP addresses of IDC services that are illegally running in a metropolitan area network according to claim 5, characterized in that: The S033 includes: S0331. The system compares the IP address candidate set with the national IDC registered address database, aggregates the consistent IP addresses, and adds them to the IP address database for running IDC services in the metropolitan area network; S0332. If the system turns on the "Ignore manual confirmation" configuration item, inconsistent IP addresses will be discarded without manual intervention; S0333. If the "Ignore manual confirmation" configuration item is not enabled and inconsistent IP addresses appear in the system, the system triggers the manual confirmation process.

10. The method for identifying IP addresses of IDC services that are illegally running in a metropolitan area network according to claim 1, characterized in that: The S04 includes: S041. The system updates the IDC IP address database of the provincial metropolitan area network to the traffic analysis object every day to ensure the timeliness and accuracy of the analysis data; S042. For the out-of-province IDC IP address library, the system manually downloads the latest address data daily or weekly through the interface provided by the traffic analysis system, and imports it into the system's "out-of-province IDC IP address library", which is then automatically updated to the traffic analysis object to achieve unified management of cross-regional IDC IP addresses.

11. A device for identifying IP addresses of IDC services that are illegally running in a metropolitan area network, characterized in that: The device includes: Description rule module, which defines the description rules of the IDC circuit ports in the metropolitan area network and automatically discovers the IDC port information in the metropolitan area network based on the description rules; The IDC port collection module forms a metropolitan area network downlink IDC port collection based on the discovered IDC port information; An IP address library acquisition module, based on the formed Netflow data of the IDC port set connected to the metropolitan area network, acquires the IP address library running the IDC service in the metropolitan area network; The timer starts the module, automatically and synchronously updates the IDC IP address database of the metropolitan area network to the traffic analysis system for analysis every day.

12. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 10 is implemented.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 10.

Images