Access mode detection method, apparatus, device, system and medium

Abstract

The present application relates to the technical field of communications. Disclosed are an access mode detection method, an apparatus, a device, a system and a medium. The method comprises: acquiring data features of data transmitted by an access device, the data features indicating features of a terminal device transmitting the data, the terminal device being connected to the access device, and the data features comprising at least one of a packet feature, a flow behavior feature, a network feature, or a device physical feature; and determining an access mode of the terminal device on the basis of the data features. The data features of the data transmitted by the access device of an access layer are acquired, such that the access mode can be detected when the data reaches the access layer, and compared with centralized unauthorized-access prevention methods, the detection of data reaching the access layer but not reaching a core layer can be compensated, thus achieving more timely and more comprehensive detection of access modes. Moreover, the types of acquired data features are various, such that the probability of detecting unauthorized-access terminal devices is higher, thus improving the detection accuracy of access modes.

Description

Access mode detection method, device, equipment, system and medium

[0001] This application claims priority to Chinese patent application No. 202410129645.9 filed on January 29, 2024, entitled “Access mode detection method, device, equipment, system and medium”, the entire contents of which are incorporated herein by reference. Technical Field

[0002] The present application relates to the field of communication technology, and in particular to a method, apparatus, device, system and medium for detecting an access mode. Background Art

[0003] In the field of communications technology, terminal devices within campus networks must undergo authorized authentication before accessing the network. However, private connections are widespread, making campus network management difficult. Private connections refer to unauthorized access to the network. For example, privately connecting multiple terminal devices to a router can create network insecurity risks. Privately connecting multiple terminal devices to a shared wireless network can lead to unauthorized network access. Furthermore, privately connecting a hub to expand network ports can create network loops and even render the network unavailable.

[0004] In related technologies, a centralized anti-illegal connection method mirrors traffic from core switches to an illegal connection detection engine. The illegal connection detection engine analyzes the mirrored traffic and detects illegally connected terminal devices based on the analysis results. When an illegally connected terminal device is detected, an access control list (ACL) is sent to the core switch, causing the core switch to block the terminal device according to the ACL.

[0005] In the centralized anti-private connection method, traffic needs to reach the core layer switch before it can be detected, and the traffic needs to be mirrored from the core layer switch to the private connection detection engine for further detection. This leads to problems of delayed detection and poor security performance.

[0006] Summary of the Invention

[0007] The present application provides an access mode detection method, apparatus, device, system and medium for detecting the access mode of a terminal device connected to a network.

[0008] In a first aspect, the present application provides a method for detecting an access mode. The method comprises: collecting data characteristics of data transmitted by an access device, the data characteristics indicating characteristics of a terminal device transmitting the data, the terminal device being connected to the access device, the data characteristics including at least one of message characteristics, traffic behavior characteristics, network characteristics, or device physical characteristics; and determining the access mode of the terminal device based on the data characteristics.

[0009] Because this method collects data characteristics from access devices at the access layer, access mode detection can be performed as soon as the data reaches the access layer. Compared to centralized anti-illegal connection methods in related technologies, this method can compensate for the detection of data that reaches the access layer but not the core layer, making access mode detection more timely and comprehensive. Furthermore, the access layer can collect a wider variety of data characteristics, increasing the probability of detecting unauthorized terminal devices and improving the accuracy of access mode detection.

[0010] In one possible implementation, the data features include multiple message features; determining the access mode of the terminal device based on the data features may include identifying an operating system associated with an access port of the terminal device based on the multiple message features; and determining that the access mode of the terminal device is a private connection if the operating systems associated with the access ports are different. The access port of the terminal device is a port on the access device to which the terminal device is connected.

[0011] This method uses packet characteristics to identify the operating system associated with the access port. Different operating systems indicate that multiple operating systems are connected to the network through the access port. Multiple operating systems represent multiple independently running user programs, indicating that the access port is shared by multiple users. If the access method is non-private connection, each port on the access device corresponds to one operating system. Therefore, by identifying different operating systems, it is possible to quickly and accurately detect that the terminal device's access method is private connection.

[0012] In one possible implementation, identifying the operating system under the access port of a terminal device based on multiple message features may include identifying the address information under the access port of the terminal device based on multiple message features; when the address information under the access port is the same, identifying the operating system under the access port of the terminal device based on multiple message features; the method also includes determining that the access mode of the terminal device is a private connection when the address information under the access port is different.

[0013] In this method, the address information under the access port is first identified through message characteristics. Different address information indicates that multiple user terminals with different addresses have accessed the network through this access port. When the access method is non-private connection, one port of the access device corresponds to one user terminal. Therefore, by identifying different address information, it is possible to quickly and accurately detect that the terminal device's access method is private connection. When the address information is the same, there may be two situations. In the first case, the access method of the terminal device connected to the access port is non-private connection. In the second case, multiple user terminals disguise themselves as the same address information for data transmission. Then, when it is determined that the address information is the same, private connection detection is further performed by identifying the operating system to ensure the accuracy of private connection detection.

[0014] In one possible implementation, the data feature includes a flow behavior feature; determining the access mode of the terminal device based on the data feature may include obtaining a deviation distance between the flow behavior feature and a reference feature, the reference feature being a flow behavior feature of data transmitted by a terminal device whose access mode is non-private connection; when the deviation distance is greater than a deviation threshold, determining that the access mode of the terminal device is private connection.

[0015] Because the traffic behavior characteristics of data transmitted by non-privately connected terminal devices differ from those of data transmitted by privately connected terminal devices, for example, a terminal device with a non-privately connected access mode corresponds to a single terminal, while a terminal device with a privately connected access mode corresponds to multiple terminals, the traffic behavior characteristics of data transmitted by a single terminal device differ from those of data transmitted by multiple terminal devices. Therefore, by comparing the deviation between the collected traffic behavior characteristics of data transmitted by the terminal device and the traffic behavior characteristics of data transmitted by non-privately connected terminal devices, it is possible to quickly and accurately detect that the terminal device's access mode is privately connected.

[0016] In one possible implementation, the data features include at least one of network features or device physical features; determining the access mode of the terminal device based on the data features may include identifying the type of the terminal device based on at least one of the network features or device physical features; and when the terminal device is a router or a hub, determining that the access mode of the terminal device is a private connection.

[0017] A router or hub is a device used to connect multiple terminals. Since the terminal device connected to the access device corresponds to a single terminal when the access method is non-private, identifying the router or hub allows for quick and accurate detection of a private connection. Furthermore, upon detecting a private connection, the system can also determine whether the private connection is to a router or a hub, making private connection detection more accurate. This private connection type can also aid in subsequent efforts to block private connections.

[0018] In one possible implementation, after determining the terminal device's access method based on data characteristics, if the terminal device's access method is private, data transmission from the terminal device can be blocked. This prevents network security issues caused by privately connected terminal devices and facilitates network management and maintenance. Alternatively, the access device can directly block data transmission from the terminal device, or it can send private connection information to the management device, which then blocks data transmission based on the private connection information. This provides two blocking paths, making the blocking method more flexible. Blocking by the access device can save management device overhead, while blocking by the management device can reduce the amount of data processed by the access device.

[0019] In one possible implementation, methods for blocking a terminal device from transmitting data include, but are not limited to: shutting down the terminal device's access port so that the access port no longer receives data; adding the terminal device's address information to a blacklist, which blocks data transmission from the terminal device corresponding to the blacklisted address information so that the access device no longer forwards data containing the address information; or logging off an online user on the terminal device so that the terminal device is disconnected from the network, preventing the terminal device from sending data to the access device. These three methods of blocking terminal device data transmission are provided, allowing for flexible selection of different blocking methods based on different scenarios.

[0020] In one possible implementation, the data transmitted by the access device flows from the terminal side to the network side. That is, the collected data flows in the uplink direction from the terminal side to the network side. This allows the method to accurately detect private connection based on uplink data, avoiding misjudgments caused by detecting downlink data, and improving the accuracy of private connection detection.

[0021] In one possible implementation, before collecting data features of data transmitted by the access device, a private connection detection configuration command is received from the management device. This private connection detection configuration command is then used to trigger the collection of data features of the data transmitted by the access device. In this approach, the private connection detection configuration command can flexibly trigger the collection of data features, i.e., trigger private connection detection. Furthermore, different private connection detection configuration commands can be set based on different user needs, making the implementation of private connection detection more tailored to user needs.

[0022] In one possible implementation, data features of data transmitted by an access device can be collected during transmission (i.e., in-stream collection); or by first copying the data transmitted by the access device to obtain copied data, and then collecting data features of the copied data. This provides two data feature collection methods, making data feature collection more flexible. In-stream collection can improve data feature collection efficiency, while copying data collection can avoid affecting data transmission.

[0023] In one possible implementation, the access device is the first-hop forwarding device for data sent by the terminal device, meaning the terminal device is directly connected to the access device. In this approach, the access device is located at the network edge, close to the terminal. By performing unauthorized connection detection at the network edge, all data entering the network can be detected, improving comprehensiveness and network security. Furthermore, data transmitted at the network edge is not forwarded by network devices, preserving more characteristics indicative of the terminal device. Consequently, data collected from data transmitted at the network edge is more comprehensive.

[0024] In a second aspect, the present application provides another access mode detection method, which includes: receiving private connection information of a terminal device sent by an access device, the private connection information indicating that the access mode of the terminal device is private connection; and issuing private connection alarm information.

[0025] In this method, when a terminal device is privately connected, private connection alarm information can be issued in time, so that the user can handle the privately connected terminal device in time, thereby improving the security of the network.

[0026] In a possible implementation, after receiving the private connection information of the terminal device sent by the access device, the terminal device may be blocked from transmitting data, thereby avoiding network security issues caused by the privately connected terminal device and ensuring the security of data in the network.

[0027] In one possible implementation, methods for blocking data transmission from a terminal device include, but are not limited to: sending a shutdown command to the access device, where the shutdown command is used by the access device to shut down the terminal device's access port; sending a blacklist to the access device, where the blacklist includes the address information of the terminal device, where the access device blocks data transmission from the terminal device corresponding to the address information in the blacklist; or sending a logoff command to the access device, where the access device logs off an online user on the terminal device. This method provides three blocking methods, allowing for flexible selection of the appropriate blocking method based on different scenarios.

[0028] In one possible implementation, after receiving the private connection information of the terminal device sent by the access device, the method further includes: visually displaying the private connection information of the terminal device, where the private connection information includes at least one of a MAC (media access control) address, an Internet Protocol (IP) address, an access port, an access time, a private connection type, or a reason for determining the private connection. In this manner, the private connection information is visually displayed, allowing a user to clearly and intuitively see the private connection status, facilitating network operation and maintenance management.

[0029] In one possible implementation, before receiving the private connection information of the terminal device sent by the access device, a private connection detection configuration command is also sent to the access device, so that the access device triggers the collection of data characteristics of the data transmitted by the access device based on the private connection detection configuration command, and determines the access mode of the terminal device based on the data characteristics.

[0030] In a third aspect, a device for detecting an access mode is provided, the device comprising:

[0031] a collection module, configured to collect data characteristics of data transmitted by the access device, the data characteristics indicating characteristics of a terminal device transmitting the data, the terminal device being connected to the access device, the data characteristics including at least one of a message characteristic, a traffic behavior characteristic, a network characteristic, or a device physical characteristic;

[0032] The determination module is used to determine the access mode of the terminal device based on the data characteristics.

[0033] In one possible implementation, the data features include multiple message features; a determination module is used to identify the operating system under the access port of the terminal device based on the multiple message features; when the operating systems under the access ports are different, determine that the access mode of the terminal device is a private connection.

[0034] In one possible implementation, the determination module is configured to identify address information of an access port of a terminal device based on multiple message features; if the address information of the access ports is the same, identify an operating system of the access port of the terminal device based on the multiple message features;

[0035] The determination module is further configured to determine that the access mode of the terminal device is a private connection when the address information under the access port is different.

[0036] In one possible implementation, the data feature includes a flow behavior feature; a determination module is used to obtain a deviation distance between the flow behavior feature and a reference feature, where the reference feature is a flow behavior feature of data transmitted by a terminal device whose access method is non-private connection; when the deviation distance is greater than a deviation threshold, it is determined that the access method of the terminal device is private connection.

[0037] In one possible implementation, the data features include at least one of network features or device physical features; a determination module is used to identify the type of the terminal device based on at least one of the network features or device physical features; and when the terminal device is a router or a hub, the access mode of the terminal device is determined to be a private connection.

[0038] In one possible implementation, the apparatus further includes: a blocking module configured to block the terminal device from transmitting data when the terminal device access mode is a private connection. Alternatively, the apparatus further includes: a sending module configured to send private connection information of the terminal device to the management device when the terminal device access mode is a private connection, the private connection information being used by the management device to block the terminal device from transmitting data.

[0039] In one possible implementation, the blocking module is used to close the access port of the terminal device; or, add the address information of the terminal device to a blacklist, and the blacklist is used to block the terminal device corresponding to the address information in the blacklist from transmitting data; or, take the user who is online on the terminal device offline.

[0040] In a possible implementation, the data transmitted by the access device is data flowing from the terminal side to the network side.

[0041] In a possible implementation, the apparatus further includes: a receiving module configured to receive a private connection detection configuration command sent by the management device; in this case, the collecting module is configured to collect data features of data transmitted by the access device based on the private connection detection configuration command.

[0042] In a possible implementation, the apparatus further includes: a copy module configured to copy data transmitted from the access device to obtain copied data; in this case, a collection module configured to collect data features of the copied data.

[0043] In a possible implementation, the access device is a first-hop forwarding device for data sent by the terminal device.

[0044] In a fourth aspect, a detection device for another access mode is provided, the device comprising:

[0045] a receiving module, configured to receive private connection information of a terminal device sent by an access device, wherein the private connection information indicates that the access mode of the terminal device is private connection;

[0046] The alarm module is used to issue private connection alarm information.

[0047] In a possible implementation, the apparatus further includes: a blocking module, configured to block the terminal device from transmitting data.

[0048] In one possible implementation, the blocking module is used to send a shutdown instruction to the access device, the shutdown instruction is used by the access device to shut down the access port of the terminal device; or, to send a blacklist to the access device, the blacklist includes the address information of the terminal device, the blacklist is used by the access device to block the terminal device corresponding to the address information in the blacklist from transmitting data; or, to send an offline instruction to the access device, the offline instruction is used by the access device to take the user who is online on the terminal device offline.

[0049] In a possible implementation, the device further includes: a visualization display module for visually displaying private connection information of the terminal device, the private connection information including at least one of MAC address, IP address, access port, access time, private connection type, or private connection determination reason.

[0050] In a possible implementation, the apparatus further includes: a sending module configured to send a private connection detection configuration command to the access device, the private connection detection configuration command being used by the access device to collect data features of data transmitted by the access device and determine an access mode of the terminal device based on the data features.

[0051] In a fifth aspect, a device for detecting an access method is provided, the device comprising a memory and a processor; at least one computer instruction is stored in the memory, and at least one computer instruction is loaded and executed by the processor, so that the device for detecting the access method implements the above-mentioned first aspect or the access method detection method in any possible implementation of the first aspect, or so that the device for detecting the access method implements the above-mentioned second aspect or the access method detection method in any possible implementation of the second aspect.

[0052] In the sixth aspect, a system for detecting an access method is provided, which includes an access device and a management device. The access device is used to execute the access method detection method in the above-mentioned first aspect or any possible implementation of the first aspect, and the management device is used to execute the access method detection method in the above-mentioned second aspect or any possible implementation of the second aspect.

[0053] In a seventh aspect, a computer-readable storage medium is provided, in which at least one instruction is stored. The instruction is loaded and executed by a processor to enable a computer to implement the access mode detection method in the above aspects.

[0054] In an eighth aspect, a computer program (product) is provided. When the computer program is executed by a computer, the processor or computer can execute the access mode detection method in the above aspects.

[0055] In a ninth aspect, a chip is provided, comprising a processor for calling and executing instructions stored in a memory, so that a computer equipped with the chip executes the access mode detection method in the above aspects.

[0056] In the tenth aspect, another chip is provided, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected through an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the computer equipped with the chip executes the access mode detection method in the above aspects.

[0057] It should be understood that the beneficial effects achieved by the technical solutions of aspects 3 to 10 of this application and their corresponding possible implementations can be referenced to the technical effects of aspects 1 and 2 and their corresponding possible implementations, and will not be repeated here. In addition, the access mode detection device mentioned in the third or fourth aspect may be the chip mentioned in the ninth or tenth aspect, or the access mode detection device may also be the device mentioned in the fifth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] FIG1 is a schematic diagram of a campus network connection structure provided by an embodiment of the present application;

[0059] FIG2 is a schematic diagram of a network connection scenario corresponding to a related technology provided in an embodiment of the present application;

[0060] FIG3 is a flow chart of a method for detecting an access mode provided in an embodiment of the present application;

[0061] FIG4 is a schematic diagram of a detection scenario of an access method provided in an embodiment of the present application;

[0062] FIG5 is an interactive diagram of a method for detecting an access mode provided in an embodiment of the present application;

[0063] FIG6 is a schematic diagram of a detection scenario of another access method provided in an embodiment of the present application;

[0064] FIG7 is a schematic diagram of a detection scenario of another access method provided in an embodiment of the present application;

[0065] FIG8 is a schematic structural diagram of a detection device for an access mode provided in an embodiment of the present application;

[0066] FIG9 is a schematic structural diagram of a detection device for another access mode provided in an embodiment of the present application;

[0067] FIG10 is a schematic diagram of the structure of a network device provided in an embodiment of the present application;

[0068] FIG11 is a schematic diagram of the structure of another network device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0069] In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0070] In the field of communications technology, private connections within campus networks are becoming increasingly common. These connections can disrupt the normal operation of campus networks and complicate network management. These include, but are not limited to, connecting multiple devices to the network through private routers, exploiting shared wireless networks to privately access and unauthorized use, and expanding the number of network ports through private hubs.

[0071] Referring to Figure 1, a schematic diagram of a campus network connection structure, terminal devices 105 within the campus network connect to an external network 101 via access layer switches 104, aggregation layer switches 103, and core layer switches 102. Core layer switches 102 are responsible for routing and high-speed forwarding, providing an optimized and reliable backbone transmission structure. Aggregation layer switches 103 are the aggregation point for multiple access layer switches 104, enabling data forwarding between the access and core layers. Access layer switches 104 connect terminal devices 105 to the network and feature low cost and high port density.

[0072] For example, Figure 1 shows the following three types of private connection. In the first, the privately connected terminal device 105 is a hub 1051. Hub 1051 is connected to multiple privately connected terminals 106, potentially causing network loops and even network unavailability. A network loop occurs when data is continuously forwarded in a loop within a network path instead of being correctly sent to its destination. This consumes a significant amount of network resources, leading to degraded network performance or even network failure. For example, privately connected terminals 106 include, but are not limited to, mobile phones, tablets, desktop computers, printers, or projectors.

[0073] In the second case, the privately connected terminal device 1052 wirelessly shares the network with other privately connected terminals 106. In the third case, the privately connected terminal device 105 is a router 1053. For the second and third private connection methods, sharing the network and connecting to the router 1053 will cause users to use the network through the shared network or the router 1053 without authorization, affecting the security of data in the campus network. In addition, for the third private connection method, if the router 1053 is connected to an access point (AP) via a wireless network (not shown in Figure 1), the signal sent by the router 1053 will interfere with the wireless connection between the AP and other terminal devices 105, thereby reducing the user's network experience. Among them, the AP is an access layer switch 104, which can also be called a wireless access point.

[0074] The above-mentioned illegal connection phenomenon poses a threat to the stability and security of the campus network. Therefore, a method is needed to identify illegal terminal devices in the network, so as to control illegal terminal devices and maintain the normal operation of the network.

[0075] In the related art, referring to FIG2 , the core switch 102 is connected to the private connection detection device 301 and the management device 302. The administrator configures traffic mirroring on the core switch 102 through the management device 302, specifically configuring the mirroring standards for the data on the core switch 102, such as the mirrored location and the amount of mirrored data. The management device 302 sends an enable command to the private connection detection device 301, controlling the private connection detection device 301 to start operation. The core switch 102 then mirrors the transmitted data to the private connection detection device 301. The private connection detection device 301 performs private connection detection on the mirrored data based on the source IP address, determines the private connection information of the privately connected terminal device, and synchronizes this private connection information to the management device 302. Users can view the private connection information through the management device 302 and configure blocking of the private connection based on the private connection information. For example, the management device 302 issues a blocking ACL to the core switch 102, which then blocks data transmission from the privately connected terminal device based on the blocking ACL.

[0076] However, related technology requires traffic to reach the core layer switch 102 before detection can be performed. For data that does not reach the core layer switch 102, for example, data sent by any terminal device 105 and forwarded to another terminal device 105 via the access layer switch 104, the aggregation layer switch 103, and the access layer switch 104, it is impossible to detect unauthorized connections, making it difficult to ensure network security below the aggregation layer. Furthermore, traffic must be mirrored from the core layer switch 102 to the unauthorized connection detection device 301 for detection. This data mirroring process is time-consuming, resulting in delayed processing of unauthorized connections.

[0077] This embodiment of the present application provides a method for detecting an access mode. This method is described using an access device as an example. The access device may be an access layer switch, an access gateway, or an AP. For example, the access device may be access layer switch 104 shown in Figure 1. As shown in Figure 3, the method includes but is not limited to the following steps 501 and 502.

[0078] Step 501, collect data characteristics of data transmitted by the access device, the data characteristics indicate characteristics of the terminal device transmitting the data, the terminal device is connected to the access device, and the data characteristics include at least one of message characteristics, flow behavior characteristics, network characteristics or device physical characteristics.

[0079] In an embodiment of the present application, an access device is connected to a terminal device, and the access device can receive data sent by the terminal device to the network. Collecting data features of data transmitted by the access device includes collecting data features of data sent by the terminal device and received by the access device, and the data features can indicate features of the terminal device. Optionally, the feature types included in the data features are not limited in this embodiment of the application and can include at least one of message features, traffic behavior features, network features, or device physical features.

[0080] Among them, message features refer to features carried in the message of the transmitted data. Optionally, the message features include at least one of user agent (UA) information, transmission control protocol (TCP) / IP protocol stack fingerprint, or domain name service (DNS) domain name fingerprint. User agent (UA) information is an identifier that identifies the browser or other terminal-side application. By analyzing the UA information, information about the browser type, version, operating system, hardware, etc. on the terminal side can be determined. DNS domain name fingerprint is used to identify and confirm the identity information of the domain name by analyzing the characteristics of the DNS record. Different operating systems generate DNS records in different ways. The type and version of the operating system can be determined based on the generation method of the DNS record.

[0081] The TCP / IP protocol stack fingerprint is information that identifies the network protocol. By analyzing the TCP / IP protocol stack fingerprint, the protocol stack of the operating system can be determined. There are subtle differences between the protocol stacks of different operating systems, and these differences can be called the fingerprint of the network protocol stack. For the TCP / IP protocol suite, these differences are reflected in the flag fields of the data packet header, such as the different values ​​of the window size, acknowledgment (ACK) sequence number, and time to live (TTL). Therefore, the TCP / IP protocol stack fingerprint can be used to identify different operating systems using different protocol stacks.

[0082] The network feature refers to a feature carried during network transmission. Optionally, the network feature includes at least one of a link layer discovery protocol (LLDP) fingerprint and a media access control address organizationally unique identifier (MAC OUI) fingerprint.

[0083] LLDP fingerprinting is a standard protocol used to automatically identify terminal devices and their attributes. An LLDP fingerprint contains information such as the manufacturer, model, and description of the terminal device. By comparing this information with a database of known device manufacturers and models, the type and attributes of a terminal device, such as a hub or router, can be identified. A MAC OUI fingerprint is the OUI portion of a MAC address. A MAC address is a unique identifier for a network device and is assigned by the terminal device's manufacturer. By comparing this OUI portion with a database of known device manufacturers, the terminal device's type can be identified.

[0084] Traffic behavior characteristics refer to the characteristics exhibited by a data stream during transmission. Optionally, the traffic behavior characteristics include at least one of the transmission frequency or transmission interval of the data stream. Since there is a deviation between the traffic behavior of the data stream sent by a non-privately connected terminal device and the traffic behavior of the data stream sent by a privately connected terminal device, the traffic behavior characteristics can be used to identify the access method of the terminal device. In addition, the data sent by the terminal device received by the access device is not shaped and sorted, and the original sequence of the data sent by the terminal device is maintained, that is, the traffic behavior characteristics of the terminal device accessing the network are retained. Therefore, the traffic behavior characteristics of the data transmitted by the access device can indicate the characteristics of the terminal device.

[0085] Device physical characteristics refer to characteristics of signals transmitted by the device during data transmission. Optionally, the device physical characteristics include at least one of the slope of the transient signal amplitude of the data frame, the voltage, the mean of the voltage difference, the variance of the voltage difference, the kurtosis of the voltage difference, or the mean square value of the voltage difference. Different types of terminal devices have different device physical characteristics, and these characteristics can be used to identify different types of terminal devices.

[0086] In one possible implementation, methods for collecting data features of data transmitted by an access device include collecting data features during the data transmission process (i.e., in-stream collection); or first copying the data transmitted by the access device to obtain copied data, and then collecting data features of the copied data. Because the copied data is a complete copy of the original data and contains all the data content of the original data, collecting data features of the copied data is equivalent to collecting data features of the original data. This provides two data feature collection methods, making data feature collection more flexible. In-stream collection can improve data feature collection efficiency, while copying data collection can avoid affecting data transmission.

[0087] In this embodiment of the present application, the access device is the first-hop forwarding device for data sent by the terminal device, meaning the terminal device is directly connected to the access device. In this approach, the access device is located at the edge of the network, close to the terminal. By performing private connection detection at the network edge, private connection detection can be performed on all data entering the network, improving the comprehensiveness of private connection detection and network security. Furthermore, data transmitted at the network edge is not forwarded by network devices, retaining more characteristics indicative of the terminal device. Consequently, the data features collected based on data transmitted at the network edge are more comprehensive.

[0088] In a communications network, data can be transmitted bidirectionally between the terminal side and the network side. Data flowing from the terminal side to the network side is called uplink data, and data flowing from the network side to the terminal side is called downlink data. The transmitted data collected by the access device is data flowing from the terminal side to the network side, that is, the data flow direction of the collected data is the uplink direction from the terminal side to the network side. For example, the access device identifies uplink data based on the data flow direction and collects data characteristics of the transmitted uplink data; alternatively, the access device identifies the uplink port receiving uplink data based on the data flow direction and collects data characteristics of data received by the uplink port.

[0089] This method can accurately detect private connection issues on uplink data, avoiding misjudgments caused by detecting downlink data, and improving the accuracy of private connection detection. For example, it can avoid misjudgments on downlink data sent by a DNS server or server virtual machine.

[0090] In one possible implementation, the process of collecting data features of data transmitted by an access device includes collecting data features of the data transmitted by the access device based on an unauthorized connection detection configuration command. The unauthorized connection detection configuration command typically includes specific configuration information regarding how to perform unauthorized connection detection, such as which data features to collect, how to process and analyze the data, etc. The access device can perform corresponding data feature collection based on the unauthorized connection detection configuration command. For example, upon receiving the unauthorized connection detection configuration command, the access device begins collecting data features in accordance with the instructions of the unauthorized connection detection configuration command. Data feature collection may include traffic analysis, protocol parsing, and packet capture, with data collection depending on the requirements of the configuration command.

[0091] Step 502: Determine the access mode of the terminal device based on the data characteristics.

[0092] This application embodiment divides the access methods of terminal devices into two types: private connection and non-private connection. Private connection refers to accessing the network without authorization or in violation of network regulations, such as unauthorized device connection, malicious intrusion, etc. Non-private connection refers to accessing the network after authorization and authentication.

[0093] Since data characteristics may include at least one of message characteristics, flow behavior characteristics, network characteristics or device physical characteristics, when the data characteristics include different feature combinations, the implementation methods for determining the access method of the terminal device based on the data characteristics are also different, including but not limited to the following.

[0094] Method 1: data features include message features.

[0095] Optionally, the process of determining the access mode of a terminal device based on data features includes identifying the operating system under the access port of the terminal device based on multiple message features; when the operating systems under the access port are different, determining that the access mode of the terminal device is a private connection. The access port of the terminal device is the port on the access device that is connected to the terminal device. The operating system under the access port is identified by message features. Different operating systems indicate that there are multiple operating systems accessing the network through the access port. Multiple operating systems represent multiple independently running user programs, that is, there is a multi-user sharing phenomenon under the access port. When the access mode is non-private connection, one port of the access device corresponds to one operating system. Therefore, by identifying different operating systems, it is possible to quickly and accurately detect that the access mode of the terminal device is a private connection.

[0096] The message features include, but are not limited to, at least one of UA information, a TCP / IP protocol stack fingerprint, or a DNS domain name fingerprint, and can reflect the operating system information of the terminal device. Exemplarily, a method for identifying the operating system of the access port of the terminal device based on multiple message features includes matching multiple message features of data received at the access port of the terminal device with message features of known operating systems, and determining that the operating system that successfully matches is the operating system of the access port.

[0097] Optionally, determining the access mode of a terminal device based on data characteristics may include identifying address information under an access port of the terminal device based on multiple message characteristics; when the address information under the access port is the same, identifying the operating system under the access port of the terminal device based on multiple message characteristics; if the operating systems under the access ports are different, determining that the access mode of the terminal device is a private connection; when the address information under the access ports is different, directly determining that the access mode of the terminal device is a private connection.

[0098] The message characteristics also include the address information of the data sender, which includes at least one of an IP address and a MAC address. For example, for data received through an access port of a terminal device, if the address information of the sender of each data item is the same, the address information of the access ports is determined to be the same; if there is data with different sender address information, the address information of the access ports is determined to be different.

[0099] In this method, the address information under the access port is first identified through message characteristics. Different address information indicates that multiple user terminals with different addresses access the network through the access port. When the access method is non-private connection, one port of the access device corresponds to one user terminal. Therefore, by identifying different address information, it is possible to quickly and accurately detect that the access method of the terminal device is private connection. When the address information is the same, there may be two situations. In the first case, the access method of the terminal device connected to the access port is non-private connection. In the second case, multiple user terminals disguise themselves as the same address information for data transmission. Then, when it is determined that the address information is the same, private connection detection is further performed by identifying the operating system to ensure the accuracy of private connection detection. Among them, the user terminal can also be called a terminal device.

[0100] In the case of a hub privately connected to the network, since the hub cannot modify the address information of the terminal device accessing the network through the hub, the hub private connection can be quickly and easily identified by identifying the address information under the same access port. In actual applications, if the network allows the hub to privately connect to the network, you can choose to use a detection method that only identifies different operating systems. If the network does not allow the hub to privately connect to the network, you can choose to use a detection method that first identifies different address information and then identifies different operating systems to improve the efficiency of identifying private hubs.

[0101] Method 2: Data features include traffic behavior features.

[0102] Optionally, the process of determining the access mode of a terminal device based on data features includes obtaining a deviation distance between a traffic behavior feature and a reference feature, where the reference feature is a traffic behavior feature of data transmitted by a terminal device with a non-private access mode; and if the deviation distance is greater than a deviation threshold, determining that the access mode of the terminal device is a private access mode. The deviation threshold can be set based on experience or flexibly adjusted according to the application scenario, and is not limited in the embodiments of the present application.

[0103] Because the traffic behavior characteristics of data transmitted by non-privately connected terminal devices differ from those of data transmitted by privately connected terminal devices, for example, a terminal device with a non-privately connected access mode corresponds to a single terminal, while a terminal device with a privately connected access mode corresponds to multiple terminals, the traffic behavior characteristics of data transmitted by a single terminal device differ from those of data transmitted by multiple terminal devices. Therefore, by comparing the deviation between the collected traffic behavior characteristics of data transmitted by the terminal device and the traffic behavior characteristics of data transmitted by non-privately connected terminal devices, it is possible to quickly and accurately detect that the terminal device's access mode is privately connected.

[0104] Taking the example of a traffic behavior feature including a transmission frequency and a transmission interval, the transmission frequency and transmission interval of a non-private connection terminal device are used as the reference frequency and reference interval, and a first deviation distance between the transmission frequency in the collected data feature and the reference frequency, as well as a second deviation distance between the transmission interval in the collected data feature and the reference interval, is obtained; the deviation distance of the traffic behavior feature is determined based on the first deviation distance and the second deviation distance. Optionally, the average of the first deviation distance and the second deviation distance is determined as the deviation distance of the traffic behavior feature, or the larger of the first deviation distance and the second deviation distance is determined as the deviation distance of the traffic behavior feature. The deviation distance can be expressed as a percentage. For example, if the collected transmission interval is 1 second and the reference interval is 0.8 seconds, the deviation distance can be calculated as (1-0.8) / 0.8*100%=25%. If the deviation threshold is 20%, since the deviation distance of 25% is greater than the deviation threshold of 20%, the access mode of the terminal device is determined to be private connection.

[0105] Method three: the data characteristics include at least one of network characteristics or device physical characteristics.

[0106] Optionally, the process of determining the access mode of the terminal device based on data characteristics includes identifying the type of the terminal device based on at least one of network characteristics or device physical characteristics; when the terminal device is a router or a hub, determining that the access mode of the terminal device is a private connection.

[0107] A router or hub is a device used to connect multiple terminals. Since the terminal device connected to the access device corresponds to a single terminal when the access method is non-private, identifying the router or hub allows for quick and accurate detection of a private connection. Furthermore, upon detecting a private connection, the system can also determine whether the private connection is to a router or a hub, making private connection detection more accurate. This private connection type can also aid in subsequent efforts to block private connections.

[0108] Taking the example of network features including LLDP fingerprints and MAC OUI fingerprints, identifying the type of a terminal device based on network features includes matching the collected LLDP fingerprints and MAC OUI fingerprints with a first database, which includes a correspondence between the LLDP fingerprints and MAC OUI fingerprints and terminal types; and determining the type of the terminal device based on the matching results. Taking the example of device physical features including data frame transient signal amplitude, voltage, and pressure difference, identifying the type of a terminal device based on device physical features includes matching the collected data frame transient signal amplitude slope, voltage, and pressure difference with a second database, which includes a correspondence between the data frame transient signal amplitude slope, voltage, and pressure difference and terminal types; and determining the type of the terminal device based on the matching results.

[0109] Thus, through at least one of the above-mentioned methods 1 to 3, the access mode of the terminal device can be determined based on any one of the data features. Specifically, for any one of the data features mentioned in the above-mentioned embodiment, if the access mode of the terminal device is determined to be private connection based on any one or more of the features, then the access mode of the terminal device is private connection.

[0110] In the embodiment of the present application, the access mode can be determined based on any one or more features, and the process of determining the access mode based on any two features can be performed simultaneously or at different times. If not performed simultaneously, the two access mode determination processes can be performed in any order, for example, first determining the access mode based on the message features, and then determining the access mode based on the flow behavior features; or, first determining the access mode based on the flow behavior features, and then determining the access mode based on the message features. In addition, if the access mode is determined based on multiple features, the results of the access modes determined based on the multiple features can be mutually verified. If the access modes determined based on any of the collected features are all non-private connections, then the access mode of the terminal device is determined to be non-private connections.

[0111] If the access mode of the terminal device is determined to be private connection based on the above steps 501 and 502, the privately connected terminal device can be blocked, that is, the terminal device is blocked from transmitting data. Optionally, the access device sends a blocking instruction or blocking signal to block the data transmission of the terminal device.

[0112] In one possible implementation, methods for blocking a terminal device from transmitting data include, but are not limited to: shutting down the terminal device's access port so that the access port no longer receives data; adding the terminal device's address information to a blacklist, which blocks data transmission from the terminal device corresponding to the blacklisted address information so that the access device no longer forwards data containing the address information; or logging off an online user on the terminal device so that the terminal device is disconnected from the network, preventing the terminal device from sending data to the access device. These three methods of blocking terminal device data transmission are provided, allowing for flexible selection of different blocking methods based on different scenarios.

[0113] Among them, the blocking method of closing the access port of the terminal device can be called port shutdown. Adding the address information of the terminal device to the blacklist can be adding the MAC address of the terminal device to the blacklist. This blocking method can be called MAC blackhole, so that the terminal device corresponding to the MAC address will also be blocked due to the blacklist when accessing other ports of the access device. The blocking method of taking the online user on the terminal device offline can be called user authentication offline. The offline user must re-perform the online authentication operation to access the network.

[0114] In this embodiment, the blocking method can be determined based on the private connection type of the terminal device. For example, if the terminal device is privately connected to a router, the blocking method can be group port shutdown; if the terminal device is connected to a shared wireless network, the blocking method can be user authentication and logoff. This blocking method is for illustration only; the specific method selected can be determined based on user configuration.

[0115] For ease of understanding, the present embodiment provides an access mode detection scenario, as shown in Figure 4 . Figure 4 includes an administrator, an access device, and a terminal device. The access device includes a collection module, a perception module, and a processing module. The collection module, perception module, and processing module are merely examples. The specific implementation is not limited to these three modules and can be flexibly adjusted as needed.

[0116] As shown in Figure 4, in step 601, the administrator configures the private connection detection configuration command to the processing module of the access device. In step 602, the processing module controls the collection module to start collecting data features. In step 603, the terminal device sends data to the access device. In step 604, the collection module collects data features based on the data sent by the terminal device. In step 605, the collection module sends the data features to the perception module. In step 606, the perception module determines whether the access method of the terminal device is a private connection based on the data features. In step 607, the information of the privately connected terminal device is sent to the processing module. In step 608, the data sent by the terminal device is blocked. In step 609, the terminal device cannot connect to the network. In step 610, the processing module sends an alarm message to the administrator. In step 611, the administrator can view the private connection terminal information and blocking results through the access device.

[0117] In summary, the embodiments of the present application collect data features of data transmitted by access devices at the access layer, enabling access mode detection as soon as the data reaches the access layer. Compared to centralized anti-illegal connection methods in related technologies, this method can compensate for the detection of data that reaches the access layer but does not reach the core layer, making access mode detection more timely and comprehensive. Furthermore, the access layer can collect a wider variety of data features, increasing the probability of detecting unauthorized terminal devices and improving the accuracy of access mode detection. The methods provided in the embodiments of the present application can identify the type of terminal device, resulting in more accurate unauthorized connection detection results. This unauthorized connection type can also assist in the subsequent implementation of unauthorized connection blocking. The data features provided in the embodiments of the present application are relatively comprehensive, and access modes determined by different data features can be mutually verified, thereby improving the accuracy of access mode identification. Furthermore, the embodiments of the present application provide two data feature collection methods, making data feature collection more flexible. In-stream collection can improve the efficiency of data feature collection, while duplicate data collection can avoid affecting data transmission.

[0118] Taking the interaction between an access device and a management device to perform the method as an example, as shown in Figure 5, the method provided in the embodiment of the present application includes but is not limited to the following steps 701 to 704. The access device may be the access layer switch 104 shown in Figure 1, and the management device is connected to the access device, and the management device is used to interact with the administrator.

[0119] Step 701: The management device sends a private connection detection configuration command to the access device.

[0120] The management device may be a central console or server used by a network administrator to configure and control network devices, and the private connection detection configuration command may be flexibly configured by the administrator according to needs.

[0121] In step 702, the access device receives the private connection detection configuration command, collects data features of data transmitted by the access device based on the private connection detection configuration command, and determines the access mode of the terminal device based on the data features.

[0122] Based on the unauthorized connection detection configuration command issued by the management device, the access device triggers the collection of data characteristics of the data transmitted by the access device and determines the access mode of the terminal device based on the data characteristics. In this method, the unauthorized connection detection configuration command can flexibly trigger the collection of data characteristics, that is, trigger unauthorized connection detection. In addition, different unauthorized connection detection configuration commands can be set according to different user needs, making the implementation of unauthorized connection detection more tailored to user needs.

[0123] The implementation of step 702 can refer to the relevant introduction of the above steps 501 and 502, which will not be repeated here.

[0124] Step 703: When the access device determines that the access mode of the terminal device is private connection, the access device sends private connection information of the terminal device to the management device.

[0125] The private connection information can indicate that the access mode of the terminal device is private connection. Optionally, the private connection information can include at least one of a MAC address, an IP address, an access port, an access time, a private connection type, or a reason for determining the private connection.

[0126] Step 704: The management device receives the private connection information of the terminal device and issues a private connection alarm message.

[0127] The embodiment of the present application does not implement the method of issuing a private connection alarm message. Optionally, the management device generates an alarm record to record relevant information about the private connection, such as the time of occurrence, the location of occurrence, the identification of the terminal device involved, etc. The management device will send the private connection alarm information to the administrator or visualize it on the management device so that the administrator can take timely countermeasures. For example, it can be sent by email, text message, instant message or a specific alarm system. The administrator who receives the private connection alarm information can take corresponding measures according to the content of the information, such as isolating the private connection device, investigating the network status, contacting the administrator, etc., to ensure the normal operation and security of the network.

[0128] In one possible implementation, after receiving the private connection information of the terminal device, the management device also blocks the terminal device from transmitting data. The methods of blocking the terminal device from transmitting data include but are not limited to: sending a shutdown instruction to the access device, the shutdown instruction is used by the access device to close the access port of the terminal device; or, sending a blacklist to the access device, the blacklist includes the address information of the terminal device, the blacklist is used by the access device to block the terminal device corresponding to the address information in the blacklist from transmitting data; or, sending an offline instruction to the access device, the offline instruction is used by the access device to offline the user who is online on the terminal device. In this method, three blocking methods are provided, and the appropriate blocking method can be flexibly selected based on different scenarios. In addition, the management device will continuously monitor the network status to ensure that private connections are effectively controlled. In the case of blocking the data transmitted by the terminal device, the management device will issue a notification to inform the user that offline measures have been taken, and will visually display the blocking method and the terminal devices involved.

[0129] In a possible implementation, after receiving the private connection information of the terminal device, the private connection information of the terminal device is visually displayed. For example, the private connection information includes MAC address, IP address, access port, access time, private connection type, and private connection determination reason.

[0130] For MAC addresses, each terminal device has a unique MAC address that identifies the terminal device. For IP addresses: The IP address is the unique identifier of the terminal device in the network and is used to locate and manage the terminal device. For access ports, the access port can determine which port the terminal device is privately connected through. For access time, recording the access time of the terminal device can evaluate the time period of the terminal device private connection and take corresponding countermeasures for the specific time period. For the type of private connection, targeted blocking measures can be taken according to the type of private connection. For the reason for private connection determination, it indicates the reason or basis for the access device to determine that the terminal device is a privately connected terminal device. The reason for private connection determination can help users understand the nature and severity of the private connection.

[0131] Visualizations of private connection information can include charts, tables, dashboards, or other visualization tools. These tools present private connection information in an intuitive and easy-to-understand manner, helping users quickly understand the overview and details of privately connected devices. By visualizing private connection information, users can quickly understand the impact and distribution of private connections, enabling them to better formulate and implement countermeasures. For example, they can isolate privately connected devices, issue alerts, notify relevant personnel, or take other appropriate actions. Visualizations can also assist users in long-term data analysis and trend forecasting, helping to prevent and address future instances of privately connected devices.

[0132] For ease of understanding, this embodiment provides another access detection scenario, as shown in Figure 6. Figure 6 includes an administrator, an access device, a management device, and a terminal device. The access device includes a collection module, a perception module, and a processing module. The collection module, perception module, and processing module are merely examples. The specific implementation is not limited to these three modules and can be flexibly adjusted as needed.

[0133] As shown in Figure 6, in step 901, the administrator configures the private connection detection configuration command through the management device's visual interface. In step 902, the management device sends the private connection detection configuration command to the processing module of the access device. In step 903, the processing module controls the collection module to begin collecting data features. In step 904, the terminal device sends data to the access device. In step 905, the collection module collects data features based on the data sent by the terminal device. In step 906, the collection module sends the data features to the perception module. In step 907, the perception module determines whether the terminal device's access method is private connection based on the data features. In step 908, the private connection information of the privately connected terminal device is sent to the processing module. In step 909, the processing module blocks the terminal device from transmitting data. In step 910, the terminal device cannot connect to the network. In step 911, the processing module sends the private connection information and the blocking result to the management device. In step 912, the management device issues an alarm to the administrator. In step 913, the administrator can view the private connection information and the blocking result through the management device's visual interface.

[0134] The perception module or processing module provided in the embodiments of the present application can also be configured on a management device, thereby reducing the workload of the access device. For example, referring to Figure 7, Figure 7 provides another access detection scenario. Figure 7 includes an administrator, an access device, a management device, and a terminal device. The access device includes a collection module and a perception module, and the management device includes a management module and a processing module. The collection module, perception module, processing module, and management module are merely examples. The specific implementation is not limited to these four modules and can be flexibly adjusted as needed.

[0135] As shown in Figure 7, in step 1001, the administrator configures the private connection detection configuration command through the visual interface of the management device. In step 1002, the management module sends the private connection detection configuration command to the collection module of the access device. In step 1003, the terminal device sends data to the access device. In step 1004, the collection module collects data features based on the data sent by the terminal device. In step 1005, the collection module sends the data features to the perception module. In step 1006, the perception module determines whether the terminal device's access method is a private connection based on the data features. In step 1007, the private connection information of the privately connected terminal device is sent to the management module. In step 1008, the management module issues an alarm to the administrator. In step 1009, the administrator views the private connection information through the visual interface of the management device. In step 1010, the management module sends a blocking message to the processing module. In step 1011, the processing module blocks the data sent by the terminal device based on the blocking information. In step 1012, the terminal device cannot connect to the network.

[0136] In summary, in the embodiment of the present application, the access device is connected to the management device, and the management device is used to implement visual management of privately connected terminal devices.

[0137] The above describes the access mode detection method provided by the embodiments of the present application. Corresponding to the above method, the embodiments of the present application also provide an access mode detection device. This device is used to execute the access mode detection method performed by the access device described above, such as the method shown in Figure 3, through the various modules shown in Figure 8. As shown in Figure 8, the access mode detection device provided by the embodiments of the present application includes the following modules.

[0138] A collection module 1101 is configured to collect data characteristics of data transmitted by an access device, where the data characteristics indicate characteristics of a terminal device transmitting the data, the terminal device being connected to the access device, and the data characteristics include at least one of a message characteristic, a traffic behavior characteristic, a network characteristic, or a device physical characteristic;

[0139] The determination module 1102 is configured to determine an access mode of the terminal device based on data characteristics.

[0140] In an exemplary embodiment, the data features include multiple message features; the determination module 1102 is used to identify the operating system under the access port of the terminal device based on the multiple message features; when the operating systems under the access ports are different, determine that the access mode of the terminal device is private connection.

[0141] In an exemplary embodiment, the determining module 1102 is configured to identify address information of an access port of a terminal device based on multiple message features; if the address information of the access ports is the same, identify the operating system of the access port of the terminal device based on the multiple message features;

[0142] The determining module 1102 is further configured to determine that the access mode of the terminal device is a private connection when the address information of the access port is different.

[0143] In an exemplary embodiment, the data features include flow behavior features; a determination module 1102 is used to obtain a deviation distance between the flow behavior features and a reference feature, where the reference feature is a flow behavior feature of data transmitted by a terminal device whose access method is non-private connection; when the deviation distance is greater than a deviation threshold, it is determined that the access method of the terminal device is private connection.

[0144] In an exemplary embodiment, the data characteristics include at least one of network characteristics or device physical characteristics; the determination module 1102 is used to identify the type of the terminal device based on at least one of the network characteristics or device physical characteristics; when the type of the terminal device is a router or a hub, determine that the access mode of the terminal device is a private connection.

[0145] In an exemplary embodiment, the apparatus further includes a blocking module configured to block data transmission by the terminal device when the terminal device access mode is private connection. Alternatively, the apparatus further includes a sending module configured to send private connection information of the terminal device to the management device when the terminal device access mode is private connection, the private connection information being used by the management device to block data transmission by the terminal device.

[0146] In an exemplary embodiment, the blocking module is used to close the access port of the terminal device; or, add the address information of the terminal device to a blacklist, and the blacklist is used to block the terminal device corresponding to the address information in the blacklist from transmitting data; or, take the user who is online on the terminal device offline.

[0147] In an exemplary embodiment, the data transmitted by the access device is data flowing from the terminal side to the network side.

[0148] In an exemplary embodiment, the apparatus further includes: a receiving module configured to receive a private connection detection configuration command sent by a management device; in this case, the collecting module 1101 is configured to collect data features of data transmitted by the access device based on the private connection detection configuration command.

[0149] In an exemplary embodiment, the apparatus further includes: a copy module, configured to copy data transmitted from the access device to obtain copied data; in this case, a collection module 1101, configured to collect data features of the copied data.

[0150] In an exemplary embodiment, the access device is a first-hop forwarding device for data sent by the terminal device.

[0151] It should be understood that the beneficial effects of the device shown in FIG8 when implementing its functions are the same as the beneficial effects of the method shown in FIG3. When the device shown in FIG8 implements its functions, it is only illustrated by the division of the above-mentioned functional modules. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiments belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0152] The present application also provides an access mode detection device. This device is used to execute the access mode detection method performed by the access device described above, such as the method shown in Figure 5, through the various modules shown in Figure 9. As shown in Figure 9, the access mode detection device provided in the present application includes the following modules.

[0153] The receiving module 1201 is configured to receive private connection information of a terminal device sent by an access device, where the private connection information indicates that the access mode of the terminal device is private connection;

[0154] The alarm module 1202 is used to issue an unauthorized connection alarm message.

[0155] In an exemplary embodiment, the apparatus further includes: a blocking module, configured to block the terminal device from transmitting data.

[0156] In an exemplary embodiment, the blocking module is used to send a shutdown instruction to the access device, and the shutdown instruction is used by the access device to close the access port of the terminal device; or, to send a blacklist to the access device, and the blacklist includes the address information of the terminal device, and the blacklist is used by the access device to block the terminal device corresponding to the address information in the blacklist from transmitting data; or, to send an offline instruction to the access device, and the offline instruction is used by the access device to take the user who is online on the terminal device offline.

[0157] In an exemplary embodiment, the apparatus further comprises: a visualization display module for visually displaying private connection information of the terminal device, the private connection information including at least one of MAC address, IP address, access port, access time, private connection type or private connection determination reason.

[0158] In an exemplary embodiment, the apparatus further includes: a sending module for sending a private connection detection configuration command to the access device, the private connection detection configuration command being used by the access device to collect data features of data transmitted by the access device and determine an access mode of the terminal device based on the data features.

[0159] It should be understood that the beneficial effects of the device shown in FIG9 when implementing its functions are the same as the beneficial effects of the method shown in FIG5 . When the device shown in FIG9 implements its functions, it is only illustrated by the division of the above-mentioned functional modules. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiments belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0160] An embodiment of the present application provides an access mode detection device, which includes a memory and a processor; the memory stores at least one computer instruction, and the at least one computer instruction is loaded and executed by the processor, so that the access mode detection device implements the access mode detection method shown in Figure 3 or Figure 5.

[0161] Referring to Figure 10 , Figure 10 shows a schematic diagram of the structure of a network device 1300 provided in this application. The network device 1300 shown in Figure 10 is used to perform the operations involved in the access mode detection method shown in Figure 4 . The network device 1300 is, for example, a switch, and can be implemented using a general bus architecture.

[0162] As shown in FIG. 10 , the network device 1300 includes at least one processor 1301 , a memory 1303 , and at least one communication interface 1304 .

[0163] The processor 1301 is, for example, a general-purpose central processing unit (CPU), a digital signal processor (DSP), a network processor (NP), a graphics processing unit (GPU), a neural-network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits for implementing the solution of the present application. For example, the processor 1301 includes an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. The PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. It can implement or execute the various logic blocks, modules, and circuits described in conjunction with the disclosure of the embodiments of the present invention. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0164] Optionally, network device 1300 also includes a bus. The bus is used to transmit information between the various components of network device 1300. The bus may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, for example. Buses can be categorized as address buses, data buses, control buses, and the like. For ease of illustration, FIG10 shows only one line, but this does not imply that there is only one bus or only one type of bus.

[0165] The memory 1303 is, for example, a read-only memory (ROM) or other type of static storage device that can store static information and instructions, or a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1303 is, for example, independent and connected to the processor 1301 via a bus. The memory 1303 can also be integrated with the processor 1301.

[0166] The communication interface 1304 uses any transceiver-like device for communicating with other devices or communication networks. The communication network can be Ethernet, a radio access network (RAN), or a wireless local area network (WLAN). The communication interface 1304 can include a wired communication interface and a wireless communication interface. Specifically, the communication interface 1304 can be an Ethernet interface, a fast Ethernet (FE) interface, a gigabit Ethernet (GE) interface, an asynchronous transfer mode (ATM) interface, a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. In an embodiment of the present application, the communication interface 1304 can be used for the network device 1300 to communicate with other devices.

[0167] In a specific implementation, as an embodiment, the processor 1301 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG10 . Each of these processors may be a single-core CPU processor or a multi-core CPU processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0168] In a specific implementation, as an embodiment, the network device 1300 may include multiple processors, such as the processor 1301 and the processor 1305 shown in FIG10 . Each of these processors may be a single-core CPU or a multi-core CPU. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0169] In a specific implementation, as an embodiment, the network device 1300 may further include an output device and an input device. The output device communicates with the processor 1301 and can display information in a variety of ways. For example, the output device can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device communicates with the processor 1301 and can receive user input in a variety of ways. For example, the input device can be a mouse, a keyboard, a touch screen device, or a sensor device.

[0170] In some embodiments, the memory 1303 is used to store program code 1310 for executing the solution of the present application, and the processor 1301 can execute the program code 1310 stored in the memory 1303. That is, the network device 1300 can implement the access mode detection method provided in the method embodiment through the processor 1301 and the program code 1310 in the memory 1303. The program code 1310 may include one or more software modules. Optionally, the processor 1301 itself may also store program code or instructions for executing the solution of the present application.

[0171] In a specific embodiment, the network device 1300 of the embodiment of the present application may correspond to the access device in the above-mentioned method embodiments. The processor 1301 in the network device 1300 reads the instructions in the memory 1303, so that the network device 1300 shown in Figure 10 can execute all or part of the operations performed by the access device.

[0172] For the sake of brevity, other optional implementations will not be described here in detail.

[0173] In a specific embodiment, the network device 1300 of the embodiment of the present application may correspond to the management device in the above-mentioned method embodiments. The processor 1301 in the network device 1300 reads the instructions in the memory 1303, so that the network device 1300 shown in Figure 10 can execute all or part of the operations performed by the management device.

[0174] For the sake of brevity, other optional implementations will not be described here in detail.

[0175] The network device 1300 may also correspond to the access mode detection apparatus shown in FIG. 8 or FIG. 9 , and each functional module in the access mode detection apparatus is implemented using software of the network device 1300. In other words, the functional modules included in the access mode detection apparatus are generated by the processor 1301 of the network device 1300 after reading the program code 1310 stored in the memory 1303.

[0176] Among them, each step of the access mode detection method shown in Figure 3 or Figure 5 is completed by the hardware integrated logic circuit or software instructions in the processor of the network device 1300. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor. The software module can be located in a storage medium mature in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.

[0177] Referring to Figure 11 , Figure 11 shows a schematic diagram of the structure of a network device 1400 provided in another exemplary embodiment of the present application. The network device 1400 shown in Figure 11 is configured to perform all or part of the operations involved in the access mode detection method shown in Figures 3 or 5 . The network device 1400 is, for example, a switch, a router, etc., and can be implemented using a general bus architecture.

[0178] As shown in FIG. 11 , the network device 1400 includes a main control board 1410 and an interface board 1430 .

[0179] The main control board (MCB), also known as the main processing unit (MPU) or route processor card, is used to control and manage various components in network device 1400, including routing calculations, device management, device maintenance, and protocol processing. MCB 1410 includes a central processing unit (CPU) 1411 and memory 1412.

[0180] Interface board 1430 is also known as a line processing unit (LPU), line card, or service board. It provides various service interfaces and implements data packet forwarding. Service interfaces include, but are not limited to, Ethernet interfaces and POS (Packet over SONET / SDH) interfaces. Ethernet interfaces, for example, are interfaces for flexible Ethernet clients (FlexE Clients). Interface board 1430 includes a central processing unit (CPU) 1431, a network processor (NPU) 1432, a forwarding table memory 1434, and a physical interface card (PIC) 1433.

[0181] The central processing unit 1431 on the interface board 1430 is used to control and manage the interface board 1430 and communicate with the central processing unit 1411 on the main control board 1410 .

[0182] The network processor 1432 is used to detect the access mode. The network processor 1432 can be in the form of a forwarding chip. The forwarding chip can be a network processor (NP). In some embodiments, the forwarding chip can be implemented using an application-specific integrated circuit (ASIC) or a field programmable gate array (FPGA). Specifically, the network processor 1432 is used to forward received packets based on the forwarding table stored in the forwarding entry memory 1434. If the destination address of the packet is the address of the network device 1400, the packet is sent to the CPU (such as the central processing unit 1431) for processing. If the destination address of the packet is not the address of the network device 1400, the next hop and outgoing interface corresponding to the destination address are searched in the forwarding table based on the destination address, and the packet is forwarded to the outgoing interface corresponding to the destination address. Processing of uplink packets can include processing the packet's inbound interface and forwarding table lookup; processing of downlink packets can include forwarding table lookup, etc. In some embodiments, the central processing unit can also perform the functions of the forwarding chip, such as implementing software forwarding based on a general-purpose CPU, thereby eliminating the need for a forwarding chip in the interface board.

[0183] Physical interface card 1433 implements physical layer interconnection. Raw traffic enters interface board 1430 through this card, and processed packets are sent out from this physical interface card 1433. Physical interface card 1433, also known as a daughter card, can be installed on interface board 1430. It converts optical and electrical signals into packets, performs a validity check on these packets, and then forwards them to network processor 1432 for processing. In some embodiments, central processing unit 1431 can also perform the functions of network processor 1432, such as implementing software forwarding based on a general-purpose CPU, eliminating the need for network processor 1432 in physical interface card 1433.

[0184] Optionally, network device 1400 includes multiple interface boards. For example, network device 1400 further includes interface board 1440. Interface board 1440 includes a central processing unit 1441, a network processor 1442, a forwarding table entry memory 1444, and a physical interface card 1443. The functions and implementation of each component in interface board 1440 are the same as or similar to those of interface board 1430 and are not described in detail here.

[0185] Optionally, network device 1400 further includes a switching fabric board 1420. Switching fabric board 1420 may also be referred to as a switch fabric unit (SFU). If network device 1400 includes multiple interface boards, switching fabric board 1420 is used to exchange data between the interface boards. For example, interface board 1430 and interface board 1440 can communicate via switching fabric board 1420.

[0186] The main control board 1410 is coupled to the interface board. For example, the main control board 1410, the interface board 1430, the interface board 1440, and the switching network board 1420 are connected to the system backplane via a system bus to achieve intercommunication. In one possible implementation, an inter-process communication (IPC) channel is established between the main control board 1410 and the interface boards 1430 and 1440, and communication is performed between the main control board 1410 and the interface boards 1430 and 1440 via the IPC channel.

[0187] Logically, network device 1400 includes a control plane and a forwarding plane. The control plane includes a main control board 1410 and a central processing unit 1411. The forwarding plane includes various components that perform forwarding, such as a forwarding table entry memory 1434, a physical interface card 1433, and a network processor 1432. The control plane performs functions such as routing, generating forwarding tables, processing signaling and protocol messages, and configuring and maintaining the network device's status. The control plane sends the generated forwarding tables to the forwarding plane. On the forwarding plane, the network processor 1432 forwards messages received by the physical interface card 1433 based on the forwarding tables sent by the control plane. The forwarding tables sent by the control plane can be stored in the forwarding table entry memory 1434. In some embodiments, the control plane and forwarding plane can be completely separate and not located on the same network device.

[0188] It's worth noting that there may be one or more main control boards (SPUs), which can include both active and standby SPUs. There may also be one or more interface boards. The higher the network device's data processing capabilities, the more interface boards it provides. Interface boards can also have one or more physical interface cards. There may be no SPUs, one or more SPUs, and multiple SPUs can provide load balancing and redundancy. In a centralized forwarding architecture, network devices may not require SPUs; the interface boards handle service data processing for the entire system. In a distributed forwarding architecture, network devices may have at least one SPU, which enables data exchange between multiple interface boards, providing high-capacity data exchange and processing capabilities. Therefore, network devices with distributed architectures have greater data access and processing capabilities than those with centralized architectures. Alternatively, a network device can consist of a single card, without a switching fabric board (SFB), integrating the functions of the interface board and the main control board. In this case, the central processing unit (CPU) on the interface board and the CPU on the main control board can be combined into a single CPU on this card, performing the combined functions of the two. This type of network device has lower data exchange and processing capabilities (for example, low-end network devices such as switches or routers). The specific architecture used depends on the specific network deployment scenario and is not specified here.

[0189] In a specific embodiment, the network device 1400 corresponds to the detection device of the access mode shown in FIG. 8 or FIG. 9 .

[0190] It should be understood that the processor described above may be a CPU, or other general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor that supports the Advanced Reduced Instruction Set Machine (ARM) architecture.

[0191] Furthermore, in an optional embodiment, the memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. The memory may also include a non-volatile random access memory. For example, the memory may also store device type information.

[0192] The memory may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may be random access memory (RAM), which is used as an external cache memory. By way of example and not limitation, many forms of RAM are available. For example, static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0193] An embodiment of the present application also provides an access mode detection system, which includes an access device and a management device, wherein the access device is connected to the management device, the access device is used to execute the operations performed by the access device in the access mode detection method shown in Figure 3 or Figure 5, and the management device is used to execute the operations performed by the management device in the access mode detection method shown in Figure 5.

[0194] An embodiment of the present application further provides a computer-readable storage medium, in which at least one instruction is stored. The instruction is loaded and executed by a processor to enable a computer to implement the access mode detection method shown in FIG. 3 or FIG. 5 .

[0195] The embodiment of the present application further provides a computer program (product), which, when executed by a computer, can enable a processor or computer to execute the access mode detection method shown in FIG. 3 or FIG. 5 .

[0196] An embodiment of the present application also provides a chip, including a processor, for calling and executing instructions stored in a memory, so that a computer equipped with the chip executes the access mode detection method shown in FIG3 or FIG5.

[0197] An embodiment of the present application also provides another chip, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the computer equipped with the chip executes the access mode detection method shown in Figure 3 or Figure 5.

[0198] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions according to the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state drive).

[0199] Those skilled in the art will appreciate that the various method steps and modules described in conjunction with the embodiments disclosed herein can be implemented in software, hardware, firmware, or any combination thereof. In order to clearly illustrate the interchangeability of hardware and software, the steps and components of each embodiment have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0200] Those skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware, or may be accomplished by a program to instruct the relevant hardware, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0201] When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer program instructions. As an example, the method of the embodiment of the present application can be described in the context of a machine executable instruction, and the machine executable instruction is such as included in the program module executed in the device on the real or virtual processor of the target. Generally speaking, a program module includes a routine, a program, a library, an object, a class, a component, a data structure, etc., which performs a specific task or realizes a specific abstract data structure. In various embodiments, the function of the program module can be merged or split between the described program modules. The machine executable instruction for the program module can be executed in a local or distributed device. In a distributed device, the program module can be located in both a local and a remote storage medium.

[0202] The computer program code for realizing the method for the embodiment of the application can be written in one or more programming languages.These computer program codes can be provided to the processor of general-purpose computer, special-purpose computer or other programmable data processing device, so that program code, when being executed by computer or other programmable data processing device, causes the function / operation specified in flow chart and / or block diagram to be implemented.Program code can be executed completely on computer, partly on computer, as independent software package, partly on computer and partly on remote computer or completely on remote computer or server.

[0203] In the context of the embodiments of the present application, computer program code or related data may be carried by any suitable carrier to enable a device, apparatus, or processor to perform the various processes and operations described above. Examples of carriers include signals, computer-readable media, and the like.

[0204] Examples of signals may include electrical, optical, radio, acoustic or other forms of propagated signals, such as carrier waves, infrared signals, etc.

[0205] A machine-readable medium may be any tangible medium that contains or stores a program for or in connection with an instruction execution system, apparatus, or device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination thereof. More detailed examples of machine-readable storage media include an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0206] Those skilled in the art will clearly understand that, for the sake of convenience and brevity of description, the specific working processes of the above-described systems, devices, and modules can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0207] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the modules is merely a logical function division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, or can be electrical, mechanical or other forms of connection.

[0208] The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0209] In addition, the functional modules in the various embodiments of the present application may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into a single module. The above-mentioned integrated modules may be implemented in the form of hardware or software functional modules.

[0210] If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0211] In this application, the terms "first", "second", etc. are used to distinguish between identical or similar items with substantially the same effects and functions. It should be understood that there is no logical or temporal dependency between "first", "second", and "nth", nor is there a limit on quantity and execution order. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another. For example, without departing from the scope of the various examples, the first deviation distance can be referred to as the second deviation distance, and similarly, the second deviation distance can be referred to as the first deviation distance.

[0212] It should also be understood that in the various embodiments of the present application, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0213] As used herein, the term "at least one" means one or more, and the term "plurality" means two or more. For example, "plurality of first data packets" means two or more first data packets. The terms "system" and "network" are often used interchangeably herein.

[0214] It should be understood that the terminology used in the description of the various examples herein is for the purpose of describing particular examples only and is not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0215] It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the listed items. The term "and / or" describes an association between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this application generally indicates that the associated objects are in an "or" relationship.

[0216] It will also be understood that the term “comprise” (also known as “includes,” “including,” “comprises,” and / or “comprising”) when used in this specification specifies the presence of stated features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0217] It should also be understood that the terms “if” and “if” may be interpreted to mean “when” or “upon” or “in response to determining” or “in response to detecting.” Similarly, the phrases “if it is determined that ” or “if [stated condition or event] is detected” may be interpreted to mean “upon determining ” or “in response to determining ” or “upon detecting [stated condition or event]” or “in response to detecting [stated condition or event],” depending on the context.

[0218] It should be understood that determining B based on A does not mean determining B based solely on A. B can also be determined based on A and / or other information.

[0219] It should also be understood that references throughout this specification to "one embodiment," "an embodiment," or "one possible implementation" mean that specific features, structures, or characteristics associated with that embodiment or implementation are included in at least one embodiment of the present application. Therefore, the appearance of "in one embodiment," "in an embodiment," or "one possible implementation" throughout this specification does not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0220] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the principles of the present application should be included in the scope of protection of the present application.

Claims

1. A method for detecting an access mode, characterized in that: The method comprises: collecting data characteristics of data transmitted by an access device, the data characteristics indicating characteristics of a terminal device transmitting the data, the terminal device being connected to the access device, the data characteristics including at least one of a message characteristic, a traffic behavior characteristic, a network characteristic, or a device physical characteristic; Determine the access mode of the terminal device based on the data characteristics.

2. The method according to claim 1, characterized in that The data feature includes a plurality of message features; and determining the access mode of the terminal device based on the data feature includes: Identifying the operating system under the access port of the terminal device based on the multiple message features; In the case that the operating systems under the access ports are different, it is determined that the access mode of the terminal device is a private connection.

3. The method according to claim 2, characterized in that The identifying the operating system under the access port of the terminal device based on the multiple message features includes: Identifying address information of an access port of the terminal device based on the multiple message features; When the address information under the access ports is the same, identifying the operating system under the access port of the terminal device based on the multiple message features; The method further comprises: When the address information under the access port is different, it is determined that the access mode of the terminal device is a private connection.

4. The method according to claim 1, wherein The data characteristics include the flow behavior characteristics; The determining the access mode of the terminal device based on the data feature includes: Obtaining a deviation distance between the traffic behavior feature and a reference feature, where the reference feature is a traffic behavior feature of data transmitted by a terminal device with a non-private access mode; When the deviation distance is greater than a deviation threshold, it is determined that the access mode of the terminal device is a private connection.

5. The method according to claim 1, wherein The data feature includes at least one of the network feature or the physical feature of the device; and determining the access mode of the terminal device based on the data feature includes: identifying a type of the terminal device based on at least one of the network characteristics or the device physical characteristics; In a case where the type of the terminal device is a router or a hub, it is determined that the access mode of the terminal device is a private connection.

6. The method according to any one of claims 1 to 5, characterized in that: After determining the access mode of the terminal device based on the data feature, the method further includes: If the access mode of the terminal device is private connection, blocking the terminal device from transmitting data; Alternatively, when the access mode of the terminal device is private connection, private connection information of the terminal device is sent to the management device, and the private connection information is used by the management device to block the terminal device from transmitting data.

7. The method according to claim 6, characterized in that The blocking of the terminal device from transmitting data includes: Closing the access port of the terminal device; Alternatively, the address information of the terminal device is added to a blacklist, where the blacklist is used to block the terminal device corresponding to the address information in the blacklist from transmitting data; Alternatively, the user who is online on the terminal device is offline.

8. The method according to any one of claims 1 to 7, characterized in that: The data transmitted by the access device is data flowing from the terminal side to the network side.

9. The method according to any one of claims 1 to 8, characterized in that: The data characteristics of the data transmitted by the acquisition access device include: Receive the private connection detection configuration command sent by the management device; Data features of data transmitted by the access device are collected based on the private connection detection configuration command.

10. The method according to any one of claims 1 to 9, characterized in that: The data characteristics of the data transmitted by the acquisition access device include: copying the data transmitted by the access device to obtain copied data; Data features of the replicated data are collected.

11. The method according to any one of claims 1 to 10, characterized in that: The access device is the first-hop forwarding device for data sent by the terminal device.

12. A method for detecting an access mode, characterized in that: The method comprises: receiving private connection information of a terminal device sent by an access device, wherein the private connection information indicates that an access mode of the terminal device is a private connection; Send a private call warning message.

13. The method according to claim 12, characterized in that After receiving the private connection information of the terminal device sent by the access device, the method further includes: Block the terminal device from transmitting data.

14. The method according to claim 13, wherein: The blocking of the terminal device from transmitting data includes: Sending a close instruction to the access device, wherein the close instruction is used by the access device to close the access port of the terminal device; Alternatively, a blacklist is sent to the access device, the blacklist including the address information of the terminal device, and the blacklist is used by the access device to block the terminal device corresponding to the address information in the blacklist from transmitting data; Alternatively, an offline instruction is sent to the access device, where the offline instruction is used by the access device to offline a user who is online on the terminal device.

15. The method according to any one of claims 12 to 14, characterized in that: After receiving the private connection information of the terminal device sent by the access device, the method further includes: The private connection information of the terminal device is visually displayed, where the private connection information includes at least one of a media access control MAC address, an Internet protocol IP address, an access port, an access time, a private connection type, or a private connection determination reason.

16. The method according to any one of claims 12 to 15, characterized in that: Before receiving the private connection information of the terminal device sent by the access device, the method further includes: Sending a private connection detection configuration command to the access device, where the private connection detection configuration command is used by the access device to collect data features of data transmitted by the access device and determine the access mode of the terminal device based on the data features.

17. A device for detecting an access mode, characterized in that: The device comprises: a collection module, configured to collect data features of data transmitted by an access device, the data features indicating features of a terminal device transmitting the data, the terminal device being connected to the access device, the data features including at least one of a message feature, a traffic behavior feature, a network feature, or a device physical feature; A determination module is used to determine the access mode of the terminal device based on the data characteristics.

18. A device for detecting an access mode, characterized in that: The device comprises: a receiving module, configured to receive private connection information of a terminal device sent by an access device, wherein the private connection information indicates that the access mode of the terminal device is private connection; The alarm module is used to issue private connection alarm information.

19. An access mode detection device, characterized in that: The device includes a memory and a processor; the memory stores at least one computer instruction, and the at least one computer instruction is loaded and executed by the processor so that the device implements the access mode detection method described in any one of claims 1-11, or so that the device implements the access mode detection method described in any one of claims 12-16.

20. A detection system for access mode, characterized in that: The system includes an access device and a management device, wherein the access device is used to implement the access mode detection method described in any one of claims 1-11, and the management device is used to implement the access mode detection method described in any one of claims 12-16.

21. A computer-readable storage medium, characterized in that The computer storage medium stores at least one instruction, and the at least one instruction is loaded and executed by the processor to enable the computer to implement the access mode detection method as described in any one of claims 1-11, or to enable the computer to implement the access mode detection method as described in any one of claims 12-16.

22. A computer program product, characterized in that The computer program product includes: computer program code, which is loaded and executed by a computer to enable the computer to implement the access mode detection method described in any one of claims 1 to 11, or to enable the computer to implement the access mode detection method described in any one of claims 12 to 16.

Images