CN114666072B - Illegal transfer point detection method, server, platform, system and storage medium - Google Patents

Abstract

Embodiments of the present invention provide an illegal transfer point detection method, server, platform, system, and storage medium. The method includes receiving message data sent by a client terminal; the message data includes source IP address, client terminal information, and An identification verification code, determining whether the sender of the message data is a client terminal connected to a different network according to the identification verification code, if the sender of the message data is a client terminal connected to a different network, then according to the The source IP address and client terminal information generate a detection instruction, and send the detection instruction to the management platform, the detection instruction is used for the management platform to determine whether the source IP address is an illegal transfer point, the above The method uses the client terminal dial test with the identification verification code, only needs to obtain the message data, does not need to obtain the routing data and business flow, and can effectively and accurately determine the illegal transfer point.

Description

Illegal transfer point detection method, server, platform, system and storage medium

technical field

The embodiments of the present invention relate to the technical field of Internet communication, and in particular to a method for detecting an illegal transfer point, a server, a platform, a system, and a storage medium.

Background technique

The network access between different operators needs to be completed through the preset direct connection point, wherein the direct connection point is the physical connection between the telecommunication networks, so that the users of one telecommunication operation enterprise can communicate with the users of another telecommunication operation enterprise Communicate with each other and settle fees according to the agreement.

In order to save costs while ensuring the quality of the user network, different-network operators will obtain the private line account of the mainstream operator in some way, and use the account as an illegal transfer point to directly access the resources of the mainstream operator. Operators cause economic losses, and at the same time cause network instability of mainstream operators. In the prior art, the detection of illegal transfer points is mainly through the deployment of soft probes in different network environments. The soft probes obtain routing data through the route tracking protocol, and then analyze the routing data to detect illegal transfer points.

However, the operator of the different network may close the routing tracking protocol, so that the soft probe cannot obtain the routing data. The above method has the defect of not being able to effectively and accurately determine the illegal transfer point.

Contents of the invention

Embodiments of the present invention provide an illegal transfer point detection method, a server, a platform, a system, and a storage medium, so as to improve the effectiveness and accuracy of illegal transfer point detection.

In the first aspect, the embodiment of the present invention provides a method for detecting an illegal transfer point, which is applied to a test server, including:

Receive the message data sent by the client terminal; the message data includes source IP address, client terminal information and identification verification code; wherein, the identification verification code is the data issued by the management platform according to the client terminal information;

Determine whether the sender of the message data is a client terminal connected to a different network according to the identification verification code;

If the sender of the message data is a client terminal connected to a different network, then generate a detection instruction according to the source IP address and client terminal information, and send the detection instruction to the management platform, and the detection instruction It is used for the management platform to determine whether the source IP address is an illegal transfer point.

Optionally, determining whether the sender of the message data is a client terminal connected to a different network according to the identification verification code includes:

Analyzing the message data to obtain the identification verification code in the message data;

Performing operations on the identification verification code and the first verification information according to a preset verification rule to obtain a verification result;

Judging whether the verification result is consistent with the second verification information, if consistent, then determining that the sender of the message data is a client terminal connected to a different network;

Wherein, the first verification information and the second verification information are data generated by the management platform according to preset verification rules and sent to the test server.

Optionally, the test server is a central office acquisition and analysis device arranged at the exit of the metropolitan area network of this province, the message data includes a destination IP address or a destination port, and the message data sent by the receiving client terminal includes:

Collect the message data of the provincial MAN export;

From the collected packet data, filter out the packet data containing the preset destination IP address or destination port.

Optionally, the test server is a test server corresponding to a destination IP address or a destination port, and the message data includes a destination IP address or a destination port, and the receiving the message data sent by the client terminal includes:

Receive packet data including the destination IP address or destination port.

In the second aspect, the embodiment of the present invention provides an illegal transfer point detection method, which is applied to the management platform, including:

Send the identification verification code to the client terminal, so that the client terminal obtains the message data according to the source IP address, the client terminal information and the identification verification code, and sends the obtained message data to the test server;

Receiving the detection instruction sent by the test server, the detection instruction includes source IP address and client terminal information; wherein, the detection instruction is the test server receiving the message data sent by the client terminal, and determining the message data The sender is generated by a client terminal connected to a different network and sent to the management platform;

Determine whether the source IP address is an illegal transfer point according to the detection instruction.

Optionally, determining whether the source IP address is an illegal transfer point according to the detection instruction includes:

determining a source IP address corresponding to the client terminal according to the client terminal information;

Judging whether the source IP address corresponding to the client terminal is consistent with the source IP address in the message data;

If not, it is determined that the source IP address in the packet data is an illegal transfer point.

Optionally, the test server is a local acquisition and analysis device arranged at the exit of the metropolitan area network of this province, the message data includes a destination IP address or a destination port, and the detection instruction sent by the receiving test server includes:

receiving a detection instruction sent by the central office collection and analysis device; the detection instruction is generated by the central office collection and analysis device after determining that the sender of the message data is a client terminal connected to a different network.

Optionally, the test server is a test server corresponding to a destination IP address or a destination port, and the message data includes a destination IP address or a destination port, and the detection instruction sent by the receiving test server includes:

receiving a detection instruction sent by the test server; the detection instruction is generated by the test server after determining that the sender of the message data is a client terminal connected to a different network.

Optionally, the sending the identification verification code to the client terminal includes:

receiving the client terminal ID sent by the client terminal;

Verify the ID of the client terminal, and if the verification is passed, send the test task and the identification verification code to the client terminal, so that the client terminal obtains the encapsulated message data according to the test task and the identification verification code; wherein, The test task includes destination IP or destination port.

In a third aspect, an embodiment of the present invention provides a test server, including: at least one processor and a memory;

the memory stores computer-executable instructions;

The at least one processor executes the computer-executed instructions stored in the memory, so that the at least one processor executes the illegal transfer point detection method according to any one of the first aspect.

In a fourth aspect, an embodiment of the present invention provides a management platform, including: at least one processor and a memory;

the memory stores computer-executable instructions;

The at least one processor executes the computer-executed instructions stored in the memory, so that the at least one processor executes the illegal transfer point detection method according to any one of the second aspect.

In a fifth aspect, an embodiment of the present invention provides an illegal transfer point detection system, including the test server described in the third aspect and the management platform described in the fourth aspect.

In a sixth aspect, an embodiment of the present invention provides a computer-readable storage medium, where computer-executable instructions are stored in the computer-readable storage medium, and when a processor executes the computer-executable instructions, the first aspect and the second aspect are implemented. The illegal transfer point detection method described in any one of the aspects.

The illegal transfer point detection method, server, platform, system, and storage medium provided by the embodiments of the present invention, the method sets a client terminal with an identification verification code in a different network environment, sends message data through the client terminal, and passes the test The server receives the message data, and judges the message data to determine whether the sending of the message data is the message data sent by the client terminal connected to the different network, and if so, sends the source IP address and the client terminal information to the management platform, the management platform judges the source IP address through the information of the client terminal, and determines whether the source IP address in the message data is an illegal transfer point. According to whether the source IP address changes, it can be determined whether the source IP address is an illegal transfer point.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained according to these drawings without any creative effort.

FIG. 1 is a schematic diagram of an application scenario of an illegal transfer point detection method provided by an embodiment of the present invention;

FIG. 2 is a schematic flowchart of an illegal transfer point detection method provided by an embodiment of the present invention;

Fig. 3 is a schematic flow diagram of a method for detecting an illegal transfer point in the province provided by an embodiment of the present invention;

FIG. 4 is a schematic diagram of a client terminal simulation application when detecting an illegal transfer point in the province provided by an embodiment of the present invention;

Fig. 5 is a schematic diagram of data processing when detecting an illegal transfer point in the province provided by an embodiment of the present invention;

FIG. 6 is a schematic flowchart of a method for detecting illegal transfer points in other provinces provided by an embodiment of the present invention;

FIG. 7 is a schematic diagram of a client terminal simulation application when detecting illegal transfer points in other provinces provided by an embodiment of the present invention;

8 is a schematic diagram of data processing when detecting illegal transfer points in other provinces provided by an embodiment of the present invention;

FIG. 9 is a schematic flowchart of another method for detecting an illegal transfer point provided by an embodiment of the present invention;

FIG. 10 is a schematic flowchart of another method for detecting illegal transfer points in the province provided by the embodiment of the present invention;

FIG. 11 is a schematic flowchart of another method for detecting illegal transfer points in other provinces provided by the embodiment of the present invention;

FIG. 12 is a schematic structural diagram of an illegal transfer point detection device provided by an embodiment of the present invention;

FIG. 13 is a schematic structural diagram of another illegal transfer point detection device provided by an embodiment of the present invention;

FIG. 14 is a schematic diagram of a hardware structure of a test server provided by an embodiment of the present invention;

FIG. 15 is a schematic diagram of the hardware structure of the management platform provided by the embodiment of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

The terms "first", "second", "third", "fourth", etc. (if any) in the description and claims of the present invention and the above drawings are used to distinguish similar objects and not necessarily Describe a specific order or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances such that the embodiments of the invention described herein are, for example, capable of practice in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having", as well as any variations thereof, are intended to cover a non-exclusive inclusion, for example, a process, method, system, product or device comprising a sequence of steps or elements is not necessarily limited to the expressly listed instead, may include other steps or elements not explicitly listed or inherent to the process, method, product or apparatus.

Fig. 1 is a schematic diagram of an application scenario of an illegal transfer point detection method provided by an embodiment of the present invention. Carrier B subnet. Wherein, the operator A network is a network of a certain operator, and the operator B network is a network of any operator except the operator A network. The operator A subnet refers to one of several small networks divided by the addresses of the operator A network, and the operator B subnet refers to one of the several small networks divided by the addresses of the operator B network. Wherein, the operator A network and the operator B network are different networks from each other, that is, they belong to different networks.

Under normal circumstances, when the subnet of operator A communicates with the subnet of operator B, it needs to establish a connection with the subnet of operator B through the network of operator A, the direct connection point, and the network of operator B. However, if the subnet of operator A If the network directly accesses the content of the operator B subnet by establishing an illegal transfer point on the operator B subnet, it is an illegal transfer. Among them, the illegal transfer point may be a certain IP address in the province, or it may be a certain IP address in other provinces. As shown in Figure 1, line 1 in the figure represents the legal data flow from the carrier A subnet to the carrier B subnet; line 2 represents the illegal data flow from the carrier A subnet to the carrier B subnet; the triangle Indicates an illegal transfer point.

In some technologies, the determination of illegal transfer points is usually to arrange software probes in different network environments. After obtaining the target route through the software probes, send the target route to the reporting point, and determine whether there is an illegal transfer point based on the target route. contact. However, in this method, the target route needs to be obtained through a traceroute protocol when obtaining the routing data. For the different network group, the agreement can be closed, resulting in the network group being unable to obtain the target route, and thus unable to determine whether the different network group has set up an illegal transfer point on the network.

In other technologies, illegal transfer points are determined by collecting IDC (Internet Data Center, Internet Data Center) business traffic. The method of collecting IDC business traffic refers to statistics and analysis of the acquired business traffic from multiple dimensions , analyze the traffic flow and protocol ratio to determine the suspected IP. However, on the one hand, this method can only analyze the traffic, and the determined illegal transfer point is not accurate enough; on the other hand, the illegal transfer group can use different protocols and interfaces to access the transferred traffic through different transfer points. , therefore, cannot effectively determine the illegal transfer point.

When the different network group sets an illegal transfer point, the source IP address of the message data will change when passing through the illegal transfer point. Therefore, the client terminal can be connected to the different network environment, and the received message data Make a judgment, if the message data is sent by a client terminal connected to a different network environment, and the source IP address of the message data is not the source IP address of the local network, then the source IP address corresponding to the message data is illegal transfer point. Specifically, the identification verification code can be inserted into the message data sent by the client terminal to determine whether the received message data is sent by a client terminal connected to a different network environment. This process does not need to obtain the target routing data. It can effectively determine whether the source IP address of the message data is an illegal transfer point, and the method does not depend on the service flow, and can solve the defects caused by the method of collecting IDC service flow to determine the illegal transfer point.

The technical solution of the present invention will be described in detail below with specific embodiments. The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

FIG. 2 is a schematic flowchart of a method for detecting an illegal transfer point provided by an embodiment of the present invention, and the method of this embodiment may be executed by a test server. As shown in Figure 2, the method of this embodiment may include:

S201. Receive message data sent by a client terminal; the message data includes a source IP address, client terminal information, and an identification verification code; wherein the identification verification code is data issued by the management platform according to the client terminal information.

In this embodiment, the client terminal includes a client terminal that sends message data to the test server through a normal network, and also includes a client terminal that is connected in a different network environment and is provided with an identification verification code in the message data sent, wherein , the client terminal connected in a different network environment is called a soft probe client. The test server cooperates with the client terminal in the different network environment to simulate Internet services through the client terminal, and the test server receives the message data sent by the client terminal. Among them, the number of client terminals can be multiple, and they must be connected to different locations on different networks, so as to avoid being analyzed by the other party and being shielded, and detection failure occurs.

The message data sent by the client terminal includes source IP address, client terminal information and identification verification code, wherein, the source IP address refers to the IP address of the client terminal when sending the message; the client information refers to the client ID or client ID. The name of the terminal and the number of the task to be executed, etc.; the identification verification code is a verification code randomly generated by the management platform through preset rules, for example, it can be a 64bit random verification code.

Wherein, the message data is the request data initiated by the client terminal when surfing the Internet. The request data can include different types of real services according to the tasks issued by the management platform, such as simulating the services of client terminals visiting websites, simulating services of client terminals watching video resources, simulating services of client terminals downloading resources, and so on.

The test server can receive data by copying the uplink traffic and obtaining packet data from the uplink traffic, or directly receive the packet data sent by the client terminal.

S202. Determine whether the sender of the message data is a client terminal connected to a different network according to the identification verification code.

Among them, the different network refers to the network of other operators, and the local network refers to the network of the operator to which the tester belongs. For example, the local network is the network of the China Unicom operator, and the foreign network is any network of the non-China Unicom operator. When the test server receives the message data, the source of the message data may be a client terminal connected in a different network environment, or may be a client terminal connected in a local network environment. Therefore, when determining an illegal transfer point, it is necessary to first determine that the sender of the message data is a client terminal connected to a different network environment, and then judge whether the message data of the client terminal in a different network environment passes through an illegal transfer point .

Specifically, it can be determined through the identification verification code. The test server can obtain the identification verification code in the message data and process the identification verification code. If the processed result meets the preset conditions, it means that the message data is sent The party is a client terminal connected to a different network.

S203. If the sender of the message data is a client terminal connected to a different network, generate a detection instruction according to the source IP address and client terminal information, and send the detection instruction to the management platform, the The detection instruction is used for the management platform to determine whether the source IP address is an illegal transfer point.

In this embodiment, after determining that the client terminal is connected to a different network, it is necessary to continue to judge according to the message data of the client terminal to determine whether the source IP address in the message data is an illegal transfer point. Wherein, the judging process can be executed on the management platform. Specifically, after the test server determines that the client terminal is connected to a different network environment, it can decapsulate the packet data, obtain the client terminal information and source IP address, and unpack the obtained client terminal information and source IP address. Combine the IP addresses to generate a detection instruction, and send the detection instruction to the management platform.

The management platform can determine whether the source IP address is an illegal transfer point according to the detection instruction. The basis for the judgment of the management platform is that when the message data sent by the client terminal passes through the illegal transfer point, the source IP address in the message data The address will change; and when the message data sent by the client terminal is transmitted through a legal channel, the source IP address in the message will not change. The management can determine whether the source IP address is an illegal transfer point by judging the source IP address in the message data.

The above method for determining whether the source IP address is an illegal transfer point can accurately determine whether the sender of the message data is a client terminal in a different network environment by inserting an identification verification code into the message data, and then the source of the client terminal Judging the IP address makes it possible to accurately determine the illegal transfer point. This method does not need to obtain routing data. When the other party closes the control message protocol, the illegal transfer point can also be determined. In addition, it can also be resolved through traffic analysis. The defect of inaccurate illegal transfer point.

Figure 3 is a schematic flowchart of a method for detecting illegal transfer points in the province provided by an embodiment of the present invention, and Figure 4 is a schematic diagram of a client terminal simulation application for detecting illegal transfer points in the province provided by an embodiment of the present invention ; Figure 5 is a schematic diagram of data processing provided by the embodiment of the present invention when detecting illegal transfer points in this province; The effect of illegal transit points in the province. Referring to FIG. 3 , FIG. 4 and FIG. 5 , this embodiment will be described in detail. As shown in Figure 3, the method of this embodiment includes:

Step S301, collecting packet data at the egress of the MAN.

Wherein, the test server is a central office acquisition and analysis device installed at the exit of the provincial MAN, and the message data includes a destination IP address or a destination port.

In this embodiment, the province refers to the province where the tester is located, and the network refers to the network of the operator to which the tester belongs. In this case, it can be understood that when the operator of a different network in this province sets up an illegal transfer point in this province and passes the When an illegal transfer point smuggles traffic from another network to the local network, the illegal transfer point can be detected.

Among them, when detecting illegal transfer points in this province, the test server is the central office collection and analysis equipment, which is a server with data collection and analysis. As shown in Figure 4, the client terminal is set in the different network environment of the province, and the central office acquisition and analysis equipment is set at the exit of the MAN of the province, that is, the exit of the MAN of the local network of the province, and the collected data is Packet data flowing through the province and the network. Among them, the illegal transfer point can provide NAT or Proxy service. NAT refers to the IP conversion Internet access function device, and Proxy refers to the protocol Internet access proxy server. Through NAT or Proxy, the traffic from different networks can be smuggled to the local network.

Wherein, the data collection method may be port mirroring or passive optical splitting, so as to copy the access request data of the broadband users out of the network to the central office collection and analysis equipment. Among them, port mirroring refers to copying the outbound data of the uplink port of the switch to the collection and analysis equipment at the local end by setting port mirroring on the switch at the core layer or the aggregation layer of the network. Passive optical splitting refers to setting an optical splitter at an optical line terminal, and obtaining user access request data through optical replication on the physical layer. Wherein, the access request data is message data.

As shown in Figure 5, the state of the message data sent by the client terminal is the original state of the message data. The state is the state when the packet enters the local network. Among them, the source IP address in the message data sent by the client terminal is Local_ip, the source IP address in the received message data is Global_ip, Local_ip represents the network IP address used in the different network environment, and Global_ip represents the network IP address used in the local network environment The network IP address used in . When passing through an illegal transfer point, the source IP address changes, that is, Local_ip is not equal to Global_ip; when not passing through an illegal transfer point, the source IP address does not change, that is, Local_ip is equal to Global_ip.

Step S302, filter out the packet data including the preset destination IP address or destination port from the collected packet data.

Wherein, after obtaining the message data, the central office acquisition and analysis device can filter the acquired message data. Specifically, the message data sent by the client terminal includes the destination IP or destination port, and the central office acquisition and analysis device can Filter packet data by destination IP or destination port. Specifically, the message data corresponding to the destination IP or destination port to be screened can be determined by receiving an instruction sent by the management platform.

According to the destination IP address or destination port of the Internet resource A issued by the management platform, the client terminal sends the message data to access the Internet resource A, as shown in Figure 4 data flow 1; The destination IP address or destination port where the Internet resource B is located, sends the packet data to access the Internet resource B, as shown in data flow 2 in FIG. 4 . The central office acquisition and analysis device can obtain the message data corresponding to data flow 1 and data flow 2 through the destination IP or destination port corresponding to Internet resource A and Internet resource B. Wherein, the target address of the test data flow is different from the protocol, and may form different IP addresses of the local network, such as Global_ip1 and Global_ip2.

By filtering the data containing the destination IP or destination port, the number of processing packet data collected and analyzed by the central office can be reduced.

Step S303 , analyzing and processing the message data to obtain an identification verification code in the message data.

When judging whether the sender of the message data is a client terminal connected to a different network according to the identification verification code, the obtained message data can be parsed first to obtain the identification verification code in the message data, where depth can be used The Deep Packet Inspection (DPI) technology unlocks the Layer 3 and Layer 4 packet headers of the Open System Interconnection Communication Reference Model, and analyzes the value at the specified position to obtain the identification verification code.

Step S304, performing calculations on the identification verification code and the first verification information according to a preset verification rule to obtain a verification result.

Wherein, in this embodiment, after the identification verification code is acquired, the identification verification code may be verified. The central office collects and analyzes the first verification information and the second verification information issued by the management platform in the storage, wherein the second verification information is calculated according to the identification verification code and the first verification information through the preset verification rules owned. The first verification information, the second verification information and the identification verification code are binary data.

Therefore, after the identification verification code is obtained, the identification verification code and the first verification information may be operated according to a preset verification rule to obtain a verification result. For example, if the data delivered by the management platform is obtained through the verification rule of the AND operation, then the AND operation is performed on the identification verification code and the first verification information to obtain the verification result of the AND operation.

Step S305 , judging whether the verification result is consistent with the second verification information, and if so, determining that the sender of the message data is a client terminal connected to a different network.

Wherein, the first verification information and the second verification information are data generated by the management platform according to preset verification rules and sent to the test server.

After the verification result is obtained, the verification result can be compared with the second verification information to determine whether they are consistent. If they are consistent, it means that the identification verification code is the data issued by the management platform, and the report corresponding to the identification verification code The sender of text data is a client terminal connected to a different network. If not, it means that the identification verification code is not the data issued by the management platform, and the sender of the message data corresponding to the identification verification code is not a client terminal connected to a different network.

Step S306, if the sender of the message data is a client terminal connected to a different network, generate a detection instruction according to the source IP address and client terminal information, and send the detection instruction to the management platform, The detection instruction is used for the management platform to determine whether the source IP address is an illegal transfer point.

Wherein, step S306 is similar to step S203 in the foregoing embodiment, and details are not described here in this embodiment.

In the above-mentioned embodiment, the message data of all destination IP addresses or destination ports can be obtained by setting a central office acquisition and analysis device, without setting up multiple test servers, and the management platform can uniformly generate the identification verification code, the first verification information and The second verification information, and make the test server verify the identification verification code according to the two verification information. This process requires a second verification, first obtain the verification result, and then verify the verification result, which has a relatively High security. In addition, the identification verification code is randomly generated, and the verification rules can be changed at any time, which cannot be tracked by Yiwang Group.

Fig. 6 is a schematic flowchart of a method for detecting illegal transfer points in other provinces provided by an embodiment of the present invention, and Fig. 7 is a simulation of a client terminal when detecting illegal transfer points in other provinces provided by an embodiment of the present invention Application schematic diagram; FIG. 8 is a schematic diagram of data processing when detecting illegal transfer points in other provinces provided by the embodiment of the present invention. On the basis of the above embodiments, the embodiment of the present invention can detect illegal transfer points in other provinces, and can achieve the effect of detecting illegal transfer points in other provinces. As shown in Figure 6, the method of this embodiment includes:

Step S601. Receive packet data including the destination IP address or destination port.

Wherein, the test server is a test server corresponding to the destination IP address or destination port, and the packet data includes the destination IP address or destination port.

In this embodiment, other provinces refer to provinces where non-testers are located. The test server is an information port node, and the information port node is a program running on the server. The server can be set on any network, and the number of information port nodes can be as large as possible. In order to obtain more message data, one information port node can only test the message data of one destination IP or destination port. The program of the information port node supports the general server of X86 architecture, and the operating system of CenOS7.0 and above.

The list of message data monitored by the information port node is determined by the management platform, which can support definition according to the target protocol TCP/UDP, target IP address and target port, and can also cover a variety of real Internet services.

The message data obtained by the information port node is the message data flowing through other provinces. For example, the information port node is a test server set up in province A (not the province), and the received message data is the message flowing through province A data.

The message data obtained by the information port node directly includes the data of the destination IP address or destination port, without the process of data screening. In addition, the information port node has the characteristics of flexible deployment and application scalability, and can cooperate with client terminals to obtain useful information.

When it is necessary to detect illegal transfer points in other provinces, if the central office collection and analysis equipment is installed at the exit of the MAN in other provinces, all the uplink access data of the other provinces will be obtained, which will cause hidden dangers to the data security of the other provinces. Therefore, the above-mentioned The method cannot realize the positioning of illegal transfer points in other provinces.

By setting up the information port node in the tested place, the message data of the destination IP address or destination port can be obtained directly, without collecting all the data of the MAN egress, and then the analysis of the message data can be realized, and the data can be determined according to the message data. Whether there is an illegal transfer point.

As shown in Figure 7, information port nodes can be set up in different networks, CDN networks, cloud resources, local networks of other provinces, and local networks of this province, etc., and management platforms can be set up on local networks of this province to receive detection instructions sent by information port nodes .

The detection method for illegal transfer points in other provinces is the same as that in this province. As shown in Figure 8, if the packet data passes through illegal transfer points in other provinces, the source IP address will change.

It should be noted that this method can also detect illegal transfer points in the province, that is, set the information port node at the location of the province's main network.

Step S602, analyzing and processing the message data to obtain an identification verification code in the message data.

Step S603, performing calculations on the identification verification code and the first verification information according to a preset verification rule to obtain a verification result.

Step S604, judging whether the verification result is consistent with the second verification information, and if so, determining that the sender of the message data is a client terminal connected to a different network.

Wherein, the first verification information and the second verification information are data generated by the management platform according to preset verification rules and sent to the test server.

Step S605, if the sender of the message data is a client terminal connected to a different network, generate a detection instruction according to the source IP address and client terminal information, and send the detection instruction to the management platform, the The detection instruction is used for the management platform to determine whether the source IP address is an illegal transfer point.

Wherein, Step S602 to Step S605 are similar to Step S303 to Step S306 in the above-mentioned embodiment, and details are not described here in this embodiment.

The above embodiments can detect illegal transfer points in other provinces by setting information port nodes, which can make the client terminal test target more flexible, obtain more valid message data, and improve the efficiency of screening illegal transfer points . The information port node can also be flexibly deployed to avoid being monitored by the different network group.

FIG. 9 is a schematic flowchart of another illegal transfer point detection method provided by an embodiment of the present invention, and the method of this embodiment can be executed by a management platform. As shown in Figure 9, the method of this embodiment may include:

Step S901 , sending the identification verification code to the client terminal, so that the client terminal obtains message data according to the source IP address, client terminal information and the identification verification code, and sends the obtained message data to the test server.

In this embodiment, during the detection process of an illegal transfer point, the management platform needs to first send an identification verification code to the client terminal, and the identification verification code is randomly generated by the management platform through preset verification rules. After receiving the identification verification code, the client terminal can obtain message data according to the identification verification code, source IP address, and client terminal information. Specifically, the client terminal may encapsulate the above data according to preset rules to obtain message data.

Step S902. Receive a detection instruction sent by the test server, where the detection instruction includes a source IP address and client terminal information.

Wherein, the detection instruction is generated and sent to the management platform after the test server receives the message data sent by the client terminal and determines that the sender of the message data is a client terminal connected to a different network.

In this embodiment, after the test server determines that the sender of the message data is a client terminal connected to a different network, it can generate a detection instruction, and the management platform can receive the detection instruction.

Step S903. Determine whether the source IP address is an illegal transfer point according to the detection instruction.

Wherein, when the management platform judges whether there is an illegal transfer point according to the detection instruction, specifically, it may judge whether the source IP address is an illegal transfer point according to the client terminal information in the detection instruction.

When the message data passes through an illegal transfer point, the source IP address will change. Therefore, based on the above facts, the management platform can determine whether the source IP address is an illegal transfer point.

In the above method, after determining that the message data is sent by a client terminal on a different network, the source IP address in the message data can be judged. If the source IP address of the text data changes, the source IP address is an illegal transfer point, and the illegal transfer point can be effectively and accurately determined without secondary judgment.

Fig. 10 is a schematic flowchart of another method for detecting illegal transfer points in the province provided by the embodiment of the present invention. On the basis of the above-mentioned embodiments, the embodiment of the present invention can detect illegal transfer points in the province. The effect of detecting illegal transfer points in this province is achieved. As shown in Figure 10, the method of this embodiment includes:

S1001. Send the identification verification code to the client terminal, so that the client terminal obtains message data according to the source IP address, client terminal information and the identification verification code, and sends the obtained message data to the test server.

Optionally, the process of sending the identification verification code to the client terminal may be: receiving the client terminal ID sent by the client terminal; verifying the client terminal ID, and if the verification is passed, sending the test task and An identification verification code, so that the client terminal obtains the encapsulated message data according to the test task and the identification verification code; wherein, the test task includes a destination IP or a destination port.

Before sending the identification verification code to the client terminal, the client terminal needs to be verified first. After the verification is passed, it means that the client terminal is legal. Specifically, the client terminal can first send the client terminal ID to the management platform, and the management platform judges whether the client terminal ID is valid. is the stored client terminal ID, if yes, the verification is passed. After the client terminal passes the verification, the management platform can generate identification verification codes and test tasks. The test tasks can cover a variety of real services, such as services for visiting websites, services for watching video resources, and services for downloading resources.

After obtaining the identification verification code and the test task, the client terminal can encapsulate the obtained data to obtain message data. For the encapsulated message data, refer to the message data shown in FIG. 5 and FIG. 8 .

By verifying the client terminal, it can ensure the information security of the data verification process and avoid being monitored by the different network group.

S1002. Receive a detection instruction sent by the central office collection and analysis device; the detection instruction is generated by the central office collection and analysis device after determining that the sender of the packet data is a client terminal connected to a different network.

The test server is a local acquisition and analysis device installed at the exit of the provincial MAN, and the message data includes a destination IP address or a destination port.

The process of the management platform receiving the detection instruction sent by the central office acquisition and analysis equipment corresponds to the process of the central office acquisition and analysis equipment sending the detection instruction to the management platform. The implementation principle and technical effect are similar and will not be repeated here.

S1003. Determine the source IP address corresponding to the client terminal according to the client terminal information.

S1004. Determine whether the source IP address corresponding to the client terminal is consistent with the source IP address in the packet data.

S1005. If inconsistent, determine that the source IP address in the packet data is an illegal transfer point.

When determining whether the source IP address is an illegal transfer point, it can be judged according to the information of the client terminal. Wherein, the client terminal information may be a client terminal ID, and may also be a client terminal name.

The source IP address of each client terminal is stored in the management platform, and the source IP address is the source IP address when the client terminal sends the message data, that is, the source IP address of the initial state of the message data.

After obtaining the source IP address corresponding to the client terminal, the source IP address corresponding to the client terminal can be compared with the source IP address in the message data, if they are inconsistent, it means that the message data has been illegally transferred point, the source IP address has changed; if they are consistent, it means that the packet data is passing through a legal path.

The above method can detect illegal transfer points in the province. Before sending the identification verification code to the client terminal, the client terminal needs to be verified first, which can ensure the security of the client terminal. By judging whether the source IP address has changed, the province can be accurately determined. Whether there is an illegal transfer point.

Figure 11 is a schematic flowchart of another method for detecting illegal transfer points in other provinces provided by the embodiment of the present invention. On the basis of the above embodiments, the embodiment of the present invention can detect illegal transfer points in other provinces, The effect of detecting illegal transfer points in other provinces can be achieved. As shown in Figure 10, the method of this embodiment includes:

S1101. Send the identification verification code to the client terminal, so that the client terminal obtains message data according to the source IP address, client terminal information and the identification verification code, and sends the obtained message data to the test server.

Wherein, step S1101 is similar to step S1001 in the above embodiment, and will not be described in detail here in this embodiment.

S1102. Receive a detection instruction sent by the test server; the detection instruction is generated by the test server after determining that the sender of the message data is a client terminal connected to a different network.

Wherein, the test server is a test server corresponding to the destination IP address or destination port, and the packet data includes the destination IP address or destination port.

The process of the management platform receiving the detection instruction sent by the test server corresponds to the process of the test server sending the detection instruction to the management platform. The implementation principle and technical effect are similar, and will not be repeated here.

S1103. Determine the source IP address corresponding to the client terminal according to the client terminal information.

S1104. Determine whether the source IP address corresponding to the client terminal is consistent with the source IP address in the packet data.

S1105. If inconsistent, determine that the source IP address in the packet data is an illegal transfer point.

Wherein, steps S1103 to S1105 are similar to steps S1003 to S1005 in the above-mentioned embodiment, and details are not described here in this embodiment.

The above method can detect illegal transfer points in other provinces. Before sending the identification verification code to the client terminal, the client terminal needs to be verified first, which can ensure the security of the client terminal. By judging whether the source IP address has changed, it can be accurately determined. Whether there are illegal transfer points in other provinces. In addition, the method can also determine illegal transfer points in the province.

FIG. 12 is a schematic structural diagram of an illegal transfer point detection device provided by an embodiment of the present invention. As shown in FIG. 12 , the illegal transfer point detection device 120 provided in this embodiment may include: a first receiving module 1201 , the first determining module 1202 and the first sending module 1203.

The first receiving module 1201 is used to receive the message data sent by the client terminal; the message data includes source IP address, client terminal information and identification verification code; wherein, the identification verification code is issued by the management platform according to the client terminal information sent data.

The first determination module 1202 is configured to determine whether the sender of the message data is a client terminal connected to a different network according to the identification verification code.

The first sending module 1203 is configured to generate a detection instruction according to the source IP address and client terminal information if the sender of the message data is a client terminal connected to a different network, and send the detection instruction to the client terminal In the management platform, the detection instruction is used for the management platform to determine whether the source IP address is an illegal transfer point.

Optionally, the first determining module 1202 is specifically configured to:

Analyzing the message data to obtain the identification verification code in the message data;

Performing operations on the identification verification code and the first verification information according to a preset verification rule to obtain a verification result;

Judging whether the verification result is consistent with the second verification information, if consistent, then determining that the sender of the message data is a client terminal connected to a different network;

Wherein, the first verification information and the second verification information are data generated by the management platform according to preset verification rules and sent to the test server.

Optionally, the first receiving module 1201 is specifically used for:

Collect the message data of the provincial MAN export;

Filter out the packet data containing the preset destination IP address or destination port from the collected packet data;

Wherein, the test server is a central office acquisition and analysis device installed at the exit of the provincial MAN, and the message data includes a destination IP address or a destination port.

Optionally, the first receiving module 1201 is specifically used for:

receiving packet data containing the destination IP address or destination port, wherein the test server is a test server corresponding to the destination IP address or destination port, and the packet data includes the destination IP address or destination port.

The device for detecting an illegal transfer point provided by the embodiment of the present invention can realize the above-mentioned method for detecting an illegal transfer point as shown in FIG. 2, FIG. 3 and FIG. Let me repeat.

Fig. 13 is a schematic structural diagram of another detection device for an illegal transfer point provided by an embodiment of the present invention. As shown in Fig. 13, the detection device 130 for an illegal transfer point provided in this embodiment may include: a second sending module 1301 , a second receiving module 1302 and a second determining module 1303 .

The second sending module 1301 is configured to send the identification verification code to the client terminal, so that the client terminal obtains message data according to the source IP address, client terminal information and the identification verification code and sends it to the test server.

The second receiving module 1302 is configured to receive the detection instruction sent by the test server, the detection instruction includes source IP address and client terminal information; wherein, the detection instruction is the test server receiving the message data sent by the client terminal, It is determined that the sender of the message data is generated by a client terminal connected to a different network and sent to the management platform.

The second determination module 1303 is configured to determine whether the source IP address is an illegal transfer point according to the client information in the detection instruction and the source IP address.

Optionally, the second determining module 1303 is specifically configured to:

determining a source IP address corresponding to the client terminal according to the client terminal information;

Judging whether the source IP address corresponding to the client terminal is consistent with the source IP address in the message data;

If not, it is determined that the source IP address in the packet data is an illegal transfer point.

Optionally, the second receiving module 1302 is specifically used for:

Receiving a detection instruction sent by the central office acquisition and analysis device; the detection instruction is generated by the central office acquisition and analysis equipment after determining that the sender of the message data is a client terminal connected to a different network;

The test server is a local acquisition and analysis device installed at the exit of the provincial MAN, and the message data includes a destination IP address or a destination port.

Optionally, the second receiving module 1302 is specifically used for:

Receiving a detection instruction sent by the test server; the detection instruction is generated by the test server after determining that the sender of the message data is a client terminal connected to a different network;

The test server is a test server corresponding to the destination IP address or destination port, and the packet data includes the destination IP address or destination port.

Optionally, the second sending module 1301 is specifically used for:

receiving the client terminal ID sent by the client terminal;

Verify the ID of the client terminal, and if the verification is passed, send the test task and the identification verification code to the client terminal, so that the client terminal obtains the encapsulated message data according to the test task and the identification verification code; wherein, The test task includes destination IP or destination port.

The detection device for an illegal transfer point provided by the embodiment of the present invention can realize the detection method for an illegal transfer point in the embodiment shown in Fig. 9, Fig. 10 and Fig. 11. Its implementation principle and technical effect are similar, and are not described here Let me repeat.

FIG. 14 is a schematic diagram of a hardware structure of a test server provided by an embodiment of the present invention. As shown in FIG. 14 , the test server 140 provided in this embodiment includes: at least one processor 1401 and a memory 1402 . Wherein, the processor 1401 and the memory 1402 are connected through a bus 1403 .

In a specific implementation process, at least one processor 1401 executes the computer-executed instructions stored in the memory 1402, so that at least one processor 1401 executes the method for detecting an illegal transfer point in the above method embodiment.

For the specific implementation process of the processor 1401, reference may be made to the foregoing method embodiments, and its implementation principles and technical effects are similar, and details are not described here in this embodiment.

FIG. 15 is a schematic diagram of the hardware structure of the management platform provided by the embodiment of the present invention. As shown in FIG. 15 , the management platform 150 provided in this embodiment includes: at least one processor 1501 and a memory 1502 . Wherein, the processor 1501 and the memory 1502 are connected through a bus 1503 .

In a specific implementation process, at least one processor 1501 executes the computer-executed instructions stored in the memory 1502, so that at least one processor 1501 executes the illegal transfer point detection method in the above method embodiment.

For the specific implementation process of the processor 1501, reference may be made to the foregoing method embodiments, and its implementation principles and technical effects are similar, and details are not repeated here in this embodiment.

In the above-mentioned embodiments shown in FIG. 14 and FIG. 15, it should be understood that the processor may be a central processing unit (English: Central Processing Unit, referred to as: CPU), and may also be other general-purpose processors, digital signal processors ( English: Digital Signal Processor, referred to as: DSP), application specific integrated circuit (English: Application Specific Integrated Circuit, referred to as: ASIC), etc. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like. The steps of the method disclosed in conjunction with the invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.

The memory may include high-speed RAM memory, and may also include non-volatile storage NVM, such as at least one disk memory.

The bus may be an Industry Standard Architecture (Industry Standard Architecture, ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (Extended Industry Standard Architecture, EISA) bus, etc. The bus can be divided into address bus, data bus, control bus and so on. For ease of representation, the buses in the drawings of the present application are not limited to only one bus or one type of bus.

An embodiment of the present invention also provides an illegal transfer point detection system, including the test server described in the above embodiment and the management platform described in the above embodiment.

An embodiment of the present invention also provides a computer-readable storage medium, where computer-executable instructions are stored in the computer-readable storage medium, and when the processor executes the computer-executable instructions, the illegal transfer point detection of the above-mentioned method embodiment is realized method.

The above-mentioned computer-readable storage medium, the above-mentioned readable storage medium can be realized by any type of volatile or non-volatile storage device or their combination, such as static random access memory (SRAM), electrically erasable Programmable Read Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Magnetic Memory, Flash Memory, Magnetic or Optical Disk. Readable storage media can be any available media that can be accessed by a general purpose or special purpose computer.

An exemplary readable storage medium is coupled to the processor such the processor can read information from, and write information to, the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium may be located in application specific integrated circuits (Application Specific Integrated Circuits, ASIC for short). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

Those of ordinary skill in the art can understand that all or part of the steps for implementing the above method embodiments can be completed by program instructions and related hardware. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps including the above-mentioned method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. scope.

Claims (13)

1. An illegal transfer point detection method, applied to a test server, is characterized in that, comprising: Receive the message data sent by the client terminal; the message data includes source IP address, client terminal information and identification verification code; wherein, the identification verification code is the data issued by the management platform according to the client terminal information; Determine whether the sender of the message data is a client terminal connected to a different network according to the identification verification code; If the sender of the message data is a client terminal connected to a different network, then generate a detection instruction according to the source IP address and client terminal information, and send the detection instruction to the management platform, and the detection instruction It is used for the management platform to determine whether the source IP address is an illegal transfer point. 2. The method according to claim 1, wherein determining whether the sender of the message data is a client terminal connected to a different network according to the identification verification code comprises: Analyzing the message data to obtain the identification verification code in the message data; Performing operations on the identification verification code and the first verification information according to a preset verification rule to obtain a verification result; Judging whether the verification result is consistent with the second verification information, if consistent, then determining that the sender of the message data is a client terminal connected to a different network; Wherein, the first verification information and the second verification information are data generated by the management platform according to preset verification rules and sent to the test server. 3. the method according to claim 1 or 2, is characterized in that, described test server is arranged on the central office collecting and analyzing equipment of this province's metropolitan area network exit, and described message data comprises purpose IP address or purpose port, so Describe receiving the message data sent by the client terminal, including: Collect the message data of the provincial MAN export; From the collected packet data, filter out the packet data containing the preset destination IP address or destination port. 4. The method according to claim 1 or 2, wherein the test server is a test server corresponding to a destination IP address or a destination port, and the message data includes a destination IP address or a destination port, and the receiving The message data sent by the client terminal, including: Receive packet data including the destination IP address or destination port. 5. A method for detecting an illegal transfer point, applied to a management platform, characterized in that it comprises: Send the identification verification code to the client terminal, so that the client terminal obtains the message data according to the source IP address, the client terminal information and the identification verification code, and sends the obtained message data to the test server; Receiving the detection instruction sent by the test server, the detection instruction includes source IP address and client terminal information; wherein, the detection instruction is the test server receiving the message data sent by the client terminal, and determining the message data The sender is generated by a client terminal connected to a different network and sent to the management platform; Determine whether the source IP address is an illegal transfer point according to the client information in the detection instruction and the source IP address. 6. The method according to claim 5, wherein determining whether the source IP address is an illegal transfer point according to the client information in the detection instruction and the source IP address comprises: determining a source IP address corresponding to the client terminal according to the client terminal information; Judging whether the source IP address corresponding to the client terminal is consistent with the source IP address in the message data; If not, it is determined that the source IP address in the packet data is an illegal transfer point. 7. according to the method described in claim 5 or 6, it is characterized in that, described test server is arranged on the central office collecting and analyzing equipment of this province's metropolitan area network exit, and described message data comprises purpose IP address or purpose port, so Describe receiving the detection instruction sent by the test server, including: receiving a detection instruction sent by the central office collection and analysis device; the detection instruction is generated by the central office collection and analysis device after determining that the sender of the message data is a client terminal connected to a different network. 8. The method according to claim 5 or 6, wherein the test server is a test server corresponding to a destination IP address or a destination port, and the message data includes a destination IP address or a destination port, and the receiving The detection instructions sent by the test server include: receiving a detection instruction sent by the test server; the detection instruction is generated by the test server after determining that the sender of the message data is a client terminal connected to a different network. 9. The method according to claim 5, wherein the sending the identification verification code to the client terminal comprises: receiving the client terminal ID sent by the client terminal; Verify the ID of the client terminal, and if the verification is passed, send the test task and the identification verification code to the client terminal, so that the client terminal obtains the encapsulated message data according to the test task and the identification verification code; wherein, The test task includes destination IP or destination port. 10. A test server, comprising: at least one processor and memory; the memory stores computer-executable instructions; The at least one processor executes the computer-executed instructions stored in the memory, so that the at least one processor executes the illegal transfer point detection method according to any one of claims 1 to 4. 11. A management platform, comprising: at least one processor and memory; the memory stores computer-executable instructions; The at least one processor executes the computer-executed instructions stored in the memory, so that the at least one processor executes the illegal transfer point detection method according to any one of claims 5-9. 12. An illegal transfer point detection system, comprising the test server as claimed in claim 10 and the management platform as claimed in claim 11. 13. A computer-readable storage medium, wherein computer-readable instructions are stored in the computer-readable storage medium, and when the processor executes the computer-executable instructions, the computer-readable storage medium according to any one of claims 1 to 9 is implemented. The illegal transfer point detection method described above.

Images