Private Internet exit detection method, related device and computer storage medium

Abstract

The invention provides a detection method for a private Internet exit, a related device and a computer storage medium. The method comprises the following steps: recording triple information when unified push software of each unit accesses a detection server; wherein the triple information comprises an internet exit IP address, access time and positioning information; and for each unit, analyzing according to rules and regulations of the unit and the received triple information of the unit to obtain an analysis result. According to the method, detection of the private Internet exit is realized by using the unified pushing software which cannot be bypassed by each unit, that is, whether each unit privately establishes the Internet exit or not is judged by recording the triple information when the unified pushing software of each unit accesses the detection server.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a detection method for a privately built Internet exit, a related device and a computer storage medium. Background Art

[0002] At present, from a technical point of view, detecting privately built Internet exits actually means detecting the IP addresses of Internet exits used by company branches. Internet exits that are legally established according to company regulations will be reported to the headquarters by each unit, while privately built Internet exits will not be reported by each unit because they are not allowed by the headquarters, making it difficult for the headquarters to obtain relevant information.

[0003] The technical difficulty in checking privately built Internet exits is that each unit will not proactively report such violations to the headquarters, and there are currently more than 3 billion IP addresses in the world, and the headquarters cannot determine which of these 3 billion IP addresses is the IP address of the privately built Internet exit used by the company's branch. In the future, after the domestic network gradually switches to IPv6 network, the number of IP addresses will reach a larger level, making it even more impossible to detect the IP addresses of privately built Internet exits through active detection. Summary of the invention

[0004] In view of this, the present application provides a method, related device and computer storage medium for detecting privately built Internet exits, which uses unified software that cannot be bypassed by each unit to detect privately built Internet exits, that is, by recording the triplet information when each unit's unified software accesses the detection server, it is determined whether each unit has privately built an Internet exit.

[0005] The first aspect of the present application provides a method for detecting a privately built Internet egress, comprising:

[0006] Record the triplet information when each unit's unified promotion software accesses the detection server; wherein the triplet information includes the Internet exit IP address, access time and location information;

[0007] For each unit, analysis is performed according to the rules and regulations of the unit and the received triplet information of the unit to obtain an analysis result.

[0008] Optionally, if the unit's rules and regulations prohibit devices connected to the Internet from being taken out of the unit and only allow access to the unit network to access the Internet, for each unit, analysis is performed according to the unit's rules and regulations and the received triplet information of the unit to obtain analysis results, including:

[0009] If the IP address in the triplet information is not in the list of legal Internet exit IP addresses, it is determined that the unit sending the triplet information has privately built an Internet exit.

[0010] Optionally, if the rules and regulations of the unit are that devices connected to the Internet can be taken out of the unit and can temporarily access the Internet through other networks, for each unit, analysis is performed according to the rules and regulations of the unit and the received triplet information of the unit to obtain analysis results, including:

[0011] For each triplet information sent by the unit, the triplet information whose IP address is not in the list of legal Internet exit IP addresses is regarded as suspicious triplet information; wherein the suspicious triplet information includes the suspicious IP address, access time and location information;

[0012] Collecting statistics on all suspicious triplet information during legal working hours to obtain statistical information; wherein the statistical information at least includes suspicious IP addresses and report counts;

[0013] If the report count is greater than a preset quantity threshold within a preset time interval, it is determined that the suspicious IP address is a private Internet exit IP address.

[0014] Optionally, if within a preset time interval, the report count is greater than a preset number threshold, after determining that the suspicious IP address is a privately built Internet egress IP address, the method further includes:

[0015] For each private Internet exit, obtain corresponding positioning information according to the private Internet exit IP address in the triplet information;

[0016] The unit that has built a private Internet exit is determined based on the positioning information corresponding to the IP address of the private Internet exit.

[0017] The second aspect of the present application provides a detection device for a privately built Internet exit, comprising:

[0018] A recording unit, used to record the triplet information when each unit's unified promotion software accesses the detection server; wherein the triplet information includes the Internet exit IP address, access time and location information;

[0019] The analysis unit is used to analyze each unit according to the rules and regulations of the unit and the received triplet information of the unit to obtain an analysis result.

[0020] Optionally, if the unit's rules and regulations prohibit devices connected to the Internet from being taken out of the unit and only allow access to the unit network to access the Internet, the analysis unit includes:

[0021] The first analyzing subunit is used to determine that the unit sending the triplet information has privately built an Internet exit if the IP address in the triplet information is not in the list of legal Internet exit IP addresses.

[0022] Optionally, if the unit's rules and regulations state that devices connected to the Internet can be taken out of the unit and can temporarily access the Internet through other networks, the analysis unit includes:

[0023] A screening unit is used for treating, for each triplet information sent by the unit, triplet information whose IP address is not in the list of legal Internet exit IP addresses as suspicious triplet information; wherein the suspicious triplet information includes a suspicious IP address, access time and location information;

[0024] A statistical unit, used to collect statistics on all suspicious triplet information within legal working hours to obtain statistical information; wherein the statistical information at least includes suspicious IP addresses and report counts;

[0025] The first determination unit is used to determine that the suspicious IP address is a private Internet exit IP address if the report count is greater than a preset quantity threshold within a preset time interval.

[0026] Optionally, the detection device for the privately built Internet exit further includes:

[0027] A second determining unit is used to obtain corresponding positioning information according to the IP address of the private Internet exit in the triple information for each private Internet exit;

[0028] The third determining unit is used to determine the unit that has the behavior of privately building an Internet exit according to the positioning information corresponding to the IP address of the privately built Internet exit.

[0029] A third aspect of the present application provides an electronic device, including:

[0030] one or more processors;

[0031] a storage device having one or more programs stored thereon;

[0032] When the one or more programs are executed by the one or more processors, the one or more processors implement the method for detecting a privately built Internet exit as described in any one of the first aspects.

[0033] A fourth aspect of the present application provides a computer storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for detecting a privately built Internet exit as described in any one of the first aspects is implemented.

[0034] It can be seen from the above scheme that the present application provides a detection method, related device and computer storage medium for privately built Internet exits, by recording the triplet information when each unit's unified promotion software accesses the detection server; wherein the triplet information includes the Internet exit IP address, access time and positioning information; for each unit, according to the unit's rules and regulations and the received triplet information of the unit, analysis is performed to obtain the analysis result. The present application uses unified promotion software that cannot be bypassed by each unit to realize the detection of privately built Internet exits, that is, by recording the triplet information when each unit's unified promotion software accesses the detection server, it is determined whether each unit has privately built an Internet exit. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0036] Figure 1 A flowchart of a method for detecting a privately built Internet exit provided in an embodiment of the present application;

[0037] Figure 2 A flowchart of a method for detecting a privately built Internet exit provided in another embodiment of the present application;

[0038] Figure 3 A schematic diagram of a detection device for a privately built Internet exit provided in another embodiment of the present application;

[0039] Figure 4 A schematic diagram of an electronic device for implementing a method for detecting a privately built Internet exit provided in another embodiment of the present application. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0041] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0042] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0043] It should be noted that the concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0044] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0045] First, the technical terms used in this application are explained:

[0046] IP: Internet Protocol. The purpose of designing IP is to improve the scalability of the network: first, to solve Internet problems and realize the interconnection of large-scale, heterogeneous networks; second, to separate the coupling relationship between top-level network applications and underlying network technologies to facilitate the independent development of the two.

[0047] IP address: A unified address format provided by the IP protocol, which assigns a logical address to each network and each host on the Internet to shield the difference in physical addresses. The mainstream IP protocols are divided into two types: IPv4 and IPv6. The address length of IPv4 is 32 bits, and the address length of IPv6 is 128 bits.

[0048] HTTP request: From entering the URL in the browser to the server returning the result, an HTTP request needs to go through the following steps: ① The browser performs DNS domain name resolution to obtain the IP address corresponding to the domain name; ② According to this IP address, find the corresponding server and establish a TCP connection through a three-way handshake; ③ After establishing the TCP connection, the browser sends an HTTP request message to the server, including the request line, request header, request body and other information; ④ The server responds to the HTTP request and sends a response message to the browser, including the status line, response header, response data and other information, and the browser obtains the HTML code; ⑤ The browser parses the HTML code and requests the resources in the HTML code (such as js, css, pictures, etc.); ⑥ The browser renders the page and presents it to the user; ⑦ The server closes the TCP connection. Among them, the alarm of the security device mainly occurs in the ③ and ④ stages. When the attacker is attacking, he usually adds offensive content to the request in the ③ stage, so that it is recognized and alarmed by the security device. Some security devices can also identify the abnormal response content from the server in the ④ stage, thereby alarming that the server may be attacked. Since the HTTP protocol is based on the TCP protocol, and the TCP protocol is connection-oriented and traceable, the alarm of the security device can be associated with the request and the return.

[0049] Internet egress: Due to the limited number of IPv4 addresses, the IP addresses currently used by units, mobile phones, and home networks are usually intranet IP addresses (addresses like 10.*.*.*, 192.168.*.*). This type of IP address does not appear on the Internet. When a user using this type of IP address accesses the Internet, the intranet IP address will be mapped to a public IP address. From the perspective of the visited website, the user uses the mapped public IP address to access this website. This mapped public IP address is the Internet egress IP address. Generally speaking, a unit may have hundreds of computers, but the Internet egress IP addresses that are ultimately mapped are generally only one or a few. From the perspective of the website, if an Internet IP address has a large number of visits, it means that the Internet IP address is used by many people, which means that the Internet IP address is actually the Internet egress of a larger internal network (generally units, Internet cafes, hotels, etc.), that is, the Internet egress IP address.

[0050] Unified promotion software: In order to facilitate the management of terminals, large enterprises usually purchase or develop dedicated terminal management software and internal communication / enterprise management apps for internal use, and force them to be installed on terminals and mobile phones connected to the network. This type of software is called unified promotion software. For example, the State Grid Corporation of China has unified promoted the "i State Grid" APP on mobile phones. It is a unified promotion software, and almost all employees of the State Grid Corporation of China will install the APP on their mobile phones. In the process of terminal management, similar software will also be installed on office terminals connected to the network.

[0051] The embodiment of the present application provides a method for detecting privately built Internet exits. First, the inspection unit will deploy a "detection server" on the Internet. The unified software provided to each unit of the company is set to access the detection server at a scheduled time (it can be a function provided by the unified software, or it can be a program / script executed by the unified software, which is not limited here). Each branch and unit shall register the legal Internet exit IP address with the regular inspection unit, which will be stored by the inspection unit to form a list of legal Internet exit IP addresses, such as Figure 1 As shown, an implementation method of a privately built Internet exit detection method specifically includes the following steps:

[0052] S101, recording the triplet information when each unit's unified promotion software accesses the detection server.

[0053] The triplet information includes the Internet exit IP address, access time and location information.

[0054] It should be noted that the server can definitely obtain the information of the Internet exit IP address according to the description of the Internet exit IP. The location information includes but is not limited to the registered user, unit, login account, geographic location and other information used for tracing the source of violations, which is not limited here. It should be noted that although it is not necessarily possible to obtain this information, the unified promotion software of general units will collect such information. As long as the unified promotion software has the corresponding function, it can report such information.

[0055] In the specific implementation process of this application, each unit's unified promotion software attempts to access the detection server at a fixed time (for example, every 10 minutes after the computer or mobile phone is started, etc., not limited here), and the detection server records the triplet information when each unit's unified promotion software accesses the detection server.

[0056] It should be noted that the timing is for the software / APP that does not usually access the server of the inspection initiating unit (for example, the headquarters, superior unit, or the unit entrusted by the headquarters or superior unit) through the Internet. If an enterprise communication APP is used, due to the continuous access characteristics of this type of APP, timing can also be omitted. At this time, the detection server can reuse the server of the communication APP / software, and there is no limitation here.

[0057] It should be noted that the "user, unit, login account, and geographic location" in the location information are sample information. In actual operations, it is not necessary to obtain all of them, nor is it limited to obtaining these four types of information. The essence of location information is that when a violation is discovered, the location information can be used to find the information of the responsible unit or person. For example, for the inspection unit, the simplest location information can only contain unit information (the inspection unit only needs to hold the responsible unit accountable), and there is no limitation here.

[0058] In the actual application process of the present application, the triplet information may be stored in a database specified on the detection server but is not limited thereto, and is not limited here.

[0059] S102: For each unit, analyze according to the unit's rules and regulations and the received triplet information of the unit to obtain an analysis result.

[0060] The unit may be an inspected unit, that is, analysis is performed only on the inspected unit, and analysis is performed according to the unit's rules and regulations and the received triplet information of the inspected unit to obtain analysis results, which is not limited here.

[0061] It is understandable that, since different units may have different rules and regulations, it is necessary to conduct a comprehensive analysis based on the unit's rules and regulations and the triplet information received from the unit.

[0062] For example, a unit's rules and regulations prohibit devices connected to the Internet from being taken out of the unit, and only devices connected to the unit's network are allowed to access the Internet, such as computers used for company research and development testing, or computers involving sensitive corporate information, or servers, etc., which are not limited here. As long as an address other than the registered one appears, it means that company assets have been taken out of the company. That is, if the IP address in the triplet information is not in the list of legal Internet exit IP addresses, it is determined that the unit sending the triplet information has privately built an Internet exit. Subsequent penalties and notifications will be imposed on the unit, which are not limited here.

[0063] For example, if the unit's rules and regulations state that devices connected to the Internet can be taken out of the unit and can temporarily access the Internet through other networks, then for each unit, an analysis is performed based on the unit's rules and regulations and the unit's triplet information received to obtain an implementation method of the analysis result, such as Figure 2 As shown, including:

[0064] S201. For each triplet of information sent by the unit, the triplet of information whose IP address is not in the list of legal Internet exit IP addresses is regarded as suspicious triplet information.

[0065] The suspicious triplet information includes the suspicious IP address, access time and location information.

[0066] Specifically, if the IP address in the triplet information is in the triplet information of the legal Internet exit IP address list, it can be directly filtered out.

[0067] S202: Collect statistics on all suspicious triplet information within legal working hours to obtain statistical information.

[0068] The statistical information at least includes suspicious IP addresses and report counts.

[0069] It should be noted that the reason for limiting the statutory working hours is that devices that can access the Internet can generally be taken home (if the rules and regulations allow it). Since the company's superior unit does not need to be responsible for the management of the home network, it only needs to be responsible for the legal Internet exit IP address on record. If an employee often takes a certain device of the company home, the IP address of the home broadband may be mistakenly determined as a private Internet exit. After limiting the statutory working hours, the possibility of such false alarms will be greatly eliminated.

[0070] It is understandable that since the location information in the suspicious triplet information is not used temporarily, it can be temporarily ignored and can be obtained later from the database storing the triplet information. Of course, the location information can also be not ignored, and the suspicious triplet information can be directly used for statistics, that is, the obtained statistical information includes: suspicious IP address, access time and location information. Of course, additional information can also be added, which is not limited here.

[0071] It should be noted that the statistical information at least including suspicious IP addresses and report counts is only the minimum data requirement for implementing this application. If data is added on the basis of the minimum data (for example, the location information is not removed, the triples are still retained in the end, or even additional information is added), as long as the algorithm is based on the IP address and access time to perform the same calculation as this patent, it should still be regarded as using the method of this application.

[0072] S203: If the report count is greater than a preset quantity threshold within a preset time interval, the suspicious IP address is determined to be a private Internet exit IP address.

[0073] The preset time interval and preset quantity threshold are preset and changed by technicians, experts, etc. and are not limited here.

[0074] The preset number threshold is set because there are situations where you take your company laptop to work outside. There are also situations where you use mobile apps but don't use the company network. In these situations, the number of public IP accesses involved is relatively small. When you go out to work, there won't be a large number of your company's employees at the destination, so the number of visits is small. When using mobile phones, operators have a large number of Internet IPs that can be mapped, and eventually different access personnel will be dispersed to a large number of Internet exit IPs, resulting in a very limited number of access personnel for each IP. Both of these situations are very different from the situation where the company privately builds an Internet exit (a large number of company employees access the Internet through a very small number of IPs).

[0075] The preset quantity threshold is generally an access density indicator such as access count / hour, access count / day, number of users / hour, number of users / day, and is not limited here.

[0076] In the actual application process of this application, after determining the IP address of the private Internet egress, an implementation method of the private Internet egress detection method further includes:

[0077] For each private Internet exit, corresponding positioning information is obtained according to the private Internet exit IP address in the triplet information; and the unit where the private Internet exit behavior exists is determined according to the positioning information corresponding to the private Internet exit IP address.

[0078] Specifically, if the positioning information corresponding to a privately built Internet exit IP address "roughly belongs to" the same unit and appears continuously over a long period of time, the IP address will be determined to be a privately built Internet exit IP address, and an assessment report will be issued to the relevant unit revealed by the positioning information.

[0079] It should be noted that "roughly attributable" means that the vast majority (for example, more than 80%) of all the location information through the export IP belongs to the same unit. This avoids false positives caused by "location information noise" caused by access from external units. If a competitor uses "completely attributable", it should be considered a special case of "roughly attributable" to this application - that is, 100% attributable to the same unit.

[0080] Continuous occurrence means that the above alarm conditions are met continuously for several hours or several days. This is to eliminate false alarm noise caused by temporary meetings of the entire unit / department, such as the annual meeting held in a hotel.

[0081] From the above scheme, it can be seen that the present application provides a method for detecting privately built Internet exits, which uses a unified software that cannot be bypassed by each unit to realize the detection of privately built Internet exits, that is, by recording the triplet information when each unit's unified software accesses the detection server, it is determined whether each unit has privately built an Internet exit.

[0082] The present application embodiment provides a detection device for a privately built Internet exit, such as Figure 3 As shown, specifically including:

[0083] The recording unit 301 is used to record the triplet information of each unit's unified promotion software.

[0084] The triplet information includes the Internet exit IP address, access time and location information.

[0085] The analyzing unit 302 is used to analyze each unit according to the unit's rules and regulations and the received triplet information of the unit to obtain an analysis result.

[0086] For the specific working process of the units disclosed in the above embodiments of the present application, please refer to the corresponding method embodiments, such as Figure 1 As shown, no further description is given here.

[0087] Optionally, in another embodiment of the present application, if the unit's rules and regulations prohibit devices connected to the Internet from being taken out of the unit and only allow access to the unit network to access the Internet, an implementation of the analysis unit includes:

[0088] The first analysis subunit is used to determine that the unit sending the triplet information has privately built an Internet exit if the IP address in the triplet information is not in the list of legal Internet exit IP addresses.

[0089] The specific working process of the units disclosed in the above embodiments of the present application can be found in the corresponding method embodiments, which will not be repeated here.

[0090] Optionally, in another embodiment of the present application, if the unit's rules and regulations stipulate that devices connected to the Internet can be taken out of the unit and can temporarily access the Internet through other networks, an implementation of the analysis unit includes:

[0091] The screening unit is used for treating, for each triplet information sent by the unit, the triplet information whose IP address is not in the list of legal Internet exit IP addresses as suspicious triplet information.

[0092] The suspicious triplet information includes the suspicious IP address, access time and location information.

[0093] The statistical unit is used to collect statistics on all suspicious triplet information within the legal working hours to obtain statistical information.

[0094] The statistical information includes at least suspicious IP addresses and report counts.

[0095] The first determination unit is used to determine that the suspicious IP address is a private Internet exit IP address if the report count is greater than a preset quantity threshold within a preset time interval.

[0096] For the specific working process of the units disclosed in the above embodiments of the present application, please refer to the corresponding method embodiments, such as Figure 2 As shown, no further description is given here.

[0097] Optionally, in another embodiment of the present application, an implementation of the detection device for a privately built Internet exit further includes:

[0098] The second determining unit is used to obtain corresponding positioning information according to the IP address of the private Internet exit in the triplet information for each private Internet exit.

[0099] The third determining unit is used to determine the unit that has the behavior of privately building an Internet exit according to the positioning information corresponding to the IP address of the privately built Internet exit.

[0100] The specific working process of the units disclosed in the above embodiments of the present application can be found in the corresponding method embodiments, which will not be repeated here.

[0101] From the above scheme, it can be seen that the present application provides a detection device for privately built Internet exits, which uses a unified software that cannot be bypassed by each unit to realize the detection of privately built Internet exits, that is, by recording the triplet information when each unit's unified software accesses the detection server, it is determined whether each unit has privately built an Internet exit.

[0102] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0103] Another embodiment of the present application provides an electronic device, such as Figure 4 As shown, including:

[0104] One or more processors 401 .

[0105] The storage device 402 stores one or more programs.

[0106] When the one or more programs are executed by the one or more processors 401, the one or more processors 401 implement the method for detecting a privately built Internet exit as described in any one of the above embodiments.

[0107] Another embodiment of the present application provides a computer storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for detecting a privately built Internet exit as described in any one of the above embodiments is implemented.

[0108] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0109] It should be noted that the computer-readable medium mentioned above in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0110] The computer-readable medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0111] Another embodiment of the present application provides a computer program product, which, when executed, is used to execute the above-mentioned method for detecting a privately built Internet exit.

[0112] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, the above-mentioned functions defined in the method of the embodiment of the present application are executed.

[0113] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in this application is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing this application.

[0114] Although several specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present application. Certain features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination.

[0115] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of application involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above application concept. For example, the above features are replaced with (but not limited to) technical features with similar functions applied in the present application.

Claims

1. A method for detecting a privately built Internet exit, characterized in that: include: Record the triplet information when each unit's unified promotion software accesses the detection server; wherein the triplet information includes the Internet exit IP address, access time and location information; For each unit, analysis is performed according to the rules and regulations of the unit and the received triplet information of the unit to obtain an analysis result.

2. The method for detecting a privately built Internet exit according to claim 1, characterized in that: If the unit's rules and regulations prohibit devices connected to the Internet from being taken out of the unit and only allow access to the unit network to access the Internet, for each unit, analysis is performed based on the unit's rules and regulations and the received triplet information of the unit to obtain analysis results, including: If the IP address in the triplet information is not in the list of legal Internet exit IP addresses, it is determined that the unit sending the triplet information has privately built an Internet exit.

3. The method for detecting a privately built Internet exit according to claim 1, characterized in that: If the rules and regulations of the unit are that devices connected to the Internet can be taken out of the unit and can temporarily access the Internet through other networks, for each unit, analysis is performed based on the rules and regulations of the unit and the received triplet information of the unit to obtain analysis results, including: For each triplet information sent by the unit, the triplet information whose IP address is not in the list of legal Internet exit IP addresses is regarded as suspicious triplet information; wherein the suspicious triplet information includes the suspicious IP address, access time and location information; Collecting statistics on all suspicious triplet information during legal working hours to obtain statistical information; wherein the statistical information at least includes suspicious IP addresses and report counts; If the report count is greater than a preset quantity threshold within a preset time interval, it is determined that the suspicious IP address is a private Internet exit IP address.

4. The method for detecting a privately built Internet exit according to claim 3, characterized in that: If within a preset time interval, the report count is greater than a preset number threshold, after determining that the suspicious IP address is a private Internet egress IP address, the method further includes: For each private Internet exit, obtain corresponding positioning information according to the private Internet exit IP address in the triplet information; The unit that has built a private Internet exit is determined based on the positioning information corresponding to the IP address of the private Internet exit.

5. A detection device for a privately built Internet exit, characterized in that: include: A recording unit, used to record the triplet information when each unit's unified promotion software accesses the detection server; wherein the triplet information includes the Internet exit IP address, access time and location information; The analysis unit is used to analyze each unit according to the rules and regulations of the unit and the received triplet information of the unit to obtain an analysis result.

6. The detection device for privately built Internet exit according to claim 5, characterized in that: If the unit's rules and regulations prohibit devices connected to the Internet from being taken out of the unit and only allow access to the Internet through the unit network, the analysis unit includes: The first analyzing subunit is used to determine that the unit sending the triplet information has privately built an Internet exit if the IP address in the triplet information is not in the list of legal Internet exit IP addresses.

7. The detection device for a privately built Internet exit according to claim 5, characterized in that: If the unit's rules and regulations state that devices connected to the Internet can be taken out of the unit and can temporarily access the Internet through other networks, the analysis unit includes: A screening unit is used for treating, for each triplet information sent by the unit, triplet information whose IP address is not in the list of legal Internet exit IP addresses as suspicious triplet information; wherein the suspicious triplet information includes a suspicious IP address, access time and location information; A statistical unit, used to collect statistics on all suspicious triplet information within legal working hours to obtain statistical information; wherein the statistical information at least includes suspicious IP addresses and report counts; The first determination unit is used to determine that the suspicious IP address is a private Internet exit IP address if the report count is greater than a preset quantity threshold within a preset time interval.

8. The detection device for a privately built Internet exit according to claim 7, characterized in that: Also includes: A second determining unit is used to obtain corresponding positioning information according to the IP address of the private Internet exit in the triple information for each private Internet exit; The third determining unit is used to determine the unit that has the behavior of privately building an Internet exit according to the positioning information corresponding to the IP address of the privately built Internet exit.

9. An electronic device, characterized in that: include: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method for detecting a privately built Internet exit as described in any one of claims 1 to 4.

10. A computer storage medium, characterized in that: A computer program is stored thereon, wherein when the computer program is executed by a processor, the method for detecting a privately built Internet exit as claimed in any one of claims 1 to 4 is implemented.

Images