WO2015154416A1 - 一种上网行为管理方法及装置 - Google Patents
一种上网行为管理方法及装置 Download PDFInfo
- Publication number
- WO2015154416A1 WO2015154416A1 PCT/CN2014/088984 CN2014088984W WO2015154416A1 WO 2015154416 A1 WO2015154416 A1 WO 2015154416A1 CN 2014088984 W CN2014088984 W CN 2014088984W WO 2015154416 A1 WO2015154416 A1 WO 2015154416A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- identification identifier
- control policy
- list
- application
- address
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/102—Entity profiles
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/101—Access control lists [ACL]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/16—Implementing security features at a particular protocol layer
- H04L63/168—Implementing security features at a particular protocol layer above the transport layer
Definitions
- the present invention relates to the field of data communications, and in particular, to a method and apparatus for managing online behavior.
- the embodiment of the invention provides a method and a device for managing online behavior, which can solve the problem that the web address search rate is slow and the user's online behavior cannot be controlled.
- the embodiment of the present invention provides a method for managing online behavior including:
- the user After receiving the Internet access message, the user obtains the keyword identification identifier in the Internet message, and matches the keyword identification identifier in the keyword identification identifier sub-list. If the matching succeeds, the corresponding first is invoked. Controlling the policy, and processing the Internet packet according to the first control policy.
- the first control policy includes processing the Internet packet normally or directly discarding the Internet packet.
- the address identification identifier sub-list associated with the keyword identification identifier sub-list may also be generated according to the application identification identifier obtained from the webpage address library.
- control policy further includes a second control policy corresponding to each application in the configuration message; if the first control policy invoked and executed is to process the Internet message normally, Then the method comprises:
- the second control policy is to limit the speed while generating an alarm prompt, forwarding a normal packet, or forwarding an Internet packet.
- the embodiment of the invention further provides an online behavior management device, comprising: a transceiver module, a list generation module, and a processing module;
- the transceiver module is configured to receive a configuration message and a policy, where the configuration message includes configuration information of the application, where the policy includes a first control policy corresponding to each application in the configuration information, and the received configuration message and policy are received. Issued to the processing module;
- the list generating module is configured to search for an identification identifier of the corresponding application from the webpage address library according to the application configuration information sent by the transceiver module, and generate a keyword identification identifier sub-list;
- the processing module includes a keyword obtaining unit. After the processing module receives the online message of the user, the keyword acquiring unit acquires the keyword identification identifier in the Internet packet, and the processing module identifies the keyword in the key. The word identification identifier sub-list is matched. If the matching is successful, the corresponding first control policy is invoked, and the Internet packet is processed according to the first control policy.
- the first control policy includes processing the Internet packet normally or directly discarding the Internet packet.
- the online behavior management apparatus further includes an address list generation module associated with the list generation module, and the address list generation module is configured to generate an address identification identifier sub-list.
- control policy further includes a second control policy corresponding to each application in the configuration message; the processing module further includes an address identifier obtaining unit, if the processing module invokes and executes the When the first control policy is to process the Internet packet, the address identifier obtaining unit in the processing module obtains the address identification identifier in the Internet packet, and performs the obtained address identification identifier in the address identification identifier sub-list. After the matching is successful, the second control policy is invoked to process the Internet packet.
- the second control policy includes performing an alarm prompt, forwarding a normal packet, or forwarding an Internet packet while performing rate limiting.
- the invention also provides a computer program and a carrier thereof, the computer program comprising program instructions, when the program instruction is executed by the online behavior management device, enabling the device to implement the online behavior management method.
- the beneficial effects of the embodiments of the present invention are: providing a method and device for managing online behaviors, which solves the problem that the web address search rate is slow and the user's online behavior cannot be controlled.
- the embodiment of the present invention includes receiving a configuration message and a policy, where the configuration message includes configuration information of the application, where the policy includes a first control policy of each application in the configuration information, and then searches for a corresponding application from the webpage address library according to the configuration information of the application.
- the embodiment of the present invention is After receiving the Internet packet sent by the user, the keyword identification identifier in the packet can be directly matched with the keyword identification identifier sub-list corresponding to the user, and the blind search is not required in the URL library. Compared with the prior art, it is convenient and quick to find, and at the same time, it is more reliable to control the user's online behavior.
- FIG. 1 is a flowchart of a method for managing online behavior provided by a first embodiment of the present invention
- FIG. 2 is a flowchart of matching a keyword application identification identifier according to a first embodiment of the present invention
- FIG. 3 is a flowchart of matching an application identification identifier according to a first embodiment of the present invention
- FIG. 4 is a schematic structural diagram of a module for managing an online behavior according to a second embodiment of the present invention.
- FIG. 5 is a schematic structural diagram of a module of an online behavior management system according to a third embodiment of the present invention.
- the system in the embodiment of the present invention receives a configuration message and a policy, where the configuration message includes application configuration information, where the policy includes a control policy corresponding to each application in the configuration information, and searches and extracts from the URL library according to the received configuration information.
- the URL library is a URL library that has been classified according to different content of different websites, and the system generates a keyword identification identifier sub-list according to the identification identifier of the corresponding application that is searched and extracted.
- the system detects the Internet access message of the user, the system first obtains the keyword identification identifier of the Internet message, and then matches the obtained keyword identification identifier with the information in the previously generated keyword identification identifier sub-list.
- the corresponding first control policy is invoked to control the packet.
- the corresponding first control policy that is invoked is a policy that is previously sent by the user.
- the application sets a configuration message according to the needs of the user, and sets a first control policy corresponding to each application, and the system obtains keyword identification from the URL library according to the configuration message set by the user. The identifier is generated, and the keyword identification identifier sub-list is generated. After the system receives the Internet packet, the system only needs to match the keyword identification identifier in the extracted network packet with the keyword identification identifier sub-list of the corresponding user.
- Search matching is performed in the entire URL library, and after the matching is successful, the corresponding first control policy is further invoked, and the Internet packet is sent. Real-time control. Therefore, the embodiment of the invention solves the problem of increasing the speed of searching for the webpage address and controlling the online behavior of the user.
- Embodiment 1 is a diagrammatic representation of Embodiment 1:
- FIG. 1 is a flowchart of a method for managing online behavior provided by an embodiment of the present invention, including:
- Step 101 Receive a configuration message and a policy that are sent by the management user, where the configuration message includes configuration information of the application, where the policy includes a first control policy corresponding to each application in the configuration information.
- Step 102 Search for an identification identifier of the corresponding application from the URL library according to the application configuration information, and generate a keyword identification identifier sub-list.
- Step 103 After receiving the Internet message of the general user, obtain the keyword identification identifier included in the Internet message, and match the keyword identification identifier with the keyword identification identifier sub-list corresponding to the user.
- the first control policy corresponding to the application is invoked, and the Internet packet is processed according to the first control policy.
- the management user who sends the configuration message and the policy or the ordinary user who initiates the Internet message belongs to a type of user, for example, a school user, a business user, etc., and in this embodiment, The management user who sends the configuration message and the policy belongs to the same type of user as the ordinary user who initiates the Internet message.
- the administrator belongs to the school user. The administrator can also initiate the Internet message as the general user.
- a configuration message and a policy are sent by the management user, where the configuration message includes configuration information of the application, and the configuration information of the application is set by the user according to his own needs and at the same time, in order to enable the URL library to be recognized.
- the identification identifier of the application; the policy is a first control policy corresponding to each application in the configuration information, and the correspondence between the application and the first control policy in the configuration information may be set according to the address relationship, or may be based on a specific keyword.
- the content setting correspondence relationship of course, the correspondence relationship is not limited to the above two setting manners, and any manner in which the application and the first configuration policy can be mutually corresponded can be within the scope of the present invention.
- the manner in which the management user sets the application to be controlled includes at least one of the following three modes:
- A The management user sets the configuration message and policy that needs to control the application through the control platform of the terminal;
- the device generates configuration messages and policies by identifying keywords that are managed by the user, such as time periods, work environments, or work content.
- the setting of the application to be controlled is preferably performed in the A mode, and the management user sends the configured configuration message and the policy to the system.
- step 102 after receiving the configuration message sent by the management user, the system searches for the identification identifier of the corresponding application in the URL library according to the configuration information in the configuration message, and generates a keyword identification identifier according to the found identification identifier.
- the sub-list in this embodiment, the configuration information is an identification identifier of some applications that the management user sets according to his own needs and at the same time, in order to enable the URL library to be recognized, and the identification identifier includes a keyword identification identifier.
- the URL library may be a URL library that has been classified according to website information or webpage content, or may be the original URL library.
- the system obtains the corresponding identification identifier in the URL library according to the configuration information in the management user configuration message, and generates a keyword identification identifier sub-list including any one of the following manners:
- A searching for the identification identifier of the corresponding application in the URL library according to the configuration information in the management user configuration message, and generating a keyword identification identifier sub-list in the URL library according to all the identified identification identifiers;
- the system preferably matches in the keyword identification list in the URL library
- the system preferably matches in the independent key sub-identification list without entering the URL list.
- the method B is preferably used to generate an application. Identify the list of identities.
- the address identification identifier sub-list associated with the keyword identification identifier sub-list may also be generated according to the application identification identifier obtained from the webpage address library, wherein the mutual association between the two lists refers to
- the keyword identification identifier in the webpage address of the same application is stored in the keyword identification identifier sub-list, and the address identification identifier is stored in the address identification identifier sub-list, and the keyword identification identifier and the address identification identifier stored in the two lists are mutually Association, which makes it easier to find the system web address.
- step 103 after receiving the Internet message of the general user, that is, when the user needs to access an application, the keyword identification identifier included in the Internet message is obtained, and the keyword identification identifier is Matching the keyword identification identifier sub-list corresponding to the user, if the matching is successful, extracting, from the keyword identification identifier sub-list, a keyword identification identifier that matches the Internet message keyword identification identifier, the keyword identification identifier and
- the first control policy set by the management user is a one-to-one correspondence. Therefore, after acquiring the keyword identification identifier, the corresponding first control policy is found according to the keyword identification identifier, and then the first control is retrieved. The policy controls the Internet message.
- the system when the system receives the Internet access message of the user, the system first extracts the keyword identification identifier of the message; the keyword identification identifier includes a part representing the protocol, and may be a part representing the port number, which may be The part representing the path may also be a combination of the above parts.
- the keyword identification identifier is not limited to the above types, and any content having the recognition function belongs to the scope of the estrus protection of the present embodiment.
- the first control policy includes: processing the Internet packet or directly discarding the Internet packet, and may also be other possible control information, which is not specifically limited in this embodiment.
- the flowchart for matching the keyword identification identifier with the information in the keyword identification identifier sub-list provided by the embodiment includes:
- Step 201 Generate a keyword identification identifier sub-list
- Step 202 The keyword identification identifier of the Internet access message is compared in the keyword identification identifier sub-list; if it is determined, if yes, go to step 203; if not, go to step 204;
- Step 203 Calling and executing the first control policy
- Step 204 Forward the packet normally.
- the first control policy is a control policy that is set by the user for each application in the configuration information, and the first control policy has a one-to-one correspondence with each application in the configuration information.
- the matching between the keyword identification identifier and the information in the keyword identification identifier sub-list is only a small step of controlling the Internet packet, so that the network packet can be controlled more accurately.
- the address identification identifier in the Internet packet further obtained, where the address identification identifier includes the information representing the address It also includes other information that specifically identifies the function of a message, such as the message name or resource storage path.
- the address application identification identifier is not limited to the above types, and any content having the identification function belongs to the scope of the estrus protection of the embodiment.
- the control policy includes a second control policy corresponding to each application in the configuration message; when the obtained address identification identifier is matched with the information in the address identification identifier sub-list, if the matching fails, It is indicated that the Internet message does not need to be controlled, that is, the Internet message is normally forwarded; if the matching is successful, the corresponding second control policy is invoked to further control the Internet message, and the URL template information is generated at the same time.
- the method for invoking the second control policy includes, but is not limited to, the following method: the system matches the obtained address identification identifier with the information in the address identification identifier sub-list.
- Controlling that is, normal transmission of the Internet message; if the matching is successful, obtaining the identification identification information of the address identification identifier in the address identification identifier sub-list, and then acquiring the previous management user setting and the identification according to the identification identification information Identifying a second control policy of the corresponding application, and then performing the application according to the second control policy It should be handled.
- FIG. 3 is a flowchart of matching the application identification identifiers included in the obtained Internet telegrams with the keyword identification identifier sub-list and the address identification identifier sub-list, respectively, according to the embodiment, including:
- Step 301 Generate a keyword identification identifier sublist and an address identification identifier sublist.
- Step 302 The keyword identification identifier of the Internet access message is compared in the keyword identification identifier sub-list; if it is matched, if yes, go to step 303; if not, go to step 306;
- Step 303 Whether the corresponding first control policy that is invoked and executed is normal forwarding; if yes, the process proceeds to step 304. If not, the process proceeds to step 307: discarding the message;
- Step 304 Obtain an address identification identifier of the Internet access packet and compare the information in the address identification identifier sub-list; determine whether the match is matched, and if yes, go to step 305; if not, go to step 306;
- Step 305 Invoking a corresponding second control policy, and further controlling the packet.
- Step 306 Forward the packet normally
- the second control policy includes: generating an alarm prompt, forwarding the Internet packet, performing rate limiting, or forwarding the packet normally.
- the generating an alert prompt indicates that the system identifies that the packet is a packet that the user is allowed to forward, but the packet is not secure at this time or the packet is an illegal packet at this time;
- the rate limit of the forwarding of the Internet packet is that the packet is allowed to be forwarded by the policy.
- the packet needs to consume more traffic, and the remaining traffic at this time is insufficient to support the smooth running of the packet. Therefore, the rate limit is applied to the packet;
- the packet has a higher priority, and other applications are closed to provide conditions for forwarding of the application.
- the first control policy is a control policy corresponding to the keyword identification identifier
- the second control policy is a control policy corresponding to the address identification identifier.
- the first control policy and the second control policy may also be the same control policy.
- the URL template information is generated, and the URL template information is generated by the system according to the statistical access record information, and the system invokes the policy. And parsing the generated URL template information, and then sending an alert notification or a webpage message push to the required user according to the parsed template information content; the system may also update or modify the URL library according to the generated URL template information; The system can also generate an access record table according to the generated URL template information, display it to the user through the display terminal, facilitate the user to view the access record, and count the network usage status.
- the URL template information includes: a template ID, indicating that the URL is sent.
- Information template indicates the total length of the information
- RECORD_NUM - indicates the number of users + URLs contained in the message
- DURATION - indicates the time interval for sending information
- policy - indicates that the message is allowed or denied
- Information length - indicates the length of the template header removed
- IP address - indicates the user's IP address
- URL information - indicates the extracted URL information of the user.
- the content of the template information described above is not limited to the above content, and can be improved according to the needs of the user.
- the URL template information is not limited to being generated after completion of a certain phase or generated after a certain step ends, or may be corresponding to a user's needs, and a corresponding time period is determined. After the time period is ended, the system is configured. The generated URL template information is automatically reflected to the user, so that the user can know the current network usage status in real time or quickly.
- Embodiment 2 is a diagrammatic representation of Embodiment 1:
- FIG. 4 is a schematic diagram of a module for managing an online behavior according to an embodiment of the present invention, including: a transceiver module 401, a list generation module 402, and a processing module 404;
- the transceiver module 401 is configured to receive a configuration message and a policy that are sent by the management user, where the configuration message includes configuration information of the application, where the policy includes a first policy corresponding to each application in the configuration information, and the received configuration message is received. And the policy is sent to the list generation module 402;
- the list generating module 402 is configured to search for the identification identifier of the corresponding application from the webpage address library according to the application configuration information sent by the transceiver module 401, and generate a keyword identification identifier sub-list;
- the processing module 404 includes a keyword obtaining unit 4041. After the processing module 404 receives the Internet message of the general user, the keyword acquiring unit 4041 acquires the keyword identification identifier in the Internet packet, and the processing module 404 selects the keyword. The identification identifier is matched in the keyword identification identifier sub-list. If the matching is successful, the corresponding first control policy is invoked, and the Internet packet is processed according to the first control policy.
- the management user who sends the configuration message and the policy or the ordinary user who initiates the Internet message belongs to a type of user, for example, a school user, a business user, etc., and in this embodiment, The management users who send configuration messages and policies belong to the same class of users as the ordinary users who initiate Internet messages. For example, they belong to school users.
- the transceiver module 401 receives a configuration message and a policy that is sent by the management user.
- the configuration message includes configuration information of the application, and the configuration information of the application is an identification identifier of a certain application that is set by the user according to the needs of the user and is configured to enable the URL library to be recognized; the policy is that the management user is the application in the configuration information.
- the manner in which the management user sets the application to be controlled includes at least one of the following three modes:
- A The management user sets the configuration message and policy that needs to control the application through the control platform of the terminal;
- the device generates configuration messages and policies by identifying keywords that are managed by the user, such as time periods, work environments, or work content.
- the management user preferably uses the A mode to perform the setting of the application to be controlled, and sends the configured configuration message to the system.
- the list generation module 402 searches the URL library for the keyword identification identifier of the corresponding application according to the configuration information in the configuration message, and according to the key found.
- the word identification identifier generates a keyword identification identifier sub-list.
- the configuration information is an identification identifier of some applications that the user sets according to his own needs and in order to enable the URL library to be recognized, and the identification identifier includes Keyword identification.
- the list generating module 402 obtains a corresponding keyword identification identifier in the URL library according to the configuration information in the user configuration message, and generates a keyword identification identifier sub-list including any one of the following manners:
- A searching for a keyword identification identifier of the corresponding application in the URL library according to the configuration information in the user configuration message, and generating a keyword identification identifier sub-list in the URL library according to all the keyword identification identifiers found;
- the system preferably matches in the application identification list in the URL library
- the processing module 404 preferably matches in the separate application identification list without entering the URL list.
- the method B is preferably used to generate the application identification identifier list.
- the online behavior management apparatus further includes an address list generation module 403 associated with the list generation module 402, and the address list generation module 403 is configured to generate an address identification identifier sub-list.
- the association between the list generation module 402 and the address list generation module 403 means that the keyword identification identifier in the webpage address of the same application is stored in the keyword identification identifier sub-list, and the address identification identifier is stored in the address identifier.
- the keyword identification identifier and the address identification identifier stored in the two lists are associated with each other, which is more convenient for searching the system webpage address.
- the processing module 404 includes a keyword obtaining unit 4041. After the processing module 404 receives the Internet message of the general user, that is, when the user needs to access an application, the keyword acquiring unit 4041 acquires the key included in the Internet message. a keyword identification identifier, the keyword identification identifier is matched with the information in the generated keyword identification identifier sub-list, and if the matching is successful, the keyword identification identifier included in the Internet telegram is extracted from the keyword identification identifier sub-list a matching keyword identification identifier, the identification identifier has a one-to-one correspondence with the first control policy set by the previous user. Therefore, after acquiring the keyword identification identifier, the corresponding identifier is found according to the keyword identification identifier. A control strategy is used to retrieve the first control policy to control the Internet message.
- the keyword obtaining unit 4041 obtains the keyword identification identifier corresponding to the packet
- the method for obtaining the keyword identification identifier corresponding to the packet includes:
- the keyword obtaining unit 4041 obtains a keyword identification identifier in the Internet packet, where the keyword identification identifier includes a portion representing a protocol, and may be a portion representing a port number, and may be a portion representing a path. It can also be a combination of the above.
- the keyword identification identifier is not limited to the above types, and any content having the recognition function belongs to the scope of the estrus protection of the present embodiment.
- the processing module 404 is configured according to the information in the Internet packet obtained by the keyword obtaining unit 4041.
- the keyword identification identifier is matched with the information in the keyword identification identifier sub-list. If the information is unsuccessful, the network packet is not controlled by the user, and the packet is forwarded normally; if the matching is successful, And controlling the packet according to the first control policy that is invoked, where the first control policy includes processing the Internet packet normally or directly discarding the Internet packet.
- the invoking the first control policy is to control a control policy set by the user for each application in the configuration message, where the first control policy has a one-to-one correspondence with each application in the configuration message, of course, corresponding to each application.
- the content of the first control strategy may be the same or different.
- the application control information in the first control policy and the configuration information is optionally configured to match the information of the application identification identifier included in the obtained Internet packet with the information in the application identification identifier list.
- the configuration information is an identification identifier of some applications that are set by the management user according to their own needs and at the same time, in order to enable the URL library to be recognized;
- the first control policy includes: processing the Internet packet or directly discarding the Internet packet, and may also be other possible control information, which is not specifically limited in this embodiment.
- the processing module 404 further includes an address identifier obtaining unit 4042, where the address identifier obtaining unit 4042 is configured to: if the keyword identification identifier is successfully matched, if the first control policy invoked and executed is to process the Internet normally And obtaining, by the packet, the address identification identifier of the Internet packet, where the address identification identifier includes information representing the address, and other information, such as a packet name or a resource storage path, for identifying a certain packet function. .
- the address identification identifier is not limited to the above types, and any content having the identification function belongs to the scope of the estrus protection of the present embodiment.
- control policy further includes: a second control policy corresponding to each application in the configuration message; and matching the address identification identifier in the obtained Internet packet with the information in the address identification identifier sub-list, if If the match fails, the network packet is not required to be controlled, that is, the Internet message is normally forwarded. If the match is successful, the corresponding second control policy is invoked to further control the Internet message, and the URL template information is generated.
- the second control policy includes: generating an alarm prompt, forwarding the Internet packet, performing rate limiting, or forwarding the packet normally.
- the generating an alert prompt indicates that the system identifies that the packet is a packet that the user is allowed to forward, but at this time The packet is not secure or the packet is an illegal packet at this time;
- the rate limit of the packet is forwarded to indicate that the packet is a packet that the user is allowed to forward.
- the packet needs to consume more traffic, and the remaining traffic at this time is insufficient to support the smooth running of the packet. Therefore, the rate limit is applied to the message;
- the packet has a higher priority, and other applications are closed to provide conditions for forwarding of the application.
- the first control policy is a control policy corresponding to the keyword identification identifier
- the second control policy is a control policy corresponding to the address identification identifier.
- the first control policy and the second control policy may also be the same control policy.
- the URL template information is generated, and the URL template information is generated by the system according to the statistical access record information, and the system invokes the policy. And parsing the generated URL template information, and then sending an alert notification or a webpage message push to the required user according to the parsed template information content; the system may also update or modify the URL library according to the generated URL template information; The system can also generate an access record table according to the generated URL template information, display it to the user through the display terminal, facilitate the user to view the access record, and count the network usage status.
- Embodiment 3 is a diagrammatic representation of Embodiment 3
- Figure 5 is a schematic diagram of the online behavior management system module provided in this embodiment, including: a behavior manager 501, a policy controller 502 and a web page address library 503;
- the policy controller 502 is configured to receive the configuration message and policy delivered by the management user, and send the received configuration message and policy to the behavior manager 501, where the configuration message includes configuration information of the application, where the policy includes configuration. a first control policy and a second control policy corresponding to each application in the message;
- the behavior manager 501 obtains a webpage address according to a configuration message delivered by the policy controller 502.
- the library 503 obtains the identification identifier of the application, and generates an application identification identifier list, where the application identification identifier list includes a keyword identification identifier sub-list; when the general user initiates the Internet packet, the behavior manager 501 obtains the content included in the e-mail packet.
- the identifier is identified, and the obtained identification identifier is matched with the information in the generated application identification identifier list. If the matching is successful, the corresponding first control policy is invoked from the policy controller 502 and the packet is controlled.
- the management user who sends the configuration message and the policy or the ordinary user who initiates the Internet message belongs to a type of user, for example, a school user, a business user, etc., and in this embodiment, The management users who send configuration messages and policies belong to the same class of users as the ordinary users who initiate Internet messages. For example, they belong to school users.
- the management user sets a corresponding configuration message and a corresponding policy to the application to be controlled according to the needs of the user, and the configuration information of the application is set by the user according to his own needs and at the same time, in order to enable the URL library to be recognized.
- Identification identifier of some applications the policy is a first control policy that the management user sets for each application in the configuration message.
- the manner in which the management user sets the application to be controlled includes any one of the following three methods:
- A The management user sets the configuration message and policy that needs to control the application through the control platform of the terminal;
- the device generates configuration messages and policies by identifying keywords that are managed by the user, such as time periods, work environments, or work content.
- the management user preferably uses the A mode to perform the setting of the application to be controlled, and sends the configured configuration message to the system.
- the management user sends the configured configuration message and policy to the policy controller 502, and the policy controller 502 stores the received configuration message and policy, and the policy controller 502 sends the received configuration message to the behavior manager. 501.
- the behavior manager 501 obtains the corresponding identification identifier from the webpage address library 503, that is, the URL library, according to the configuration information in the received configuration message, and generates an application identification identifier list according to the found identification identifier.
- the configuration information includes an identification identifier of some applications that the user sets according to his own needs and in order to enable the URL library to be recognized, for example, keyword identification identifier information.
- the behavior manager 501 obtains the corresponding identification identifier in the URL library according to the configuration information in the user configuration message, and generates the application identification identifier list, which includes any one of the following manners:
- A searching for the identification identifier of the corresponding application in the URL library according to the configuration information in the user configuration message, and generating an application identification identifier list in the URL library according to all the identified identification identifiers;
- the system preferably matches in the application identification list in the URL library
- the method B is preferably used to generate the application identification identifier list.
- the behavior manager 501 further generates an address identification identifier sub-list associated with the keyword identification identifier sub-list, wherein the mutual association between the two lists refers to the webpage address of the same application.
- the keyword identification identifier is stored in the keyword identification identifier sub-list
- the address identification identifier is stored in the address identification identifier sub-list
- the keyword identification identifier and the address identification identifier stored in the two lists are associated with each other, which is more convenient for the system.
- the search for the web address is performed by the keyword identification identifier sub-list, wherein the mutual association between the two lists refers to the webpage address of the same application.
- the behavior manager 501 further has a message or an application identification function.
- the behavior manager 501 obtains a keyword identification identifier of the Internet message, and then acquires the The keyword identification identifier is matched with the previously generated keyword identification list. If the matching is successful, the behavior manager 501 calls the corresponding first control policy from the policy controller 502 to control the packet, and the control includes The policy controller 502 controls the user-initiated Internet packet; the control policy includes the normal processing of the Internet packet or the direct discarding of the Internet packet; if the matching is unsuccessful, the behavior manager 501 directly forwards the packet. Conduct WEB access.
- the behavior manager 501 further Obtaining the address identification identifier in the Internet packet, and then matching the obtained address identification identifier with the address identification identifier sub-list. If the matching is unsuccessful, the behavior manager 501 directly forwards the packet to perform WEB access; If the packet is successful, the second control policy is used to process the packet.
- the second control policy includes generating an alarm prompt, forwarding the packet normally, or forwarding the Internet packet while limiting the rate.
- the first control policy is a control policy corresponding to the keyword identification identifier
- the second control policy is a control policy corresponding to the address identification identifier.
- the first control policy and the second control policy may also be the same control policy.
- the corresponding URL template information is generated, and the template information is generated by the system according to the statistical access record information.
- Template information the system will parse the generated URL template information at the same time as the policy is invoked, and then send an alert notification or a webpage message push to the required user according to the parsed template information content; the system may also generate the URL template information according to the template information.
- the URL library is updated or modified.
- the system can also generate an access record table according to the generated URL template information, display the display to the user through the display terminal, facilitate the user to view the access record, and count the network usage status.
- all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve. Thus, the invention is not limited to any specific combination of hardware and software.
- the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
- each device/function module/functional unit in the above embodiment When each device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
- the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
- the application includes receiving a configuration message and a policy delivered by the user, where the configuration message includes configuration information of the application, and the policy includes a first control policy of each application in the configuration information, and then searching for a corresponding application from the webpage address database according to the configuration information of the application. Identifying the identifier, and then generating a keyword identification identifier sub-list; after receiving the Internet packet sent by the user, obtaining the keyword identification identifier in the Internet packet, and then acquiring the obtained keyword identification identifier in the keyword identification identifier A match is performed in the list. If successful, the corresponding first control policy is invoked to process the packet. Compared with the prior art, it is convenient and quick to find, and more reliable to control the user's online behavior.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Information Transfer Between Computers (AREA)
Abstract
一种上网行为管理方法及装置，解决网页地址查找速率慢以及对用户上网行为无法进行控制的问题。管理方法包括接收用户下发的配置消息和策略，配置消息包括应用的配置信息，策略包括配置信息中各应用的第一控制策略；然后根据该应用的配置信息从网页地址库中查找对应应用的识别标识，然后生成关键字识别标识子列表；当接收到用户下发的上网报文以后，获取该上网报文中的关键字识别标识，然后将获取的关键字识别标识在关键字识别标识子列表中进行匹配，如成功，则调用对应的第一控制策略对该报文进行处理。与现有技术相比较，方便快速查找的同时，也更加可靠的对用户的上网行为进行控制。
Description
本发明涉及数据通信领域，尤其涉及一种上网行为管理方法及装置。
互联网、移动互联网迅速蓬勃发展的今天，给人们带来了诸多方便的同时也带来了一些负面的问题，这些负面问题一般包括以下几方面：
(1)、由于P2P软件的泛滥，以及互联网提供的大量休闲性或者娱乐性内容的增多，例如：在线电子游戏、网上购物、股票交易、网上电台以及流媒体等等，使人们在上班期间把大量的时间以及网络宽带资源浪费在了购物、游戏等与工作无关的内容中，如果不加以节制，会使得人们把更多的精力和宽带的资源白白浪费；
(2)、现在互联网发展很迅速，随之而来的是一些不法分子的乘虚而入。他们利用或者制造病毒、木马等危险程序，在用户浏览各种网页时，可随时侵蚀公司内部的网络，从而造成公司内部机密泄露，或内部网络无法使用等情况。
移动互联网的发展还增加了以下问题，无论用户访问哪一种网站，都需要通过系统在数据量庞大的网页地址库(UniformResourceLocator URL库)中进行匹配查找，URL库中存储有大量的网站地址，在用户访问某一网站时，需要经过一定时间的查找才能够匹配到需要的网站。
通过以上的分析可知，如何对用户的上网行为进行管理的同时，增强URL匹配查找的速率，是亟待需要解决的问题。
发明内容
本发明实施例提供一种上网行为管理方法及装置，能够解决网页地址查找速率慢以及对用户上网行为无法进行控制的问题。
为了解决上述问题，本发明实施例提供了一种上网行为管理方法包括：
接收下发的配置消息和策略，所述配置消息包括应用的配置信息，所述策略包括配置消息中各应用对应的第一控制策略；
根据所述应用配置信息从网页地址库中获取对应应用的识别标识，并生成应用识别标识列表，所述应用识别标识列表包括关键字识别标识子列表；
接收到用户的上网报文后，获取该上网报文中的关键字识别标识，将该关键字识别标识在所述关键字识别标识子列表中进行匹配，若匹配成功，则调用对应的第一控制策略，并根据该第一控制策略对所述上网报文进行处理。
在本发明一实施例中，所述第一控制策略包括正常处理该上网报文或直接丢弃该上网报文。
在本发明一实施例中，根据从网页地址库中获取的应用识别标识还可生成与所述关键字识别标识子列表相关联的地址识别标识子列表。
在本发明一实施例中，所述控制策略还包括与所述配置消息中的各应用对应的第二控制策略；若调用并执行的所述第一控制策略为正常处理该上网报文时，则所述方法包括：
获取所述上网报文中的地址识别标识，将获取的地址识别标识在所述地址识别标识子列表中进行匹配，匹配成功后，调用所述第二控制策略对所述上网报文进行处理。
在本发明一实施例中，所述第二控制策略为产生告警提示、正常转发报文或者转发上网报文的同时进行限速。
本发明实施例还提供一种上网行为管理装置，包括：收发模块，列表生成模块，处理模块；
所述收发模块设置为接收下发的配置消息和策略，所述配置消息包括应用的配置信息，所述策略包括配置信息中各应用对应的第一控制策略，并将接收到的配置消息和策略下发给处理模块；
所述列表生成模块设置为根据收发模块下发的所述应用配置信息从网页地址库中查找对应应用的识别标识，并生成关键字识别标识子列表；
所述处理模块包括关键字获取单元，处理模块接收到用户的上网报文后，关键字获取单元获取所述上网报文中的关键字识别标识，处理模块将该关键字识别标识在所述关键字识别标识子列表进行匹配，若匹配成功，则调用对应的第一控制策略，并根据该第一控制策略对所述上网报文进行处理。
在本发明一实施例中，所述第一控制策略包括正常处理该上网报文或直接丢弃该上网报文。
在本发明一实施例中，所述上网行为管理装置还包括与列表生成模块相关联的地址列表生成模块，所述地址列表生成模块设置为生成地址识别标识子列表。
在本发明一实施例中，所述控制策略还包括与所述配置消息中的各应用对应的第二控制策略；所述处理模块还包括地址标识获取单元，若处理模块调用并执行的所述第一控制策略为正常处理该上网报文时，则处理模块中的地址标识获取单元获取所述上网报文中的地址识别标识，将获取的地址识别标识在所述地址识别标识子列表中进行匹配，匹配成功后，调用所述第二控制策略对所述上网报文进行处理。
在本发明一实施例中，所述第二控制策略包括产生告警提示、正常转发报文或者转发上网报文的同时进行限速。
本发明还提供一种计算机程序及其载体，所述计算机程序包括程序指令，当该程序指令被上网行为管理设备执行时，使得该设备可实施上述上网行为管理方法。
本发明实施例的有益效果是：提供一种上网行为管理方法及装置，解决网页地址查找速率慢以及对用户上网行为无法进行控制的问题。本发明实施例包括接收下发的配置消息和策略，配置消息包括应用的配置信息，策略包括配置信息中各应用的第一控制策略；然后根据该应用的配置信息从网页地址库中查找对应应用的识别标识，然后生成关键字识别标识子列表；当接收到用户的上网报文以后，获取该上网报文对应的关键字识别标识，然后将获取的关键字识别标识与关键字识别标识子列表中的信息进行匹配即可，如成功，则调用对应的第一控制策略对该报文进行控制。可见，本发明实施例在
接收到用户下发的上网报文后，可直接将该报文中的关键字识别标识与该用户对应的关键字识别标识子列表中进行匹配，不需要在URL库中进行盲目的查找，与现有技术相比较，方便快速查找的同时，也更加可靠的对用户的上网行为进行控制。
附图概述
图1是本发明第一实施例提供的上网行为管理方法流程图；
图2是本发明第一实施例提供的关键字应用识别标识匹配流程图；
图3是本发明第一实施例提供的应用识别标识匹配流程图；
图4是本发明第二实施例提供的上网行为管理装置模块结构示意图；
图5是本发明第三实施例提供的上网行为管理系统模块结构示意图。
本发明的较佳实施方式
本发明实施例的系统接收下发的配置消息以及策略，该配置消息包括应用配置信息，该策略包括配置信息中各应用对应的控制策略，根据接收到的配置信息，从URL库中查找并提取对应应用的识别标识。在本实施例中，所述URL库为之前已经根据不同网站不同内容进行过分类的URL库，系统根据查找并提取到的对应应用的识别标识，生成关键字识别标识子列表。当系统检测到用户的上网报文时，系统首先获取该上网报文的关键字识别标识，然后将该获取的关键字识别标识与之前生成的关键字识别标识子列表中的信息进行匹配。如果匹配成功，则调用对应的第一控制策略对该报文进行控制，在本实施例中，调用的对应第一控制策略是之前接收到用户下发的策略。与现有技术相比较，本申请根据用户的需求对需要控制的应用设置了配置消息，同时设置了各应用对应的第一控制策略，系统根据用户设置的配置消息从URL库中获取关键字识别标识，并生成关键字识别标识子列表，在系统接收到上网报文以后，仅需将提取的该上网报文中的关键字识别标识与对应用户的关键字识别标识子列表进行匹配，不需要在整个URL库中进行查找匹配，同时，在匹配成功以后，还进一步调用对应的第一控制策略，对该上网报文
进行实时控制。因此，本发明实施例解决了增快网页地址查找速率的同时，也对用户上网行为进行控制的问题。
下文中将结合附图对本发明的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
实施例一：
图1本发明实施例提供的上网行为管理方法流程图，包括：
步骤101：接收管理用户下发的配置消息和策略，该配置消息包括应用的配置信息，策略包括与配置信息中的各应用分别对应的第一控制策略；
步骤102：根据应用配置信息从URL库中查找对应应用的识别标识，并生成关键字识别标识子列表；
步骤103：接收到一般用户的上网报文后，获取该上网报文中包含的关键字识别标识，将该关键字识别标识与该类用户对应的关键字识别标识子列表进行匹配，若匹配成功，则调用与该应用对应的第一控制策略，并根据该第一控制策略对该上网报文进行处理。
在本实施例中，不论是下发配置消息和策略的管理用户还是发起上网报文的普通用户，都属于一类用户，例如，学校用户，企业用户等等，且在本实施例中，下发配置消息和策略的管理用户与发起上网报文的普通用户属于同一类用户，例如，都属于学校用户，其中，管理员也可以以一般用户的身份发起上网报文。
在步骤101中，接收管理用户下发的配置消息和策略，该配置消息包括应用的配置信息，所述应用的配置信息为用户根据自己的需求，同时为了让URL库能够识别而设置的某些应用的识别标识；所述策略是配置信息中各应用对应的第一控制策略，配置信息中各应用与第一控制策略之间可以根据地址关系来设定对应关系，也可以根据特定的关键字内容设定对应关系，当然，该对应关系不限于上述两种设置方式，只要是可以实现应用与第一配置策略之间相互对应的方式都可以在本实施例请求保护的范围之内。
在本实施例中，管理用户对需要控制的应用进行设置的方式至少包括以下3种方式中的任一种：
A：管理用户通过终端的控制平台，设置需要控制应用的配置消息和策略；
B：管理用户登录到相关应用的网站，设置配置消息和策略；
C：设备通过识别管理用户输入的关键字，例如时间段、工作环境或者工作内容等，生成配置消息和策略。
在本实施例中，优选采用A方式进行需要控制应用的设置，管理用户将配置好的配置消息和策略下发给系统。
在步骤102中，当系统接收到管理用户下发的配置消息后，根据所述配置消息中的配置信息在URL库中查找对应应用的识别标识，并根据查找到的识别标识生成关键字识别标识子列表，在本实施例中，所述配置信息为管理用户根据自己的需求，同时为了让URL库能够识别而设置的某些应用的识别标识，所述识别标识包括关键字识别标识。
在本实施例中，所述的URL库可以是根据网站信息或是网页内容已经分类后的URL库，也可以是最原始的URL库。
在本实施例中，系统根据管理用户配置消息中的配置信息在URL库中获取对应的识别标识，并生成关键字识别标识子列表包括以下方式中的任一种：
A：根据管理用户配置消息中的配置信息在URL库中查找对应应用的识别标识，根据查找到的所有识别标识在URL库中生成关键字识别标识子列表；
B：根据管理用户配置消息中的配置信息在URL库中提取对应应用的识别标识，然后将提取到的所有识别标识在系统中生成独立的关键字识别标识子列表。
当采用A方式匹配网页地址时，系统优选在URL库中的关键字识别列表中进行匹配；
当采用B方式匹配网页地址时，系统优选在独立的关键子识别列表中进行匹配，而不需要进入URL列表。
为了能够快速查找到网页地址，在本实施例中优选采用方式B生成应用
识别标识列表。
可选地，在本实施例中，根据从网页地址库中获取的应用识别标识还可生成与关键字识别标识子列表相关联的地址识别标识子列表，其中，两列表之间相互关联是指同一应用的网页地址中的关键字识别标识存放在关键字识别标识子列表中，地址识别标识存放在地址识别标识子列表中，同时将存放在两列表中的关键字识别标识与地址识别标识相互关联，这样更加方便系统网页地址的查找。
在步骤103中，接收到一般用户的上网报文后，也就是检测到该用户需要访问某一应用时，获取所述上网报文中包括的关键字识别标识，将该关键字识别标识在该用户对应的关键字识别标识子列表中进行匹配，如果匹配成功，则从关键字识别标识子列表中提取与该上网报文关键字识别标识相互匹配的关键字识别标识，该关键字识别标识与之前管理用户设定的第一控制策略之间是一一对应，因此，在获取该关键字识别标识以后，则根据该关键字识别标识找到对应的第一控制策略，进而调取该第一控制策略对该上网报文进行控制。
在本实施例中，当系统接收到用户的上网报文时，首先提取该报文的关键字识别标识；所述关键字识别标识包括代表协议的部分，可以是代表端口号的部分，可以是代表路径的部分，还可以是上述几部分的组合。当然所述关键字识别标识不限于上述几种类型，只要是具有识别功能的内容都属于本本实施例求情保护的范围。
可选地，所述第一控制策略包括正常处理该上网报文或直接丢弃该上网报文，当然还可以是其他可能的控制信息，本实施例中不做具体限定。
如图2所示，为本实施例提供的将关键字识别标识与关键字识别标识子列表中信息进行匹配的流程图，包括：
步骤201：生成关键字识别标识子列表；
步骤202：获取上网报文的关键字识别标识在关键字识别标识子列表中进行比较；判断是否匹配，如是，进入步骤203；如不匹配，进入步骤204；
步骤203：调用并执行第一控制策略；
步骤204：正常转发该报文。
在本实施例中，所述第一控制策略是管理用户为配置信息中各应用设置的控制策略，该第一控制策略与配置信息中各应用之间一一对应。
可选地，上述将关键字识别标识与关键字识别标识子列表中信息的匹配，仅是对该上网报文进行控制的一小步，为了能够更加准确的对该上网报文进行控制，在本实施例中，当匹配成功后，若调用的第一控制策略为正常处理该上网报文时，则进一步获取的上网报文中的地址识别标识，所述地址识别标识包括代表地址的信息以外，还包括具有具体识别某一报文功能的其他信息，例如报文名称或资源存储路径等。当然所述地址应用识别标识不限于上述几种类型，只要是具有识别功能的内容都属于本实施例求情保护的范围。
在本实施例中，所述控制策略包括与所述配置消息中的各应用对应的第二控制策略；当将获取的地址识别标识与地址识别标识子列表中的信息进行匹配，若匹配失败，则说明对该上网报文不需要进行控制，即正常转达该上网报文；若匹配成功，则调用对应的第二控制策略对该上网报文做进一步控制，同时生成URL模板信息，在本实施例中，调用第二控制策略的具体方式包括但不限于以下方式，系统将获取的地址识别标识与地址识别标识子列表中的信息进行匹配，如果匹配失败，则说明对该上网报文不需要进行控制，即正常转达该上网报文；若匹配成功，则获取该地址识别标识在地址识别标识子列表中的识别标识信息，然后根据该识别标识信息获取之前管理用户设定好的与该识别标识对应的应用的第二控制策略，然后根据该第二控制策略对该应用进行相应处理。
如图3，是本实施例提供的将获取的上网报文中包含的应用识别标识分别与关键字识别标识子列表和地址识别标识子列表进行匹配的流程图，包括：
步骤301：生成关键字识别标识子列表和地址识别标识子列表；
步骤302：获取上网报文的关键字识别标识在关键字识别标识子列表中进行比较；判断是否匹配，如是，进入步骤303；如不匹配，进入步骤306；
步骤303：调用并执行的对应的第一控制策略是否为正常转发；如是，则进入步骤304，如不是正常转发，进入步骤307：丢弃该报文；
步骤304：获取上网报文的地址识别标识与地址识别标识子列表中信息进行比较；判断是否匹配，如是，进入步骤305；如不匹配，进入步骤306；
步骤305：调用对应的第二控制策略，并对该报文做进一步控制；
步骤306：正常转发该报文；
可选地，在本实施例中，第二控制策略包括：产生告警提示、转发上网报文的同时进行限速或者正常转发报文。
所述产生告警提示表示系统识别该报文是用户允许转发的报文，但此时该报文不安全或者该报文此时是非法报文；
所述转发上网报文的同时进行限速表示该报文是策略允许转发的报文，由于该报文需要消耗更多的流量，而此时的剩余流量不足以支持该报文的流畅运行，因此，对该报文进行限速；
所述正常转发该报文，有以下几种可能：
A：该报文符合转发条件；
B：该报文的优先级更高，关闭其他应用，为该应用的转发提供条件。
在本实施例中，所述第一控制策略为与关键字识别标识所对应的控制策略，所述第二控制策略为与地址识别标识所对应的控制策略。当然，第一控制策略和第二控制策略也可以仅是同一条控制策略，当执行关键字识别标识时，仅调用该控制策略中的其中一部分；当执行地址识别标识时，调用该控制策略中的另一部分。
在本实施例中，调用对应的控制策略对该上网报文进一步控制的同时，生成URL模板信息，所述URL模板信息为系统根据统计访问记录信息，生成的模板信息，系统在调用策略的同时，会解析生成的URL模板信息，然后根据解析出的模板信息内容，向需要的用户发送告警通知或者是网页消息推送等；系统还可以根据生成的URL模板信息对URL库进行更新或者修改；当然，系统根据生成的URL模板信息还可以生成访问记录表，通过显示终端显示给用户，方便用户查看访问记录，以及统计网络使用状况。
在本实施例中，所述URL模板信息包括：模板ID——表示发送的是URL
信息模板；模板长度——表示该信息的总长度；RECORD_NUM——表示报文中包含的用户+URL的数量；DURATION——表示发送信息的时间间隔；策略——表示允许或拒绝报文通过；信息长度——表示除去模板头的长度；IP地址——表示用户的IP地址；URL信息——表示提取出来的该用户的URL信息。上述模板信息内容不限于上述内容，可以根据用户的需求进行改进。
在本实施例中，URL模板信息不限于在某一个阶段完成后生成或者是某一个步骤结束后再生成，也可以是根据用户的需求，制定对应的时间段，在该时间段结束后，系统自动将生成的URL模板信息反映给用户，这样方便用户实时或者快捷的了解当前网络的使用状况。
实施例二：
图4是本发明实施例中提供的上网行为管理装置模块示意图，包括：收发模块401，列表生成模块402，处理模块404；
所述收发模块401设置为接收管理用户下发的配置消息和策略，所述配置消息包括应用的配置信息，所述策略包括配置信息中各应用对应的第一策略，并将接收到的配置消息和策略下发给列表生成模块402；
所述列表生成模块402设置为根据收发模块401下发的所述应用配置信息从网页地址库中查找对应应用的识别标识，并生成关键字识别标识子列表；
所述处理模块404包括关键字获取单元4041，处理模块404接收到一般用户的上网报文后，关键字获取单元4041获取所述上网报文中的关键字识别标识，处理模块404将该关键字识别标识在所述关键字识别标识子列表进行匹配，若匹配成功，则调用对应的第一控制策略，并根据该第一控制策略对所述上网报文进行处理。
在本实施例中，不论是下发配置消息和策略的管理用户还是发起上网报文的普通用户，都属于一类用户，例如，学校用户，企业用户等等，且在本实施例中，下发配置消息和策略的管理用户与发起上网报文的普通用户属于同一类用户，例如，都属于学校用户。
在本实施例中，收发模块401接收管理用户下发的配置消息和策略，该
配置消息包括应用的配置信息，所述应用的配置信息为用户根据自己的需求，同时为了让URL库能够识别而设置的某些应用的识别标识；所述策略是管理用户为配置信息中各应用设置的第一控制策略。
在本实施例中，管理用户对需要控制的应用进行设置的方式至少包括以下3种方式中的任一种：
A：管理用户通过终端的控制平台，设置需要控制应用的配置消息和策略；
B：管理用户登录到相关应用的网站，设置配置消息策略；
C：设备通过识别管理用户输入的关键字，例如时间段、工作环境或者工作内容等，生成配置消息和策略。
在本实施例中，管理用户优选采用A方式进行需要控制应用的设置，将配置好的配置消息下发给系统。
在本实施例中，列表生成模块402接收到收发模块401下发的配置消息后，根据所述配置消息中的配置信息在URL库中查找对应应用的关键字识别标识，并根据查找到的关键字识别标识生成关键字识别标识子列表，在本实施例中，所述配置信息为用户根据自己的需求，同时为了让URL库能够识别而设置的某些应用的识别标识，所述识别标识包括关键字识别标识。
在本实施例中，列表生成模块402根据用户配置消息中的配置信息在URL库中获取对应的关键字识别标识，并生成关键字识别标识子列表包括以下方式中的任一种：
A：根据用户配置消息中的配置信息在URL库中查找对应应用的关键字识别标识，根据查找到的所有关键字识别标识在URL库中生成关键字识别标识子列表；
B：根据用户配置消息中的配置信息在URL库中提取对应应用的关键字识别标识，然后将提取到的所有关键字识别标识生成独立的关键字识别标识子列表。
当采用A方式匹配网页地址时，系统优选在URL库中的应用识别列表中进行匹配；
当采用B方式匹配网页地址时，处理模块404优选在独立的应用识别列表中进行匹配，而不需要进入URL列表。
为了能够快速查找到网页地址，在本实施例中优选采用方式B生成应用识别标识列表。
可选地，所述上网行为管理装置还包括与列表生成模块402相关联的地址列表生成模块403，所述地址列表生成模块403设置为生成地址识别标识子列表。在本实施例中，所述列表生成模块402与地址列表生成模块403相互关联是指同一应用的网页地址中的关键字识别标识存放在关键字识别标识子列表中，地址识别标识存放在地址识别标识子列表中，同时将存放在两列表中的关键字识别标识与地址识别标识相互关联，这样更加方便系统网页地址的查找。
处理模块404包括关键字获取单元4041，处理模块404在接收一般用户的上网报文后，也就是检测到用户需要访问某一应用时，关键字获取单元4041获取所述上网报文中包含的关键字识别标识，将该关键字识别标识与生成的关键字识别标识子列表中信息进行匹配，如果匹配成功，则从关键字识别标识子列表中提取与该上网报文中包含的关键字识别标识相互匹配的关键字识别标识，该识别标识与之前用户设定的第一控制策略之间是一一对应，因此，在获取该关键字识别标识以后，则根据该关键字识别标识找到对应的第一控制策略，进而调取该第一控制策略对上网报文进行控制。
在本实施例中，关键字获取单元4041获取该报文对应的关键字识别标识，获取该报文对应关键字识别标识的方法包括：
根据用户发起的上网报文，提取该报文的关键字识别标识；
在本实施例中，关键字获取单元4041获取所述上网报文中关键字识别标识，所述关键字识别标识包括代表协议的部分，可以是代表端口号的部分，可以是代表路径的部分，还可以是上述几部分的组合。当然所述关键字识别标识不限于上述几种类型，只要是具有识别功能的内容都属于本本实施例求情保护的范围。
可选地，处理模块404根据关键字获取单元4041获取的上网报文中的关
键字识别标识，将该关键字识别标识与关键字识别标识子列表中信息进行匹配，如不成功，表明该上网报文不是用户所需要控制的，则正常转发该报文；如果匹配成功，则根据调用的第一控制策略对该报文进行控制，所述第一控制策略包括正常处理该上网报文或直接丢弃该上网报文。
在本实施例中，所述调用第一控制策略是管理用户为配置消息中各应用设置的控制策略，该第一控制策略与配置消息中各应用之间一一对应，当然，各应用对应的第一控制策略内容可以相同也可以不同。
为了能够更加准确将获取的上网报文中包含的应用识别标识与应用识别标识列表中信息进行匹配，在本实施例中，可选地，所述第一控制策略与配置信息中各应用配置信息一一对应，所述配置信息为管理用户根据自己的需求，同时为了让URL库能够识别而设置的某些应用的识别标识；
可选地，所述第一控制策略包括正常处理该上网报文或直接丢弃该上网报文，当然还可以是其他可能的控制信息，本实施例中不做具体限定。
可选地，所述处理模块404还进一步包括地址标识获取单元4042，所述地址标识获取单元4042设置为在关键字识别标识匹配成功后，若调用并执行的第一控制策略为正常处理该上网报文时，进一步获取所述上网报文的地址识别标识，所述地址识别标识包括代表地址的信息以外，还包括具有识别某一报文功能的其他信息，例如报文名称或资源存储路径等。当然所述地址识别标识不限于上述几种类型，只要是具有识别功能的内容都属于本本实施例求情保护的范围。
在本实施例中，控制策略还包括与所述配置消息中的各应用对应的第二控制策略；当将获取上网报文中的地址识别标识与地址识别标识子列表中的信息进行匹配，若匹配失败，则说明对该上网报文不需要进行控制，即正常转达该上网报文；若匹配成功，则调用对应的第二控制策略对该上网报文做进一步控制，同时生成URL模板信息。
可选地，在本实施例中，第二控制策略包括：产生告警提示、转发上网报文的同时进行限速或者正常转发报文。
所述产生告警提示表示系统识别该报文是用户允许转发的报文，但此时
该报文不安全或者该报文此时是非法报文；
所述转发上网报文的同时进行限速表示该报文是管理用户允许转发的报文，由于该报文需要消耗更多的流量，而此时的剩余流量不足以支持该报文的流畅运行，因此，对该报文进行限速；
所述正常转发该报文，有以下几种可能：
A：该报文符合转发条件；
B：该报文的优先级更高，关闭其他应用，为该应用的转发提供条件。
在本实施例中，所述第一控制策略为与关键字识别标识所对应的控制策略，所述第二控制策略为与地址识别标识所对应的控制策略。当然，第一控制策略和第二控制策略也可以仅是同一条控制策略，当执行关键字识别标识时，仅调用该控制策略中的其中一部分；当执行地址识别标识时，调用该控制策略中的另一部分。
在本实施例中，调用对应的控制策略对该上网报文进一步控制的同时，生成URL模板信息，所述URL模板信息为系统根据统计访问记录信息，生成的模板信息，系统在调用策略的同时，会解析生成的URL模板信息，然后根据解析出的模板信息内容，向需要的用户发送告警通知或者是网页消息推送等；系统还可以根据生成的URL模板信息对URL库进行更新或者修改；当然，系统根据生成的URL模板信息还可以生成访问记录表，通过显示终端显示给用户，方便用户查看访问记录，以及统计网络使用状况。
实施例三：
图5是本实施例中提供的上网行为管理系统模块示意图，包括：行为管理器501，策略控制器502和网页地址库503；
所述策略控制器502设置为接收管理用户下发的配置消息和策略，并将接收到的配置消息和策略发送给行为管理器501，所述配置消息包括应用的配置信息，所述策略包括配置消息中各应用对应的第一控制策略和第二控制策略；
所述行为管理器501根据策略控制器502下发的配置消息，从网页地址
库503中获取应用的识别标识，并生成应用识别标识列表，该应用识别标识列表包括关键字识别标识子列表；当一般用户发起上网报文时，行为管理器501获取该上网报文中包含的识别标识，将该获取的识别标识与生成的应用识别标识列表中信息进行匹配，若匹配成功，则从策略控制器502中调用对应的第一控制策略并对该报文进行控制。
在本实施例中，不论是下发配置消息和策略的管理用户还是发起上网报文的普通用户，都属于一类用户，例如，学校用户，企业用户等等，且在本实施例中，下发配置消息和策略的管理用户与发起上网报文的普通用户属于同一类用户，例如，都属于学校用户。
在本实施例中，管理用户根据自己的需求通过对需要控制的应用设置对应的配置消息以及对应的策略，所述应用的配置信息为用户根据自己的需求，同时为了让URL库能够识别而设置的某些应用的识别标识；所述策略是管理用户为配置消息中各应用设置的第一控制策略。
在本实施例中，管理用户对需要控制的应用进行设置的方式包括以下3种方式中的任一种：
A：管理用户通过终端的控制平台，设置需要控制应用的配置消息和策略；
B：管理用户登录到相关应用的网站，设置配置消息策略；
C：设备通过识别管理用户输入的关键字，例如时间段、工作环境或者工作内容等，生成配置消息和策略。
在本实施例中，管理用户优选采用A方式进行需要控制应用的设置，将配置好的配置消息下发给系统。
管理用户将设置好的配置消息和策略下发给策略控制器502，策略控制器502将接收到的配置消息和策略进行存储，同时，策略控制器502将接收到的配置消息发送给行为管理器501，行为管理器501根据接收到的配置消息中的配置信息从网页地址库503即URL库中获取对应的识别标识，并根据查找到的识别标识生成应用识别标识列表，在本实施例中，所述配置信息包括用户根据自己的需求，同时为了让URL库能够识别而设置的某些应用的识别标识，例如，关键字识别标识信息。
在本实施例中，行为管理器501根据用户配置消息中的配置信息在URL库中获取对应的识别标识，并生成应用识别标识列表包括以下方式中的任一种：
A：根据用户配置消息中的配置信息在URL库中查找对应应用的识别标识，根据查找到的所有识别标识在URL库中生成应用识别标识列表；
B：根据用户配置消息中的配置信息在URL库中提取对应应用的识别标识，然后将提取到的所有识别标识在行为管理器501中生成独立的应用识别标识列表。
当采用A方式匹配网页地址时，系统优选在URL库中的应用识别列表中进行匹配；
当采用B方式匹配网页地址时，优选与行为管理器501中的应用识别列表中进行匹配，而不需要进入URL列表。
为了能够快速查找到网页地址，在本实施例中优选采用方式B生成应用识别标识列表。
可选地，在本实施例中，行为管理器501还生成与所述关键字识别标识子列表相互关联的地址识别标识子列表，其中，两列表之间相互关联是指同一应用的网页地址中的关键字识别标识存放在关键字识别标识子列表中，地址识别标识存放在地址识别标识子列表中，同时将存放在两列表中的关键字识别标识与地址识别标识相互关联，这样更加方便系统网页地址的查找。
在本实施例中，所述的行为管理器501还具有报文或者应用识别功能，当一般用户发起上网报文时，行为管理器501获取该上网报文的关键字识别标识，然后将获取的该关键字识别标识与之前生成的关键字识别列表进行匹配，如果匹配成功，则行为管理器501从策略控制器502中调用对应的第一控制策略对该报文进行控制，所述控制包括通过策略控制器502对用户发起的上网报文进行控制；该控制策略包括正常处理该上网报文或直接丢弃该上网报文；如果匹配不成功，则行为管理器501直接将正常转发该报文，进行WEB访问。
如果调用的第一控制策略为正常处理该报文，则行为管理器501进一步
获取上网报文中的地址识别标识，然后将获取的地址识别标识与地址识别标识子列表进行匹配，如果匹配不成功，则行为管理器501直接将正常转发该报文，进行WEB访问；如果匹配成功，则调用对应的第二控制策略对该报文进行处理，该第二控制策略包括产生告警提示、正常转发报文或者转发上网报文的同时进行限速。
所述第一控制策略为与关键字识别标识所对应的控制策略，所述第二控制策略为与地址识别标识所对应的控制策略。当然，第一控制策略和第二控制策略也可以仅是同一条控制策略，当执行关键字识别标识时，仅调用该控制策略中的其中一部分；当执行地址识别标识时，调用该控制策略中的另一部分。
为了方便用户实时监测和了解网络的使用情况，本实施例中，在对上网报文进行处理的过程中，还会生成对应的URL模板信息，该模板信息为系统根据统计访问记录信息，生成的模板信息，系统在调用策略的同时，会解析生成的URL模板信息，然后根据解析出的模板信息内容，向需要的用户发送告警通知或者是网页消息推送等；系统还可以根据生成的URL模板信息对URL库进行更新或者修改；当然，系统根据生成的URL模板信息还可以生成访问记录表，通过显示终端显示给用户，方便用户查看访问记录，以及统计网络使用状况。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件等)执行，在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
上述实施例中的各装置/功能模块/功能单元可以采用通用的计算装置来实现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的各装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以权利要求所述的保护范围为准。
本申请包括接收用户下发的配置消息和策略，配置消息包括应用的配置信息，策略包括配置信息中各应用的第一控制策略；然后根据该应用的配置信息从网页地址库中查找对应应用的识别标识，然后生成关键字识别标识子列表；当接收到用户下发的上网报文以后，获取该上网报文中的关键字识别标识，然后将获取的关键字识别标识在关键字识别标识子列表中进行匹配，如成功，则调用对应的第一控制策略对该报文进行处理。与现有技术相比较，方便快速查找的同时，也更加可靠的对用户的上网行为进行控制。
Claims (12)
- 一种上网行为管理方法，包括：接收下发的配置消息和策略，所述配置消息包括应用的配置信息，所述策略包括配置信息中与各应用对应的第一控制策略；根据所述应用配置信息从网页地址库中获取对应应用的识别标识，并生成关键字识别标识子列表；接收到用户的上网报文后，获取该上网报文中的关键字识别标识，将该关键字识别标识在所述关键字识别标识子列表中进行匹配，若匹配成功，则调用对应的第一控制策略，并根据该第一控制策略对所述上网报文进行处理。
- 如权利要求1所述的方法，其中，所述第一控制策略包括正常处理该上网报文和直接丢弃该上网报文。
- 如权利要求1所述的方法，其中，根据从网页地址库中获取的应用识别标识还可生成与所述关键字识别标识子列表相关联的地址识别标识子列表。
- 如权利要求3所述的方法，其中，所述第一控制策略还包括与所述配置消息中的各应用对应的第二控制策略；若调用并执行的所述第一控制策略为正常处理该上网报文时，所述方法还包括：获取所述上网报文中的地址识别标识，将获取的地址识别标识在所述地址识别标识子列表中进行匹配，若匹配成功，调用所述第二控制策略对所述上网报文进行处理。
- 如权利要求4所述的方法，其中，所述第二控制策略包括产生告警提示、正常转发报文或者转发上网报文的同时进行限速。
- 一种上网行为管理装置，包括：收发模块，列表生成模块，处理模块；所述收发模块设置为接收下发的配置消息和策略，所述配置消息包括应用的配置信息，所述策略包括配置信息中与各应用对应的第一控制策略，并将接收到的配置消息和策略下发给处理模块；所述列表生成模块设置为根据收发模块下发的所述应用配置信息从网页 地址库中查找对应应用的识别标识，并生成关键字识别标识子列表；所述处理模块包括关键字获取单元，处理模块接收到用户的上网报文后，关键字获取单元获取所述上网报文中的关键字识别标识，处理模块将该关键字识别标识在所述关键字识别标识子列表进行匹配，若匹配成功，则调用对应的第一控制策略，并根据该第一控制策略对所述上网报文进行处理。
- 如权利要求6所述的装置，其中，所述第一控制策略包括正常处理该上网报文和直接丢弃该上网报文。
- 如权利要求6所述的装置，还包括与列表生成模块相关联的地址列表生成模块，所述地址列表生成模块设置为生成地址识别标识子列表。
- 如权利要求6所述的装置，所述第一控制策略还包括与所述配置消息中的各应用对应的第二控制策略；所述处理模块还包括地址标识获取单元，若处理模块调用并执行的所述第一控制策略为正常处理该上网报文时，地址标识获取单元获取所述上网报文中的地址识别标识，将获取的地址识别标识在所述地址识别标识子列表中进行匹配，匹配成功后，调用所述第二控制策略对所述上网报文进行处理。
- 如权利要求9所述的装置，其中，所述第二控制策略包括产生告警提示、正常转发报文或者转发上网报文的同时进行限速。
- 一种计算机程序，包括程序指令，当该程序指令被上网行为管理设备执行时，使得该设备可实施权利要求1-5任一项的方法。
- 一种载有权利要求11所述计算机程序的载体。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410146519.0 | 2014-04-11 | ||
| CN201410146519.0A CN104980409A (zh) | 2014-04-11 | 2014-04-11 | 一种上网行为管理方法及装置 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2015154416A1 true WO2015154416A1 (zh) | 2015-10-15 |
Family
ID=54276519
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2014/088984 WO2015154416A1 (zh) | 2014-04-11 | 2014-10-20 | 一种上网行为管理方法及装置 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN104980409A (zh) |
| WO (1) | WO2015154416A1 (zh) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111143743A (zh) * | 2019-12-26 | 2020-05-12 | 杭州迪普科技股份有限公司 | 一种自动扩充应用识别库的方法及装置 |
| CN114745305A (zh) * | 2022-06-15 | 2022-07-12 | 中邮消费金融有限公司 | 一种基于用户行为识别的动态交互方法及系统 |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108376071B (zh) * | 2016-11-11 | 2021-08-24 | 中移（杭州）信息技术有限公司 | 一种app识别方法及系统 |
| CN112242981A (zh) * | 2019-07-19 | 2021-01-19 | 西安中兴新软件有限责任公司 | 一种网站过滤的方法和装置 |
| CN114338139B (zh) * | 2021-12-27 | 2023-03-24 | 北京安博通科技股份有限公司 | 一种上网行为管理支持终端类型控制的方法 |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101030947A (zh) * | 2007-04-29 | 2007-09-05 | 华为技术有限公司 | 一种报文发送的方法和装置 |
| CN101640608A (zh) * | 2009-04-13 | 2010-02-03 | 山石网科通信技术（北京）有限公司 | 网络行为监控方法 |
| CN102724189A (zh) * | 2012-06-06 | 2012-10-10 | 杭州华三通信技术有限公司 | 一种控制用户url访问的方法及装置 |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101901245A (zh) * | 2010-01-15 | 2010-12-01 | 莱克斯科技(北京)有限公司 | 一种基于云语义库的网页审计方法 |
| CN102685215B (zh) * | 2012-04-18 | 2015-12-16 | 华为技术有限公司 | 移动终端上网监控的方法、装置和系统 |
| CN103136372B (zh) * | 2013-03-21 | 2016-03-02 | 陕西通信信息技术有限公司 | 网络可信性行为管理中url快速定位、分类和过滤方法 |
-
2014
- 2014-04-11 CN CN201410146519.0A patent/CN104980409A/zh not_active Withdrawn
- 2014-10-20 WO PCT/CN2014/088984 patent/WO2015154416A1/zh active Application Filing
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101030947A (zh) * | 2007-04-29 | 2007-09-05 | 华为技术有限公司 | 一种报文发送的方法和装置 |
| CN101640608A (zh) * | 2009-04-13 | 2010-02-03 | 山石网科通信技术（北京）有限公司 | 网络行为监控方法 |
| CN102724189A (zh) * | 2012-06-06 | 2012-10-10 | 杭州华三通信技术有限公司 | 一种控制用户url访问的方法及装置 |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111143743A (zh) * | 2019-12-26 | 2020-05-12 | 杭州迪普科技股份有限公司 | 一种自动扩充应用识别库的方法及装置 |
| CN114745305A (zh) * | 2022-06-15 | 2022-07-12 | 中邮消费金融有限公司 | 一种基于用户行为识别的动态交互方法及系统 |
| CN114745305B (zh) * | 2022-06-15 | 2022-09-09 | 中邮消费金融有限公司 | 一种基于用户行为识别的动态交互方法及系统 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104980409A (zh) | 2015-10-14 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11206451B2 (en) | Information interception processing method, terminal, and computer storage medium | |
| US11122067B2 (en) | Methods for detecting and mitigating malicious network behavior and devices thereof | |
| CN110943961B (zh) | 数据处理方法、设备以及存储介质 | |
| WO2018121331A1 (zh) | 攻击请求的确定方法、装置及服务器 | |
| WO2015154416A1 (zh) | 一种上网行为管理方法及装置 | |
| WO2020087948A1 (zh) | 网络切片模板生成方法、装置、设备及存储介质 | |
| TW201638779A (zh) | 一種對虛擬主機的資源管理的方法、裝置、系統及電子設備 | |
| US10798017B2 (en) | Method and system for reclaiming unused resources in a networked application environment | |
| CN104883267A (zh) | 网络配置访问方法及装置 | |
| US10887261B2 (en) | Dynamic attachment delivery in emails for advanced malicious content filtering | |
| WO2017167208A1 (zh) | 识别恶意网站的方法、装置及计算机存储介质 | |
| US20110314077A1 (en) | Identification of compatible products for use with mobile devices | |
| WO2016169438A1 (zh) | 获取用户账号的方法和装置 | |
| CN106470150B (zh) | 关系链存储方法及装置 | |
| WO2014015787A1 (en) | Method, server, and client for pushing and displaying splash screen | |
| WO2012151843A1 (zh) | Url过滤系统及过滤url的方法、网关 | |
| WO2015123990A1 (zh) | 一种页面推送方法、装置、服务器和系统 | |
| WO2016037489A1 (zh) | Rcs垃圾消息的监控方法、装置及系统 | |
| TW201941094A (zh) | 漏洞調查系統、傳輸伺服器、漏洞調查方法及程式 | |
| US11005797B2 (en) | Method, system and server for removing alerts | |
| CN110995489B (zh) | 大数据平台服务器管理方法、装置、服务器及存储介质 | |
| WO2016201780A1 (zh) | 网关管理方法及装置 | |
| WO2017136979A1 (zh) | 一种远程访问的实现方法、装置和系统 | |
| US20140201233A1 (en) | Method, device, and system for uploading data | |
| CN111786938A (zh) | 防止恶意获取资源的方法、系统和电子设备 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 14888891 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 14888891 Country of ref document: EP Kind code of ref document: A1 |