CN103457789A - Parallel operation detecting method and device - Google Patents
Parallel operation detecting method and device Download PDFInfo
- Publication number
- CN103457789A CN103457789A CN2013103567688A CN201310356768A CN103457789A CN 103457789 A CN103457789 A CN 103457789A CN 2013103567688 A CN2013103567688 A CN 2013103567688A CN 201310356768 A CN201310356768 A CN 201310356768A CN 103457789 A CN103457789 A CN 103457789A
- Authority
- CN
- China
- Prior art keywords
- cookie
- value
- name
- characteristic value
- parallel operation
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Abstract
The invention discloses a parallel operation detecting method and device which are used for solving the problem that the misjudgment rate is relatively high when parallel operation detection is conducted on user terminals having access to a network in the prior art. The method comprises the steps that according to characteristic values which are used for representing behavior characteristics of the user terminals and contained in network data packages sent by an IP address to be detected, and all parallel operation conditions which are respectively set in advance with respect to different types of the characteristic values, whether the characteristic values trigger the parallel operation conditions corresponding to the characteristic values is judged; according to the number of triggered times of each parallel operation condition, a parallel operation evaluation value used for evaluating whether the IP address is used by the user terminals in a shared mode is determined; when the parallel operation evaluation value is greater than a preset parallel operation threshold value, a notification message representing that the IP address is used by the user terminals in the shared mode is output.
Description
Technical field
The present invention relates to the network security technology field, relate in particular to a kind of parallel operation detection method and device.
Background technology
At present, nearly all ISP is all that employing is metered for the charge method of wideband switch-in business, rather than meterage.The certain user utilizes this leak just, the mode that allows a plurality of user terminals access by parallel operation is carried out shared network, so that the expense that user corresponding to the plurality of user terminal shares wideband switch-in business jointly, thereby brought huge economic loss to ISP.So-called parallel operation access, refer to without the user terminal of network authentication and walk around or crack network authentication mechanism, and share through the user terminal of network authentication agreement (Internet Protocol, the IP) address interconnected between same network and carry out access network.Therefore, the user terminal of access network is carried out and machine testing, namely judge whether the IP address of the user terminal of access network is shared and used by a plurality of user terminals.
At present, industry is carried out the user terminal of access network and the method for generally using during machine testing has following several:
1, the sign id field continuity detection method in the IP message
All comprise an id field in the IP message that the user terminal of access network sends, the value of this id field sends the order of IP message according to user terminal, from 0 to 65535 successively circulation increase progressively, and receive that the equipment (as router, acting server etc.) of the network side of IP message can not modify to this field.Therefore, if the order of the IP message sent by same IP address arrival network side and the sending order of user terminal are consistent, the value that arrives so the id field in each IP message of network side should increase progressively, so can whether only have a user terminal under same IP address according to the continuity judgement of the value of this id field.Yet generally the sending order of the order of very difficult assurance IP message arrival network side and user terminal is consistent.In addition, if user terminal has infected virus or worm, also can make the id field in the IP message produce ANOMALOUS VARIATIONS, this all can cause inevitable erroneous judgement, and the accuracy of testing result is reduced greatly, and False Rate is relatively high.
2, some website of Cookie(in order to distinguish user identity, carry out session tracking and be stored in the data on the subscriber's local terminal) sign ID counts detection method
Record the Cookie ID value of the different user terminals of the same website of access in the Cookie term of validity, and judge the number of the user terminal of sharing this IP address according to the number of the different Cookie ID values under same IP address.If only have a Cookie ID value under same IP address, illustrate that this IP address only used by a user terminal, there do not is the situation of parallel operation access; If a plurality of Cookie ID values are arranged under same IP address, illustrate that this IP address shared by a plurality of user terminals, there is the situation of parallel operation access.Yet, if a user terminal is opened a plurality of browsers simultaneously, now network side can be the different Cookie ID value of each browser assignment; In addition, if the user terminal browser is set to cleaning Cookie ID value when cutting out, when reopening and use browser, network side can be redistributed again Cookie ID value so.Therefore, according to the number of Cookie ID value, be the number that can not judge exactly the user terminal of share I P address.Therefore the False Rate of this detection scheme is also higher, and the accuracy of testing result is lower.
3, the sequence number continuity detection method of transmission control protocol (Transmission Control Protocol, TCP) message
This detection method is similar to the above-mentioned principle detected according to the sign id field in the IP message, therefore also exists False Rate higher, the defect that the accuracy of testing result is lower.
As can be seen here, the existing user terminal to access network carries out and all there is the defect that False Rate is higher in the method for machine testing.
Summary of the invention
The embodiment of the present invention provides a kind of parallel operation detection method and device, in order to solve in prior art the higher problem of False Rate of at the user terminal to access network, carrying out and existing during machine testing.
The embodiment of the present invention is by the following technical solutions:
A kind of parallel operation detection method comprises:
The characteristic value for the behavioural characteristic that characterizes user terminal comprised in the network packet sent according to IP address to be detected, and each parallel operation condition arranged for the dissimilar of characteristic value and respectively in advance, judge whether described characteristic value triggers the parallel operation condition corresponding with it; Wherein, the characteristic value that comprises respectively the type corresponding with it in each parallel operation condition is shared while using the characteristic information that should possess in described IP address by a plurality of user terminals, when described characteristic value possesses the described characteristic information comprised in the parallel operation condition corresponding with it, described characteristic value triggers the parallel operation condition corresponding with it;
The number of times be triggered according to each parallel operation condition, be identified for assessing described IP address and whether by a plurality of user terminals, shared the parallel operation assessed value of using;
When described parallel operation assessed value is greater than the parallel operation threshold value set in advance, output is shared for characterizing described IP address the notification message used by a plurality of user terminals.
A kind of and machine detecting device comprises:
Parallel operation condition judgment unit, the characteristic value for the behavioural characteristic that characterizes user terminal comprised for the network packet sent according to IP address to be detected, and each parallel operation condition arranged for the dissimilar of characteristic value and respectively in advance, judge whether described characteristic value triggers the parallel operation condition corresponding with it; Wherein, the characteristic value that comprises respectively the type corresponding with it in each parallel operation condition is shared while using the characteristic information that should possess in described IP address by a plurality of user terminals, when described characteristic value possesses the described characteristic information comprised in the parallel operation condition corresponding with it, described characteristic value triggers the parallel operation condition corresponding with it;
Parallel operation assessed value determining unit, the number of times be triggered for each parallel operation condition gone out according to parallel operation condition judgment unit judges, be identified for assessing described IP address and whether by a plurality of user terminals, shared the parallel operation assessed value of using;
The notification message output unit, while in parallel operation assessed value determining unit, determining described parallel operation assessed value, being greater than the parallel operation threshold value set in advance, output is shared for characterizing described IP address the notification message used by a plurality of user terminals.
The beneficial effect of the embodiment of the present invention is as follows:
In technique scheme, at first, according to the characteristic value of a plurality of types, jointly judge that whether IP address to be detected shared and use by a plurality of user terminals, compared with prior art, basis for estimation is more comprehensive; Secondly, all types of characteristic values is the different parallel operation condition of correspondence respectively, and the number of times be triggered according to each parallel operation condition is determined the parallel operation assessed value of IP address to be detected, rather than the continuity identified in the number of the cookie value that only basis detects blindly or IP message judges whether IP address to be detected is shared and used by a plurality of user terminals, therefore can greatly improve the accuracy rate of judgement and reduce False Rate, thereby avoid the higher defect of False Rate existed in the prior art.
The accompanying drawing explanation
Fig. 1 is the schematic diagram of realizing that mode that in prior art, the user accesses by parallel operation is carried out shared network;
A kind of parallel operation detection method that Fig. 2 provides for the embodiment of the present invention realize schematic diagram;
The realization flow figure of the number of concurrent of the characteristic value of a kind of definite cookie type that Fig. 3 provides for the embodiment of the present invention;
The another kind that Fig. 4 provides for the embodiment of the present invention is determined the realization flow figure of number of concurrent of the characteristic value of cookie type;
Fig. 5 is provide and application scenarios schematic diagram machine detecting device for the embodiment of the present invention;
The structural representation of a kind of and machine detecting device that Fig. 6 provides for the embodiment of the present invention.
Embodiment
For the higher problem of False Rate that solves in prior art that user terminal to access network carries out and exist during machine testing, the inventor comes shared network to be studied to the mode that in prior art, how a plurality of users access by parallel operation, as shown in Figure 1, the mode accessed by parallel operation for user in prior art is carried out the schematic diagram of realizing of shared network, wherein, the user of user terminal 1 is the user of legal use wideband switch-in business, this user terminal 1 carries out network authentication by Authentication Client, and after authentication success access network, then user terminal 2, user terminal 3, user terminal 4 is by network address translation (the Network Address Translation of router, NAT) pattern, the IP address of self is set to the IP address identical with user terminal 1, thereby bypassing authentication mechanism, realize that parallel operation accesses shared network.
Mode based on above-mentioned parallel operation access of the prior art, the embodiment of the present invention provides a kind of parallel operation detection method and device.In this technical scheme, at first, according to the characteristic value of a plurality of types, jointly judge that whether IP address to be detected shared and use by a plurality of user terminals, compared with prior art, basis for estimation is more comprehensive; Secondly, all types of characteristic values is the different parallel operation condition of correspondence respectively, and the number of times be triggered according to each parallel operation condition is determined the parallel operation assessed value of IP address to be detected, rather than the continuity identified in the number of the cookie value that only basis detects blindly or IP message judges whether IP address to be detected is shared and used by a plurality of user terminals, therefore can greatly improve the accuracy rate of judgement and reduce False Rate, thereby avoid the higher defect of False Rate existed in the prior art.
Below in conjunction with Figure of description, embodiments of the invention are described, should be appreciated that embodiment described herein, only for description and interpretation the present invention, is not limited to the present invention.And, in the situation that do not conflict, the embodiment in this explanation and the feature of embodiment can be interosculated.
The embodiment of the present invention provides a kind of parallel operation detection method, is illustrated in figure 2 the realization flow figure of the method, mainly comprises the steps:
Characteristic value in the embodiment of the present invention is the sign of the behavioural characteristic for characterizing user terminal, and its type can comprise: cookie type, account type and version number's type etc.Such as, when the type of characteristic value is the cookie type, characteristic value can be the cookie name; When the type of characteristic value is account type, characteristic value can be QQ number, microblog users name or website log account etc.; When the type of characteristic value is version number's type, characteristic value can be operating system version of software version number or personal computer number etc.It should be noted that, the characteristic value in the embodiment of the present invention can be, but not limited to the characteristic value into above-mentioned this several types.
Wherein, the characteristic value that comprises respectively the type corresponding with it in each parallel operation condition is shared while using the characteristic information that should possess in IP address to be detected by a plurality of user terminals, when the characteristic value comprised in network packet possesses the characteristic information comprised in the parallel operation condition corresponding with it, it triggers the parallel operation condition corresponding with it.Such as: during characteristic value that the characteristic value comprised in the network packet that IP address to be detected sends is the cookie type, the characteristic value comprised in the network packet that can send according to IP address to be detected, determine the number of concurrent of this characteristic value, whether the number of concurrent that then judges this characteristic value is greater than the number of concurrent threshold value set in advance, judgment result is that while being, determining that this characteristic value triggers the parallel operation condition;
When the type of the characteristic value comprised in the network packet that IP address to be detected sends is account type, at first obtain the characteristic value of account type the network packet sent from IP address to be detected, then judge in the very first time length set in advance, whether the quantity of the mutually different characteristic value got is greater than the account amount threshold set in advance, when judgment result is that while being, determine that the characteristic value got triggers the parallel operation condition in this very first time length;
When the type of the characteristic value comprised in the network packet that IP address to be detected sends is version number's type, at first obtain the characteristic value of version number's type the network packet sent from IP address to be detected, then judge in the second time span set in advance, in the characteristic value got, whether exist at least one to meet the characteristic value of the specified conditions that set in advance, when judgment result is that while being, determine that the characteristic value got triggers the parallel operation condition in this second time span; Wherein, specified conditions are: each characteristic value got respectively the indication software version in, the indicated software version of this characteristic value is not up-to-date software version, and after the acquisition time of the acquisition time of this characteristic value characteristic value of up-to-date software version in indication.
This step can realize in the following manner: when the parallel operation condition is triggered once, the parallel operation assessed value of IP address to be detected just adds 1 accordingly.
Further, in actual applications, the parallel operation assessed value of IP address to be detected is not limited to above-mentioned this definite method, and the number of times that can also be triggered according to each parallel operation condition and the weight coefficient arranged for different parallel operation conditions and are respectively in advance determined the parallel operation assessed value of IP address to be detected.
In technique scheme, the characteristic value by a plurality of types judges whether IP address to be detected is shared and used by a plurality of user terminals, and compared with prior art, basis for estimation is more comprehensive, therefore can greatly reduce False Rate jointly.
Based on foregoing invention design, the characteristic value of cookie type of below take is example, and the number of concurrent of the characteristic value of how to confirm cookie type is specifically introduced.
As shown in Figure 3, the realization flow figure of the number of concurrent of the characteristic value of a kind of definite cookie type provided for the embodiment of the present invention, wherein, the characteristic value of cookie type is the cookie name.
Because different message in the network packet of IP address transmission to be detected may carry identical characteristic value, if repeat to obtain these identical characteristic values, there are a large amount of insignificant characteristic values in the characteristic value that not only can make to acquire, also can increase the operation burden of system, therefore, in the embodiment of the present invention, in the GET request message the network packet that can be, but not limited to only send from IP address to be detected, obtain characteristic value.
Wherein, the supervision website set in advance can be the higher website of some visit capacities, can be divided into special group website and essential website, and wherein, essential website is the often number of site of access of domestic consumer, such as Baidu, microblogging, Sina, Tengxun etc.; And the special group website can be arranged respectively according to different groups.Such as take the student as example, can be school's Intranet, school library website etc.It should be noted that, monitor website can according to and the machine testing demand arranged, at this, do not enumerate.
Wherein, step 31～step 33 is optional step, in the network packet that in the embodiment of the present invention, also directly secondary IP address sends, obtains cookie name and the cookie value corresponding with the cookie name.Why to set in advance and monitor website, the screening of realization to the characteristic value of cookie type, be because if all characteristic values to the cookie type are blindly all obtained, what the data volume got can be very is huge, to system, brings great operation burden.
Wherein, pre-stored cookie name can obtain in the following manner:
At first, at the net environment without parallel operation, the message that the URL information of URL information and the supervision website that sets in advance obtained from network packet is complementary; Then, obtain respectively cookie name and the cookie value corresponding with each cookie name difference from the above-mentioned message got, and whether each cookie name that judgement gets respectively meets the storage condition set in advance; Wherein, storage condition is: the number of times that obtains of this cookie name is greater than the frequency threshold value of obtaining set in advance, and the number of the cookie value corresponding with this cookie name is less than the cookie value number threshold value set in advance; Finally, the cookie name that meets above-mentioned storage condition is stored.
It should be noted that, why according to the pre-stored cookie name of above-mentioned storage condition, be because at the net environment without parallel operation, a corresponding user terminal in IP address, and the user of this user terminal accesses while monitoring website and possesses following feature:
1, monitor that the visit capacity of website is high, this just requires obtaining number of times and should being greater than the frequency threshold value of obtaining set in advance of the cookie name that gets;
2, when the user accesses same supervision website, the cookie value that generally the cookie name is distributed in this supervision website should not occur many-valued, yet, if this user opens a plurality of browsers while browsing same supervision website simultaneously, this monitors that website will be the different cookie value of each browser assignment, in addition, if this user's browser is set to cleaning cookie value when cutting out, so when using browser to reopen this supervision website, the cookie value can be redistributed for this user again in this supervision website, therefore in order to make the follow-up testing result obtained more accurate, only obtain in the embodiment of the present invention and do not occur many-valued or the cookie name of less cookie value occurs, therefore just require the number of the cookie value of the cookie name correspondence that gets should be less than the cookie value number threshold value set in advance, and this cookie value number threshold value can be 1, also can be for being greater than a preferred value of 1.
In this step, when there being the cookie value be complementary with the cookie value got, and in the corresponding cookie value of pre-stored cookie name be complementary in the cookie name with getting, during cookie value after the acquisition time of the cookie value that exists at least one acquisition time to be complementary in the cookie value with getting, illustrate that this user terminal corresponding to IP address to be detected has been used alternatingly different cookie values and has visited same website (same cookie name).And, in the situation that, without parallel operation, IP address to be detected, when the same website of access, generally should only have a cookie value, therefore if there is above-mentioned this situation, there is the possibility of parallel operation in this IP address to be detected.
Wherein, the process of above-mentioned introduction is only the handling process for a GET message, and to IP address to be detected carry out and the whole process of machine testing in comprise a plurality of above-mentioned handling processes.
In the above-mentioned scheme provided of the embodiment of the present invention, the cookie name comprised in the network packet sent according to IP address to be detected and with the corresponding cookie value of this cookie name, and pre-stored cookie name and the cookie value corresponding with pre-stored cookie name difference, judge whether user terminal corresponding to IP address to be detected has been used alternatingly different cookie values and has visited same website (same cookie name), when judging user terminal corresponding to IP address to be detected and be used alternatingly different cookie values and visit same website, this cookie name comprised in network packet so triggers the parallel operation condition.With in prior art, compare, this programme be not blindly will the number of the different cookie values under IP address to be detected as the foundation that judges parallel operation, so False Rate is relatively low.
Below or take the characteristic value of cookie type is example, introduce the method for number of concurrent of the characteristic value of another kind of how to confirm cookie type.
As shown in Figure 4, the another kind provided for the embodiment of the present invention is determined the realization flow figure of number of concurrent of the characteristic value of cookie type, and wherein the characteristic value of cookie type is the cookie name.What the method was different from above-described embodiment is, when judging whether user terminal corresponding to IP address to be measured has been used alternatingly different cookie values and visits same website, the highest significant position and the least significant bit that are the bitmap bitmap corresponding by each cookie value relatively judge, below the method are done to concrete introduction:
Wherein, the obtain manner of pre-stored cookie name can, with reference to the description in step 34 in above-described embodiment, not repeat them here.And obtain each cookie name and the cookie value corresponding with each cookie name difference the network packet sent from IP address to be detected, can, with reference to the description in step 31～step 33 in above-described embodiment, at this, also repeat no more.It should be noted that, in the embodiment of the present invention, when obtaining each cookie name the network packet sent from IP address to be detected and distinguishing corresponding cookie value with each cookie name, if the cookie name got and pre-stored cookie name are complementary, in cookie value corresponding to the cookie name that the cookie name that judges and get is complementary, the cookie value that cookie value corresponding to the cookie name that whether exists and get is complementary, if there is no, this cookie value that will get is stored in cookie value corresponding to the cookie name that is complementary with the cookie name got, be the bitmap bitmap of one 32 of this cookie value associations of storage simultaneously, and the lowest order of bitmap is set to effectively, be that lowest order is set to 1, if exist, the lowest order of the bitmap that the cookie value that the cookie value corresponding with the cookie name got is complementary is corresponding is set to 1.
In the embodiment of the present invention, the acquisition time of two cookie values choosing can be corresponding according to it bitmap determine, when between the least significant bit of the least significant bit of bitmap corresponding to cookie value or highest significant position corresponding bitmap in another cookie value and highest significant position, two of description selection cookie values are for alternately obtaining.
Step 49, by each cookie value difference of this cookie name correspondence, each data bit of corresponding bitmap moves forward one.
Wherein, said process can be carried out in each default execution cycle circulation.
In technique scheme, not only can determine respectively the number of concurrent of each cookie name got from each network packet, and the number of concurrent of each cookie name of determining is all each cookie name maximum number of concurrent within each execution cycle.
Based on the above-mentioned parallel operation detection method provided, the embodiment of the present invention also provides a kind of and machine detecting device, as shown in Figure 5, and for the embodiment of the present invention is that provide and application scenarios schematic diagram machine detecting device.Wherein, can by and machine detecting device be deployed between switch and user terminal, make the up-downgoing flow of user terminal to pass through and machine detecting device, also machine detecting device just can be realized each user terminal under switch is monitored in real time, thereby guarantees that this net environment not there will be the situation of parallel operation.
Based on foregoing invention design, the embodiment of the present invention provides a kind of and machine detecting device, as shown in Figure 6, is the structural representation of this and machine detecting device.Also machine detecting device comprises:
Parallel operation condition judgment unit 61, the characteristic value for the behavioural characteristic that characterizes user terminal comprised for the network packet sent according to IP address to be detected, and each parallel operation condition arranged for the dissimilar of characteristic value and respectively in advance, judge whether described characteristic value triggers the parallel operation condition corresponding with it; Wherein, the characteristic value that comprises respectively the type corresponding with it in each parallel operation condition is shared while using the characteristic information that should possess in described IP address by a plurality of user terminals, when described characteristic value possesses the described characteristic information comprised in the parallel operation condition corresponding with it, described characteristic value triggers the parallel operation condition corresponding with it;
Parallel operation assessed value determining unit 62, the number of times be triggered for each parallel operation condition of judging according to parallel operation condition judgment unit 61, be identified for assessing described IP address and whether by a plurality of user terminals, shared the parallel operation assessed value of using;
Notification message output unit 63, while in parallel operation assessed value determining unit 62, determining described parallel operation assessed value, being greater than the parallel operation threshold value set in advance, output is shared for characterizing described IP address the notification message used by a plurality of user terminals.
When the type of the characteristic value comprised in network packet is the cookie type, parallel operation condition judgment unit 61 can specifically comprise:
Number of concurrent determination module 611, the characteristic value of the cookie type comprised for the network packet sent according to described IP address, determine the number of concurrent of described characteristic value;
Whether number of concurrent judge module 612, be greater than the number of concurrent threshold value set in advance for the number of concurrent that judges the described characteristic value that number of concurrent determination module 611 is determined;
The first trigger module 613, for when judgment result is that of number of concurrent judge module 612 is, determine that described characteristic value triggers the parallel operation condition corresponding with it.
Concrete, when the characteristic value of cookie type is the cookie name, number of concurrent determination module 611 can specifically for:
Obtain cookie name and the cookie value corresponding with described cookie name from described network packet;
From pre-stored cookie name, judge whether to exist the cookie name be complementary with the cookie name got;
When the cookie name that the cookie name of judging existence and get is complementary, the corresponding cookie value of pre-stored cookie name be complementary from the cookie name with getting, judge whether to exist the cookie value be complementary with the cookie value got;
When judging, exist in the cookie value be complementary with the cookie value got and the corresponding cookie value of pre-stored cookie name be complementary in the cookie name with getting, during cookie value after the acquisition time of the cookie value that exists at least one acquisition time to be complementary in the cookie value with getting, the number of concurrent of the cookie name that the cookie name with getting is complementary is upgraded; And
The number of concurrent of the cookie name that the number of concurrent after upgrading is defined as getting.
In addition, when the characteristic value of cookie type is the cookie name, number of concurrent determination module 611, can also specifically for:
Obtain cookie name and the cookie value corresponding with described cookie name from described network packet;
Carry out following operation in each default execution cycle: according to pre-stored cookie name, and each cookie name got and the cookie value corresponding with each cookie name difference, determine the cookie name be complementary with pre-stored cookie name, and the cookie value corresponding with the cookie name of determining; And determine that for the cookie name each cookie name that submodule is determined carries out respectively the first assigned operation;
Described the first assigned operation comprises: whether the number of the cookie value of this cookie name correspondence that judgement is determined is not less than two; Judgment result is that while being, from the cookie value of this cookie name correspondence, choose any two unduplicated cookie values and carry out the second assigned operations, until travel through any two unduplicated cookie values; Judge whether the current number of concurrent of this cookie name is greater than the historical number of concurrent of the pre-stored cookie name be complementary with this cookie name; When judging described current number of concurrent and be greater than described historical number of concurrent, according to described current number of concurrent, described historical number of concurrent is upgraded; And the historical number of concurrent after upgrading is defined as to the number of concurrent of this cookie name;
Described the second assigned operation comprises: according to the acquisition time of two cookie values choosing, whether two cookie values that judgement is chosen are alternately to obtain; When judging two cookie values choosing when alternately obtaining, the current number of concurrent of this cookie name is added to 1.
Wherein, number of concurrent determination module 611 is being carried out while obtaining cookie name and the cookie value corresponding with described cookie name from described network packet, can specifically for:
Obtain the message that comprises the cookie field in described network packet, and determine the uniform resource position mark URL information in described message; Judge whether the URL information in the described message that URL acquisition of information module gets is complementary with the URL information of the supervision website set in advance; Judgment result is that while being, the cookie field from described message is obtained cookie name and the cookie value corresponding with described cookie name.
Wherein, in above-mentioned two situations, this device can also comprise:
At the net environment without parallel operation, the message that the URL information of URL information and the supervision website that sets in advance obtained is complementary; Obtain respectively cookie name and the cookie value corresponding with each cookie name difference from the described message got; And whether each cookie name that judgement gets respectively meets the storage condition set in advance; The cookie name that meets described storage condition is stored; Wherein, described storage condition is: the number of times that obtains of this cookie name is greater than the frequency threshold value of obtaining set in advance, and the number of the cookie value corresponding with this cookie name is less than the cookie value number threshold value set in advance.
When the type of the characteristic value comprised in network packet is account type, parallel operation condition judgment unit 61 can specifically comprise:
Account type characteristic value acquisition module 614, obtain the characteristic value of account type for the network packet sent from described IP address;
Account quantity judge module 615, for judgement, in the very first time length set in advance, whether the quantity of the mutually different described characteristic value that account type characteristic value acquisition module 614 gets is greater than the account amount threshold set in advance;
The second trigger module 616, for when judgment result is that of account quantity judge module 615 is, determine that the characteristic value of the account type got in described very first time length triggers the parallel operation condition corresponding with it.
When the type of the characteristic value in network packet is version number's type, parallel operation condition judgment unit 61 can specifically comprise:
Version number's type feature value acquisition module 617, obtain the characteristic value of version number's type for the network packet sent from described IP address;
Whether version judge module 618, in the second time span set in advance, exist at least one to meet the characteristic value of the specified conditions that set in advance for judgement in the described characteristic value that version number's type feature value acquisition module 617 gets; Described specified conditions are: each characteristic value got respectively the indication software version in, the indicated software version of this characteristic value is not up-to-date software version, and after the acquisition time of the acquisition time of this characteristic value characteristic value of up-to-date software version in indication;
The 3rd trigger module 619, while for judging at version judge module 617, existing at least one to meet the characteristic value of described specified conditions, determine that the characteristic value of the version number's type got in described the second time span triggers the parallel operation condition corresponding with it.
Those skilled in the art should understand, embodiments of the invention can be provided as method, system or computer program.Therefore, the present invention can adopt complete hardware implementation example, implement software example or in conjunction with the form of the embodiment of software and hardware aspect fully.And the present invention can adopt the form that wherein includes the upper computer program of implementing of computer-usable storage medium (including but not limited to magnetic disc store, CD-ROM, optical memory etc.) of computer usable program code one or more.
The present invention describes with reference to flow chart and/or the block diagram of method, equipment (system) and computer program according to the embodiment of the present invention.Should understand can be in computer program instructions realization flow figure and/or block diagram each flow process and/or the flow process in square frame and flow chart and/or block diagram and/or the combination of square frame.Can provide these computer program instructions to the processor of all-purpose computer, special-purpose computer, Embedded Processor or other programmable data processing device to produce a machine, make the instruction of carrying out by the processor of computer or other programmable data processing device produce for realizing the device in the function of flow process of flow chart or a plurality of flow process and/or square frame of block diagram or a plurality of square frame appointments.
These computer program instructions also can be stored in energy vectoring computer or the computer-readable memory of other programmable data processing device with ad hoc fashion work, make the instruction be stored in this computer-readable memory produce the manufacture that comprises command device, this command device is realized the function of appointment in flow process of flow chart or a plurality of flow process and/or square frame of block diagram or a plurality of square frame.
These computer program instructions also can be loaded on computer or other programmable data processing device, make and carry out the sequence of operations step to produce computer implemented processing on computer or other programmable devices, thereby the instruction of carrying out on computer or other programmable devices is provided for realizing the step of the function of appointment in flow process of flow chart or a plurality of flow process and/or square frame of block diagram or a plurality of square frame.
Although described the preferred embodiments of the present invention, once those skilled in the art obtain the basic creative concept of cicada, can make other change and modification to these embodiment.So claims are intended to all changes and the modification that are interpreted as comprising preferred embodiment and fall into the scope of the invention.
Obviously, those skilled in the art can carry out various changes and modification and not break away from the spirit and scope of the present invention the present invention.Like this, if within of the present invention these are revised and modification belongs to the scope of the claims in the present invention and equivalent technologies thereof, the present invention also is intended to comprise these changes and modification interior.
Claims (14)
1. a parallel operation detection method, is characterized in that, comprising:
The characteristic value for the behavioural characteristic that characterizes user terminal comprised in the network packet sent according to IP address to be detected, and each parallel operation condition arranged for the dissimilar of characteristic value and respectively in advance, judge whether described characteristic value triggers the parallel operation condition corresponding with it; Wherein, the characteristic value that comprises respectively the type corresponding with it in each parallel operation condition is shared while using the characteristic information that should possess in described IP address by a plurality of user terminals, when described characteristic value possesses the described characteristic information comprised in the parallel operation condition corresponding with it, described characteristic value triggers the parallel operation condition corresponding with it;
The number of times be triggered according to each parallel operation condition, be identified for assessing described IP address and whether by a plurality of user terminals, shared the parallel operation assessed value of using;
When described parallel operation assessed value is greater than the parallel operation threshold value set in advance, output is shared for characterizing described IP address the notification message used by a plurality of user terminals.
2. the method for claim 1, is characterized in that, the type of the characteristic value comprised in network packet is the cookie type; ?
Judge that whether the described characteristic value comprised in network packet triggers the parallel operation condition corresponding with it, specifically comprises:
The characteristic value of the cookie type comprised in the network packet sent according to described IP address, determine the number of concurrent of described characteristic value; And
Whether the number of concurrent that judges described characteristic value is greater than the number of concurrent threshold value set in advance;
Judgment result is that while being, determining that described characteristic value triggers the parallel operation condition corresponding with it.
3. method as claimed in claim 2, is characterized in that, the characteristic value of cookie type is the cookie name; ?
The described characteristic value comprised in the network packet sent according to described IP address, determine and specifically comprise the number of concurrent of described characteristic value:
Obtain cookie name and the cookie value corresponding with described cookie name from described network packet;
From pre-stored cookie name, judge whether to exist the cookie name be complementary with the cookie name got;
When the cookie name that the cookie name of judging existence and get is complementary, the corresponding cookie value of pre-stored cookie name be complementary from the cookie name with getting, judge whether to exist the cookie value be complementary with the cookie value got;
When judging, exist in the cookie value be complementary with the cookie value got and the corresponding cookie value of pre-stored cookie name be complementary in the cookie name with getting, during cookie value after the acquisition time of the cookie value that exists at least one acquisition time to be complementary in the cookie value with getting, the number of concurrent of the cookie name that the cookie name with getting is complementary is upgraded; And
The number of concurrent of the cookie name that the number of concurrent after upgrading is defined as getting; Perhaps
The described characteristic value comprised in the network packet sent according to described IP address, determine and specifically comprise the number of concurrent of described characteristic value:
Obtain cookie name and the cookie value corresponding with described cookie name from described network packet;
Carry out following operation in each default execution cycle:
According to pre-stored cookie name, and each cookie name got and the cookie value corresponding with each cookie name difference, determine the cookie name be complementary with pre-stored cookie name, and the cookie value corresponding with the cookie name of determining; And carry out respectively the first assigned operation for each cookie name of determining;
Described the first assigned operation comprises: whether the number of the cookie value of this cookie name correspondence that judgement is determined is not less than two; Judgment result is that while being, from the cookie value of this cookie name correspondence, choose any two unduplicated cookie values and carry out the second assigned operations, until travel through any two unduplicated cookie values; Judge whether the current number of concurrent of this cookie name is greater than the historical number of concurrent of the pre-stored cookie name be complementary with this cookie name; When judging described current number of concurrent and be greater than described historical number of concurrent, according to described current number of concurrent, described historical number of concurrent is upgraded; And the historical number of concurrent after upgrading is defined as to the number of concurrent of this cookie name;
Described the second assigned operation comprises: according to the acquisition time of two cookie values choosing, whether two cookie values that judgement is chosen are alternately to obtain; When judging two cookie values choosing when alternately obtaining, the current number of concurrent of this cookie name is added to 1.
4. method as claimed in claim 3, is characterized in that, obtains cookie name and the cookie value corresponding with described cookie name from described network packet, specifically comprises:
Obtain the message that comprises the cookie field in described network packet, and determine the uniform resource position mark URL information in described message;
Judge whether the URL information in described message is complementary with the URL information of the supervision website set in advance;
Judgment result is that while being, the cookie field from described message is obtained cookie name and the cookie value corresponding with described cookie name.
5. method as claimed in claim 3, is characterized in that, pre-stored cookie name obtains in the following manner:
At the net environment without parallel operation, the message that the URL information of URL information and the supervision website that sets in advance obtained is complementary;
Obtain respectively each cookie name and the cookie value corresponding with each cookie name difference from the described message got; And
Whether each cookie name that judgement gets respectively meets the storage condition set in advance; Wherein, described storage condition is: the number of times that obtains of this cookie name is greater than the frequency threshold value of obtaining set in advance, and the number of the cookie value corresponding with this cookie name is less than the cookie value number threshold value set in advance;
The cookie name storage of described storage condition will be met.
6. described method as arbitrary as claim 1～5, is characterized in that, the type of the characteristic value comprised in network packet is account type; ?
Judge that whether the described characteristic value comprised in network packet triggers the parallel operation condition corresponding with it, specifically comprises:
Obtain the characteristic value of account type the network packet sent from described IP address;
Judgement is in the very first time length set in advance, and whether the quantity of the characteristic value of the mutually different account type got is greater than the account amount threshold set in advance;
Judgment result is that while being, determining that the characteristic value of the account type got triggers the parallel operation condition corresponding with it in described very first time length.
7. described method as arbitrary as claim 1～5, is characterized in that, the type of the characteristic value comprised in network packet is version number's type; ?
Judge that whether the described characteristic value comprised in network packet triggers the parallel operation condition corresponding with it, specifically comprises:
Obtain the characteristic value of version number's type the network packet sent from described IP address;
Whether judgement, in the second time span set in advance, exists at least one to meet the characteristic value of the specified conditions that set in advance in the characteristic value of the version number's type got; Described specified conditions are: the characteristic value of each version number's type got respectively in the software version of indication, the indicated software version of this characteristic value is not up-to-date software version, and after the acquisition time of the acquisition time of this characteristic value characteristic value of up-to-date software version in indication;
Judging while existing at least one to meet the characteristic value of described specified conditions, determine that the characteristic value of the version number's type got triggers the parallel operation condition corresponding with it in described the second time span.
8. one kind and machine detecting device, is characterized in that, comprising:
Parallel operation condition judgment unit, the characteristic value for the behavioural characteristic that characterizes user terminal comprised for the network packet sent according to IP address to be detected, and each parallel operation condition arranged for the dissimilar of characteristic value and respectively in advance, judge whether described characteristic value triggers the parallel operation condition corresponding with it; Wherein, the characteristic value that comprises respectively the type corresponding with it in each parallel operation condition is shared while using the characteristic information that should possess in described IP address by a plurality of user terminals, when described characteristic value possesses the described characteristic information comprised in the parallel operation condition corresponding with it, described characteristic value triggers the parallel operation condition corresponding with it;
Parallel operation assessed value determining unit, the number of times be triggered for each parallel operation condition gone out according to parallel operation condition judgment unit judges, be identified for assessing described IP address and whether by a plurality of user terminals, shared the parallel operation assessed value of using;
The notification message output unit, while in parallel operation assessed value determining unit, determining described parallel operation assessed value, being greater than the parallel operation threshold value set in advance, output is shared for characterizing described IP address the notification message used by a plurality of user terminals.
9. device as claimed in claim 8, is characterized in that, the type of the characteristic value comprised in network packet is the cookie type; ?
Parallel operation condition judgment unit specifically comprises:
The number of concurrent determination module, the characteristic value of the cookie type comprised for the network packet sent according to described IP address, determine the number of concurrent of described characteristic value;
Whether the number of concurrent judge module, be greater than the number of concurrent threshold value set in advance for the number of concurrent that judges the described characteristic value that the number of concurrent determination module is determined;
The first trigger module, for when judgment result is that of number of concurrent judge module is, determine that described characteristic value triggers the parallel operation condition corresponding with it.
10. device as claimed in claim 9, is characterized in that, the characteristic value of cookie type is the cookie name; ?
The number of concurrent determination module, specifically for:
Obtain cookie name and the cookie value corresponding with described cookie name from described network packet;
From pre-stored cookie name, judge whether to exist the cookie name be complementary with the cookie name got;
When the cookie name that the cookie name of judging existence and get is complementary, the corresponding cookie value of pre-stored cookie name be complementary from the cookie name with getting, judge whether to exist the cookie value be complementary with the cookie value got;
When judging, exist in the cookie value be complementary with the cookie value got and the corresponding cookie value of pre-stored cookie name be complementary in the cookie name with getting, during cookie value after the acquisition time of the cookie value that exists at least one acquisition time to be complementary in the cookie value with getting, the number of concurrent of the cookie name that the cookie name with getting is complementary is upgraded; And the number of concurrent of the cookie name that the number of concurrent after upgrading is defined as getting; Perhaps
The number of concurrent determination module, specifically for:
Obtain cookie name and the cookie value corresponding with described cookie name from described network packet;
Carry out following operation in each default execution cycle: according to pre-stored cookie name, and each cookie name got and the cookie value corresponding with each cookie name difference, determine the cookie name be complementary with pre-stored cookie name, and the cookie value corresponding with the cookie name of determining; And carry out respectively the first assigned operation for each cookie name of determining;
Described the first assigned operation comprises: whether the number of the cookie value of this cookie name correspondence that judgement is determined is not less than two; Judgment result is that while being, from the cookie value of this cookie name correspondence, choose any two unduplicated cookie values and carry out the second assigned operations, until travel through any two unduplicated cookie values; Judge whether the current number of concurrent of this cookie name is greater than the historical number of concurrent of the pre-stored cookie name be complementary with this cookie name; When judging described current number of concurrent and be greater than described historical number of concurrent, according to described current number of concurrent, described historical number of concurrent is upgraded; And the historical number of concurrent after upgrading is defined as to the number of concurrent of this cookie name;
Described the second assigned operation comprises: according to the acquisition time of two cookie values choosing, whether two cookie values that judgement is chosen are alternately to obtain; When judging two cookie values choosing when alternately obtaining, the current number of concurrent of this cookie name is added to 1.
11. device as claimed in claim 10, is characterized in that, the number of concurrent determination module is carried out: while obtaining cookie name and the cookie value corresponding with described cookie name from described network packet, specifically for:
Obtain the message that comprises the cookie field in described network packet, and determine the uniform resource position mark URL information in described message; Judge whether the URL information in described message is complementary with the URL information of the supervision website set in advance; Judgment result is that while being, the cookie field from described message is obtained cookie name and the cookie value corresponding with described cookie name.
12. device as claimed in claim 10, is characterized in that, described device also comprises:
Memory cell, for according to the following pre-stored cookie name of mode:
At the net environment without parallel operation, the message that the URL information of URL information and the supervision website that sets in advance obtained is complementary; Obtain respectively cookie name and the cookie value corresponding with each cookie name difference from the described message got; And whether each cookie name that judgement gets respectively meets the storage condition set in advance; The cookie name storage of described storage condition will be met; Wherein, described storage condition is: the number of times that obtains of this cookie name is greater than the frequency threshold value of obtaining set in advance, and the number of the cookie value corresponding with this cookie name is less than the cookie value number threshold value set in advance.
13. described device as arbitrary as claim 8～12 is characterized in that the type of the characteristic value comprised in network packet is account type; ?
Parallel operation condition judgment unit specifically comprises:
Account type characteristic value acquisition module, obtain the characteristic value of account type for the network packet sent from described IP address;
Account quantity judge module, for judgement, in the very first time length set in advance, whether the quantity of the mutually different described characteristic value that account type characteristic value acquisition module gets is greater than the account amount threshold set in advance;
The second trigger module, for when judgment result is that of account quantity judge module is, determine that the characteristic value of the account type got in described very first time length triggers the parallel operation condition corresponding with it.
14. described device as arbitrary as claim 8～12 is characterized in that the type of the characteristic value comprised in network packet is version number's type; ?
Parallel operation condition judgment unit specifically comprises:
Version number's type feature value acquisition module, obtain the characteristic value of version number's type for the network packet sent from described IP address;
Whether the version judge module, in the second time span set in advance, exist at least one to meet the characteristic value of the specified conditions that set in advance for judgement in the described characteristic value that version number's type feature value acquisition module gets; Described specified conditions are: each characteristic value got respectively the indication software version in, the indicated software version of this characteristic value is not up-to-date software version, and after the acquisition time of the acquisition time of this characteristic value characteristic value of up-to-date software version in indication;
The 3rd trigger module, while for judging at the version judge module, existing at least one to meet the characteristic value of described specified conditions, determine that the characteristic value of the version number's type got in described the second time span triggers the parallel operation condition corresponding with it.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2013103567688A CN103457789A (en) | 2013-08-15 | 2013-08-15 | Parallel operation detecting method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2013103567688A CN103457789A (en) | 2013-08-15 | 2013-08-15 | Parallel operation detecting method and device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN103457789A true CN103457789A (en) | 2013-12-18 |
Family
ID=49739774
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2013103567688A Pending CN103457789A (en) | 2013-08-15 | 2013-08-15 | Parallel operation detecting method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103457789A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105939231A (en) * | 2016-05-16 | 2016-09-14 | 杭州迪普科技有限公司 | Shared access detection method and shared access detection device |
| CN105991630A (en) * | 2015-03-26 | 2016-10-05 | 杭州迪普科技有限公司 | Shared access detection method and device |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1878096A (en) * | 2006-07-04 | 2006-12-13 | 陈玲玲 | Method for detecting number of computer users in inner compute network |
| CN101035031A (en) * | 2007-04-03 | 2007-09-12 | 华为技术有限公司 | Method and device for detecting the number of the shared access host |
| WO2009054623A1 (en) * | 2007-10-24 | 2009-04-30 | Plustech Inc. | Method for permitting and blocking use of internet by detecting plural terminals on network |
| CN102882748A (en) * | 2012-10-23 | 2013-01-16 | 深圳中兴网信科技有限公司 | Network access detection system and network access detection method |
| CN102891781A (en) * | 2012-10-19 | 2013-01-23 | 深圳中兴网信科技有限公司 | Network sharing detection system and network sharing detection method |
| CN102957581A (en) * | 2012-11-29 | 2013-03-06 | 深圳中兴网信科技有限公司 | Network access detection system and network access detection method |
| CN102984003A (en) * | 2012-11-30 | 2013-03-20 | 深圳中兴网信科技有限公司 | Network access detection system and network access detection method |
-
2013
- 2013-08-15 CN CN2013103567688A patent/CN103457789A/en active Pending
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1878096A (en) * | 2006-07-04 | 2006-12-13 | 陈玲玲 | Method for detecting number of computer users in inner compute network |
| CN101035031A (en) * | 2007-04-03 | 2007-09-12 | 华为技术有限公司 | Method and device for detecting the number of the shared access host |
| WO2009054623A1 (en) * | 2007-10-24 | 2009-04-30 | Plustech Inc. | Method for permitting and blocking use of internet by detecting plural terminals on network |
| CN102891781A (en) * | 2012-10-19 | 2013-01-23 | 深圳中兴网信科技有限公司 | Network sharing detection system and network sharing detection method |
| CN102882748A (en) * | 2012-10-23 | 2013-01-16 | 深圳中兴网信科技有限公司 | Network access detection system and network access detection method |
| CN102957581A (en) * | 2012-11-29 | 2013-03-06 | 深圳中兴网信科技有限公司 | Network access detection system and network access detection method |
| CN102984003A (en) * | 2012-11-30 | 2013-03-20 | 深圳中兴网信科技有限公司 | Network access detection system and network access detection method |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105991630A (en) * | 2015-03-26 | 2016-10-05 | 杭州迪普科技有限公司 | Shared access detection method and device |
| CN105991630B (en) * | 2015-03-26 | 2019-09-06 | 杭州迪普科技股份有限公司 | A kind of shared access detection method and device |
| CN105939231A (en) * | 2016-05-16 | 2016-09-14 | 杭州迪普科技有限公司 | Shared access detection method and shared access detection device |
| US10447793B2 (en) | 2016-05-16 | 2019-10-15 | Hangzhou Dptech Technologies Co., Ltd. | Detecting shared access |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107624233B (en) | VPN transmission tunnel scheduling method and device and VPN client server | |
| WO2014205060A1 (en) | Confidence scoring of device reputation based on characteristic network behavior | |
| US9503506B2 (en) | Transit-mode-based webpage accessing method, system, and crawler route server | |
| CN108924005B (en) | Network detection method, network detection apparatus, medium, and device | |
| CN112954089B (en) | Method, device, equipment and storage medium for analyzing data | |
| CN104052832A (en) | Method and device for setting IP address of domain name resolution server and server | |
| CN103152325B (en) | Prevent the method by sharing mode access the Internet and device | |
| CN105323121B (en) | A kind of Network status detection method and device | |
| CN110868361A (en) | Gateway load balancing method, device and equipment | |
| CN104954431A (en) | Network selection method, device and system | |
| CN104967632B (en) | Webpage abnormal data processing method, data server and system | |
| CN106027284A (en) | Network fault diagnosis method and device | |
| CN105468981A (en) | Vulnerability identification technology-based plugin safety scanning device and scanning method | |
| CN104486168A (en) | Router wireless performance evaluation system and method | |
| CN107992416B (en) | Method and device for determining webpage time delay | |
| CN103457789A (en) | Parallel operation detecting method and device | |
| Yamamoto et al. | Prediction of traffic congestion on wired and wireless networks using RNN | |
| EP3593493B1 (en) | Prediction of a performance indicator | |
| CN110457900B (en) | Website monitoring method, device and equipment and readable storage medium | |
| CN105554740A (en) | Method and apparatus for identifying wireless hotspots, and device | |
| CN103297480A (en) | System and method for automatically detecting application service | |
| CN107948989B (en) | Method and device for calculating networking time of mobile terminal | |
| CN113656302A (en) | WAF rule automatic testing method, system, storage medium and terminal equipment | |
| JP6787845B2 (en) | Suspected location estimation device and suspected location estimation method | |
| CN105515896B (en) | A kind of judgment method and device of mobile terminal network obstruction |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20131218 |