Communication network equipment external connection detection method and device
By sending SCTP protocol INIT messages in telecommunications network equipment and using the response information to determine the outbound status, the problems of difficult detection and high false alarms in existing technologies are solved, achieving efficient and accurate outbound detection and improving network security management.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-30
- Publication Date
- 2026-04-21
AI Technical Summary
Existing technologies cannot effectively detect the external connections of telecommunications network equipment using the SCTP protocol, and existing methods suffer from high false alarm rates, detection difficulties and network risks due to inconsistent operating systems.
The internal network detection module sends SCTP protocol INIT messages to the device under test, and the external monitoring module receives response information to determine the external status of the device. The source port or Initiate Tag field of the INIT message is embedded with an identification tag for unique identification, thereby achieving efficient detection.
It enables efficient external detection of telecommunications equipment, reduces the probability of false alarms, improves identification accuracy and efficiency, simplifies network management processes, and enhances security protection capabilities.
Smart Images
Figure CN121907533A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, and in particular to a method and apparatus for external detection of communication network equipment. Background Technology
[0002] Existing methods for detecting unauthorized external connections typically involve sending customized TCP or UDP packets to the device under test. Upon receiving the packet, the device replies to a detection server on another network. If no unauthorized external connection has occurred, the detection server on the other network will not receive the packet; if an unauthorized external connection has occurred, the detection server will receive the packet, thus determining the unauthorized external connection status of the device under test. Existing methods can also utilize devices with dual network interface cards (NICs), sending two separate detection packets to the device under test and comparing whether each NIC receives a reply packet to determine if an external connection has occurred. Alternatively, software applications can be installed on the device under test to periodically access internet resources for the same detection method.
[0003] However, existing technical solutions are not applicable to telecommunications network equipment using the SCTP protocol, as they cannot respond to corresponding detection packets for TCP or UDP protocols. Furthermore, existing technologies typically use port fields to identify the device under test, which are limited by the number of bits and often require multiple packet verifications. Using dual-NIC devices requires publishing routing protocols, posing a risk to the internal telecommunications network. Installing software on the device under test also presents challenges due to the lack of standardization across operating systems. Therefore, how to detect devices using the SCTP protocol in external networks has become an unresolved issue. Summary of the Invention
[0004] This application provides a method and apparatus for detecting external connections of communication network devices. It can send SCTP protocol INIT messages to the device under test through an internal network detection module. When the external connection monitoring module receives the response information, it can determine that the device under test is an unauthorized external connection device, thus realizing efficient detection of telecommunications dedicated equipment connecting to external networks. Moreover, compared with using ports, the information transmitted by using the SCTP protocol is more comprehensive, and identification can be completed by sending a data packet at once, which greatly reduces the probability of false alarms and improves the identification accuracy and efficiency.
[0005] In a first aspect, embodiments of this application provide a method for detecting external connections of a communication network device, the method comprising: The external monitoring module obtains the IP addresses of each device to be monitored in the internal network and generates multiple identification tags based on the IP addresses. The intranet detection module constructs an SCTP protocol INIT message based on the device to be detected and its corresponding identification identifier; The intranet detection module sends SCTP protocol INIT messages to the device under test based on the device's IP address and the preset detection period. The device under test receives and analyzes the SCTP protocol INIT message to obtain response information. If the external monitoring module receives a response, it obtains an external connection confirmation result; The external monitoring module determines the device to be tested based on the external connection results and identification tags.
[0006] Furthermore, the external monitoring module obtains the IP addresses of each device under test in the internal network, and derives multiple identification identifiers based on the IP addresses, including: The external monitoring module obtains the IP addresses of each device under test in the internal network through manual input, ARP protocol packet detection, or ICMP packet detection, and obtains multiple identification tags based on the IP addresses.
[0007] Furthermore, the identifier can be any number between 1 and 65535 or an IP address.
[0008] Furthermore, the IP address of the SCTP protocol INIT message is the IP address of a network monitoring device or multiple network monitoring devices set up in an external network.
[0009] Furthermore, the identification identifier is located at the source port of the INIT message, or the identification identifier is located in the Initiate Tag field of the INIT message.
[0010] Furthermore, the response information includes INITACK or ABORT messages.
[0011] Furthermore, if the external monitoring module receives a response, it obtains an external connection confirmation result, including: If the external monitoring module receives an INITACK message, it will detect the identification mark of the INITACK message to obtain the external connection confirmation result; Alternatively, if the external monitoring module receives an INITACK message, it checks the VerificationTag of the INITACK message to obtain the external connection confirmation result.
[0012] Secondly, embodiments of this application provide an external connection detection device for communication network equipment, the device comprising: The external monitoring module is used to obtain the IP addresses of each device to be monitored in the internal network and obtain multiple identification tags based on the IP addresses; if a response message is received, an external connection confirmation result is obtained; and the device to be monitored is determined based on the external connection confirmation result and the identification tags. The intranet detection module is used to construct an SCTP protocol INIT message based on the device under test and its corresponding identification identifier; and to send the SCTP protocol INIT message to the device under test according to its IP address and preset detection period. The device under test is used to receive and analyze SCTP protocol INIT messages to obtain response information.
[0013] Thirdly, embodiments of this application provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it performs the steps of a communication network device external connection detection method as described in any of the above embodiments.
[0014] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of a communication network device external connection detection method as described in any of the above embodiments.
[0015] In summary, compared with the prior art, the beneficial effects of the technical solution provided in this application include at least the following: This application provides a method for detecting external connections of communication network devices. It can send SCTP protocol INIT messages to the device under test via an internal network detection module. When the external connection monitoring module receives a response, it can determine that the device under test is an unauthorized external connection device, thus achieving efficient detection of telecommunications-specific devices connecting to external networks. Furthermore, compared to using ports, the SCTP protocol transmits more comprehensive information, enabling identification to be completed with a single data packet transmission, significantly reducing the probability of false alarms and improving identification accuracy and efficiency. Attached Figure Description
[0016] Figure 1 This is a flowchart of an external connection detection method for a communication network device provided as an exemplary embodiment of this application.
[0017] Figure 2 This is a structural diagram of an external detection device for a communication network device provided as an exemplary embodiment of this application. Detailed Implementation
[0018] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.
[0019] Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of this application.
[0020] Please see Figure 1 This application provides a method for detecting external connections of a communication network device, which specifically includes the following steps: Step S1: The external monitoring module obtains the IP addresses of each device to be monitored in the internal network and obtains multiple identification tags based on the IP addresses.
[0021] In some embodiments, the external monitoring module obtains the IP addresses of each device to be monitored in the internal network, and obtains multiple identification identifiers based on the IP addresses, including: The external monitoring module obtains the IP addresses of each device under test in the internal network through manual input, ARP protocol packet detection, or ICMP packet detection, and obtains multiple identification tags based on the IP addresses.
[0022] In some embodiments, the identifier is any number between 1 and 65535 or an IP address.
[0023] In some embodiments, the identification identifier is located at the source port of the INIT message, or the identification identifier is located in the Initiate Tag field of the INIT message.
[0024] In one feasible implementation, the external monitoring module's detection end obtains the IP addresses of all devices in the internal network through manual input, ARP protocol packet monitoring, ICMP packet monitoring, or other network device discovery methods. After obtaining the internal network detection module, it assigns it a unique identification identifier; the identification identifier can be a number between 1 and 65535, an IP address, or a variation thereof, used to identify the unique device to be monitored.
[0025] The external monitoring module employs multiple methods—manual input, ARP packet detection, and ICMP packet detection—to acquire the IP addresses of each device under test within the internal network, ensuring comprehensive device discovery. Multiple unique identifiers are derived from the IP addresses, further enhancing the flexibility and uniqueness of device identification. These identifiers are located in the source port or Initial Tag field of the INIT message, enabling accurate identification and tracking of each device under test during communication. This improves the efficiency and accuracy of external monitoring, significantly simplifies network device management processes, reduces the risk of manual configuration errors, and strengthens the security capabilities of the internal network.
[0026] Step S2: The intranet detection module constructs an SCTP protocol INIT message based on the device to be detected and its corresponding identification identifier.
[0027] In some embodiments, the IP address of the SCTP protocol INIT message is the IP address of a network detection device or multiple network monitoring devices set up in an external network.
[0028] In one feasible implementation, the intranet detection module constructs an SCTP protocol INIT message based on the telecommunications device to be detected. The IP address of the SCTP protocol INIT message is the IP address of one or more network monitoring devices placed in other external networks. The SCTP protocol INIT message must contain the unique identifier of the device to be detected. The location used in this application can be one of the following two (or other fields that can carry the unique identifier of the device to be detected, which are not specifically limited in this application).
[0029] First, the source port of the INIT message can be modified to the identifier of the device to be monitored (8 bits, which can be set to a number from 1 to 65535), allowing the external monitoring module to listen to the port and determine unauthorized external devices. Second, the Initiate Tag field of the INIT message (32 bits long, which can be set to a unique identifier such as an IP address or a variant of an IP address) can be modified, allowing the external monitoring module to listen to the Verification Tag field in the SCTP protocol for uniqueness verification.
[0030] The internal network detection module can proactively construct standardized SCTP protocol INIT messages based on the device under test and its corresponding unique identifier. By setting the destination IP address of the INIT message to one or more network monitoring devices located on an external network, a communication link is effectively established from the internal device under test to the external monitoring node. This application embeds the unique identifier of the device under test into the source port field or Initiate Tag field of the INIT message, realizing device identification and traceability without changing the basic protocol interaction process. This greatly improves the initiative and accuracy of network boundary security monitoring, providing a reliable technical foundation for network monitoring.
[0031] Step S3: The intranet detection module sends an SCTP protocol INIT message to the device under test based on the IP address of the device under test and the preset detection period.
[0032] The internal network detection module can accurately target devices based on their IP addresses and automatically initiate detection processes according to preset detection cycles, achieving continuous and regular proactive monitoring of external connection behavior. By periodically sending SCTP INIT messages carrying unique identifiers to devices with specified IP addresses, it can effectively detect whether devices are engaging in unauthorized network access. The introduction of preset detection cycles makes the monitoring process more systematic, allowing users to flexibly adjust the detection frequency according to actual security policies. While ensuring real-time monitoring, it optimizes system resources, thereby significantly improving the ability to detect covert external connections, enhancing the internal network's early warning level against external threats, and providing a stable and reliable automated method for network security management.
[0033] Step S4: The device under test receives and analyzes the SCTP protocol INIT message to obtain response information.
[0034] In some embodiments, the response information includes an INITACK message or an ABORT message.
[0035] In one feasible implementation, after receiving the SCTP protocol INIT message, the telecommunications device under test will respond with either a INITACK message or an ABORT message based on whether the Initiate Tag field is 0. If the telecommunications device under test is connected to an external monitoring module, the external monitoring module will receive the INITACK message. Based on the identifier or INIT message in the received SCTP protocol INITACK message, the module can determine that the message originates from a specific, unique device under test. The INITACK message detects the unique identifier of the device under test. This application can use one of the following two locations (or other fields that can carry the unique identifier of the device under test; this application is not specifically limited to these).
[0036] The first function is to detect the target port of the INITACK or ABORT message, i.e., the identifier of the device to be detected (8 bits, number 1-65535), which is used to identify the specific unauthorized external device. The second function is to detect the Verification Tag (32 bits) of the INITACK message, which is also used to identify the specific unauthorized external device.
[0037] The above process effectively utilizes the interactive nature of the standard protocol, transforming the device's own response into monitorable information, which greatly enhances the authenticity and reliability of external behavior determination, improves judgment accuracy, and reduces the probability of misjudgment.
[0038] Step S5: If the external monitoring module receives a response, the external connection confirmation result is obtained.
[0039] In some embodiments, if the external connection monitoring module receives a response message, it obtains an external connection confirmation result, including: If the external monitoring module receives an INITACK message, it will detect the identification mark of the INITACK message to obtain the external connection confirmation result; Alternatively, if the external monitoring module receives an INITACK message, it checks the VerificationTag of the INITACK message to obtain the external connection confirmation result.
[0040] Specifically, by parsing and verifying the INITACK message received by the external connection monitoring module, the actual external connection behavior of the internal network device can be proactively identified; by detecting the identification identifier carried in the INITACK message or verifying its Verification Tag field, the response information is accurately matched, and the interaction response at the protocol layer is directly associated with the specific device to be detected that initiated the external connection attempt, effectively avoiding false positives and false negatives.
[0041] Step S6: The external monitoring module determines the device to be tested based on the external connection determination results and identification marks.
[0042] In some feasible implementations, the external monitoring module identifies a unique device that has breached network isolation and reports this unique identifier to the management terminal of the external monitoring module. The management terminal then sends an alert to relevant personnel, including the time, the received IP address, and the unique identifier of the internal network device. Subsequently, relevant personnel can use this alert information to locate the corresponding telecommunications device and conduct investigations to prevent potential network security risks.
[0043] The communication network device external connection detection method provided in the above embodiments can send SCTP protocol INIT messages to the device under test through the internal network detection module. When the external connection monitoring module receives the response information, it can determine that the device under test is an unauthorized external connection device, realizing efficient detection of telecommunications dedicated equipment connecting to external networks. Moreover, compared with using ports, the information transmitted by using the SCTP protocol is more comprehensive, and identification can be completed by sending a data packet at once, which greatly reduces the probability of false alarms and improves the identification accuracy and efficiency.
[0044] In some feasible implementations, this application can be deployed in an office network environment. In enterprise network security monitoring, the external connection monitoring module scans the internal network to obtain the IP addresses of various office computers and servers, and obtains corresponding identification tags based on the IP addresses. The internal network detection module constructs corresponding messages based on each office computer, server, and identification tag, and sends the corresponding messages to each office computer and server to be monitored according to a preset detection cycle. Based on the obtained external connection determination results and identification tags, it determines the office computer or server that actually made the external connection. This application can further realize real-time monitoring of unauthorized external connection behavior in the office network, improving the enterprise's information security protection capabilities.
[0045] In some feasible implementations, this application can be applied to management scenarios for various IoT devices. Through a data transmission and reception process similar to the above embodiments, each IoT device and its corresponding identification tag are acquired, thereby completing monitoring. This achieves the integration of this application into the IoT management environment, enabling efficient management of a large number of IoT devices and ensuring the reliable operation of the IoT system.
[0046] In some feasible implementations, this application can be applied to data center operation and maintenance scenarios. By using a data transmission and reception process similar to the above embodiments, the identification identifiers corresponding to each network device and each server within the data center can be obtained, further completing the monitoring; it can achieve deep integration with data center operation and maintenance, and detect abnormal network behavior more promptly, ensuring the secure operation of the data center.
[0047] In some feasible implementations, this application can be applied to cloud computing environments. By using a data transmission and reception process similar to the above embodiments, the IP addresses and identification identifiers of each virtual machine in the cloud computing environment are obtained, thereby completing the monitoring operation; this helps cloud service providers to monitor each virtual machine in the environment in real time, enhances the controllability of the cloud computing environment, and ensures the security of the computing process in the cloud computing environment.
[0048] Please see Figure 2 Another embodiment of this application provides a communication network device external connection detection device, the device comprising: The external monitoring module is used to obtain the IP addresses of each device to be monitored in the internal network and obtain multiple identification tags based on the IP addresses; if a response message is received, the external connection determination result is obtained; and the device to be monitored is determined based on the external connection determination result and the identification tags.
[0049] The intranet detection module is used to construct an SCTP protocol INIT message based on the device under test and its corresponding identification identifier; and to send the SCTP protocol INIT message to the device under test according to its IP address and preset detection period.
[0050] The device under test is used to receive and analyze SCTP protocol INIT messages to obtain response information.
[0051] The specific limitations of the communication network device external connection detection device provided in this embodiment can be found in the embodiment of the communication network device external connection detection method described above, and will not be repeated here. Each module in the above-described communication network device external connection detection device can be implemented entirely or partially through software, hardware, or a combination thereof. Each module can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.
[0052] This application provides a computer device that may include a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it causes the processor to perform the steps of a communication network device external connection detection method as described in any of the above embodiments.
[0053] The working process, working details, and technical effects of the computer device provided in this embodiment can be found in the embodiment of an external detection method for a communication network device described above, and will not be repeated here.
[0054] This application provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the steps of a communication network device external connection detection method as described in any of the above embodiments. The computer-readable storage medium refers to a data storage medium, which may include, but is not limited to, floppy disks, optical disks, hard disks, flash memory, USB flash drives, and / or Memory Sticks. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
[0055] The working process, working details, and technical effects of the computer-readable storage medium provided in this embodiment can be found in the embodiment of an external detection method for a communication network device described above, and will not be repeated here.
[0056] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.
[0057] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0058] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.
Claims
1. A method for external connection detection of communication network equipment, characterized in that, The method includes: The external monitoring module obtains the IP addresses of each device to be monitored in the internal network and generates multiple identification tags based on the IP addresses. The intranet detection module constructs an SCTP protocol INIT message based on the device to be detected and its corresponding identification identifier; The intranet detection module sends the SCTP protocol INIT message to the device under test based on the IP address of the device under test and the preset detection period; The device under test receives and analyzes the SCTP protocol INIT message to obtain response information; If the external monitoring module receives the response information, it obtains an external connection confirmation result; The external monitoring module determines the device to be tested based on the external connection determination result and the identification mark.
2. The external connection detection method for communication network equipment according to claim 1, characterized in that, The external monitoring module acquires the IP addresses of each device to be monitored in the internal network, and obtains multiple identification identifiers based on the IP addresses, including: The external monitoring module obtains the IP addresses of each device to be monitored in the internal network through manual input, ARP protocol packet detection, or ICMP packet detection, and obtains multiple identification tags based on the IP addresses.
3. The external connection detection method for communication network equipment according to claim 2, characterized in that, The identification identifier is any number between 1 and 65535 or an IP address.
4. The external connection detection method for communication network equipment according to claim 3, characterized in that, The IP address of the SCTP protocol INIT message is the IP address of a network detection device or multiple network monitoring devices set up in an external network.
5. The method for external connection detection of communication network equipment according to claim 1, characterized in that, The identification identifier is located at the source port of the INIT message, or the identification identifier is located in the Initiate Tag field of the INIT message.
6. The external connection detection method for communication network equipment according to claim 1, characterized in that, The response information includes an INITACK message or an ABORT message.
7. The external connection detection method for communication network equipment according to claim 6, characterized in that, If the external monitoring module receives the response information, it obtains an external connection confirmation result, including: If the external monitoring module receives an INITACK message, it detects the identification mark of the INITACK message to obtain the external connection confirmation result. Alternatively, if the external connection monitoring module receives an INITACK message, it checks the Verification Tag of the INITACK message to obtain an external connection confirmation result.
8. An external detection device for communication network equipment, characterized in that, The device includes: The external monitoring module is used to obtain the IP addresses of each device to be monitored in the internal network, and obtain multiple identification identifiers based on the IP addresses; if the response information is received, an external connection determination result is obtained; and the device to be monitored is determined based on the external connection determination result and the identification identifiers. The intranet detection module is used to construct an SCTP protocol INIT message based on the device under test and its corresponding identification identifier; and to send the SCTP protocol INIT message to the device under test according to its IP address and a preset detection period. The device under test is used to receive and analyze the SCTP protocol INIT message to obtain response information.
9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the communication network device external connection detection method as described in any one of claims 1 to 7.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the communication network device external connection detection method as described in any one of claims 1 to 7.