Internet surfing behavior management method and device, storage medium and electronic equipment

Abstract

The invention provides an internet behavior management method and device, a storage medium and electronic equipment, and belongs to the technical field of network security. The internet behavior management method comprises the following steps: acquiring a data packet of a data link layer; performing data processing on the data packet to obtain data content; and processing the data content based on a preset current domain name setting rule so as to realize internet behavior management. Due to the fact that the whole management process is achieved on the data link layer, the data can be directly analyzed, high operability is achieved, various data interception, analysis and recombination can be conducted, the problem of data omission or non-statistics is solved, and interception accuracy is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an online behavior management method, an online behavior management device, a machine-readable storage medium and an electronic device. Background Art

[0002] There are more and more router-type communication devices on the market, and the most common ones are home gateways and routers. The main difference is that home gateways often have multiple wide area network (WAN) connections, which are responsible for isolating the public network and the intranet. Routers generally have only one WAN, and routers often support wireless uplink and wireless mesh networks (Mesh). But no matter which form, as the current home networking business becomes more and more complex, new management methods need to be added to assist in network management.

[0003] First of all, the current network has many access restrictions, and the management based on Internet Protocol (IP) has not kept up with the times, so the management of domain names is very important. In actual use, whether it is daily access by users or access by various professional applications (Application, APP), the server IP is dynamically managed through domain name resolution to ensure the stable operation of services such as content delivery network (Content Delivery Network, CDN) and load balancing. Therefore, restrictions on fixed IPs are no longer meaningful.

[0004] Secondly, due to the complexity of internal networking, it is often no longer the era of a single device as a gateway. The simple 192.168.1.1 is no longer applicable. Apart from the users modifying the address pool themselves, most manufacturers have also set special addresses for themselves to avoid conflicts with 192.168.1.1. This makes it impossible for many users without network knowledge to find their devices.

[0005] Traditional domain name interception often uses the device's own Domain Name System Proxy (DNS Proxy) to locate by manually specifying the host, but this solution has great limitations. The first is that the downstream device can only take effect when using the gateway as the Domain Name System (DNS) resolution. In other words, if the user uses a static address, or although the Dynamic Host Configuration Protocol (DHCP) is used, the DNS server address issued by DHCP is a public DNS resolution server, then this domain name will no longer be intercepted. Secondly, for bridging services, since the data packets will be forwarded directly at the driver layer and the CPU will no longer process the data packets, it will not be intercepted, especially in Mesh network services, where bridging will be widely used.

[0006] Therefore, the existing Internet behavior management methods have low interception accuracy. Summary of the invention

[0007] The purpose of the embodiments of the present invention is to provide an online behavior management method, an online behavior management device, a machine-readable storage medium and an electronic device. The online behavior management method can perform various data interception, analysis and reorganization, reduce the problem of data omission or non-statistics, and improve the interception accuracy.

[0008] In order to achieve the above-mentioned purpose, the first aspect of the present application provides an Internet behavior management method, which is applied to the data link layer in network communication, and the method includes:

[0009] Get the data link layer data packet;

[0010] Performing data processing on the data packet to obtain data content;

[0011] Based on the preset current domain name setting rules, the data content is processed to achieve online behavior management.

[0012] In the embodiment of the present application, the processing of the data content based on the preset current domain name setting rule includes:

[0013] Extracting a DNS data packet from the data content;

[0014] Extracting domain name request information from the DNS data packet;

[0015] Based on the domain name request information and the preset current domain name setting rule, determining whether the DNS data packet is a special DNS;

[0016] When it is determined that the DNS data packet is a special DNS, the domain name is redirected for the data content to obtain a reply message data packet, and the reply message data packet is sent to the requesting end.

[0017] In the embodiment of the present application, the domain name redirection of the data content to obtain a reply message data packet includes:

[0018] The access request message in the data content is discarded, and a reply message is constructed to obtain a reply message data packet.

[0019] In the embodiment of the present application, the step of constructing a reply message to obtain a reply message data packet includes:

[0020] The data content is sent to a domain name system agent, and the domain name system agent composes a reply message to obtain a reply message data packet.

[0021] In the embodiment of the present application, the step of constructing a reply message to obtain a reply message data packet includes:

[0022] Based on the source IP address and the destination MAC address in the data content, a reply message is constructed to obtain a reply message data packet.

[0023] In the embodiment of the present application, the data content is processed based on the preset current domain name setting rule to achieve online behavior management, including:

[0024] Based on the preset current domain name setting rules, determine whether the current router is in a locked network state;

[0025] When it is determined that the current router is in a network-locked state, extract a DNS data packet from the data content, parse the domain name request in the DNS data packet, obtain an IP address, and determine whether the IP address is in a preset whitelist;

[0026] When it is determined that the IP address is in the preset white list, the data packet is allowed to pass.

[0027] In an embodiment of the present application, obtaining a data link layer data packet includes:

[0028] Register the new driver in the Linux system kernel;

[0029] Under the new driver, the hook mechanism in the netfilter framework is used to capture the data link layer data packet on the NF_BR_PRE_ROUTING chain of the PF_BRIDGE protocol family.

[0030] A second aspect of the present application provides an Internet behavior management device, which is applied to a data link layer in network communication, and the device includes:

[0031] An acquisition module, used to acquire data packets at the data link layer;

[0032] A first processing module, used for performing data processing on the data packet to obtain data content;

[0033] The second processing module is used to process the data content based on the preset current domain name setting rules to achieve online behavior management.

[0034] A third aspect of the present application provides an electronic device, the electronic device comprising:

[0035] at least one processor;

[0036] a memory connected to the at least one processor;

[0037] The memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the above-mentioned Internet behavior management method by executing the instructions stored in the memory.

[0038] A fourth aspect of the present application provides a machine-readable storage medium, on which instructions are stored. When the instructions are executed by a processor, the processor is configured to execute the above-mentioned Internet behavior management method.

[0039] Through the above technical solution, by obtaining the data packet of the data link layer; processing the data packet to obtain the data content; processing the data content based on the preset current domain name setting rules, to achieve online behavior management. By capturing the data packet of the data link layer, the data can be directly analyzed, with high operability, various data interception, analysis, and reorganization can be performed, more data can be intercepted, the problem of data omission or non-statistics is reduced, and the interception accuracy is improved.

[0040] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0042] Figure 1 A schematic diagram of a process flow of an online behavior management method according to an embodiment of the present application is shown;

[0043] Figure 2 A schematic diagram of a business process according to an embodiment of the present application is shown;

[0044] Figure 3 A schematic diagram of the structure of an online behavior management device according to an embodiment of the present application is shown;

[0045] Figure 4 The internal structure of a computer device according to an embodiment of the present application is schematically shown.

[0046] Description of Reference Numerals

[0047] 410 - acquisition module; 420 - first processing module; 430 - second processing module; A01 - processor; A02 - network interface; A03 - internal memory; A04 - display screen; A05 - input device; A06 - non-volatile storage medium; B01 - operating system; B02 - computer program. DETAILED DESCRIPTION

[0048] The specific implementation of the embodiment of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0049] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of national laws and regulations. In the embodiments of this application, some existing solutions in the industry such as certain software, components, and models may be mentioned, which should be considered as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0050] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back...), the directional indications are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0051] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0052] Please see Figure 1 , Figure 1 The flowchart of a method for managing online behavior according to an embodiment of the present application is schematically shown. This embodiment provides a method for managing online behavior, which is applied to the data link layer in network communication, and the method comprises the following steps:

[0053] Step 210: Obtaining a data link layer data packet;

[0054] In this embodiment, the data link layer is the second layer in the Open System Interconnection (OSI) model in computer networks, located between the physical layer and the network layer. It is mainly responsible for converting the original signal received by the physical layer into a frame that the network layer can understand.

[0055] In some embodiments, obtaining a data link layer data packet includes:

[0056] First, register the new driver in the Linux system kernel;

[0057] Then, under the new driver, the hook mechanism in the netfilter framework is utilized to capture the data link layer data packet on the NF_BR_PRE_ROUTING chain of the PF_BRIDGE protocol family.

[0058] In this embodiment, taking the Linux system as an example, the above-mentioned acquisition of the data link layer data packet can be to register a new driver in the Linux system kernel, so that the service is in the driver layer and has strong performance and can cope with high-load operations. Under the Linux system, the hook mechanism in the netfilter framework is used to capture all data packets on the NF_BR_PRE_ROUTING chain of the PF_BRIDGE protocol family. The method of capturing data fully utilizes the Linux standard interface operation, so it has good portability.

[0059] Among them, the netfilter framework is a framework for implementing network packet filtering, processing, and modification. It defines a series of rule chains and hooks, allowing developers to write kernel modules or user space programs to customize network packets. The PF_BRIDGE protocol family is used to handle bridging-related network functions, which corresponds to the processing flow of bridge network packets. NF_BR_PRE_ROUTING is a rule chain under the PF_BRIDGE protocol family, and packets will pass through this chain in the early stages of entering the bridge processing logic. Mounting the hook function here can intercept, view, and subsequently process the packets that have just entered the bridge processing.

[0060] Step 220: Process the data packet to obtain data content;

[0061] In this embodiment, the above data processing includes removing the header before the three layers, that is, removing the data link layer header and physical layer related encapsulation information, etc. It can be implemented by the data link layer protocol parsing function, which will not be described in detail here.

[0062] Step 230: Based on the preset current domain name setting rules, the data content is processed to achieve online behavior management.

[0063] In this embodiment, according to the current domain name setting rules, it can be determined how to operate the data packet of the data content, and the operation scheme includes allowing, discarding, forwarding, etc., that is, the above-mentioned processing of the data content includes allowing, discarding, forwarding, etc. operations on the data content. For example, the preset current domain name setting rules can be a rule table, which records different domain names and corresponding operation strategies (such as allowing, discarding, forwarding, etc.). When receiving a data packet of the data content, the device will parse the data packet, extract the domain name involved therein, and then match the extracted domain name with the domain name in the rule table to determine how to operate.

[0064] For domain name access, since the downstream device does not exist in the same network segment as the router in bridge mode, special processing is required for the case where the target IP is the local IP during bridge forwarding, and the data is directly captured to the CPU, so that it can be captured by the http server at the application layer. For example, because it is a bridge, the IP obtained by the PC is 10.10.10.10, but the IP of the router is 192.168.1.1. These two sides cannot be directly accessed, so human intervention is required to capture the CPU for processing. Since the target IP of the return message is a valid IP, even if it is sent across network segments, the reply message can still reach the destination, thereby achieving the purpose of cross-segment communication.

[0065] In Mesh networking, due to the difference between Controller and Agent, the access device will be determined based on the user's configuration, whether it is the HTTP service of Contorller or Agent. If the access is to Contorller and the current device is Agent, it will be allowed directly.

[0066] Please see Figure 2 , Figure 2 A schematic diagram of a business process according to an embodiment of the present application is schematically shown. In some embodiments, the processing of the data content based on the preset current domain name setting rule includes:

[0067] First, extract a DNS data packet from the data content;

[0068] In this embodiment, considering DNS and TCP, IP layer has IPv6 and IPv4, after combination, the data content can be processed for four situations respectively, and DNS packets can be extracted respectively. That is, it includes DNS data packet extraction based on TCP under IPv4, DNS data packet extraction based on UDP under IPv4, DNS data packet extraction based on TCP under IPv6, and DNS data packet extraction based on UDP under IPv6. Specifically, it can be realized by reasonable programming according to the corresponding protocol structure and characteristics. The above extraction process belongs to the prior art and will not be repeated here.

[0069] Then, extracting domain name request information from the DNS data packet;

[0070] In this embodiment, the domain name request information is obtained by analyzing the DNS data packet to obtain the detailed information of the domain name request. First, the header of the DNS data packet is parsed to obtain key information such as the number of questions, which can help determine the number and starting position of the domain name request information that needs to be parsed later. Then, the "question" part is located according to the header information, and the domain name request information is parsed according to a specific format, which usually involves the representation method of the parsed domain name and the type of record queried.

[0071] Then, based on the domain name request information and the preset current domain name setting rule, it is determined whether the DNS data packet is a special DNS;

[0072] In this embodiment, the preset current domain name setting rules usually define which domain names or domain name-related behaviors belong to special cases, such as specific domain names are restricted from access, specific types of queries need to be monitored, etc. The domain name request information is matched and compared with these rules one by one, and whether the DNS data packet belongs to a special DNS is determined based on the matching results. The preset current domain name setting rules can be blacklist and whitelist rules based on domain names, rules based on domain name suffixes, rules based on record types, etc.

[0073] Then, when it is determined that the DNS data packet is a special DNS, the domain name is redirected for the data content to obtain a reply message data packet, and the reply message data packet is sent to the requesting end.

[0074] In this embodiment, domain name redirection is a network technology used to direct a request originally directed to a certain domain name to another specified domain name or resource corresponding to an IP address. When performing domain name redirection, it involves modifying and processing the domain name related information in the relevant application layer protocol (such as HTTP, DNS, etc.), and then constructing a reply message data packet that complies with the protocol specification, so that the request end receives the response after redirection and changes its subsequent access behavior, thereby achieving Internet interception. Accordingly, when it is determined that the DNS data packet is not a special DNS, it means that it matches the preset current domain name setting rule, and the data packet is directly released.

[0075] In some embodiments, performing domain name redirection on the data content to obtain a reply message data packet includes: discarding an access request message in the data content, and constructing a reply message to obtain a reply message data packet.

[0076] In this embodiment, for data packets that require domain name redirection, the component sends a reply message after discarding the request message, thereby achieving the function of redirecting the domain name. By discarding the request message and then constructing a reply message, the request message for a specific domain name sent by the client can be intercepted, and the client is not allowed to access the originally expected target address according to the normal process. Instead, a reply message is constructed by itself to guide the client to other specified domain names or resources, thereby changing the client's subsequent access path and achieving the effect of domain name redirection.

[0077] The process of assembling the reply message can be directly forwarded to the DNS Proxy, and the reply message can be assembled by the DNS Proxy, or the driver can assemble the reply message by itself.

[0078] In some embodiments, when the driver constructs the reply message by itself, the constructing of the reply message to obtain the reply message data packet includes: constructing the reply message based on the source IP address and the destination MAC address in the data content to obtain the reply message data packet.

[0079] In this embodiment, domain name redirection is performed at the DNS level by tampering with the content in the DNS response data packet, changing the IP address information corresponding to the original domain name, so that the client receives the redirected IP address and then accesses different resources. At the data link layer, the MAC address is used to uniquely identify network devices in a network environment such as a local area network, and is a key factor in accurately forwarding data frames in a local network. When a request packet is received, the destination MAC address in the request packet is the MAC address of the target device (such as a server), and when the server constructs a reply message, it needs to set the source MAC address in the data link layer header of the reply message to its own MAC address (that is, the original destination MAC address in the request packet), and the destination MAC address is set to the source MAC address in the request packet (that is, the client's MAC address), so that the data frame can be accurately returned from the server to the client.

[0080] In some embodiments, when a reply message is constructed using a DNS Proxy, the construction of the reply message to obtain a reply message data packet includes: sending the data content to a domain name system proxy, and the domain name system proxy constructs a reply message to obtain a reply message data packet.

[0081] In this embodiment, the reply message formed by the domain name system proxy is encapsulated into a data packet that complies with the network transmission specification, which fully guarantees that the reply message data packet can be accurately and smoothly returned to the client that initiated the request. The above process of forming a reply message through a domain name system proxy belongs to the prior art and will not be repeated here.

[0082] It should be noted that when constructing a reply message, the reply message data packet needs to be recaptured into the driver registered in the Linux system kernel to avoid directly sending the unmodified reply message to the downstream device.

[0083] In some embodiments, the processing of the data content based on the preset current domain name setting rule to achieve online behavior management includes:

[0084] First, based on the preset current domain name setting rules, determine whether the current router is in a locked network state;

[0085] In this embodiment, when processing the data content, the DNS can be filtered, and the DNS filtering and permission can be used to achieve the purpose of locking the network while allowing access to the specified domain name, and the specified domain name can also be filtered. The router can be integrated with deep packet inspection (DPI) technology, which can perform a comprehensive analysis of past network data packets and accurately extract domain name information from the data content. When the intranet device initiates a network access request and the data packet flows through the router, the DPI module is quickly started to carefully identify the domain name in the data packet. If the extracted domain name perfectly matches any domain name in the preset blacklist, the router will immediately perform the corresponding action according to the pre-configured policy, which may include directly blocking the access request and sending an alarm message to the network administrator to prompt that an illegal access attempt has been found; or the access request is temporarily shelved and enters the waiting review state, and the administrator manually determines whether to release it. The specific operation depends on the security level and management mode of the network.

[0086] Then, when it is determined that the current router is in a locked network state, a DNS data packet is extracted from the data content, a domain name request in the DNS data packet is parsed to obtain an IP address, and it is determined whether the IP address is in a preset whitelist;

[0087] In this embodiment, rules can be set to filter the specified IP addresses to achieve the restrictions of the IP black and white lists. After the DNS data packet is determined, the domain name request information therein can be parsed to obtain the corresponding IP address. The preset white list can be a list of IP addresses that are allowed to be accessed and pre-set by the network administrator based on network security policies, business requirements and other factors. This list can be stored in a configuration file, or maintained in a program with a data structure such as an array or a linked list. After obtaining the IP address, it is necessary to compare it with the preset white list to determine whether it meets the access requirements.

[0088] Then, when it is determined that the IP address is in the preset white list, the data packet is allowed to pass.

[0089] Then, when it is determined that the IP address is not in the preset white list, the data packet is discarded.

[0090] In this embodiment, if the IP address is in the preset whitelist, it means that the access requirement is met and the data packet can be released; otherwise, it means that the access requirement is not met and the data packet is discarded.

[0091] For domain name access, in bridge mode, the downstream device does not exist in the same network segment as the router, so it is necessary to do special processing when the target IP is the local IP during bridge forwarding, and capture it directly to the CPU, so that it can be captured by the http server at the application layer. As for the return message, since the target IP is a valid IP, even if it is sent across network segments, the reply message can still reach the destination, thus achieving the purpose of cross-segment communication. In mesh networking, due to the difference between Controller and Agent, the user's configuration will determine whether the device to be accessed is the http service of Contorller or Agent. Assuming that the access is to Contorller and the current device is Agent, it should be released directly.

[0092] In the above implementation process, by obtaining the data packet of the data link layer; processing the data packet to obtain the data content; processing the data content based on the preset current domain name setting rules, so as to realize the management of Internet behavior. By capturing the data packet of the data link layer, the data can be directly analyzed, with high operability, various data interception, analysis, and reorganization can be performed, more data can be intercepted, the problem of data omission or uncounted can be reduced, and the interception accuracy is improved. For the hanging device, all DNS data is normal, which can ensure that the hanging device obtains the access address of the routing device itself through the custom domain name, and the DNS configuration of the network and the user's own local computer can be ignored. Ignoring the network connection environment, the devices in the static IP and bridge environment can be managed, even if the hanging device has its own manually configured DNS server. The cross-segment solution is considered in the workflow to ensure that the page can still be accessed even if the network IP address is not in the same network segment under the bridge. It can also cooperate with the Mesh network to ensure operability in the networking environment and flexibility.

[0093] It should be noted that, according to the data packets, the counter can also be used to calculate how many packets each device sends per second, how large each packet is, etc., so as to realize data flow statistics for each device. When a legitimate data packet is found, it is directly discarded, so that the data packet cannot be sent out and cannot be accessed. In the specific implementation, not all packets are discarded. As long as the packet is discarded, the service is incomplete and cannot be completed normally, so as to realize the network locking service of prohibiting the designated device from the network.

[0094] Figure 1 FIG. 1 is a flow chart of the method for managing online behavior in the embodiment. It should be understood that although Figure 1The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0095] Please see Figure 3 , Figure 3 The schematic diagram of the structure of an online behavior management device according to an embodiment of the present application is schematically shown. This embodiment provides an online behavior management device, the device includes an acquisition module 410, a first processing module 420 and a second processing module 430, wherein:

[0096] An acquisition module 410 is used to acquire a data packet of a data link layer;

[0097] A first processing module 420 is used to perform data processing on the data packet to obtain data content;

[0098] The second processing module 430 is used to process the data content based on the preset current domain name setting rules to achieve online behavior management.

[0099] The online behavior management device includes a processor and a memory. The acquisition module 410, the first processing module 420, the second processing module 430, etc. are all stored in the memory as program units, and the processor executes the program units stored in the memory to implement corresponding functions.

[0100] The processor includes a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the interception accuracy can be improved by adjusting the kernel parameters.

[0101] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0102] An embodiment of the present invention provides a machine-readable storage medium on which a program is stored. When the program is executed by a processor, the online behavior management method is implemented.

[0103] An embodiment of the present invention provides a processor, which is used to run a program, wherein the Internet behavior management method is executed when the program is running.

[0104] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor A01, a network interface A02, a display screen A04, an input device A05 and a memory (not shown in the figure) connected through a system bus. Among them, the processor A01 of the computer device is used to provide computing and control capabilities. The memory of the computer device includes an internal memory A03 and a non-volatile storage medium A06. The non-volatile storage medium A06 stores an operating system B01 and a computer program B02. The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 in the non-volatile storage medium A06. The network interface A02 of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor A01, a method for managing online behavior is implemented. The display screen A04 of the computer device can be a liquid crystal display or an electronic ink display, and the input device A05 of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0105] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0106] In one embodiment, the Internet behavior management method and device provided by the present application can be implemented in the form of a computer program. The computer program can be Figure 4 The computer device memory may store various program modules constituting the Internet behavior management method device, for example, Figure 3 The acquisition module 410, the first processing module 420 and the second processing module 430 are shown. The computer program composed of various program modules enables the processor to execute the steps of the Internet behavior management method of each embodiment of the present application described in this specification.

[0107] Figure 4 The computer device shown can be Figure 3The acquisition module 410 in the shown online behavior management method device executes step 210. The computer device may execute step 220 through the first processing module 420. The computer device may execute step 230 through the second processing module 430.

[0108] An embodiment of the present application provides an electronic device, the electronic device comprising: at least one processor; a memory connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, the at least one processor implements the above-mentioned Internet behavior management method by executing the instructions stored in the memory, and the processor implements the following steps when executing the instructions:

[0109] Get the data link layer data packet;

[0110] Performing data processing on the data packet to obtain data content;

[0111] Based on the preset current domain name setting rules, the data content is processed to achieve online behavior management.

[0112] In one embodiment, the processing of the data content based on the preset current domain name setting rule includes:

[0113] Extracting a DNS data packet from the data content;

[0114] Extracting domain name request information from the DNS data packet;

[0115] Based on the domain name request information and the preset current domain name setting rule, determining whether the DNS data packet is a special DNS;

[0116] When it is determined that the DNS data packet is a special DNS, the domain name is redirected for the data content to obtain a reply message data packet, and the reply message data packet is sent to the requesting end.

[0117] In one embodiment, the domain name redirection of the data content to obtain a reply message data packet includes:

[0118] The access request message in the data content is discarded, and a reply message is constructed to obtain a reply message data packet.

[0119] In one embodiment, the step of constructing a reply message to obtain a reply message data packet includes:

[0120] The data content is sent to a domain name system agent, and the domain name system agent composes a reply message to obtain a reply message data packet.

[0121] In one embodiment, the step of constructing a reply message to obtain a reply message data packet includes:

[0122] Based on the source IP address and the destination MAC address in the data content, a reply message is constructed to obtain a reply message data packet.

[0123] In one embodiment, the processing of the data content based on the preset current domain name setting rule to achieve online behavior management includes:

[0124] Based on the preset current domain name setting rules, determine whether the current router is in a locked network state;

[0125] When it is determined that the current router is in a network-locked state, extract a DNS data packet from the data content, parse the domain name request in the DNS data packet, obtain an IP address, and determine whether the IP address is in a preset whitelist;

[0126] When it is determined that the IP address is in the preset white list, the data packet is allowed to pass.

[0127] In one embodiment, obtaining a data link layer data packet includes:

[0128] Register the new driver in the Linux system kernel;

[0129] Under the new driver, the hook mechanism in the netfilter framework is used to capture the data link layer data packet on the NF_BR_PRE_ROUTING chain of the PF_BRIDGE protocol family.

[0130] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0131] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0132] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0133] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0134] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0135] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0136] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0137] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0138] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for managing online behavior, characterized in that: include: Get the data link layer data packet; Performing data processing on the data packet to obtain data content; Based on the preset current domain name setting rules, the data content is processed to achieve online behavior management.

2. The method for managing online behavior according to claim 1, characterized in that: The processing of the data content based on the preset current domain name setting rule includes: Extracting a DNS data packet from the data content; Extracting domain name request information from the DNS data packet; Based on the domain name request information and the preset current domain name setting rule, determining whether the DNS data packet is a special DNS; When it is determined that the DNS data packet is a special DNS, the domain name is redirected for the data content to obtain a reply message data packet, and the reply message data packet is sent to the requesting end.

3. The method for managing online behavior according to claim 2, characterized in that: The domain name redirection of the data content to obtain a reply message data packet includes: The access request message in the data content is discarded, and a reply message is constructed to obtain a reply message data packet.

4. The method for managing online behavior according to claim 3, characterized in that: The step of forming a reply message to obtain a reply message data packet includes: The data content is sent to a domain name system agent, and the domain name system agent composes a reply message to obtain a reply message data packet.

5. The method for managing online behavior according to claim 3, characterized in that: The step of forming a reply message to obtain a reply message data packet includes: Based on the source IP address and the destination MAC address in the data content, a reply message is constructed to obtain a reply message data packet.

6. The method for managing online behavior according to claim 1, characterized in that: The processing of the data content based on the preset current domain name setting rule to achieve online behavior management includes: Based on the preset current domain name setting rules, determine whether the current router is in a locked network state; When it is determined that the current router is in a network-locked state, extract a DNS data packet from the data content, parse the domain name request in the DNS data packet, obtain an IP address, and determine whether the IP address is in a preset whitelist; When it is determined that the IP address is in the preset white list, the data packet is allowed to pass.

7. The method for managing online behavior according to claim 1, characterized in that: The step of obtaining a data link layer data packet comprises: Register the new driver in the Linux system kernel; Under the new driver, the hook mechanism in the netfilter framework is used to capture the data link layer data packet on the NF_BR_PRE_ROUTING chain of the PF_BRIDGE protocol family.

8. A device for managing online behavior, characterized in that: include: An acquisition module, used to acquire data packets at the data link layer; A first processing module, used for performing data processing on the data packet to obtain data content; The second processing module is used to process the data content based on the preset current domain name setting rules to achieve online behavior management.

9. An electronic device, characterized in that: The electronic device includes: at least one processor; a memory connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the Internet behavior management method according to any one of claims 1 to 7 by executing the instructions stored in the memory.

10. A machine-readable storage medium having instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor is configured to execute the Internet behavior management method according to any one of claims 1 to 7.

Images