CN100401696C - Method for detecting number of computer users in inner compute network - Google Patents
Method for detecting number of computer users in inner compute network Download PDFInfo
- Publication number
- CN100401696C CN100401696C CNB2006100882144A CN200610088214A CN100401696C CN 100401696 C CN100401696 C CN 100401696C CN B2006100882144 A CNB2006100882144 A CN B2006100882144A CN 200610088214 A CN200610088214 A CN 200610088214A CN 100401696 C CN100401696 C CN 100401696C
- Authority
- CN
- China
- Prior art keywords
- cookie
- address
- account number
- website
- broadband account
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Images
Landscapes
- Information Transfer Between Computers (AREA)
Abstract
The present invention discloses a method for detecting the number of computer users in an inner computer network, which comprises the steps: all IP packets which flow through a communication link are derived by the mirror image function of a light splitter or a network device and then are analyzed; the coincidence relation among an IP address, a website URL and a Cookie is obtained by referring an HTTP protocol; the coincidence relation among the IP address, the website URL and the Cookie is converted into the coincidence relation among a broad band account number, the website URL and the Cookie by referring an RADIUS protocol; the number of computer users sharing the same IP address or the same broad band account number to access a network is found out by comparing Cookies when the users access the WEB website. The present invention can more accurately calculate the number of users sharing the same IP address or the same broad band account number to connect the Internet so as to provide important market data for Internet accessing operators and can be used for hitting the misuse of broad band resources.
Description
One, technical field
The present invention relates to a kind of method that detects the computer user's number in the internal computer network, be applicable to the Internet access service field.
Two, background technology
Based on the consideration of the scarcity and the fail safe aspect of IP address resource, the user is extensive use of NAT (Network Address Translator) or application layer HTTP Proxy at present, allows many computers share an IP address and is linked into the Internet.
Because the needs of market development, ISP wishes to grasp in the internal computer network of each enterprise or family has be linked into the Internet for what computer users, yet does not also have desirable solution can satisfy this demand at present.
Utilize the dull growth property of the Identification field in the IP packets headers, can judge what computer users roughly and just connect the Internet in shared certain IP address, but this method is at the number of users of judging use UNIX type operating system, when using the number of users of HTTP Proxy, make a mistake easily, only can be as a kind of supplementary means.Discern browser kind in IM ID (Instant Message Identity) that the user uses, EMAIL account number, the HTTP data message and version number etc. in addition, can be as a reference, but all inaccurate.
Three, summary of the invention
1, goal of the invention: the purpose of this invention is to provide a kind of method that is used for calculating what computer users shared same IP address or broadband account number connection the Internet more accurately.
2, for achieving the above object, a kind of method that detects computer number of users in the internal computer network of the present invention is characterized in that this method may further comprise the steps:
(1) utilizes the image feature of the optical splitter or the network equipment to derive initial data, monitor all the IP groupings on certain communication link of flowing through;
(2) analyze these IP groupings with reference to http protocol, obtain the corresponding relation between IP address, website URL, the Cookie three;
(3) with reference to these IP groupings of Radius protocal analysis, the dynamic correspondence table that obtains broadband account number and IP address is (when same broadband account number is connected to the Internet at every turn, may obtain different IP addresses), thus the corresponding relation between IP address, website URL, the Cookie three is converted to corresponding relation between broadband account number, website URL, the Cookie three.
Only analyze the situation of fixed ip address below, utilize the dynamic correspondence table of broadband account number and IP address just can obtain the situation of broadband account number, no longer repeat.
(4) utilize same WEB website to distribute to various computing machine user's Cookie difference, detected Cookie number has been weighed shared this IP address of what computer users or broadband account number connection the Internet when visiting same website with same IP address or broadband account number, and for example system monitoring arrives following corresponding relation:
(IP address ip _ A, URL_1, Cookie_X)
(IP address ip _ A, URL-1, Cookie_Y)
2 computer users then can have been calculated, by share I P address IP_A and Internet connection.
The incoherent characteristic of Cookie of utilizing different WEB website to be distributed, detect maximum when visiting a plurality of different web sites with the corresponding Cookie number in identical WEB website with same IP address or broadband account number, weighed what computer users shared same IP address or broadband account number and connected the Internet, for example system monitoring arrives following corresponding relation:
(IP address ip _ A, URL_1, Cookie_X)
(IP address ip _ A, URL_1, Cookie_Y)
(IP address ip _ A, URL_2, Cookie_1)
(IP address ip _ A, URL_2, Cookie_2)
(IP address ip _ A, URL_2, Cookie_3)
(IP address ip _ A, URL_2, Cookie_4)
(IP address ip _ A, URL_2, Cookie_5)
(IP address ip _ A, URL_3, Cookie_Z)
The Cookie number corresponding with URL_1 is 2, and the Cookie number corresponding with URL_2 is 5, and the Cookie number corresponding with URL_3 is 1, gets maximum value calculation and goes out to have 5 computer users by IP address ip _ A and Internet connection.
Can adopt Cookie time-interleaving method to improve accuracy in computation, promptly at certain time intervals in, the maximum of the Cookie quantity of detected Cookie overlapping appearance in time when visiting specific WEB website with same IP address has been weighed shared this IP address of what computer users and has been connected the Internet.On time shaft, with the time period of certain Cookie, as the valid interval of this Cookie from occurring for the first time once occurring to the end.The maximum of Cookie quantity in the valid interval overlay region of each Cookie is computer user's number that shared this IP address connects the Internet.For example system monitoring is to each Cookie corresponding with website URL_2, and the relation on time shaft has then calculated 3 computer users as shown in Figure 1, shared IP address ip _ A and Internet connection.
For further improving accuracy of detection, initiatively be that the computer user implants specific Cookie by the WEB redirecting technique.The quantity that detects this specific Cookie during with same IP address access internet has been weighed shared this connection the Internet, IP address of what computer users.By following two kinds of methods, all can initiatively implant Cookie for the computer user.
Method one:
(A) user visits certain website WEB_1 with http protocol;
(B) before website WEB_1 response, detection system sends redirection message with http protocol to the user, and promptly HTTP 302 messages are redirected to website WEB_2;
(C) user browser is automatically with http protocol access site WEB_2, and website WEB_2 implants Cookie, and returns another redirection message, is redirected to the user and plans the website WEB_1 that visits originally.Be the example that WEB_2 goes up redirection message below, WEB_1 is www.example.com, and the Cookie of implantation is TESTCOOKIE=123456abc.
| HTTP/1.1302?Object?moved Location：http://www.example.com/ Set-Cookie：TESTCOOKIE＝123456abc；expires＝Sun，17-Jan-2038 19:14:07GMT；path＝/ Content-Length：0 Content-Type：text/html Connection：close Cache-control：private |
Method two:
(A) user visits certain website WEB_1 with http protocol;
(B) before website WEB_1 response, detection system sends redirection message with http protocol to the user, i.e. HTTP 302 messages, this message still are redirected to him to the user wants the website WEB_1 that visits, and implants Cookie simultaneously.Be an example of this redirection message below, WEB_1 is www.example.com, and the Cookie of implantation is TESTCOOKIE=USER_123.
| HTTP/1.1302Object?moved Location：http://www.example.com/ Set-Cookie：TESTCOOKIE＝USER_123；expires＝Sun，17-Jan-2038 19:14:07GMT；path＝/；domain＝www.cctv.com Content-Length：0 |
Distribute to the uniqueness characteristic of same computer user's Cookie according to same WEB website, find that same computer user uses different IP addresses to connect the situation of the Internet.For example, system monitoring arrives following corresponding relation:
(IP address ip _ A, URL_1, Cookie_M)
(IP address ip _ B, URL_1, Cookie_M)
A computer user then has been described, had connected the Internet with IP address ip _ A originally, connected the Internet by using IP address ip _ B instead afterwards, can see the transfer of same computer user between different IP addresses with this.
In addition, for detecting the situation that a plurality of computer users shared same IP address connects the Internet, also can send advertised information (for example being warning) to these computer users, method is as follows:
(A) user visits certain website WEB_1 with http protocol;
(B) before website WEB_1 response, detection system sends redirection message with http protocol to the user, and promptly HTTP 302 messages are redirected to website WEB_2, and the user sees the advertised information on the WEB_2 website.
In conjunction with other strategies of the dull growth property of utilizing the Identification field in the IP packets headers described in the background technology of front and operator's definition, whether need can determine a plurality of computer users to send advertised information to the online of shared same IP address.
The present invention finds out computer user's number of sharing the online of same IP address by the Cookie of contrast user when using http protocol visit WEB website.Because http protocol itself is a stateless, so same user can not be distinguished in the visit of different time to it in WEB website itself.The introducing of Cookie is exactly in order to address this problem.Cookie itself is a very little text, and the WEB website can be write this file the hard disk of access customer by user's browser.When user browser when visiting same WEB website next time, under qualified situation (as the server domain name unanimity, URL unanimity, and Cookie does not have expired etc.), browser will return to the WEB website to this Cookie.Because Cookie is the file that is kept on the hard disk, even the user closes browser, shuts down computer, perhaps Lian Wang IP address changes, and the content of Cookie all can not change.The Cookie that while is distributed to various computing machine user owing to the WEB website is different, so Cookie can be regarded as identifying uniquely computer user's sign.
The present invention utilize passive monitoring or initiatively implant two kinds of methods obtain the user when visit specific WEB website with Cookie, and utilize the sign of Cookie as the Internet user.On this basis, the present invention has designed technological package and has discerned how many computer users shared same IP address or broadband account number connection the Internet.Because having used different users Cookie when visiting identical WEB website is this characteristic inequality, the present invention can calculate the computer user's quantity in the internal computer network more exactly.
3, beneficial effect: the present invention can calculate what computer users shared same IP address more exactly or the broadband account number connects the Internet, for the Internet access carrier provides important marketing data, also can be used for hitting the abuse bandwidth resources.
Four, description of drawings
Fig. 1 is a Cookie time-interleaving method schematic diagram.
Fig. 2 is an application system specific embodiments schematic diagram.
Five, embodiment
Concrete system realization scheme of the present invention as shown in Figure 2.Metropolitan area network/province territory Netcom that ISP makes up crosses router _ 2 and is connected with INTERNET backbone's router _ 1; The Radius server is linked into metropolitan area network by router _ 3; Computer user _ A, user _ B are linked into metropolitan area network by NAT; Computer user _ C, user _ D are linked into metropolitan area network by HTTP PROXY; HTTP, Raduis protocol analysis system are responsible for User IP packet and Radius IP packet are analyzed, and are redirected the WEB website and provide the announcement page to the user, and initiatively implant Cookie to user side.
The present invention utilizes the image feature of the optical splitter or the network equipment to derive initial data, can monitor all the IP packets on certain communication link of flowing through.In Fig. 2, the present invention has derived IP packet between router _ 1 and router _ 2 and the IP packet between router _ 3 and the Radius server.HTTP, Radius protocol analysis system can obtain the corresponding relation between IP address, website URL, the Cookie three with reference to http protocol analysis user IP packet; With reference to the packet of radius protocol analyzing IP, can obtain broadband account number, the IP address dynamic correspondence table between the two, thereby the corresponding relation between IP address, website URL, the Cookie three can be converted to the corresponding relation between broadband account number, website URL, the Cookie three.Use the several method of the present invention aforesaid calculating same IP address or the pairing Cookie number of broadband account number, just can calculate computer user's quantity of sharing same IP address or broadband account number connection the Internet.
Claims (3)
1. method that detects computer number of users in the internal computer network is characterized in that this method may further comprise the steps:
(1) utilizes the image feature of the optical splitter or the network equipment to derive initial data, monitor all the IP groupings on certain communication link of flowing through;
(2) analyze these IP groupings with reference to http protocol, obtain the corresponding relation between IP address, website URL, the Cookie three;
(3) with reference to these IP groupings of Radius protocal analysis, obtain the dynamic correspondence table of broadband account number and IP address, thereby the corresponding relation between IP address, website URL, the Cookie three is converted to corresponding relation between broadband account number, website URL, the Cookie three;
(4) utilize same WEB website to distribute to various computing machine user's Cookie difference, detected Cookie number has been weighed shared this IP address of what computer users or broadband account number connection the Internet when visiting same website with same IP address or broadband account number; And the incoherent characteristic of Cookie of utilizing different WEB website to be distributed, detect the maximum with the corresponding Cookie number in identical WEB website when visiting a plurality of different web sites, weighed what computer users shared same IP address or broadband account number and connected the Internet with same IP address or broadband account number.
2. method that detects computer number of users in the internal computer network is characterized in that this method may further comprise the steps:
(1) utilizes the image feature of the optical splitter or the network equipment to derive initial data, monitor all the IP groupings on certain communication link of flowing through;
(2) analyze these IP groupings with reference to http protocol, obtain the corresponding relation between IP address, website URL, the Cookie three;
(3) with reference to these IP groupings of Radius protocal analysis, obtain the dynamic correspondence table of broadband account number and IP address, thereby the corresponding relation between IP address, website URL, the Cookie three is converted to corresponding relation between broadband account number, website URL, the Cookie three;
(4) in adopting at certain time intervals, the maximum of the Cookie quantity of detected Cookie overlapping appearance in time when visiting specific WEB website with same IP address or broadband account number has been weighed shared this IP address of what computer users or broadband account number and has been connected the Internet.
3. method that detects computer number of users in the internal computer network is characterized in that this method may further comprise the steps:
(1) utilizes the image feature of the optical splitter or the network equipment to derive initial data, monitor all the IP groupings on certain communication link of flowing through;
(2) analyze these IP groupings with reference to http protocol, obtain the corresponding relation between IP address, website URL, the Cookie three;
(3) with reference to these IP groupings of Radius protocal analysis, obtain the dynamic correspondence table of broadband account number and IP address, thereby the corresponding relation between IP address, website URL, the Cookie three is converted to corresponding relation between broadband account number, website URL, the Cookie three;
(4) initiatively be that the computer user implants specific Cookie by the WEB redirecting technique, the quantity that detects this specific Cookie during with same IP address or broadband account number access internet has been weighed shared this IP address of what computer users or broadband account number connection the Internet.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB2006100882144A CN100401696C (en) | 2006-07-04 | 2006-07-04 | Method for detecting number of computer users in inner compute network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB2006100882144A CN100401696C (en) | 2006-07-04 | 2006-07-04 | Method for detecting number of computer users in inner compute network |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN1878096A CN1878096A (en) | 2006-12-13 |
| CN100401696C true CN100401696C (en) | 2008-07-09 |
Family
ID=37510403
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CNB2006100882144A Expired - Fee Related CN100401696C (en) | 2006-07-04 | 2006-07-04 | Method for detecting number of computer users in inner compute network |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN100401696C (en) |
Families Citing this family (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101222348B (en) * | 2007-01-10 | 2011-05-11 | 阿里巴巴集团控股有限公司 | Method and system for calculating number of website real user |
| CN100562020C (en) * | 2007-03-30 | 2009-11-18 | 华为技术有限公司 | Detection method, statistic analysis server and detection system |
| KR101013996B1 (en) * | 2008-10-10 | 2011-02-14 | 플러스기술주식회사 | A method for detecting a judgement whether or not a client use NATNetwork Address Translation, and the number of terminals sharing |
| CN101631052B (en) * | 2009-08-25 | 2012-09-05 | 杭州华三通信技术有限公司 | Method and device for detecting number of access terminals |
| WO2013106951A1 (en) * | 2012-01-21 | 2013-07-25 | 博泰雄森（北京）网络科技有限公司 | Method and system for identifying user identity according to specific information |
| CN103457789A (en) * | 2013-08-15 | 2013-12-18 | 北京星网锐捷网络技术有限公司 | Parallel operation detecting method and device |
| US9301126B2 (en) | 2014-06-20 | 2016-03-29 | Vodafone Ip Licensing Limited | Determining multiple users of a network enabled device |
| CN105703962A (en) * | 2014-11-25 | 2016-06-22 | 中兴通讯股份有限公司 | Internet access user detection method and device |
| CN105447147B (en) * | 2015-11-26 | 2019-02-01 | 晶赞广告（上海）有限公司 | A kind of data processing method and device |
| CN106789413B (en) * | 2016-12-10 | 2019-12-06 | 锐捷网络股份有限公司 | Method and device for detecting proxy internet surfing |
| CN108833197B (en) * | 2018-04-10 | 2020-10-16 | 中国科学院信息工程研究所 | Active detection method and detection platform based on cloud |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6460079B1 (en) * | 1999-03-04 | 2002-10-01 | Nielsen Media Research, Inc. | Method and system for the discovery of cookies and other client information |
| CN1449618A (en) * | 2000-09-04 | 2003-10-15 | 国际商业机器公司 | System communication between computer systems |
| US20040128390A1 (en) * | 2002-12-31 | 2004-07-01 | International Business Machines Corporation | Method and system for user enrollment of user attribute storage in a federated environment |
| WO2005013072A2 (en) * | 2003-08-01 | 2005-02-10 | Tacoda Systems, Inc. | System and method for segmenting and targeting audience members |
| CN1732700A (en) * | 2002-12-31 | 2006-02-08 | 摩托罗拉公司 | Method of tracking mobile station location |
-
2006
- 2006-07-04 CN CNB2006100882144A patent/CN100401696C/en not_active Expired - Fee Related
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6460079B1 (en) * | 1999-03-04 | 2002-10-01 | Nielsen Media Research, Inc. | Method and system for the discovery of cookies and other client information |
| CN1449618A (en) * | 2000-09-04 | 2003-10-15 | 国际商业机器公司 | System communication between computer systems |
| US20040128390A1 (en) * | 2002-12-31 | 2004-07-01 | International Business Machines Corporation | Method and system for user enrollment of user attribute storage in a federated environment |
| CN1732700A (en) * | 2002-12-31 | 2006-02-08 | 摩托罗拉公司 | Method of tracking mobile station location |
| WO2005013072A2 (en) * | 2003-08-01 | 2005-02-10 | Tacoda Systems, Inc. | System and method for segmenting and targeting audience members |
Also Published As
| Publication number | Publication date |
|---|---|
| CN1878096A (en) | 2006-12-13 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN100401696C (en) | Method for detecting number of computer users in inner compute network | |
| US10027564B2 (en) | Unobtrusive methods and systems for collecting information transmitted over a network | |
| US9800539B2 (en) | Request routing management based on network components | |
| US9160703B2 (en) | Request routing management based on network components | |
| KR100900491B1 (en) | Method and apparatus for blocking distributed denial of service | |
| US10284516B2 (en) | System and method of determining geographic locations using DNS services | |
| US7685275B2 (en) | Network interaction analysis | |
| CN102047242B (en) | Content management | |
| US8667176B2 (en) | Network service access method and access gateway equipment | |
| US11456935B2 (en) | Method and server for monitoring users during their browsing within a communications network | |
| US20180324064A1 (en) | Unobtrusive methods and systems for collecting information transmitted over a network | |
| US9412111B2 (en) | Network interaction monitoring appliance | |
| KR101518472B1 (en) | Method for detecting a number of the devices of a plurality of client terminals selected by a web server with additional non-specified domain name from the internet request traffics sharing the public IP address and System for detecting selectively the same | |
| US20110302272A1 (en) | Unobtrusive methods and systems for collecting information transmitted over a network | |
| CN106411819A (en) | Method and apparatus for recognizing proxy Internet protocol address | |
| KR101518469B1 (en) | Method for detecting a number of the selected devices of a plurality of client terminals from the internet request traffics sharing the public IP address and System for detecting selectively the same | |
| US10402832B2 (en) | Network interaction correlation | |
| KR101028037B1 (en) | A system and a method for compulsory redirecting user's connection address by watching the user's connection address | |
| WO2008076234A1 (en) | A network interaction monitoring appliance | |
| Pujol Gil | Web content delivery, monetization, and search | |
| TWI446772B (en) | A cross - domain cookie access method, system and device | |
| Pujol Gil | Web content delivery, monetization, and search: back-office and advertisement traffic on the Internet | |
| KR20070119813A (en) | System for providing internet site ranking information and method thereof | |
| WO2009128820A1 (en) | Unobtrusive methods and systems for collecting information transmitted over a network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20080709 Termination date: 20190704 |
|
| CF01 | Termination of patent right due to non-payment of annual fee |