CN107426208A - A kind of method for monitoring network illegal external connection - Google Patents

Abstract

A method for monitoring illegal network outreach, specifically comprising the following steps: setting a network outreach detection list for a server in an intranet; initiating a network connection request according to the network outreach detection list; judging whether the network connection is successful, if the network connection is successful , then give an alarm; if the network connection is unsuccessful, continue to initiate a network connection request. One of the technical solutions of the present invention is through domain name resolution, Ping detection, timing establishment of TCP connection, or manual network connection detection. When it is detected that the set domain name or IP address is connected, an alarm is triggered in time, so that the user can obtain Know which machine made an illegal connection to which domain name or IP when, and can take timely measures.

Description

A method of monitoring network illegal outreach

technical field

The invention relates to the technical field of network monitoring, in particular to a method for monitoring network illegal outreach.

Background technique

Nowadays, the development of computer and network technology provides computer users with rich means of network and device interconnection. These various ways of interconnection are becoming one of the biggest challenges to be faced in the standardized management of industries and enterprises. If a new connection channel is opened between the internal network and the external network, external hackers or viruses can bypass the protective barrier between the internal network and the external network, successfully invade illegal external computers, and steal sensitive information of the internal network. Information and confidential data, and even use the machine as a springboard to attack and infect important servers of the internal network, causing the entire internal network to be paralyzed. Therefore, illegal outreach is an important aspect affecting computer network security, and effective prevention of illegal outreach is of great significance to ensure the safe and stable operation of various information systems.

Contents of the invention

The purpose of the present invention is to provide a method for monitoring network illegal outreach, which is used to solve the problem that illegal outreach is easy to occur in computer network security, which leads to the paralysis of the entire internal network.

The technical solution adopted by the present invention to solve the technical problem is: a method for monitoring illegal outreach on the network, which is characterized in that it specifically includes the following steps:

Set the network outreach detection list for servers in the intranet;

Initiate a network connection request according to the network outreach detection list;

Judging whether the network connection is successful, if the network connection is successful, an alarm will be issued; if the network connection is unsuccessful, continue to initiate a network connection request.

Further, the setting of the network outreach detection list includes the establishment of a domain name resolution connection, a Ping detection connection, and a TCP connection.

Further, the establishment of the domain name resolution connection is used to detect whether the server in the internal network environment can connect to the external network, and the specific establishment method includes: inputting the domain name.

Further, the establishment of the Ping detection connection is used to detect whether the server can ping the target IP address, and the specific establishment method includes: inputting the IP address.

Further, the establishment of the TCP connection is used to detect whether the machine can perform a TCP connection to the target IP and target port, and the specific establishment method includes: inputting the IP address and port number.

Further, said initiating a network request includes automatically initiating a network request and manually initiating a network request.

Further, the automatically initiating network request is that the server regularly sends a network connection request through an instruction, including a ping instruction for a ping detection connection, a telnet instruction for a TCP connection, and an nslookup instruction for a domain name resolution connection;

The manually initiating network request is to perform manual outreach to detect networks in the network outreach detection list.

Further, the alarm content of the successful network connection alarm includes time, server number, and a successful network connection method.

The effects provided in the summary of the invention are only the effects of the embodiments, rather than all the effects of the invention. One of the above technical solutions has the following advantages or beneficial effects:

Through domain name resolution, Ping detection, timing establishment of TCP connection, or manual network connection detection, when the set domain name or IP address is detected to be connected, an alarm will be triggered in time, so that the user can know which machine is responding Which domain name or IP has made an illegal connection, and measures can be taken in time.

Description of drawings

Fig. 1 is the schematic flow chart of the method of the embodiment of the present invention;

FIG. 2 is a schematic diagram of automatically initiating a network connection request according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of manually initiating a network connection request according to an embodiment of the present invention.

detailed description

In order to clearly illustrate the technical features of the present solution, the present invention will be described in detail below through specific implementation methods and in conjunction with the accompanying drawings. The following disclosure provides many different embodiments or examples for implementing different structures of the present invention. To simplify the disclosure of the present invention, components and arrangements of specific examples are described below. Furthermore, the present invention may repeat reference numerals and/or letters in different instances. This repetition is for the purpose of simplicity and clarity and does not in itself indicate a relationship between the various embodiments and/or arrangements discussed. It should be noted that components illustrated in the figures are not necessarily drawn to scale. Descriptions of well-known components and processing techniques and processes are omitted herein to avoid unnecessarily limiting the present invention.

As shown in Figure 1, a method for monitoring illegal outreach on the network specifically includes the following steps:

Set the network outreach detection list for the server in the intranet; initiate a network connection request according to the network outreach detection list; judge whether the network connection is successful, and if the network connection is successful, issue an alarm; if the network connection is unsuccessful, continue to initiate the network connection Connection request.

The network outreach detection list settings include the establishment of domain name resolution connection, Ping detection connection establishment, and TCP connection establishment.

The establishment of the domain name resolution connection is used to detect whether the server in the internal network environment can connect to the external network. The specific establishment method includes: inputting the domain name.

The establishment of the Ping detection connection is used to detect whether the server can ping the target IP address. The specific establishment method includes: inputting the IP address.

The establishment of a TCP connection is used to detect whether the machine can perform a TCP connection to the target IP and target port. The specific establishment method includes: inputting the IP address and port number.

Initiating a network request includes automatically initiating a network request and manually initiating a network request.

As shown in Figure 2, automatically initiating a network request means that the server regularly sends a network connection request through instructions, including a ping instruction for a ping detection connection, a telnet instruction for a TCP connection, and an nslookup instruction for a domain name resolution connection.

Set the time interval for regular detection, such as 10 minutes, and make a network connection request every 10 minutes.

Use ping<IP> command, such as ping<10.2.92.100>, to perform ping detection connection; use telnet<IP><port> command, such as telnet<10.2.92.100><8080>, to perform TCP connection; use nslookup<domain name> Instructions, such as nslookup<www.baidu.com>, perform domain name resolution connection.

Determine whether the connection is successful. If the connection is successful, an alarm will be issued. The alarm content includes: time (YYYY-MM-DD), server XXX Ping detection (10.2.92.100) is successful; or time (YYYY-MM-DD), server XXX TCP The connection (10.2.92.100) (8080) is successful; or the time (YYYY-MM-DD), server XXX domain name resolution connection (www.baidu.com) is successful.

As shown in Figure 3, a network request can be manually initiated, and manual detection is performed according to the network outreach detection list. If the connection is successful, an alarm is issued. The content of the alarm is the same as that for automatically initiating a network request, and will not be described here.

The above is only a preferred embodiment of the present invention. For those of ordinary skill in the art, without departing from the principle of the present invention, some improvements and modifications can also be made, and these improvements and modifications are also considered as the present invention. protection scope of the invention.

Claims (8)

1. a kind of method for monitoring network illegal external connection, it is characterized in that, specifically include following steps：

Network external connection detection list is carried out to the server in Intranet to set；

List is detected according to network external connection and initiates network connecting request；

Judge whether network connection success, if network connection success, is alerted；If network connection is unsuccessful, after Supervention plays network connecting request.

2. a kind of method for monitoring network illegal external connection according to claim 1, it is characterized in that, network external connection detection list Setting includes domain name mapping establishment of connection, Ping detections establishment of connection, TCP establishment of connections.

3. a kind of method for monitoring network illegal external connection according to claim 2, it is characterized in that, domain name parsing connection Foundation be used for whether the server that detects in intranet environment can to connect outer net, it, which specifically establishes mode, includes：Inputs domain name.

4. a kind of method for monitoring network illegal external connection according to claim 2, it is characterized in that, the Ping detections connection Foundation be used for detect the server whether can ping lead to target ip address, it, which specifically establishes mode, includes：Input IP address.

5. a kind of method for monitoring network illegal external connection according to claim 2, it is characterized in that, the TCP connections are built Stand for detecting whether this machine can carry out TCP connections to Target IP, target port, it, which specifically establishes mode, includes：Input IP Address and port numbers.

6. a kind of method for monitoring network illegal external connection according to claim 1, it is characterized in that, the initiation network request Including automatically initiating network request and initiating network request manually.

7. a kind of method for monitoring network illegal external connection according to claim 6, it is characterized in that, it is described to automatically initiate network Ask be server by instructing timing to send network connecting request, include ping instructions, the TCP connections of ping detection connections Telnet instructions, the nslookup instructions of domain name mapping connection；

It is described to initiate network request manually to carry out the network in manual external connection detection network external connection detection list.

8. a kind of method for monitoring network illegal external connection according to claim 1, it is characterized in that, the network connection success The warning content alerted includes time, server numbering, the successful mode of network connection.