CN104038929A - Network access anomaly identification method and network access anomaly identification device - Google Patents
Network access anomaly identification method and network access anomaly identification device Download PDFInfo
- Publication number
- CN104038929A CN104038929A CN201410195369.2A CN201410195369A CN104038929A CN 104038929 A CN104038929 A CN 104038929A CN 201410195369 A CN201410195369 A CN 201410195369A CN 104038929 A CN104038929 A CN 104038929A
- Authority
- CN
- China
- Prior art keywords
- application process
- network
- access
- netwoks
- abnormal
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention provides a network access anomaly identification method and a network access anomaly identification device. The network access anomaly identification method comprises steps: when an application process accesses the network, the statistical value of each identifier in at least one identifier used for identifying the network usage of the application process is acquired according to the predetermined cycle; the statistical value of each identifier is compared with the predetermined value corresponding to each identifier and the times of situations where the statistical value exceeds the corresponding predetermined value is determined; when the times is larger than or equal to the predetermined number, the application process network access anomaly can be judged. Through the technical scheme of the invention, the application process with abnormal flow consumption can be timely found out, the network connection of the application process is disconnected, a role of protection is thus achieved before the flow exceeds the standard, and the application process normally used by a user is not disturbed.
Description
Technical field
The present invention relates to terminal technology field, in particular to a kind of access to netwoks abnormality recognition method and the abnormal recognition device of a kind of access to netwoks.
Background technology
Along with 4G (the4Generation mobile communication, the 4th third-generation mobile communication technology) the universal use of network, terminal is in the time being used mobile network, the speed of accesses network is greatly improved, surf the web or download file and use 2G (2-Generation wireless telephone technology, second generation mobile communication technical specification)/3G (3rd – Generation, 3G (Third Generation) Moblie technology) network compares, consuming time greatly reducing, but when being improved, access to netwoks speed also supervenes a problem: when rogue software (trojan horse program) carries out transceiving data by 4G network, may within very short time, use a large amount of flows, even user's flow still in the time exceeding set meal total flow, cause the expense of great number.
For this problem, mainly contain now following two kinds of solutions:
Scheme one: set the upper limit of use traffic, close network and connect in the time that use traffic is more than or equal to default higher limit.But this scheme has obvious deficiency: (1) has stoped the normal use of application.On the one hand, even if use traffic reaches the upper limit, user also may still have the demand of online, and for example: chat tool does not need a large amount of flows, even if use traffic is more than or equal to default higher limit, user may still can use chat tool; Limited on the other hand the access of terminal to network, the application in many terminals cannot be used, and the various application programs that equipment is installed cannot normally be used, and affects user and experiences.(2) can not stop in time the waste of flow.From the angle of normal use, user more wishes that the operable time of the flow in set meal is longer, and flow exceedes that to close that network connects after default higher limit can only be last line of defense, is not user's real demand.
Scheme two: use with the application of antivirus software character a suspicious process list of the title of application process and server or the shared end of cloud is contrasted, once find the process title of coupling, point out this application process possibility access to netwoks of user abnormal, a large amount of consumed flow, the network that prompting disconnects this application process connects.But this scheme is ageing poor; for emerging rogue software (trojan horse program); in process list, there is no record; whether access to netwoks is abnormal with regard to this application process of None-identified for the mode of mating by contrast; will cause a large amount of flow wastes once use; also be that this kind of mode need to first have user to be consumed after a large amount of flows could to judge that a certain application process is is rogue software (trojan horse program), fail effectively to protect user's flow.
Therefore, how to note abnormalities the in time application process of consumed flow the network that disconnects this application process is connected to become technical problem urgently to be resolved hurrily at present.
Summary of the invention
The present invention is just based on the problems referred to above; the abnormal recognition technology of a kind of new access to netwoks has been proposed; the application process of the consumed flow that can note abnormalities in time; the network that disconnects this application process connects; thereby before flow exceeds standard, realize the effect of protection, can not cause interference to the normal application process using of user simultaneously.
In view of this, according to an aspect of the present invention, propose a kind of access to netwoks abnormality recognition method, having comprised: in the time of application process accesses network, obtained the statistical value of each identification item of at least one identification item of the Internet Use for identifying described application process by predetermined period; The statistical value of described each identification item is contrasted with the predetermined value corresponding with described each identification item respectively, and definite statistical value is greater than the number of times that corresponding predetermined value occurs; In the time that described number of times is more than or equal to predetermined quantity, judge that described application process access to netwoks is abnormal.
In this technical scheme, in the time of application process accesses network, by the statistical value of each identification item at least one identification item of the Internet Use of mark application process is compared with the predetermined value corresponding with each identification item respectively, then be greater than according to the statistical value of at least one identification item of the Internet Use of this application process of mark the number of times that corresponding predetermined value occurs, judge that this application process access to netwoks is abnormal, realize in application process use procedure, the application process of discovering network access exception in time, the application process of the consumed flow that also notes abnormalities in time, with in prior art, judge that application process is whether compared with access to netwoks extremely using total flow to disconnect network while exceeding default higher limit and the title of application process and server or cloud is shared to suspicious process list contrast in end, in the use procedure of application process, the application process of the consumed flow that notes abnormalities in time, thereby using total flow to exceed default higher limit (flow exceeds standard) before, the application process of the consumed flow that notes abnormalities in time, the effectively limited flow of protection, make can use the longer time at flow.
Specifically, for identify the statistical value of identification item of Internet Use of application process can be following at least one or a combination set of: the total flow that this application process is used in the given time, the total time of this application process access network and the in the given time total degree etc. of this application process interconnection network in the given time, judge whether access to netwoks can make with the following method application process extremely, for example: when the total flow that this application process is used is in the given time greater than the first predetermined threshold, this application process is carried out to mark, the mark number of times of this application process adds 1 simultaneously, when the total time of this application process access network is greater than the second predetermined threshold in the given time, this application process is carried out to mark, the mark number of times of this application process adds 1 simultaneously, when the total degree of this application process interconnection network is greater than the 3rd predetermined threshold in the given time, this application process is carried out to mark, the mark number of times of this application process adds 1 simultaneously, when total reference numerals of this application process is greater than predetermined quantity (can system default setting, also can be set by the user) time, judge that the access to netwoks of this application process is abnormal.
Certainly, those skilled in the art should be understood that, all should judge whether separately that for each application process access to netwoks is abnormal, and from application process access network, just start the statistic of at least one identification item that obtains the Internet Use for identifying application process with predetermined period, to judge this application process, whether access to netwoks is abnormal, wherein, the time of predetermined period is shorter, the speed of the process of discovering network abnormal access is faster, and the flow that the abnormal application process of access to netwoks consumes is fewer.
In technique scheme, preferably, before obtaining the statistical value of described each identification item, judge whether the network of described application process access is specified network; During as described specified network, carry out the step of the statistical value that obtains described each identification item at the network of judging the access of described application process.
In this technical scheme, by before obtaining the statistical value of the each identification item of application process, whether the network that judges access is specified network, can effectively protect the network traffics while using specified network, specifically, with regard to mobile data network and WIFI (WIreless Fidelity, Wireless Fidelity) network, at one comparatively in specific embodiment, specified network can be mobile data network, because the flow of mobile data network is limited, therefore in the time that application process is used mobile data network, obtain the statistical value of each identification item, to judge whether abnormal consumption flow of application process, network traffics when thereby effectively protection is used mobile data network, and in the time that WIFI network connects, operable flow does not limit, now for application process, whether abnormal consumption flow may not paid close attention to, do not need to obtain the statistical value of each identification item, and at another comparatively in specific embodiment, specified network can be WIFI network, owing to using Mobile data accesses network, while obtaining the statistical value of each identification item, if there is the abnormal application process of access to netwoks, still can consume user's flow, and for fear of this kind of situation, can be in the time that WIFI network connects, whether access to netwoks is abnormal to test each application process, also in the time that WIFI network connects, need to obtain the statistical value of each identification item, judge that whether application process access to netwoks is abnormal, and in the time using Mobile data accesses network, due to application process, whether test has extremely been passed through in access to netwoks under WIFI network, therefore do not need the statistical value of the each identification item that obtains this application process.Certainly, specified network can be also the 4G express network in mobile data network, and for the 2G/3G network of low speed because network rate may not obtain the statistical value of each identification item more slowly yet.
In technique scheme, preferably, after judging that described application process access to netwoks is abnormal, the network that disconnects described application process connects.
In this technical scheme, by in the time judging that application process access to netwoks is abnormal, the network that directly disconnects application process connects, can save as much as possible flow, avoid the abnormal application process of access to netwoks to continue consumed flow, certainly, after connecting, the network that disconnects application process can point out the access to netwoks of this application process of user extremely to disconnect the network connection of this application process.
Certainly, it should be noted that, because the abnormal application process of access to netwoks is likely also the normal application process using of user, therefore by the time judging that application process access to netwoks is abnormal, as comparatively preferred technical scheme, can point out and whether disconnect network connection, be connected and compare with the network that directly disconnects this application process in the time judging that application process access to netwoks is abnormal, avoid the normal application process using of direct disconnect user and likely produce the situation of erroneous judgement, if but when the abnormal application process of access to netwoks is rogue software (trojan horse program), in the time that whether prompting disconnects the network connection of application process, this application process still consuming user's flow, especially, for 4G express network, within the time of prompting, still may consume a lot of flows, be unfavorable for effective protection of flow, therefore, in the time judging that application process access to netwoks is abnormal, processing mode can default setting be directly to disconnect network to connect, certainly, processing mode also can be arranged by user, effectively to protect flow.As more preferred technical scheme, can different processing modes be set according to the difference of application process.For example, adopt prompting whether to disconnect the mode that network connects for the application process of chat tool class, adopt for the application process except chat tool (browser, music video, game etc.) mode that network connects that directly disconnects.
In technique scheme, preferably, also comprise: obtain the total flow that all application processes of accesses network have been used; Judge whether described total flow is less than first threshold; And in the time judging that the abnormal and described total flow of described application process access to netwoks is less than described first threshold, upload the information of described application process to network terminal.
In this technical scheme, by in the time judging application process access to netwoks extremely and the use total flow of all processes of accesses network is less than first threshold, also be in the situation of flow permission, for example upload the information of application process, to network terminal (: server or cloud are shared end), in the situation that not having user to be consumed a large amount of flow, whether access to netwoks is abnormal still can to judge emerging application process, could be judged that by a large amount of consumed flow emerging application process is whether compared with access to netwoks extremely with needing first to have user in prior art, effectively protect user's flow, the information of application process abnormal access to netwoks is uploaded to network terminal simultaneously, can make more user directly determine that by the right form of advance ratio this application process access to netwoks is abnormal, save the time, and whether access to netwoks is abnormal to have avoided a large amount of users to repeat to judge an application process.
Wherein, in the time that the use total flow of all application processes of accesses network is more than or equal to first threshold; the network that can also directly disconnect all application processes of accesses network connects, and can be used as last pipe protection, avoids producing high cost because use traffic exceedes total flow.Certainly, in the time using first, can by with the form of operator calibration; the total flow of obtaining total flow and having used, using total flow as first threshold, as comparatively preferred technical scheme; first threshold can be set and be less than total flow value, better to protect flow.
In technique scheme, preferably, also comprise: receive according to the set predetermined value corresponding to described each identification item of type of the network of described application process access.
In this technical scheme, due to the network type difference of application process accesses network, corresponding access to netwoks speed is also not identical, therefore the predetermined value of setting for each identification item can be not identical yet, specifically, for example: taking the scheduled time as 1 minute, identification item is that the total flow that application process is used is in the given time example, for 4G network, network rate may be 5MB/S (million is per second), within 1 minute, will use 300M flow, and for 2G network, network rate may be 0.05M/S, within 1 minute, will use 3M flow, obviously, for 2G network and 4G network, it is inappropriate that the total flow that application process is used is in the given time used same predetermined value, therefore can different predetermined values be set corresponding to different network types, 4G network is 300M corresponding to the predetermined value of the total flow that application process is used in the given time, and 2G network is 3M corresponding to the predetermined value of the total flow that application process is used in the given time.
Certainly, the operable flow total amount of different network types is not identical yet, and therefore, the setting of first threshold also should arrange different values according to different network types.
According to a second aspect of the invention, the abnormal recognition device of a kind of access to netwoks has been proposed, comprise: acquiring unit, for in the time of application process accesses network, obtain the statistical value of each identification item of at least one identification item of the Internet Use for identifying described application process by predetermined period; Processing unit, the statistical value that is used for described each identification item that described acquiring unit is got contrasts with the predetermined value corresponding with described each identification item respectively, and definite statistical value is greater than the number of times that corresponding predetermined value occurs, and in the time that described number of times is more than or equal to predetermined quantity, judge that described application process access to netwoks is abnormal.
In this technical scheme, in the time of application process accesses network, by the statistical value of each identification item at least one identification item of the Internet Use of mark application process is compared with the predetermined value corresponding with each identification item respectively, then be greater than according to the statistical value of at least one identification item of the Internet Use of this application process of mark the number of times that corresponding predetermined value occurs, judge that this application process access to netwoks is abnormal, realize in application process use procedure, the application process of discovering network access exception in time, the application process of the consumed flow that also notes abnormalities in time, with in prior art, judge that application process is whether compared with access to netwoks extremely using total flow to disconnect network while exceeding default higher limit and the title of application process and server or cloud is shared to suspicious process list contrast in end, in the use procedure of application process, the application process of the consumed flow that notes abnormalities in time, thereby using total flow to exceed default higher limit (flow exceeds standard) before, the application process of the consumed flow that notes abnormalities in time, the effectively limited flow of protection, make can use the longer time at flow.
Specifically, for identify the statistical value of identification item of Internet Use of application process can be following at least one or a combination set of: the total flow that this application process is used in the given time, the total time of this application process access network and the in the given time total degree etc. of this application process interconnection network in the given time, judge whether access to netwoks can make with the following method application process extremely, for example: when the total flow that this application process is used is in the given time greater than the first predetermined threshold, this application process is carried out to mark, the mark number of times of this application process adds 1 simultaneously, when the total time of this application process access network is greater than the second predetermined threshold in the given time, this application process is carried out to mark, the mark number of times of this application process adds 1 simultaneously, when the total degree of this application process interconnection network is greater than the 3rd predetermined threshold in the given time, this application process is carried out to mark, the mark number of times of this application process adds 1 simultaneously, when total reference numerals of this application process is greater than predetermined quantity (can system default setting, also can be set by the user) time, judge that the access to netwoks of this application process is abnormal.
Certainly, those skilled in the art should be understood that, all should judge whether separately that for each application process access to netwoks is abnormal, and from application process access network, just start the statistic of at least one identification item that obtains the Internet Use for identifying application process with predetermined period, to judge this application process, whether access to netwoks is abnormal, wherein, the time of predetermined period is shorter, the speed of the process of discovering network abnormal access is faster, and the flow that the abnormal application process of access to netwoks consumes is fewer.
In technique scheme, preferably, also comprise: the first judging unit, before obtaining the statistical value of described each identification item at described acquiring unit, judges whether the network of described application process access is specified network; Described acquiring unit during as described specified network, obtains the statistical value of described each identification item specifically for the network of judging the access of described application process at described the first judging unit.
In this technical scheme, by before obtaining the statistical value of the each identification item of application process, whether the network that judges access is specified network, can effectively protect the network traffics while using specified network, specifically, with regard to mobile data network and WIFI network, at one comparatively in specific embodiment, specified network can be mobile data network, because the flow of mobile data network is limited, therefore in the time that application process is used mobile data network, obtain the statistical value of each identification item, to judge whether abnormal consumption flow of application process, network traffics when thereby effectively protection is used mobile data network, and in the time that WIFI network connects, operable flow does not limit, now for application process, whether abnormal consumption flow may not paid close attention to, do not need to obtain the statistical value of each identification item, and at another comparatively in specific embodiment, specified network can be WIFI network, owing to using Mobile data accesses network, while obtaining the statistical value of each identification item, if there is the abnormal application process of access to netwoks, still can consume user's flow, and for fear of this kind of situation, can be in the time that WIFI network connects, whether access to netwoks is abnormal to test each application process, also in the time that WIFI network connects, need to obtain the statistical value of each identification item, judge that whether application process access to netwoks is abnormal, and in the time using Mobile data accesses network, due to application process, whether test has extremely been passed through in access to netwoks under WIFI network, therefore do not need the statistical value of the each identification item that obtains this application process.Certainly, specified network can be also the 4G express network in mobile data network, and for the 2G/3G network of low speed because network rate may not obtain the statistical value of each identification item more slowly yet.
In technique scheme, preferably, described processing unit is also for after judging that described application process access to netwoks is abnormal, and the network that disconnects described application process connects.
In this technical scheme, by in the time judging that application process access to netwoks is abnormal, the network that directly disconnects application process connects, can save as much as possible flow, avoid the abnormal application process of access to netwoks to continue consumed flow, certainly, after connecting, the network that disconnects application process can point out the access to netwoks of this application process of user extremely to disconnect the network connection of this application process.
Certainly, it should be noted that, because the abnormal application process of access to netwoks is likely also the normal application process using of user, therefore by the time judging that application process access to netwoks is abnormal, as comparatively preferred technical scheme, can point out and whether disconnect network connection, be connected and compare with the network that directly disconnects this application process in the time judging that application process access to netwoks is abnormal, avoid the normal application process using of direct disconnect user and likely produce the situation of erroneous judgement, if but when the abnormal application process of access to netwoks is rogue software (trojan horse program), in the time that whether prompting disconnects the network connection of application process, this application process still consuming user's flow, especially, for 4G express network, within the time of prompting, still may consume a lot of flows, be unfavorable for effective protection of flow, therefore, in the time judging that application process access to netwoks is abnormal, processing mode can default setting be directly to disconnect network to connect, certainly, processing mode also can be arranged by user, effectively to protect flow.As more preferred technical scheme, can different processing modes be set according to the difference of application process.For example, adopt prompting whether to disconnect the mode that network connects for the application process of chat tool class, adopt for the application process except chat tool (browser, music video, game etc.) mode that network connects that directly disconnects.
In technique scheme, preferably, the total flow that described acquiring unit has also used for obtaining all application processes of accesses network; The abnormal recognition device of described access to netwoks also comprises: the second judging unit, for judging whether the total flow that described acquiring unit gets is less than first threshold; Uploading unit, when judging that at described processing unit abnormal and described the second judging unit of described application process access to netwoks judges that described total flow is less than described first threshold, uploads the information of described application process to network terminal.
In this technical scheme, by in the time judging application process access to netwoks extremely and the use total flow of all processes of accesses network is less than first threshold, also be in the situation of flow permission, for example upload the information of application process, to network terminal (: server or cloud are shared end), in the situation that not having user to be consumed a large amount of flow, whether access to netwoks is abnormal still can to judge emerging application process, could be judged that by a large amount of consumed flow emerging application process is whether compared with access to netwoks extremely with needing first to have user in prior art, effectively protect user's flow, the information of application process abnormal access to netwoks is uploaded to network terminal simultaneously, can make more user directly determine that by the right form of advance ratio this application process access to netwoks is abnormal, save the time, and whether access to netwoks is abnormal to have avoided a large amount of users to repeat to judge an application process.
Wherein, in the time that the use total flow of all application processes of accesses network is more than or equal to first threshold; the network that can also directly disconnect all application processes of accesses network connects, and can be used as last pipe protection, avoids producing high cost because use traffic exceedes total flow.Certainly, in the time using first, can by with the form of operator calibration; the total flow of obtaining total flow and having used, using total flow as first threshold, as comparatively preferred technical scheme; first threshold can be set and be less than total flow value, better to protect flow.
In technique scheme, preferably, also comprise: receiving element, for receiving according to the set predetermined value corresponding to described each identification item of type of the network of described application process access.
In this technical scheme, due to the network type difference of application process accesses network, corresponding access to netwoks speed is also not identical, therefore the predetermined value of setting for each identification item can be not identical yet, specifically, for example: taking the scheduled time as 1 minute, identification item is that the total flow that application process is used is in the given time example, for 4G network, network rate may be 5MB/S (million is per second), within 1 minute, will use 300M flow, and for 2G network, network rate may be 0.05M/S, within 1 minute, will use 3M flow, obviously, for 2G network and 4G network, it is inappropriate that the total flow that application process is used is in the given time used same predetermined value, therefore can different predetermined values be set corresponding to different network types, 4G network is 300M corresponding to the predetermined value of the total flow that application process is used in the given time, and 2G network is 3M corresponding to the predetermined value of the total flow that application process is used in the given time.
Certainly, the operable flow total amount of different network types is not identical yet, and therefore, the setting of first threshold also should arrange different values according to different network types.
Brief description of the drawings
Fig. 1 shows the schematic flow diagram of access to netwoks abnormality recognition method according to an embodiment of the invention;
Fig. 2 shows the schematic diagram of access to netwoks abnormality recognition method idiographic flow according to an embodiment of the invention;
Fig. 3 shows the structural representation of the abnormal recognition device of access to netwoks according to an embodiment of the invention.
Embodiment
In order more clearly to understand above-mentioned purpose of the present invention, feature and advantage, below in conjunction with the drawings and specific embodiments, the present invention is further described in detail.It should be noted that, in the situation that not conflicting, the feature in the application's embodiment and embodiment can combine mutually.
A lot of details are set forth in the following description so that fully understand the present invention; but; the present invention can also adopt other to be different from other modes described here and implement, and therefore, protection scope of the present invention is not subject to the restriction of following public specific embodiment.
Fig. 1 shows the schematic flow diagram of access to netwoks abnormality recognition method according to an embodiment of the invention.
As shown in Figure 1, access to netwoks abnormality recognition method according to an embodiment of the invention, comprise: step 102, in the time of application process accesses network, obtain the statistical value of each identification item of at least one identification item of the Internet Use for identifying described application process by predetermined period; Step 104, contrasts the statistical value of described each identification item respectively with the predetermined value corresponding with described each identification item, and definite statistical value is greater than the number of times that corresponding predetermined value occurs; Step 106, in the time that described number of times is more than or equal to predetermined quantity, judges that described application process access to netwoks is abnormal.
In this technical scheme, in the time of application process accesses network, by the statistical value of each identification item at least one identification item of the Internet Use of mark application process is compared with the predetermined value corresponding with each identification item respectively, then be greater than according to the statistical value of at least one identification item of the Internet Use of this application process of mark the number of times that corresponding predetermined value occurs, judge that this application process access to netwoks is abnormal, realize in application process use procedure, the application process of discovering network access exception in time, the application process of the consumed flow that also notes abnormalities in time, with in prior art, judge that application process is whether compared with access to netwoks extremely using total flow to disconnect network while exceeding default higher limit and the title of application process and server or cloud is shared to suspicious process list contrast in end, in the use procedure of application process, the application process of the consumed flow that notes abnormalities in time, thereby using total flow to exceed default higher limit (flow exceeds standard) before, the application process of the consumed flow that notes abnormalities in time, the effectively limited flow of protection, make can use the longer time at flow.
Specifically, for identify the statistical value of identification item of Internet Use of application process can be following at least one or a combination set of: the total flow that this application process is used in the given time, the total time of this application process access network and the in the given time total degree etc. of this application process interconnection network in the given time, judge whether access to netwoks can make with the following method application process extremely, for example: when the total flow that this application process is used is in the given time greater than the first predetermined threshold, this application process is carried out to mark, the mark number of times of this application process adds 1 simultaneously, when the total time of this application process access network is greater than the second predetermined threshold in the given time, this application process is carried out to mark, the mark number of times of this application process adds 1 simultaneously, when the total degree of this application process interconnection network is greater than the 3rd predetermined threshold in the given time, this application process is carried out to mark, the mark number of times of this application process adds 1 simultaneously, when total reference numerals of this application process is greater than predetermined quantity (can system default setting, also can be set by the user) time, judge that the access to netwoks of this application process is abnormal.
Certainly, those skilled in the art should be understood that, all should judge whether separately that for each application process access to netwoks is abnormal, and from application process access network, just start the statistic of at least one identification item that obtains the Internet Use for identifying application process with predetermined period, to judge this application process, whether access to netwoks is abnormal, wherein, the time of predetermined period is shorter, the speed of the process of discovering network abnormal access is faster, and the flow that the abnormal application process of access to netwoks consumes is fewer.
In technique scheme, preferably, before obtaining the statistical value of described each identification item, judge whether the network of described application process access is specified network; During as described specified network, carry out the step of the statistical value that obtains described each identification item at the network of judging the access of described application process.
In this technical scheme, by before obtaining the statistical value of the each identification item of application process, whether the network that judges access is specified network, can effectively protect the network traffics while using specified network, specifically, with regard to mobile data network and WIFI network, at one comparatively in specific embodiment, specified network can be mobile data network, because the flow of mobile data network is limited, therefore in the time that application process is used mobile data network, obtain the statistical value of each identification item, to judge whether abnormal consumption flow of application process, network traffics when thereby effectively protection is used mobile data network, and in the time that WIFI network connects, operable flow does not limit, now for application process, whether abnormal consumption flow may not paid close attention to, do not need to obtain the statistical value of each identification item, and at another comparatively in specific embodiment, specified network can be WIFI network, owing to using Mobile data accesses network, while obtaining the statistical value of each identification item, if there is the abnormal application process of access to netwoks, still can consume user's flow, and for fear of this kind of situation, can be in the time that WIFI network connects, whether access to netwoks is abnormal to test each application process, also in the time that WIFI network connects, need to obtain the statistical value of each identification item, judge that whether application process access to netwoks is abnormal, and in the time using Mobile data accesses network, due to application process, whether test has extremely been passed through in access to netwoks under WIFI network, therefore do not need the statistical value of the each identification item that obtains this application process.Certainly, specified network can be also the 4G express network in mobile data network, and for the 2G/3G network of low speed because network rate may not obtain the statistical value of each identification item more slowly yet.
In technique scheme, preferably, after judging that described application process access to netwoks is abnormal, the network that disconnects described application process connects.
In this technical scheme, by in the time judging that application process access to netwoks is abnormal, the network that directly disconnects application process connects, can save as much as possible flow, avoid the abnormal application process of access to netwoks to continue consumed flow, certainly, after connecting, the network that disconnects application process can point out the access to netwoks of this application process of user extremely to disconnect the network connection of this application process.
Certainly, it should be noted that, because the abnormal application process of access to netwoks is likely also the normal application process using of user, therefore by the time judging that application process access to netwoks is abnormal, as comparatively preferred technical scheme, can point out and whether disconnect network connection, be connected and compare with the network that directly disconnects this application process in the time judging that application process access to netwoks is abnormal, avoid the normal application process using of direct disconnect user and likely produce the situation of erroneous judgement, if but when the abnormal application process of access to netwoks is rogue software (trojan horse program), in the time that whether prompting disconnects the network connection of application process, this application process still consuming user's flow, especially, for 4G express network, within the time of prompting, still may consume a lot of flows, be unfavorable for effective protection of flow, therefore, in the time judging that application process access to netwoks is abnormal, processing mode can default setting be directly to disconnect network to connect, certainly, processing mode also can be arranged by user, effectively to protect flow.As more preferred technical scheme, can different processing modes be set according to the difference of application process.For example, adopt prompting whether to disconnect the mode that network connects for the application process of chat tool class, adopt for the application process except chat tool (browser, music video, game etc.) mode that network connects that directly disconnects.
In technique scheme, preferably, also comprise: obtain the total flow that all application processes of accesses network have been used; Judge whether described total flow is less than first threshold; And in the time judging that the abnormal and described total flow of described application process access to netwoks is less than described first threshold, upload the information of described application process to network terminal.
In this technical scheme, by in the time judging application process access to netwoks extremely and the use total flow of all processes of accesses network is less than first threshold, also be in the situation of flow permission, for example upload the information of application process, to network terminal (: server or cloud are shared end), in the situation that not having user to be consumed a large amount of flow, whether access to netwoks is abnormal still can to judge emerging application process, could be judged that by a large amount of consumed flow emerging application process is whether compared with access to netwoks extremely with needing first to have user in prior art, effectively protect user's flow, the information of application process abnormal access to netwoks is uploaded to network terminal simultaneously, can make more user directly determine that by the right form of advance ratio this application process access to netwoks is abnormal, save the time, and whether access to netwoks is abnormal to have avoided a large amount of users to repeat to judge an application process.
Wherein, in the time that the use total flow of all application processes of accesses network is more than or equal to first threshold; the network that can also directly disconnect all application processes of accesses network connects, and can be used as last pipe protection, avoids producing high cost because use traffic exceedes total flow.Certainly, in the time using first, can by with the form of operator calibration; the total flow of obtaining total flow and having used, using total flow as first threshold, as comparatively preferred technical scheme; first threshold can be set and be less than total flow value, better to protect flow.
In technique scheme, preferably, also comprise: receive according to the set predetermined value corresponding to described each identification item of type of the network of described application process access.
In this technical scheme, due to the network type difference of application process accesses network, corresponding access to netwoks speed is also not identical, therefore the predetermined value of setting for each identification item can be not identical yet, specifically, for example: taking the scheduled time as 1 minute, identification item is that the total flow that application process is used is in the given time example, for 4G network, network rate may be 5MB/S (million is per second), within 1 minute, will use 300M flow, and for 2G network, network rate may be 0.05M/S, within 1 minute, will use 3M flow, obviously, for 2G network and 4G network, it is inappropriate that the total flow that application process is used is in the given time used same predetermined value, therefore can different predetermined values be set corresponding to different network types, 4G network is 300M corresponding to the predetermined value of the total flow that application process is used in the given time, and 2G network is 3M corresponding to the predetermined value of the total flow that application process is used in the given time.
Certainly, the operable flow total amount of different network types is not identical yet, and therefore, the setting of first threshold also should arrange different values according to different network types.
Below in conjunction with Fig. 2, for identify application process Internet Use identification item statistical value taking this application process is used in the given time total flow, in the given time this application process access network total time and in the given time the total degree of this application process interconnection network describe the concrete steps of the access to netwoks abnormality recognition method of embodiments of the invention in detail as example.
Fig. 2 shows the schematic diagram of access to netwoks abnormality recognition method idiographic flow according to an embodiment of the invention.
As shown in Figure 2, access to netwoks abnormality recognition method idiographic flow according to an embodiment of the invention, comprising:
Step 202, receives the flow higher limit of setting or the total flow value of calibrating operable total flow value and having used with operator.
Step 204, whether the network that judges the access of current application process is mobile network, if the network of application process access is mobile network, perform step 206, otherwise do not continue to carry out, also in the present embodiment, only, in the time that the network of application process access is mobile network, judge that whether application process access to netwoks is abnormal.
Step 206, in the time that the network of application process access is mobile network, add up the total flow using in the given time of each application process, total time, the in the given time total degree of interconnection network and all processes of accesses network of access network are used in the given time total flow.
Step 208, whether the total flow that judgement is used is in the given time greater than the first predetermined threshold, also judges whether flow uses too fast, if the total flow using is in the given time greater than the first predetermined threshold, performs step 216, otherwise execution step 204.
Step 210, judge whether the total time of access network is greater than the second predetermined threshold in the given time, also judge whether long-time connection, if the total time of access network is greater than the second predetermined threshold in the given time, perform step 216, otherwise execution step 204.
Step 212, judge whether the total degree of interconnection network is greater than the 3rd predetermined threshold in the given time, whether the number of times that also judges interconnection network is too frequent, if the total degree of interconnection network is greater than the 3rd predetermined threshold in the given time, performs step 216, otherwise execution step 204.
Step 214, whether the total flow that judges all processes uses of accesses network is greater than default higher limit, also judge whether the total flow using exceeds standard, if the total flow that all processes of accesses network are used is greater than default higher limit, perform step 220, otherwise execution step 204.Certainly, it should be noted in the discussion above that step 208 herein, step 210, step 212, step 214 is carried out simultaneously.
Step 216, adds suspicious mark to this application process, and the reference numerals of this application process adds 1.
Step 218, judges whether the reference numerals of application process is greater than predetermined quantity, also judges that whether this application process access to netwoks is abnormal, if the reference numerals of application process is greater than predetermined quantity, performs step 220, otherwise execution step 204.
Step 220, in the time that the reference numerals of application process is greater than predetermined quantity, the total flow of cutting off the network connection of application process and/or use in all processes of accesses network is greater than default higher limit, the network that cuts off all processes of accesses network connects, point out and inquire whether continue networking, if continue networking, perform step 222, connect otherwise disconnect network.
Step 222, in the time receiving the instruction that continues networking, continues interconnection network, and the access to netwoks of not reresenting application process extremely and/or is not reresented the total flow that all processes of accesses network use and is greater than default higher limit.
Can find out from above-mentioned concrete implementing procedure, the present invention fundamentally protects user's flow in time, not merely for rogue software or trojan horse program etc.Because have a set of oneself decision mechanism, so need not wait until that flow has consumed and just can make response, and every kind of decision method can be decided by user in its sole discretion the standard of mark, not affect user and normally use thereby reach, and reduce to greatest extent flow loss, really meet user's demand.Describe below in conjunction with concrete application scenarios.
Application scenarios one:
Some application process can not stop after download starts.For example: some software and advertisement, after click, download immediately and there is no a stop button, also have some game application self little, but need extra packet to move after installing, downloading data bag at once after installation, and cannot stop.Under express network, before being stopped, user may consume a large amount of flows.The total flow using in the given time by obtaining this application process, once find that this application process consumed flow exceedes preset value, can stop flow loss in time.
Application scenarios two:
Subscriber equipment is utilized and does cloud computing.At present a lot of ideal moneys continue to bring out, and the camouflage that digs ore deposit is being played in some application, and actual is to utilize user's equipment to do cloud computing, and this application is often frequent with server interaction, and each data volume is little, more hidden.For this situation, can carry out mark to it by the total degree (rate of connections) that obtains interconnection network in this application process scheduled time, and reminding user is reacted in time.
Fig. 3 shows the structural representation of the abnormal recognition device of access to netwoks according to an embodiment of the invention.
As shown in Figure 3, the abnormal recognition device 300 of access to netwoks according to an embodiment of the invention, comprise: acquiring unit 302, for in the time of application process accesses network, obtain the statistical value of each identification item of at least one identification item of the Internet Use for identifying described application process by predetermined period; Processing unit 304, the statistical value that is used for described each identification item that described acquiring unit 302 is got contrasts with the predetermined value corresponding with described each identification item respectively, and definite statistical value is greater than the number of times that corresponding predetermined value occurs, and in the time that described number of times is more than or equal to predetermined quantity, judge that described application process access to netwoks is abnormal.
In this technical scheme, in the time of application process accesses network, by the statistical value of each identification item at least one identification item of the Internet Use of mark application process is compared with the predetermined value corresponding with each identification item respectively, then be greater than according to the statistical value of at least one identification item of the Internet Use of this application process of mark the number of times that corresponding predetermined value occurs, judge that this application process access to netwoks is abnormal, realize in application process use procedure, the application process of discovering network access exception in time, the application process of the consumed flow that also notes abnormalities in time, with in prior art, judge that application process is whether compared with access to netwoks extremely using total flow to disconnect network while exceeding default higher limit and the title of application process and server or cloud is shared to suspicious process list contrast in end, in the use procedure of application process, the application process of the consumed flow that notes abnormalities in time, thereby using total flow to exceed default higher limit (flow exceeds standard) before, the application process of the consumed flow that notes abnormalities in time, the effectively limited flow of protection, make can use the longer time at flow.
Specifically, for identify the statistical value of identification item of Internet Use of application process can be following at least one or a combination set of: the total flow that this application process is used in the given time, the total time of this application process access network and the in the given time total degree etc. of this application process interconnection network in the given time, judge whether access to netwoks can make with the following method application process extremely, for example: when the total flow that this application process is used is in the given time greater than the first predetermined threshold, this application process is carried out to mark, the mark number of times of this application process adds 1 simultaneously, when the total time of this application process access network is greater than the second predetermined threshold in the given time, this application process is carried out to mark, the mark number of times of this application process adds 1 simultaneously, when the total degree of this application process interconnection network is greater than the 3rd predetermined threshold in the given time, this application process is carried out to mark, the mark number of times of this application process adds 1 simultaneously, when total reference numerals of this application process is greater than predetermined quantity (can system default setting, also can be set by the user) time, judge that the access to netwoks of this application process is abnormal.
Certainly, those skilled in the art should be understood that, all should judge whether separately that for each application process access to netwoks is abnormal, and from application process access network, just start the statistic of at least one identification item that obtains the Internet Use for identifying application process with predetermined period, to judge this application process, whether access to netwoks is abnormal, wherein, the time of predetermined period is shorter, the speed of the process of discovering network abnormal access is faster, and the flow that the abnormal application process of access to netwoks consumes is fewer.
In technique scheme, preferably, also comprise: the first judging unit 306, before obtaining the statistical value of described each identification item at described acquiring unit 302, judges whether the network of described application process access is specified network; Described acquiring unit 302 during as described specified network, obtains the statistical value of described each identification item specifically for the network of judging the access of described application process at described the first judging unit 306.
In this technical scheme, by before obtaining the statistical value of the each identification item of application process, whether the network that judges access is specified network, can effectively protect the network traffics while using specified network, specifically, with regard to mobile data network and WIFI network, at one comparatively in specific embodiment, specified network can be mobile data network, because the flow of mobile data network is limited, therefore in the time that application process is used mobile data network, obtain the statistical value of each identification item, to judge whether abnormal consumption flow of application process, network traffics when thereby effectively protection is used mobile data network, and in the time that WIFI network connects, operable flow does not limit, now for application process, whether abnormal consumption flow may not paid close attention to, do not need to obtain the statistical value of each identification item, and at another comparatively in specific embodiment, specified network can be WIFI network, owing to using Mobile data accesses network, while obtaining the statistical value of each identification item, if there is the abnormal application process of access to netwoks, still can consume user's flow, and for fear of this kind of situation, can be in the time that WIFI network connects, whether access to netwoks is abnormal to test each application process, also in the time that WIFI network connects, need to obtain the statistical value of each identification item, judge that whether application process access to netwoks is abnormal, and in the time using Mobile data accesses network, due to application process, whether test has extremely been passed through in access to netwoks under WIFI network, therefore do not need the statistical value of the each identification item that obtains this application process.Certainly, specified network can be also the 4G express network in mobile data network, and for the 2G/3G network of low speed because network rate may not obtain the statistical value of each identification item more slowly yet.
In technique scheme, preferably, described processing unit 304 is also for after judging that described application process access to netwoks is abnormal, and the network that disconnects described application process connects.
In this technical scheme, by in the time judging that application process access to netwoks is abnormal, the network that directly disconnects application process connects, can save as much as possible flow, avoid the abnormal application process of access to netwoks to continue consumed flow, certainly, after connecting, the network that disconnects application process can point out the access to netwoks of this application process of user extremely to disconnect the network connection of this application process.
Certainly, it should be noted that, because the abnormal application process of access to netwoks is likely also the normal application process using of user, therefore by the time judging that application process access to netwoks is abnormal, as comparatively preferred technical scheme, can point out and whether disconnect network connection, be connected and compare with the network that directly disconnects this application process in the time judging that application process access to netwoks is abnormal, avoid the normal application process using of direct disconnect user and likely produce the situation of erroneous judgement, if but when the abnormal application process of access to netwoks is rogue software (trojan horse program), in the time that whether prompting disconnects the network connection of application process, this application process still consuming user's flow, especially, for 4G express network, within the time of prompting, still may consume a lot of flows, be unfavorable for effective protection of flow, therefore, in the time judging that application process access to netwoks is abnormal, processing mode can default setting be directly to disconnect network to connect, certainly, processing mode also can be arranged by user, effectively to protect flow.As more preferred technical scheme, can different processing modes be set according to the difference of application process.For example, adopt prompting whether to disconnect the mode that network connects for the application process of chat tool class, adopt for the application process except chat tool (browser, music video, game etc.) mode that network connects that directly disconnects.
In technique scheme, preferably, the total flow that described acquiring unit 302 has also used for obtaining all application processes of accesses network; The abnormal recognition device of described access to netwoks also comprises: the second judging unit 308, for judging whether the total flow that described acquiring unit 302 gets is less than first threshold; Uploading unit 310, when judging that at described processing unit 304 abnormal and described the second judging unit 308 of described application process access to netwoks judges that described total flow is less than described first threshold, uploads the information of described application process to network terminal.
In this technical scheme, by in the time judging application process access to netwoks extremely and the use total flow of all processes of accesses network is less than first threshold, also be in the situation of flow permission, for example upload the information of application process, to network terminal (: server or cloud are shared end), in the situation that not having user to be consumed a large amount of flow, whether access to netwoks is abnormal still can to judge emerging application process, could be judged that by a large amount of consumed flow emerging application process is whether compared with access to netwoks extremely with needing first to have user in prior art, effectively protect user's flow, the information of application process abnormal access to netwoks is uploaded to network terminal simultaneously, can make more user directly determine that by the right form of advance ratio this application process access to netwoks is abnormal, save the time, and whether access to netwoks is abnormal to have avoided a large amount of users to repeat to judge an application process.
Wherein, in the time that the use total flow of all application processes of accesses network is more than or equal to first threshold; the network that can also directly disconnect all application processes of accesses network connects, and can be used as last pipe protection, avoids producing high cost because use traffic exceedes total flow.Certainly, in the time using first, can by with the form of operator calibration; the total flow of obtaining total flow and having used, using total flow as first threshold, as comparatively preferred technical scheme; first threshold can be set and be less than total flow value, better to protect flow.
In technique scheme, preferably, also comprise: receiving element 312, for receiving according to the set predetermined value corresponding to described each identification item of type of the network of described application process access.
In this technical scheme, due to the network type difference of application process accesses network, corresponding access to netwoks speed is also not identical, therefore the predetermined value of setting for each identification item can be not identical yet, specifically, for example: taking the scheduled time as 1 minute, identification item is that the total flow that application process is used is in the given time example, for 4G network, network rate may be 5MB/S (million is per second), within 1 minute, will use 300M flow, and for 2G network, network rate may be 0.05M/S, within 1 minute, will use 3M flow, obviously, for 2G network and 4G network, it is inappropriate that the total flow that application process is used is in the given time used same predetermined value, therefore can different predetermined values be set corresponding to different network types, 4G network is 300M corresponding to the predetermined value of the total flow that application process is used in the given time, and 2G network is 3M corresponding to the predetermined value of the total flow that application process is used in the given time.
Certainly, the operable flow total amount of different network types is not identical yet, and therefore, the setting of first threshold also should arrange different values according to different network types.
More than be described with reference to the accompanying drawings technical scheme of the present invention; by technical scheme of the present invention; the application process of the consumed flow that can note abnormalities in time; the network that disconnects this application process connects; thereby before flow exceeds standard, realize the effect of protection, can not cause interference to the normal application process using of user simultaneously.
The foregoing is only the preferred embodiments of the present invention, be not limited to the present invention, for a person skilled in the art, the present invention can have various modifications and variations.Within the spirit and principles in the present invention all, any amendment of doing, be equal to replacement, improvement etc., within all should being included in protection scope of the present invention.
Claims (10)
1. an access to netwoks abnormality recognition method, is characterized in that, comprising:
In the time of application process accesses network, obtain the statistical value of each identification item of at least one identification item of the Internet Use for identifying described application process by predetermined period;
The statistical value of described each identification item is contrasted with the predetermined value corresponding with described each identification item respectively, and definite statistical value is greater than the number of times that corresponding predetermined value occurs;
In the time that described number of times is more than or equal to predetermined quantity, judge that described application process access to netwoks is abnormal.
2. access to netwoks abnormality recognition method according to claim 1, is characterized in that, before obtaining the statistical value of described each identification item,
Whether the network that judges described application process access is specified network;
During as described specified network, carry out the step of the statistical value that obtains described each identification item at the network of judging the access of described application process.
3. access to netwoks abnormality recognition method according to claim 1, is characterized in that, after judging that described application process access to netwoks is abnormal,
The network that disconnects described application process connects.
4. access to netwoks abnormality recognition method according to claim 1, is characterized in that, also comprises:
Obtain the total flow that all application processes of accesses network have been used;
Judge whether described total flow is less than first threshold; And
In the time judging that the abnormal and described total flow of described application process access to netwoks is less than described first threshold, upload the information of described application process to network terminal.
5. according to the access to netwoks abnormality recognition method described in any one in claim 1 to 4, it is characterized in that, also comprise: receive according to the set predetermined value corresponding to described each identification item of type of the network of described application process access.
6. the abnormal recognition device of access to netwoks, is characterized in that, comprising:
Acquiring unit, for when the application process accesses network, obtains the statistical value of each identification item of at least one identification item of the Internet Use for identifying described application process by predetermined period;
Processing unit, contrasts with the predetermined value corresponding with described each identification item respectively for the statistical value of described each identification item that described acquiring unit is got, and definite statistical value is greater than the number of times that corresponding predetermined value occurs, and
In the time that described number of times is more than or equal to predetermined quantity, judge that described application process access to netwoks is abnormal.
7. the abnormal recognition device of access to netwoks according to claim 6, is characterized in that, also comprises:
The first judging unit, before obtaining the statistical value of described each identification item at described acquiring unit, judges whether the network of described application process access is specified network;
Described acquiring unit during as described specified network, obtains the statistical value of described each identification item specifically for the network of judging the access of described application process at described the first judging unit.
8. the abnormal recognition device of access to netwoks according to claim 6, is characterized in that, described processing unit is also for after judging that described application process access to netwoks is abnormal, and the network that disconnects described application process connects.
9. the abnormal recognition device of access to netwoks according to claim 6, is characterized in that,
The total flow that described acquiring unit has also used for obtaining all application processes of accesses network;
The abnormal recognition device of described access to netwoks also comprises:
The second judging unit, for judging whether the total flow that described acquiring unit gets is less than first threshold;
Uploading unit, when judging that at described processing unit abnormal and described the second judging unit of described application process access to netwoks judges that described total flow is less than described first threshold, uploads the information of described application process to network terminal.
10. according to the abnormal recognition device of the access to netwoks described in application item in claim 6 to 9, it is characterized in that, also comprise:
Receiving element, for receiving according to the set predetermined value corresponding to described each identification item of type of the network of described application process access.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410195369.2A CN104038929A (en) | 2014-05-09 | 2014-05-09 | Network access anomaly identification method and network access anomaly identification device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410195369.2A CN104038929A (en) | 2014-05-09 | 2014-05-09 | Network access anomaly identification method and network access anomaly identification device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN104038929A true CN104038929A (en) | 2014-09-10 |
Family
ID=51469487
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410195369.2A Pending CN104038929A (en) | 2014-05-09 | 2014-05-09 | Network access anomaly identification method and network access anomaly identification device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104038929A (en) |
Cited By (17)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104767809A (en) * | 2015-04-02 | 2015-07-08 | 天脉聚源（北京）教育科技有限公司 | Downloading control method and system |
| CN105528535A (en) * | 2015-12-25 | 2016-04-27 | 北京奇虎科技有限公司 | Log information based user behavior analysis method and apparatus |
| CN105721713A (en) * | 2016-03-31 | 2016-06-29 | 北京金山安全软件有限公司 | Data network state control method and device for terminal |
| CN106209781A (en) * | 2016-06-27 | 2016-12-07 | 徐汕 | A kind of based on the access recognition methods of statistical exceptional interface |
| WO2017028738A1 (en) * | 2015-08-20 | 2017-02-23 | 阿里巴巴集团控股有限公司 | Region-based risk control method and device |
| CN107438262A (en) * | 2016-05-25 | 2017-12-05 | 中国移动通信集团设计院有限公司 | A kind of abnormal user recognition methods and device |
| CN108092970A (en) * | 2017-12-13 | 2018-05-29 | 腾讯科技（深圳）有限公司 | A kind of wireless network maintaining method and its equipment, storage medium, terminal |
| CN108347355A (en) * | 2017-01-22 | 2018-07-31 | 腾讯科技（深圳）有限公司 | A kind of detection method and its equipment of application state |
| CN108900496A (en) * | 2018-06-22 | 2018-11-27 | 杭州安恒信息技术股份有限公司 | A kind of quick detection website is implanted the detection method and device of digging mine wooden horse |
| CN109344913A (en) * | 2018-10-31 | 2019-02-15 | 中国刑事警察学院 | A kind of network intrusions behavioral value method based on improvement MajorClust cluster |
| CN109688166A (en) * | 2019-02-28 | 2019-04-26 | 新华三信息安全技术有限公司 | A kind of exception outgoing behavioral value method and device |
| TWI665899B (en) * | 2017-01-19 | 2019-07-11 | 香港商阿里巴巴集團服務有限公司 | Area-based risk control method and equipment |
| CN110661794A (en) * | 2019-09-20 | 2020-01-07 | 秒针信息技术有限公司 | Flow identification method and device, electronic equipment and readable storage medium |
| CN112533246A (en) * | 2020-12-08 | 2021-03-19 | 广东小天才科技有限公司 | Monitoring system and method for frequent network requests of intelligent equipment |
| CN112738070A (en) * | 2020-12-25 | 2021-04-30 | 广州凡科互联网科技股份有限公司 | Web-based website micro-credit traffic monitoring method |
| CN112953755A (en) * | 2021-01-18 | 2021-06-11 | 上海商米科技集团股份有限公司 | Equipment flow early warning method, system and storage medium |
| CN113079151A (en) * | 2021-03-26 | 2021-07-06 | 深信服科技股份有限公司 | Exception handling method and device, electronic equipment and readable storage medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102833668A (en) * | 2012-08-20 | 2012-12-19 | 中国联合网络通信集团有限公司 | Data traffic reminding method and data traffic reminding device |
| CN103209439A (en) * | 2013-03-14 | 2013-07-17 | 北京小米科技有限责任公司 | Method, apparatus and device for monitoring data traffic |
| CN103500307A (en) * | 2013-09-26 | 2014-01-08 | 北京邮电大学 | Mobile internet malignant application software detection method based on behavior model |
-
2014
- 2014-05-09 CN CN201410195369.2A patent/CN104038929A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102833668A (en) * | 2012-08-20 | 2012-12-19 | 中国联合网络通信集团有限公司 | Data traffic reminding method and data traffic reminding device |
| CN103209439A (en) * | 2013-03-14 | 2013-07-17 | 北京小米科技有限责任公司 | Method, apparatus and device for monitoring data traffic |
| CN103500307A (en) * | 2013-09-26 | 2014-01-08 | 北京邮电大学 | Mobile internet malignant application software detection method based on behavior model |
Cited By (27)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104767809A (en) * | 2015-04-02 | 2015-07-08 | 天脉聚源（北京）教育科技有限公司 | Downloading control method and system |
| CN104767809B (en) * | 2015-04-02 | 2018-12-21 | 天脉聚源（北京）教育科技有限公司 | A kind of download control method and system |
| WO2017028738A1 (en) * | 2015-08-20 | 2017-02-23 | 阿里巴巴集团控股有限公司 | Region-based risk control method and device |
| CN106469346A (en) * | 2015-08-20 | 2017-03-01 | 阿里巴巴集团控股有限公司 | A kind of risk control method based on region and equipment |
| CN106469346B (en) * | 2015-08-20 | 2018-10-02 | 阿里巴巴集团控股有限公司 | A kind of risk control method and equipment based on region |
| CN105528535A (en) * | 2015-12-25 | 2016-04-27 | 北京奇虎科技有限公司 | Log information based user behavior analysis method and apparatus |
| CN105721713A (en) * | 2016-03-31 | 2016-06-29 | 北京金山安全软件有限公司 | Data network state control method and device for terminal |
| CN107438262A (en) * | 2016-05-25 | 2017-12-05 | 中国移动通信集团设计院有限公司 | A kind of abnormal user recognition methods and device |
| CN107438262B (en) * | 2016-05-25 | 2019-12-13 | 中国移动通信集团设计院有限公司 | abnormal user identification method and device |
| CN106209781A (en) * | 2016-06-27 | 2016-12-07 | 徐汕 | A kind of based on the access recognition methods of statistical exceptional interface |
| CN106209781B (en) * | 2016-06-27 | 2019-09-06 | 航天云网科技发展有限责任公司 | One kind accessing recognition methods based on statistical exceptional interface |
| TWI665899B (en) * | 2017-01-19 | 2019-07-11 | 香港商阿里巴巴集團服務有限公司 | Area-based risk control method and equipment |
| CN108347355A (en) * | 2017-01-22 | 2018-07-31 | 腾讯科技（深圳）有限公司 | A kind of detection method and its equipment of application state |
| CN108092970B (en) * | 2017-12-13 | 2021-01-15 | 腾讯科技（深圳）有限公司 | Wireless network maintenance method and equipment, storage medium and terminal thereof |
| CN108092970A (en) * | 2017-12-13 | 2018-05-29 | 腾讯科技（深圳）有限公司 | A kind of wireless network maintaining method and its equipment, storage medium, terminal |
| CN108900496A (en) * | 2018-06-22 | 2018-11-27 | 杭州安恒信息技术股份有限公司 | A kind of quick detection website is implanted the detection method and device of digging mine wooden horse |
| CN109344913A (en) * | 2018-10-31 | 2019-02-15 | 中国刑事警察学院 | A kind of network intrusions behavioral value method based on improvement MajorClust cluster |
| CN109688166A (en) * | 2019-02-28 | 2019-04-26 | 新华三信息安全技术有限公司 | A kind of exception outgoing behavioral value method and device |
| CN109688166B (en) * | 2019-02-28 | 2021-06-04 | 新华三信息安全技术有限公司 | Abnormal outgoing behavior detection method and device |
| CN110661794B (en) * | 2019-09-20 | 2021-07-27 | 秒针信息技术有限公司 | Flow identification method and device, electronic equipment and readable storage medium |
| CN110661794A (en) * | 2019-09-20 | 2020-01-07 | 秒针信息技术有限公司 | Flow identification method and device, electronic equipment and readable storage medium |
| CN112533246A (en) * | 2020-12-08 | 2021-03-19 | 广东小天才科技有限公司 | Monitoring system and method for frequent network requests of intelligent equipment |
| CN112533246B (en) * | 2020-12-08 | 2024-03-15 | 广东小天才科技有限公司 | Monitoring system and method for frequent network requests of intelligent equipment |
| CN112738070A (en) * | 2020-12-25 | 2021-04-30 | 广州凡科互联网科技股份有限公司 | Web-based website micro-credit traffic monitoring method |
| CN112738070B (en) * | 2020-12-25 | 2023-02-17 | 广州凡科互联网科技股份有限公司 | Web-based website micro-credit traffic monitoring method |
| CN112953755A (en) * | 2021-01-18 | 2021-06-11 | 上海商米科技集团股份有限公司 | Equipment flow early warning method, system and storage medium |
| CN113079151A (en) * | 2021-03-26 | 2021-07-06 | 深信服科技股份有限公司 | Exception handling method and device, electronic equipment and readable storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104038929A (en) | Network access anomaly identification method and network access anomaly identification device | |
| CN106774786B (en) | Power consumption control method and device | |
| CN102006588B (en) | Method and system for monitoring network behavior of smart mobile phone | |
| CN106102143B (en) | Application processing method and device | |
| CN109246741B (en) | Wireless network connection method for terminal | |
| CN102891890B (en) | Exchange method between a kind of terminal and relevant device, system | |
| JP2009525703A (en) | Apparatus and method for providing configurable task management on a wireless device | |
| CN103139307B (en) | A kind of Internet resources download the restoration methods and download system of interrupting | |
| CN104219653A (en) | Method and device for controlling double-card Internet access | |
| CN103235915A (en) | Network application program processing method and mobile terminal thereof | |
| JP2008538249A5 (en) | ||
| CN105516502A (en) | Mobile terminal and flow control method therefor | |
| CN105530655A (en) | Flow monitoring method and device | |
| CN106851779A (en) | A kind of method and mobile terminal for recognizing access point and focus | |
| CN107734033A (en) | A kind of method, terminal, system and computer-readable recording medium exempted from flow and download application program | |
| CN104581671A (en) | Prompting method and device for data traffic | |
| US20130179571A1 (en) | Communications apparatus and method | |
| CN106209918A (en) | The method of a kind of internet security management and terminal | |
| CN103051625A (en) | Method and system for monitoring networking application programs by utilizing intelligent terminals | |
| CN111132132A (en) | Traffic management method and device and terminal equipment | |
| CN106302519A (en) | The method of a kind of internet security management and terminal | |
| CN103150243A (en) | Monitoring method for application program of mobile terminal | |
| CN105245591A (en) | Method and system for monitoring desktop cloud performance experience | |
| CN110908881B (en) | Buried point data transmitting method and device, electronic equipment and computer readable storage medium | |
| CN107508882B (en) | Data transmission method, related device and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20140910 |