CN114422203A - Method and apparatus for identifying illegal broadband access - Google Patents

Abstract

The present disclosure relates to methods and apparatus for identifying broadband violation access. Provided is a method for identifying illegal broadband access, comprising: obtaining, by a computing terminal, a GET request message from a source IP address associated with a specific user from a core router; The HTTP request message is analyzed to count the number of different destination IP addresses contained in the HTTP request message per unit time; the computing terminal compares the number of the different destination IP addresses with a threshold value; and in response to determining If the number of different destination IP addresses is greater than the threshold, the computing terminal identifies that the specific user has illegal broadband access behavior.

Description

Method and apparatus for identifying illegal broadband access

technical field

The present disclosure relates generally to broadband access, and more particularly to a method, apparatus, and computer-readable storage medium for identifying broadband violation access.

Background technique

Since most of the content on the Internet is on the backbone networks of first-tier operators (such as China Telecom and China Unicom) (that is, in the computer rooms of the first-tier operators and their partners), other second-tier operators (such as Radio and television cable operators and other private operators) have the need for interconnection with first-level operators, and pay fees for first-level applications. In the current Chinese Internet architecture, the first-tier operators are backbone network operators, and they do not need to pay each other for interconnection, while other second- or third-tier operators are connected to the backbone network of the first-tier operators. You need to pay more expensive interconnection fees. Many third-party companies buy access bandwidth from first-tier operators, but do not use it themselves, but resell it to other operators to earn the difference.

Third-party companies buy large bandwidth from first-tier operators and then resell them to other operators. This method violates current communication industry regulations, causes unfair market competition within a certain range, and disrupts the order of the communication market. Because the threshold for third-party companies to purchase bandwidth from first-tier operators is low, and it is difficult to make judgments through prior data review, it is necessary to break through traditional detection techniques.

At present, an idea in the prior art is to determine the occurrence of illegal broadband access by identifying the content of a specific application packet. The identification may include, for example, counting the cumulative number of accounts used by a specific application, counting the cumulative account login times of a specific application, or counting the number of concurrent NAT sessions of a network address translation (NAT) system.

SUMMARY OF THE INVENTION

The following presents a brief summary of the disclosure in order to provide a basic understanding of some aspects of the disclosure. It should be understood, however, that this summary is not an exhaustive overview of the present disclosure. It is not intended to identify key or critical parts of the disclosure nor to limit the scope of the disclosure. Its sole purpose is to present some concepts related to the disclosure in a simplified form as a prelude to the more detailed description that is presented later.

According to one aspect of the present disclosure, there is provided a method for identifying illegal broadband access, comprising: obtaining, by a computing terminal, a GET request message from a source IP address associated with a specific user from a core router; The computing terminal analyzes the obtained HTTP request message to count the number of different destination IP addresses contained in the HTTP request message per unit time; the computing terminal compares the number of the different destination IP addresses with the threshold making a comparison; and in response to determining that the number of different destination IP addresses is greater than a threshold, the computing terminal identifies that the particular user has broadband access violations.

According to another aspect of the present disclosure, there is provided an apparatus for identifying broadband violation access including a memory having instructions stored thereon and a processor. The processor is configured to execute instructions stored on the memory to perform: obtaining, by the apparatus, a GET-style HTTP request message from a source IP address associated with a particular user from the core router; The HTTP request message is analyzed to count the number of different destination IP addresses contained in the HTTP request message per unit time; the device compares the number of the different destination IP addresses with a threshold value; and in response to determining The number of the different destination IP addresses is greater than the threshold, and the apparatus identifies that the specific user has illegal broadband access behavior.

According to yet another aspect of the present disclosure, there is provided a computer-readable storage medium comprising computer-executable instructions that, when executed by one or more processors, cause the one or more processors to process The device performs the method according to the above-mentioned aspects of the present disclosure.

Description of drawings

The accompanying drawings, which form a part of the specification, illustrate embodiments of the present disclosure and together with the description serve to explain the principles of the present disclosure.

The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, wherein:

FIG. 1 shows a flowchart of a method for identifying broadband illegal access according to an embodiment of the present invention;

FIG. 2 shows a schematic diagram of a mirroring operation for user traffic according to an embodiment of the present disclosure;

FIG. 3 shows an example of a result obtained by performing detection on an access point of a single host according to an embodiment of the present disclosure;

FIG. 4 shows an example of a result obtained by performing detection on an access point of a large-bandwidth user according to an embodiment of the present disclosure;

FIG. 5 shows an example of a result of detection according to an embodiment of the present disclosure on an access point of another high-bandwidth user; and

6 illustrates an exemplary configuration of a computing device in which embodiments in accordance with the present disclosure may be implemented.

Detailed ways

The following detailed description is made with reference to the accompanying drawings and is provided to assist in a comprehensive understanding of various example embodiments of the present disclosure. The following description includes various details to aid in understanding, but these details are to be regarded as examples only and not for the purpose of limiting the disclosure, which is defined by the appended claims and their equivalents. The words and phrases used in the following description are only used to enable a clear and consistent understanding of the present disclosure. Also, descriptions of well-known structures, functions, and configurations may be omitted for clarity and conciseness. Those of ordinary skill in the art will recognize that various changes and modifications of the examples described herein can be made without departing from the spirit and scope of the present disclosure.

The inventor of the present invention finds that the broadband illegal access identification technology used in the prior art has certain limitations. For example, when counting the number of accounts used or the number of account logins for a specific application and using this as a judgment basis, due to the large number of Internet users, it is impossible to unify the specific applications to be counted, and even common applications may have statistical deviations. For example, a user with broadband access violations may not use one or more of the applications being counted at all. In addition, when the number of NAT sessions is counted and used as a judgment basis, it is not easy to obtain the number of NAT sessions of users, and specific fields can be modified through NAT devices or third-party software to avoid inspection. Therefore, how to solve the universality of detection and prevent tampering with fields to avoid checking is the subject of the present invention.

Based on this, the inventors propose the present invention. The invention focuses on illegal private connection of telecommunication bandwidth, and based on big data analysis of user behavior, automatically identifies illegal access behavior, and technically realizes effective monitoring of illegal broadband access.

Referring now to FIG. 1, FIG. 1 shows a flow diagram of a method 100 for identifying broadband violation access in accordance with one embodiment of the present invention. The method 100 is performed, for example, by the computing device 1200 described in FIG. 6 . The method 100 may include an HTTP request message acquisition step 110 , an IP address statistics step 120 , a comparison step 130 , and a violation access identification step 140 .

The method 100 begins with the HTTP request message acquisition step 110 . In the HTTP request message obtaining step 110, the computing terminal obtains the HTTP request message in the GET mode from the source IP address associated with the specific user from the core router. According to an embodiment of the present disclosure, the computing terminal may be connected to a core router of a metropolitan area network computer room through a network cable. For example, the computing terminal can be deployed in a large-bandwidth upper-layer metropolitan area network computer room as a monitoring terminal, so that a single terminal can cover more user access points. Specifically, in one example, the network cable of the computing terminal may be connected to the Gigabit network cable interface of the core egress router in the MAN computer room.

Here, what is obtained is the HTTP request message in the GET method. Such requests can be cached and used only to retrieve data. According to an embodiment of the present disclosure, the step 110 of obtaining the HTTP request message may include: implementing command configuration on the core router to mirror the HTTP protocol traffic, and for the source IP address, using a policy to convert the HTTP request in the GET method The message is mirrored to the computing terminal. According to an embodiment of the present disclosure, the HTTP request message under the HTTP protocol may be transmitted using port 80, for example.

FIG. 2 shows a schematic diagram of a mirroring operation of user traffic according to an embodiment of the present disclosure. In Figure 2, user 210 accesses its local router (user access router 220). The HTTP request issued by the user 210 is sent to the Internet 250 via the local router 220 and the core router 230 (see the data flow marked with the dashed arrow in FIG. 2). According to one embodiment of the present disclosure, the present invention is implemented by executing the various steps of the method 100 for identifying illegal broadband access at a monitoring terminal 240 (ie, a computing terminal) in an operator's metropolitan area network computer room. Specifically, the core router 230 implements the mirroring of HTTP protocol traffic through command configuration, and mirrors the HTTP request message in the GET mode to the monitoring terminal through the policy for the source IP address of the user (refer to the data flow marked with the dotted arrow in FIG. 2 ) . Because the mirroring method is used, the user's network access operation will not be affected, and the user will not perceive that the HTTP request packet is obtained. According to an embodiment of the present disclosure, the command configuration of the core router includes using a dual-threaded real image function.

Since the HTTP request packet in the GET mode is small, the actual measured mirror traffic bandwidth of 100,000 online users is about 100M, so a computer room monitoring terminal with average performance can execute the method 100 according to the embodiment of the present invention. Investment is almost zero.

Referring back now to FIG. 1, in the IP address statistics step 120 of FIG. 1, the computing terminal analyzes the obtained HTTP request message to count different destination IP addresses contained in the HTTP request message per unit time quantity.

FIG. 3 shows an example of a result obtained by performing detection on an access point of a single host according to an embodiment of the present disclosure. As can be seen from Figure 3, the statistical result of the access point of the single host is 0 most of the time, and occasionally data less than 100 IP addresses per minute occurs. This situation also confirms the real usage of users, that is, most of the time users do not have web browsing operations, but when they occasionally browse web pages, due to the large number of links on most mainstream websites, a single user visits within a minute. Different IP addresses are probably on the order of tens of magnitudes.

FIG. 4 shows an example of a result obtained by performing detection according to an embodiment of the present disclosure on an access point of a high-bandwidth user. In the example of FIG. 4 , the high-bandwidth user has, for example, 80 hosts. Access points for high-bandwidth users (eg, with 80 hosts) will count at around 300 IP addresses per minute most of the time. Although the contribution value of a single host is about 30 IP addresses per minute according to experience, considering the time difference of browsing the web and the repetition of mainstream websites, the total number of IP addresses per minute is not simply the data of 80 hosts. Do stacking, so the order of 300 IP addresses per minute should be in the reasonable range.

FIG. 5 shows an example of a result of detection according to an embodiment of the present disclosure on an access point of another large-bandwidth user. In order to verify the usability of the identification method proposed in this paper, a test was conducted before a newly discovered illegal access point accessing a large-bandwidth user was shut down. ) is more than 1200. The illegal access user with large bandwidth in Figure 5 also has 80 hosts. As can be seen from Fig. 5, compared with normal high-bandwidth users (eg, the detected users in Fig. 4) with the same bandwidth and user order, the traffic volume is more than 4 times that of the normal traffic volume. Taking into account the time dispersion of users browsing web pages and the repeatability of mainstream websites, it is conservatively estimated that the number of real users is at least 10,000.

According to an embodiment of the present disclosure, the IP address statistics step 120 may include counting the number of different destination IP addresses included in the HTTP request packets in multiple time periods, and obtaining the statistics in the multiple time periods. The median number of different destination IP addresses contained in HTTP request packets. For example, in the example of FIG. 4 , the detection results of three consecutive detection periods are 282, 270 and 314 (pieces/minute) in sequence. At this time, the median of the number of detected IP addresses in a plurality of time periods was 282. In the example of FIG. 5 , the detection results of three consecutive detection periods are 1240, 1254 and 1252 (pieces/minute) in sequence. At this time, the median of the number of detected IP addresses in a plurality of time periods was 1252. In another example, the average number of the numbers of different destination IP addresses included in the HTTP request packets in the collected multiple time periods may also be obtained as the judgment index.

Referring now back to FIG. 1, in a comparison step 130 of FIG. 1, the number of different destination IP addresses is compared to a threshold by the computing terminal. According to an embodiment of the present disclosure, the threshold may be determined based on statistical data of other users with the same bandwidth and scale under the same node as the specific user. For example, the threshold can be determined according to the detection result of the normal high-bandwidth user shown in the example of FIG. 4 , so as to determine whether the HTTP access behavior of the high-bandwidth user shown in the example of FIG. 5 is abnormal.

According to an embodiment of the present disclosure, the threshold may be a multiple of the number of different destination IP addresses included in the HTTP request packets of the specific user and other users with the same bandwidth and the same scale under the same node within a unit time. . For example, twice the detection result of the normal high-bandwidth user shown in the example of FIG. 4 may be used as the threshold. For example, twice the 282, 270, or 314 shown in Figure 4 can be used as the threshold.

It should be noted that the double here is just an example for illustration, and three times or four times or higher multiples of the detection result of a normal user may also be used as the threshold, which depends on practical application experience. In addition, the threshold value may not necessarily be an integer multiple of the detection result of normal users.

Although in the above description only the detection result of one normal user (the user in the example of FIG. 4 ) is used to determine the threshold. In other embodiments, the detection results of multiple normal users may be used to determine the threshold. For example, a multiple of the average value of the detection results of a plurality of normal users is used as the threshold.

Referring now back to FIG. 1, in the violation access identification step 140 of FIG. 1, in response to determining that the number of different destination IP addresses is greater than a threshold, the computing terminal identifies that the particular user has broadband violation access behavior. For example, twice the detection result 282 shown in the example of FIG. 4 may be used as the threshold. When 282*2=564 is used as the threshold, the detection results 1240, 1254 and 1252 of the user in the example of FIG. 5 all exceed the threshold, so it can be determined that the user in the example of FIG. 5 is suspected of illegal broadband access. According to one embodiment, when any detection result of a user exceeds a threshold, it may be determined that the user may have illegal broadband access behavior.

According to one embodiment of the present disclosure, comparing the number of different destination IP addresses to a threshold may include comparing the median to the threshold. In the case of using the examples in FIG. 4 and FIG. 5 for illustration, the median 1252 of the detection results of the user in the example in FIG. 5 exceeds the threshold 564, so it can be determined that the user in the example in FIG. 5 is suspected of illegal broadband connection enter.

According to an embodiment of the present disclosure, the method 100 may further include presenting statistical data and analysis results associated with the specific user in the form of a list or a graph. This presentation may be implemented on the monitoring terminal 240 . The monitoring terminal 240 can also send the statistical data and analysis results associated with the specific user to other terminals or servers for presentation through the network, so that a unified and intuitive result presentation can be provided for the management department. According to an embodiment of the present disclosure, the presentation may be implemented using, for example, the echart component, so as to facilitate the viewing and statistics of the regulatory authority.

The present invention may be an apparatus, method and/or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of the present invention.

According to one embodiment of the present invention, there is provided an apparatus for identifying broadband violation access including a memory having instructions stored thereon and a processor. The processor is configured to execute instructions stored on the memory to perform: obtaining, by the apparatus, a GET-style HTTP request message from a source IP address associated with a particular user from the core router; The HTTP request message is analyzed to count the number of different destination IP addresses contained in the HTTP request message per unit time; the device compares the number of the different destination IP addresses with a threshold value; and in response to determining The number of the different destination IP addresses is greater than the threshold, and the apparatus identifies that the specific user has illegal broadband access behavior.

According to one embodiment of the present invention, there is provided a computer-readable storage medium comprising computer-executable instructions that, when executed by one or more processors, cause the one or more processors to Execution: the computing terminal obtains from the core router a GET request message from the source IP address associated with the specific user; the computing terminal analyzes the obtained HTTP request message to count the HTTP request messages per unit time. the number of different destination IP addresses contained in the request message; comparing the number of different destination IP addresses with a threshold by the computing terminal; and in response to determining that the number of different destination IP addresses is greater than the threshold, the computing The terminal identifies that the specific user has illegal broadband access behavior.

The method of the present invention combines the inevitable behavior characteristics of user network access, and the method of analyzing user behavior has high accuracy in identifying illegal behaviors, and solves the problem of avoiding detection by modifying IP packet header information by third-party technology. At the same time, because the inventive method adopts the client/server C/S architecture, the terminal in the computer room is fully utilized, and the problem of large investment caused by the deployment of probes in different networks is reduced.

The present invention analyzes and counts the essential and unmodifiable information (destination IP address) in the HTTP message of the user surfing the Internet, avoids the limitation brought by the prior art for statistics on specific applications or accounts, and avoids being The third-party device or program modifies the fields of the packet header, resulting in the risk of detection being avoided. Through practical verification, the present invention can accurately find large-bandwidth users with illegal private connections. In addition, the technical solution of the present invention is convenient to deploy, makes full use of the computing power of the terminal in the monitoring computer room, and can provide intuitive and efficient display of results.

6 illustrates an exemplary configuration of a computing device 1200 capable of implementing embodiments in accordance with the present disclosure.

Computing device 1200 is an example of a hardware device to which the above-described aspects of the present disclosure can be applied. Computing device 1200 may be any machine configured to perform processing and/or computation. Computing device 1200 may be, but is not limited to, a workstation, server, desktop computer, laptop computer, tablet computer, personal data assistant (PDA), smartphone, vehicle-mounted computer, or combinations thereof.

As shown in FIG. 6, computing device 1200 may include one or more elements that may connect or communicate with bus 1202 via one or more interfaces. The bus 2102 may include, but is not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and an external bus. Set up component interconnect (PCI) bus and so on. Computing device 1200 may include, for example, one or more processors 1204 , one or more input devices 1206 , and one or more output devices 1208 . The one or more processors 1204 may be any kind of processors, and may include, but are not limited to, one or more general-purpose processors or special-purpose processors (such as special-purpose processing chips). Computing device 1200, which may correspond to monitoring terminal 240 in FIG. 2, for example, is configured to implement method 100 for identifying broadband violation access. Input device 1206 may be any type of input device capable of inputting information to a computing device, and may include, but is not limited to, a mouse, keyboard, touch screen, microphone, and/or remote controller. Output device 1208 may be any type of device capable of presenting information, and may include, but is not limited to, displays, speakers, video/audio output terminals, vibrators, and/or printers.

Computing device 1200 may also include or be connected to non-transitory storage device 1214, which may be any storage device that is non-transitory and may implement data storage, and may include, but is not limited to, disk drives, optical storage device, solid state memory, floppy disk, flexible disk, hard disk, magnetic tape or any other magnetic medium, compact disk or any other optical medium, cache memory and/or any other memory chip or module, and/or from which a computer can read data , instructions and/or code in any other medium. Computing device 1200 may also include random access memory (RAM) 1210 and read only memory (ROM) 1212 . ROM 1212 may store programs, utilities or processes to be executed in a non-volatile manner. RAM 1210 may provide volatile data storage and store instructions related to the operation of computing device 1200 . Computing device 1200 may also include a network/bus interface 1216 coupled to data link 1218 . The network/bus interface 1216 may be any kind of device or system capable of enabling communication with external devices and/or networks, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication devices, and/or chipsets (such as Bluetooth ^™ devices, 802.11 devices, WiFi devices, WiMax devices, cellular communication facilities, etc.).

The present disclosure may be implemented as any combination of apparatus, system, integrated circuit, and computer program on a non-transitory computer-readable medium. One or more processors may be implemented as integrated circuits (ICs), application specific integrated circuits (ASICs) or large scale integrated circuits (LSIs), system LSIs, super LSIs or ultra LSIs that perform some or all of the functions described in this disclosure components.

The present disclosure includes the use of software, applications, computer programs or algorithms. Software, applications, computer programs or algorithms may be stored on a non-transitory computer readable medium to cause a computer, such as one or more processors, to perform the steps described above and described in the figures. For example, one or more memories store software or algorithms in executable instructions, and one or more processors may be associated with a set of instructions that execute the software or algorithms to provide various functions in accordance with the embodiments described in this disclosure.

Software and computer programs (also referred to as programs, software applications, applications, components, or code) include machine instructions for programmable processors and can be written in high-level procedural languages, object-oriented programming languages, functional programming languages , logic programming language or assembly language or machine language. The term "computer-readable medium" refers to any computer program product, apparatus, or device for providing machine instructions or data to a programmable data processor, such as magnetic disks, optical disks, solid-state storage devices, memories, and programmable logic devices (PLDs) , including a computer-readable medium receiving machine instructions as computer-readable signals.

Computer-readable media may include, for example, dynamic random access memory (DRAM), random access memory (RAM), read only memory (ROM), electrically erasable read only memory (EEPROM), compact disk read only memory ( CD-ROM) or other optical disk storage devices, magnetic disk storage devices or other magnetic storage devices, or may be used to carry or store the desired computer readable program code in the form of instructions or data structures and capable of being used by a general purpose or special purpose computer or general purpose or any other medium accessed by a dedicated processor. As used herein, a magnetic disk or disk includes compact disk (CD), laser disk, optical disk, digital versatile disk (DVD), floppy disk and blu-ray disk, where disks usually reproduce data magnetically, while disks reproduce data by laser Copy data optically. Combinations of the above are also included within the scope of computer-readable media.

The subject matter of the present disclosure is provided as examples of apparatuses, systems, methods, and programs for performing the features described in this disclosure. However, in addition to the features described above, other features or variations are also contemplated. It is contemplated that implementation of the components and functions of the present disclosure may be accomplished with any emerging technology that may replace any of the above-implemented technologies.

Additionally, the above description provides examples, and does not limit the scope, applicability, or configuration set forth in the claims. Changes may be made in the function and arrangement of elements discussed without departing from the spirit and scope of the disclosure. Various embodiments may omit, substitute or add various procedures or components as appropriate. For example, features described with respect to some embodiments may be combined in other embodiments.

In addition, in the description of the present disclosure, the terms "first", "second", "third", etc. are used for descriptive purposes only and should not be construed as indicating or implying relative importance and order.

Similarly, although operations are depicted in the figures in a particular order, this should not be construed as requiring that such operations be performed in the particular order shown or in a sequential order, or that all illustrated operations be performed to achieve the desired the result of. In some cases, multitasking and parallel processing can be advantageous.

Claims (12)

1. A method for identifying broadband illegal access, comprising:

acquiring a GET mode HTTP request message from a source IP address associated with a specific user from a core router by a computing terminal;

analyzing the acquired HTTP request message by the computing terminal to count the number of different destination IP addresses contained in the HTTP request message in unit time;

comparing, by the computing terminal, the number of different destination IP addresses to a threshold; and

in response to determining that the number of different destination IP addresses is greater than a threshold, the computing terminal identifies that the particular user has a broadband illegal access behavior.

2. The method of claim 1, wherein the computing terminal is connected to a core router of a metropolitan area network room by a network cable.

3. The method of claim 2, wherein obtaining a GET-mode HTTP request message from a source IP address associated with a particular user comprises:

and mirroring HTTP request messages in a GET mode to the computing terminal through a strategy according to the source IP address.

4. The method of claim 1, wherein counting the number of different destination IP addresses contained in the HTTP request message per unit time comprises:

counting the number of different destination IP addresses contained in the HTTP request message in a plurality of time periods; and

and calculating the median of the number of different destination IP addresses contained in the HTTP request message in a plurality of counted time intervals.

5. The method of claim 4, wherein comparing the number of different destination IP addresses to a threshold comprises comparing the median to the threshold.

6. The method of claim 1, wherein the threshold is determined based on statistics of other users of the same bandwidth and scale under the same node as the particular user.

7. The method of claim 6, wherein the threshold is a multiple of the number of different destination IP addresses contained in HTTP request messages per unit time of other users of the same bandwidth and size under the same node as the particular user.

8. The method of claim 1, further comprising:

presenting the statistical data and analysis results associated with the particular user in a list or graph.

9. The method of claim 8, wherein the presenting is implemented using an echart component.

10. The method of claim 3, wherein command configuring the core router comprises using a dual-thread real mirror function.

11. An apparatus for identifying broadband illegal access, comprising:

a memory having instructions stored thereon; and

a processor configured to execute instructions stored on the memory to perform the method of any of claims 1 to 10.

12. A computer-readable storage medium comprising computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform the method of any one of claims 1-10.

Images