WO2016082626A1

WO2016082626A1 - Internet user detection method and device

Info

Publication number: WO2016082626A1
Application number: PCT/CN2015/091583
Authority: WO
Inventors: 孙春艳; 宋科; 张廷友
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-11-25
Filing date: 2015-10-09
Publication date: 2016-06-02
Also published as: CN105703962A

Abstract

The present invention provides an Internet user detection method and device. The method comprises: acquiring a first clock offset average value of a first packet and a second clock offset average value of a second packet, the first packet and the second packet being neighboring packets; determining the difference between the first clock offset average value and the second clock offset average value; and comparing an absolute value of the difference with a predetermined threshold, and determining, according to the comparison result, whether to increase Internet users. By means of the present invention, the problem in the related art that a limitation exists in the solution of detecting the quantity of Internet users is resolved, and further, the quantity of hosts that wideband users illegally access can be accurately detected, so that the requirement of an operator is met.

Description

Internet user detection method and device

Technical field

The present invention relates to the field of communications, and in particular to a method and apparatus for detecting a user on the Internet.

Background technique

Network Address Translation (NAT) is an internal management IP address that is hidden by converting a private network address, such as an intranet intranet, into a public address such as the Internet. In this way, by using unregistered IP addresses internally and converting them to a small number of externally registered IP addresses, the cost of IP address registration is reduced and the address space that is increasingly lacking, namely IPV4, is saved. At the same time, this also hides the internal network structure, which reduces the risk of internal network attacks.

FIG. 1 is a schematic diagram of the working principle of a NAT according to the related art. The working principle of the NAT in the related art is described in conjunction with FIG. 1 . The working principle includes the following steps:

Step S11: The gateway gateway of the terminal client is set as the security application gateway host, so when the network Internet is to be connected, the packet is sent to the NAT host, and the source IP of the packet header is 192.168. .1.100;

Step S12: Through the NAT host, it will masquerade the source IP of the client's external online packet, that is, 192.168.1.100, as a public IP of the interface of ppp0 (assumed to be dialed), because it is a public IP. So this packet can be connected to the Internet, and the NAT host will remember that the online packet is transmitted by the client with the IP address: 192.168.1.100;

Step S13: the packet sent back by the Internet is of course received by the NAT host. At this time, the NAT host will query the routing information of the original record, and change the target IP from the public IP above ppp0 back to the original 192.168.1.100;

Step S14: Finally, the NAT host transmits the packet to the client that originally sent the packet.

The use of NAT devices or software is beneficial to the user, but is extremely detrimental to the operator's network content auditing and the like. The terminal user of the operator shares the Internet connection provided by the operator to multiple hosts/terminals of the intranet through the NAT software/NAT device, so that multiple hosts/terminals can simultaneously use the Internet connection to access the Internet. The number of users sharing the Internet is detected under NAT. This requirement usually comes from the fixed-line home broadband access service provider. Implementing this detection will help operators analyze user behavior and understand the number of potential users.

User behavior detection is now performed primarily on the gateway, as shown in Figure 1. Currently related technology There are several detection methods: such as TTL detection method, once a router that processes it, the TTL value is decremented by 1. According to this characteristic, it is detected whether the TTL value of the user uplink packet is 32, 64, 128. If not, the user is used. NAT. However, some manufacturers may produce special routers that do not reduce the TTL value, so this method will fail.

In addition, there is another method for the TCP sliding window detection method, which determines the number of users by determining the number of different sliding windows by obtaining the Window Size field of the TCP protocol of the network transmission protocol. The limitation of this method is that it can be applied to different systems, such as Andriod and iOS, but the window size of different terminals of the same system may be the same, and the number of terminals of the same system cannot be detected. Applying the feature detection method to detect various accounts such as the number of QQ accounts, the operating system, and the browser version may involve infringing user privacy.

In view of the limitation of the scheme for detecting the number of Internet users in the related art, an effective solution has not been proposed yet.

Summary of the invention

The main purpose of the embodiments of the present invention is to provide a method and a device for detecting an Internet user, so as to at least solve the problem that the scheme for detecting the number of Internet users in the related art has limitations.

According to an aspect of the embodiments of the present invention, a method for detecting a network user includes: obtaining a first clock offset average value of the first packet, and a second clock offset average value of the second packet, where The first packet and the second packet are adjacent messages; determining a difference between the first clock offset average value and the second clock offset average value; comparing the difference values The absolute value is the size of the predetermined threshold, and based on the comparison result, it is determined whether to increase the number of Internet users.

Optionally, the first packet and the second packet are both uplink transmission control protocol TCP packets.

Optionally, the first clock offset average of the first packet or the second clock offset average of the second packet is obtained by: p _N =(t _N -t ₁ )/(r _N -r ₁ ); m _N = (p ₂ + p ₃ +... + p _N ) / (N-1); where p _N is the clock offset value of the message N, and m _N is the clock offset of the message N The average value; t _N is the timestamp of the message N, r _N is the system time of the message N; p _N is the clock offset value of the message N; m _N is the average value of the clock offset, and N is a natural number.

Optionally, the N is not less than 100.

Optionally, determining whether to share the Internet for multiple users according to the comparison result includes: when the absolute value is greater than the predetermined threshold, the number of Internet users is increased by 1; when the absolute value is not greater than the predetermined threshold, determining The number of Internet users has not increased.

According to another aspect of the embodiments of the present invention, a device for detecting a user on the Internet includes: an obtaining module, configured to acquire a first clock offset average value of the first packet, and a second clock of the second packet An offset average, wherein the first packet and the second packet are adjacent messages; and the determining module is configured to determine the first clock offset average and the second clock offset average And a comparison module, configured to compare the absolute value of the difference with a predetermined threshold, and determine whether to increase the number of users according to the comparison result.

Alternatively, N is not less than 100.

Optionally, the comparing module is further configured to: when the absolute value is greater than the predetermined threshold, the number of Internet users is increased by one; when the absolute value is not greater than the predetermined threshold, the number of Internet users is not increased. .

In the embodiment of the present invention, the difference between the average values of the clock offsets of the first packet and the second packet of the two adjacent packets is obtained, and then the difference between the difference and the predetermined threshold is compared to determine whether the number of Internet users is increased. The solution solves the limitation of the scheme for detecting the number of users on the Internet in the related art, and can accurately detect the number of hosts that illegally access the broadband users, and meets the requirements of the operator.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a schematic diagram of a working principle of a NAT according to the related art;

2 is a flowchart of a method for detecting a user on the Internet according to an embodiment of the present invention;

3 is a structural block diagram of a detecting device for a web user according to an embodiment of the present invention;

4 is a diagram of deployment of a DPI device in a network in accordance with an alternative implementation of the present invention;

5 is a flow chart of a clock offset detection method in accordance with an alternate embodiment of the present invention.

detailed description

The invention will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

In this embodiment, a method for detecting a user on the Internet is provided. FIG. 2 is a flowchart of a method for detecting a user on the Internet according to an embodiment of the present invention. As shown in FIG. 2, the process includes the following steps:

Step S202: Acquire a first clock offset average value of the first packet, and a second clock offset average value of the second packet.

The first packet and the second packet are adjacent packets.

Step S204: determining a difference between the first clock offset average value and the second clock offset average value;

Step S206: Comparing the absolute value of the difference with the predetermined threshold, and determining whether to increase the online user according to the comparison result.

In this embodiment, the difference between the average value of the clock offsets of the first packet and the second packet of the two adjacent packets is obtained, and then the difference between the difference and the predetermined threshold is compared to determine whether the number of Internet users is increased. The solution to the limitation of detecting the number of Internet users in the related art is solved, and the number of hosts illegally accessing the broadband users can be accurately detected to meet the requirements of the operator.

In an optional embodiment of the present embodiment, the first packet and the second packet are both uplink transmission control protocol TCP packets.

In addition, in the embodiment, there are multiple ways to obtain the first clock offset average value of the first packet or the second clock offset average value of the second packet, and an optional implementation manner in this embodiment. The average offset average can be obtained as follows:

p _N =(t _N -t ₁ )/(r _N -r ₁ );

m _N = (p ₂ + p ₃ +... + p _N ) / (N-1);

Where p _N is the clock offset of the packet N, m _N is the average of the clock offset of the packet N; t _N is the timestamp of the packet N, and r _N is the system time of the packet N; p _N is The clock offset value of the message N; m _N is the average value of the clock offset, and N is a natural number. It should be noted that the foregoing packet N may be the first packet or the second packet involved in this embodiment.

In this embodiment, since the number of samples initially is small, the mean value has a large error, so N for the present embodiment is preferably not less than 100. It should be noted that the value of the N is only an example of the embodiment, and Make adjustments according to the needs of operators.

In another optional implementation manner of this embodiment, determining whether to share the Internet for multiple users according to the comparison result may be implemented by: when the absolute value is greater than the predetermined threshold, the number of Internet users is increased by one; When the absolute value is not greater than the predetermined threshold, the number of Internet users does not increase.

In this embodiment, a detection device for the Internet user is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and has not been described again. As used below, the term "module" "unit" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

3 is a structural block diagram of a detecting device for a web user according to an embodiment of the present invention. As shown in FIG. 3, the device includes: an obtaining module 32, configured to obtain a first clock offset average value of the first packet, and a second The second clock offset average of the packet, wherein the first packet and the second packet are adjacent packets; the determining module 34 is coupled to the obtaining module 32, and is configured to determine the first clock offset average and the first The difference between the two clock offset average values; the comparison module 36 is coupled to the determining module 34, and is configured to compare the absolute value of the difference value with the predetermined threshold value, and determine whether to increase the online user according to the comparison result.

In an optional implementation manner of this embodiment, the first packet and the second packet are both uplink transmission control protocol TCP packets.

Optionally, in this embodiment, the first clock offset average value of the first packet or the second clock offset average value of the second packet is obtained by:

p _N =(t _N -t ₁ )/(r _N -r ₁ );

m _N = (p ₂ + p ₃ +... + p _N ) / (N-1);

Where p _N is the clock offset of the packet N, m _N is the average of the clock offset of the packet N; t _N is the timestamp of the packet N, and r _N is the system time of the packet N; p _N is The clock offset value of the message N; m _N is the average value of the clock offset, and N is a natural number.

In this embodiment, since the number of samples initially is small, the mean value has a large error, so N for the present embodiment is preferably not less than 100. It should be noted that the value of the N is only an example of the embodiment, and is not limited to the present invention, that is, the corresponding adjustment can be made according to the needs of the operator.

For the comparison module 36 involved in this embodiment, the number of Internet users is increased by 1 when the absolute value is greater than the predetermined threshold, and the number of Internet users is not increased when the absolute value is not greater than the predetermined threshold.

In order to better explain the present invention, the following embodiments in conjunction with the accompanying drawings and alternative embodiments of the present invention Give an example.

The optional embodiment provides a method for detecting the Internet access of a multi-user under the NAT. The method can detect the number of users sharing the Internet and meet the requirements of the operator.

Embodiment 1

In the related art, the clock offset may be slightly different because there are different operating systems or different machine devices of the same operating system. Therefore, the time offset of the sender can be determined by checking the timestamp in the uplink message.

For timestamps, IP options, ICMP, and TCP options can all be time stamped. However, in the first embodiment, the timestamp of the TCP option is taken as an example for description; for the timestamp of the TCP option, although the Windows system does not fill in by default, the Linux/Unix system (eg, Android, iPhoneOS) will carry, and many The website is also a Linux system, so there is still a certain percentage of traffic in the network, which contains the TCP.OPTION.TSVAL timestamp.

Table 1 is a TCP.OPTION.Tsval field definition map in accordance with an alternative embodiment of the present invention, as shown in Table 1:

TCP Timestamps Option (Tsopt):

Kind:8

Length: 10 bytes

Kind=8

10

TS Value (TSval)

TS Echo Reply (TSecr)

Table 1

In the RFC1323 "TCP Extensions for High Performance" document, the TCP.OPTION.TSval value is defined. Because of different operating systems, the frequency of filling in TCP.OPTION.TSVAL is very different. Therefore, you can only take the relative time offset ratio of each TCP stream.

The principle of obtaining the time offset ratio in the first embodiment is: sampling the timestamp and system time of the N packets before each stream, where the timestamp is represented by t ₁ , t ₂ , ... t _N , and the system time is r ₁ , r ₂ , ... r _N indicate that the clock offset value is represented by p ₁ , p ₂ , ... p _N , and the average value of the clock offset is represented by m ₁ , m ₂ , ... m _N . The first message is used as the base value for the calculation.

Message 1 clock offset value: As the calculated reference value, it is not taken.

Message 2 clock offset value: p ₂ = (t _{2 -} t ₁ ) / (r _{2 -} r ₁ )

Average value: m ₂ = p ₂

Message 3 clock offset value: p ₃ = (t _{3 -} t ₁ ) / (r _{3 -} r ₁ )

Average: m ₁ = (p ₁ + p ₃ )/2

Message N clock offset value: p _N = (t _{N -} t ₁ ) / (r _{N -} r ₁ )

Average: m _N = (p ₂ + p ₃ +... + p _N ) / (N-1)

Observe the trajectory of the clock offset average (m ₁ , m ₂ , ... m _N ). Since the number of samples at the beginning is small and the mean has a large error, it is recommended to observe from m100 (that is, the first 100 samples are only used for calculation. , not as a basis for judgment). Continuously observe the average value of each clock offset. If the current value is found to satisfy the following conditions, the number of users is considered to increase by 1. The judgment condition is:

l=100,101,...,N

among them

For the allowable range of fluctuations, the error is within this range, and it is considered to be stable fluctuations, and the number of users does not increase. If this range is exceeded, the number of users is considered to increase by one.

Through the first embodiment, the number of hosts illegally accessing broadband users can be accurately detected, thereby meeting the needs of operators.

The method of this optional implementation can be applied to a Deep Packet Inspection (DPI) device. DPI technology is a protocol identification technology that has emerged in recent years. Based on the analysis of the packet header, DPI technology adds analysis to the application layer. It is an application layer-based traffic detection and control technology. Figure 4 is based on the present invention. The deployment diagram of the selected DPI device in the network, as shown in FIG. 4, when the IP data packet, TCP or UDP data stream passes through the network device based on the DPI technology, the DPI engine reads the content of the IP packet payload deeply. The application layer information in the OSI 7 layer protocol is analyzed to identify the application layer protocol of the IP packet. DPI devices can perform traffic offload analysis on the network.

Embodiment 2

FIG. 5 is a flowchart of a method for detecting a clock offset according to an alternative embodiment of the present invention. As shown in FIG. 5, the method includes:

Step S502: Record the system time of the message;

For the continuous stream, record the system time of each incoming packet, which is denoted as r _N . Step 102, parsing of packets TCP.OPTION.Tsval acquisition timestamp field, referred to as t _N;

Step S504: Parsing the packet and obtaining a timestamp.

Step S506: calculating an always offset value;

Wherein, the clock offset value of each message is calculated according to the formula p _N = (t _{N -} t ₁ ) / (r _{N -} r ₁ ). The timestamp of the first message and the system time are used as the reference values for the calculation.

Step S508: calculating an always-offset average trajectory;

Among them, the average value of the clock offset of each message is calculated according to the formula m _N = (p ₂ + p ₃ + ... + p _N ) / (N-1).

Step S510: Observing a clock offset average track;

Step S512: returning the detected number of users to the upper layer;

Continuously observe the average value of each clock offset, according to the formula

If the current value is found to satisfy the formula condition, the number of users is considered to increase by 1.

The above is only an alternative embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

Claims

A method for detecting a user on the Internet includes:

Obtaining a first clock offset average value of the first packet, and a second clock offset average value of the second packet, where the first packet and the second packet are adjacent packets;

Determining a difference between the first clock offset average value and the second clock offset average value;

Comparing the absolute value of the difference with the predetermined threshold, and determining whether to increase the online user according to the comparison result.
The method according to claim 1, wherein the first message and the second message are both uplink transmission control protocol TCP messages.
The method according to claim 2, wherein the first clock offset average of the first message or the second clock offset average of the second message is obtained by:

p N =(t N -t 1 )/(r N -r 1 );

m N = (p 2 + p 3 +... + p N ) / (N-1);

Where p N is the clock offset of the packet N, m N is the average of the clock offset of the packet N; t N is the timestamp of the packet N, and r N is the system time of the packet N; p N is The clock offset value of the message N; m N is the average value of the clock offset, and N is a natural number.
The method of claim 3 wherein N is not less than 100.
The method according to claim 4, wherein determining whether to share the Internet for multiple users according to the comparison result comprises:

When the absolute value is greater than the predetermined threshold, the number of Internet users is increased by one; when the absolute value is not greater than the predetermined threshold, it is determined that the number of Internet users is not increased.
A detecting device for an Internet user, comprising:

An acquiring module, configured to obtain a first clock offset average value of the first packet, and a second clock offset average value of the second packet, where the first packet and the second packet are phase Neighboring message

Determining a module, configured to determine a difference between the first clock offset average value and the second clock offset average value;

The comparison module is configured to compare the absolute value of the difference value with a predetermined threshold value, and determine whether to increase the online user according to the comparison result.
The apparatus according to claim 6, wherein the first message and the second message are both uplink transmission control protocol TCP messages.
The apparatus according to claim 7, wherein the first clock offset average of the first message or the second clock offset average of the second message is obtained by:

p N =(t N -t 1 )/(r N -r 1 );

m N = (p 2 + p 3 +... + p N ) / (N-1);

Where p N is the clock offset of the packet N, m N is the average of the clock offset of the packet N; t N is the timestamp of the packet N, and r N is the system time of the packet N; p N is The clock offset value of the message N; m N is the average value of the clock offset, and N is a natural number.
The apparatus of claim 8 wherein N is not less than 100.
The apparatus according to claim 9, wherein

The comparison module is further configured to: when the absolute value is greater than the predetermined threshold, the number of Internet users is increased by one; when the absolute value is not greater than the predetermined threshold, the number of Internet users is not increased.